Defense Suicide Prevention Office (DSPO)

Connect Program

Performance Work Statement (PWS)

1.0 INTRODUCTION

The Defense Suicide Prevention Office (DSPO) requires a non-personal services Contractor to tailor/update, expand, and validate the existing Connect Program (Wyman et al 2020; 2022) to the Department of War (DoW) and all Military Services (Army, Navy, Marine Corps, Air Force, Space Force, National Guard Bureau, and Coast Guard). The Contractor shall validate the implementation of the Connect Program and provide a report that includes evaluation findings and recommendations for sustained program implementation and evaluation.

The Connect Program was developed as Wingman-Connect through a 10-year collaboration between the University of Rochester and the Department of Air Force. The Connect Program (Wyman et al 2020;

2022) provides group interactive training for military personnel, followed by text messages and base-wide activities to embed concepts into culture and peer networks. The Connect Program’s interactive group design progresses from individual engagement (e.g., each participant shares career goals and values) to building group-level skills and norms (e.g., mapping group strengths). Specifically, participants learn together about and model skills to each other to grow and sustain “Four Cores” supportive of mental health and essential to job success: (1) Healthy relationships and accountability spanning military and family/intimate relationships (Kinship); (2) Meaning and value in work and life (Purpose), (3) Informal and formal help-seeking (Guidance); and (4) Activities that give strength and balance emotions (Balance).The Connect Program (Wyman et al 2020; 2022) provides group interactive training for military personnel, followed by text messages and base-wide activities to embed concepts into culture and peer networks. The Connect Program’s interactive group design progresses from individual engagement (e.g., each participant shares career goals and values) to building group-level skills and norms (e.g., mapping group strengths). Specifically, participants learn together about and model skills to each other to grow and sustain “Four Cores” supportive of mental health and essential to job success: (1) Healthy relationships and accountability spanning military and family/intimate relationships (Kinship); (2) Meaning and value in work and life (Purpose), (3) Informal and formal help-seeking (Guidance); and (4) Activities that give strength and balance emotions (Balance).

2.0 BACKGROUND

DSPO is the focal point for all suicide prevention strategic development, implementation, centralization, standardization, communication, and evaluation of DoW suicide programs, policies, research, and surveillance activities. Priorities for suicide prevention policy oversight and compliance and responsibilities outlined Department of Defense Instruction (DoDI) 6490.16 and Defense Suicide Prevention Program, DoDI 6400.09, DoD Policy on Integrated Primary Prevention of Self-Directed Harm and Prohibited Abuse or Harm. DSPO works collaboratively with internal and external partners from the Military Services, Federal agencies, medical professionals, military service organizations, and other non-profits to combat suicide in the military community and provide holistic support to Service members and their families through policy, oversight, and engagement to positively impact individual beliefs and behaviors, as well as instill systemic culture change. The DoW adopted an evidence-informed public health approach to suicide prevention as a framework for developing, supporting, and promoting effective suicide prevention activities across the Department.

The public health approach values multi-disciplinary collaboration, which brings together many different perspectives and experiences to enrich and strengthen the solutions for many diverse communities within the Military services.

Understanding that suicide prevention is tied to readiness, the public health approach focuses on upstream prevention by leveraging known risk and protective factors associated with suicide. The goal is to develop and evaluate programs and initiatives that address risk and protective factors, disseminate results, and continuously monitor suicide data.

Suicide is now the leading cause of death for Service Members. Findings and conclusions of the 2022 independent report by the Suicide Prevention and Response Independent Review Committee (SPRIRC) highlight the urgent need for new population-oriented approaches to reduce these rates. Specifically, military suicide prevention needs new approaches, training, and interventions. characterized by:

1. Upstream Suicide Prevention Focused on Group and Individual Strengths and Protective Factors.

2. Improved Social Connectedness for Suicide Prevention.

3. Modernized Suicide Prevention Training.

4. High-Quality Implementation and Sustainment.

DSPO’s Solution: The Connect Program is the only evidence-based suicide prevention program that touches on the four points above. The Connect Program significantly reduces suicide risk by strengthening the everyday relationships and unit culture that research shows are crucial for preventing suicide. The Connect Program is the only program to hold a gold-standard Randomized Controlled Trial (RCT) with 1,500 Air Force personnel (Wyman et al., 2020, 2022) demonstrated significant reductions in suicide risk, depressive symptoms, and occupational problems.

1. Upstream Suicide Prevention Focused on Group and Individual Strengths and Protective Factors: The Connect Program is a universal upstream program that targets broad populations of military personnel in their natural organization units. The focus on the ‘Four Cores’ addresses research informed suicide-protective factors that are framed in terms of universally relatable goals of career and relationship success.

The program addresses an urgent need for interventions that are effective in reducing suicide risk across broad military populations–particularly where stigma and concerns about negative career impacts remain major barriers to disclosing suicidal thoughts/behaviors.

2. Promoting Social Connection Via Network Enhancement: Connect strengthens two suicide-protective functions of relationship networks: (1) Positive social bonds, to augment protective effects including belonging and support. While learning and modeling skills for growing relationships–including with family/intimate partners–Connect participants develop new and stronger connections to each other. (2) Norms that incentivize adaptive coping. Through collaborative activities, participants develop skills for managing career and personal challenges and create shared healthy norms. Behaviors are incentivized through descriptive norms (i.e., perceptions of what others do) and injunctive norms (i.e., perceived social consequences). These healthy coping norms are especially important given evidence that some social ties can increase suicide risk.

3. Modernizing Training with Research-Informed Strategies: The SPIRIC Report specifically named Wingman Connect as a ‘point of strength’ in the US Military–a positive example of effective prevention approaches. The Connect Program employs a highly interactive group-based training that employs research-informed strategies to promote participants engagement and adoption: Personally Meaningful:

Each participant is invited to share personally relevant goals and values referenced throughout. Active:

High-energy activities maintain interest and create shared positive emotional experiences. Socially Interactive: Drawing out ‘real world’ strengths to teach and develop shared language and healthy norms.

4. High-Quality Implementation and Sustainment: The Connect Program is guided by evidence-informed implementation approach and measurement based on the Exploration, Preparation, Implementation, and Sustainment (EPIS) framework. EPIS is both a process and determinant framework developed by Dr.

Greg Aarons and colleagues, who consulted on its application to the Connection program and are part of the team continuing to inform implementation through a NIMH-funded study of the USAF scale-up.

Therefore, implementing the Connect Program will provide DSPO with an updated evidence-based interactive suicide prevention program for the Military Services to reduce suicides and increase readiness of the Total Force by promoting social connectedness and heathy coping skills.

3.0 SCOPE

The Contractor shall provide the personnel, management, and materials necessary to tailor, expand, and validate the Connect Program, an evidence-based suicide prevention program that promotes interpersonal relationship skill-building and communication, healthy coping skills, and help-seeking behaviors across all Military Services (Army, Navy, Marine Corps, Air Force, Space Force, National Guard Bureau, and Coast Guard) for the Department of War (DoW). The Contractor shall validate the updates and implementation through program delivery and evaluation. The Contractor shall provide a report that includes evaluation findings and recommendations for sustained program implementation and evaluation.

This contract requirement includes the establishment and support of the following Contractor objectives:

1. Review, tailor, and update the evidence based Connect Program to ensure alignment with DoW and Military Services values, language, and initiatives while ensuring integrity and fidelity to the tested Connect model.

2. Validate the updated program and associated implementation strategy and tools with approximately (400 to 600) DoW personnel.

3. Evaluate DoW participants’ program engagement, adoption of skills, and group cohesion and relationships; measure key aspects of implementation quality and support; and provide recommendations for broader implementation of the Connect Program for DoW personnel.

4.0 REQUIREMENTS The Contractor shall:

4.1 Program Management Support

4.1.1 The Contractor shall provide a Program Manager (PM) to serve as a Point of Contact (POC) in support of the contract.

4.1.1.2 The Contractor is responsible for managing the work under the contract, supervising contractor personnel, and communicating policies, purposes, and goals of the organization to subordinates. The PM will be responsible for assigning the task to its personnel and reviewing work. Once the tasks are assigned, the contractor’s personnel may ask the requester for clarifications and further details on the task if needed. The Contractor shall submit all products/deliverables to the Government for review and approval.

4.1.2 Be responsible for establishing the project team and management infrastructure to ensure mission success and communication clarity.

4.1.3 Be responsible for aligning all personnel and vendors to the mission, objectives, and requirements via a project kickoff meeting.

4.1.4 Be responsible for developing and establishing and communication across responsible teams and contacts.

4.1.5 Conduct an analysis to identify who is Responsible, Accountable, Consulted, and Informed (RACI analysis) for major tasks and outcomes in the project.

4.1.6 Define project scope, desired outcome, and evaluation approach; and produce a succinct Project Charter that can serve as a briefing and transition-in document for project team members and interested parties.

4.1.7 Develop a Project Plan following best practices project management guidelines including identifying the project scope, specifying communications, implementation timeline, and evaluation approach.

4.1.8 Participate in monthly meetings as well as meetings scheduled by and with the COR to discuss status of progress against all deliverables. PM will have personnel associated with active tasks available during a meeting in attendance, either in person or by phone.

4.1.9 Submit a Monthly Status Report (MSR) describing the status of activities during the previous calendar month. Report shall include: Period of report, summary of work performed by PWS paragraph, deliverables open, deliverable assigned date, deliverable due date, revised due date (when applicable due to DSPO priorities), progress toward deliverable, status and planned actions towards deliverables, deliverables provided, project schedules/task lists with priorities (as determined by DSPO), status of deliverables and projects with priorities, and known or anticipated issues, with plans of action. The Contractor shall provide one written Monthly Status Report (MSR) to the COR and Program Manager in electronic format for all tasks assigned by the close of business (COB) of the 10th workday after the month of service.

4.2 Tailor/Update Connect Program for the Department of War (DoW)

4.2.1 Map and identify DoW interested parties and relevant policies, initiatives, and Command priorities that are relevant to the Connect Program. Provide environmental scan of policies, initiatives, and Command priorities.

4.2.2 Identify sample population and location for this evaluation in collaboration with the DoW.

4.2.3 Conduct discovery process to identify and recommend Connect Program updates to ensure alignment with DoW values, language, and initiatives while ensuring integrity and fidelity to the tested Connect Program.

4.2.4 Update Connect Program

4.2.5 Provide a report for the updated Connect Program.

4.3 Validate the updated Connect Program through a pilot implementation

4.3.1 Identify and coordinate with potential DoW co-facilitators in preparation for a pilot implementation.

4.3.2 Provide PowerPoint brief and letters of support template to Government for review and approval.

Upon approval the brief and letters of support will be sent to Military Service leaders to foster a strong implementation climate for the Connect Program.

4.3.3 Obtain 100% of clearances and approvals necessary for implementing the project.

4.3.4 Deliver updated Connect Program and collect evaluation data from 400 to 600 DoW personnel.

4.3.5 Use evaluation data to iteratively refine the Connect Program and implementation strategy, tools, and assets to support high-fidelity delivery.

4.3.6 Provide evaluation report containing metrics and real-time participant evaluation data, feedback, and recommendations based on those findings.

4.4 Develop sustainable evaluation plan and recommendations for expansion

4.4.1 Translate program evaluation findings and learnings into expansion recommendations.

4.4.2 Provide a sustainable evaluation plan including identified metrics and analytic methodology.

4.4.3 Assist DSPO and relevant DoW leaders in determining scope, desired outcomes, and evaluation metrics for DoW expansion.

4.5 Participate in a Post-Award Conference

This meeting shall provide an introduction between the Contractor personnel and Government personnel who will be involved with the contract. The meeting shall provide the opportunity to discuss technical, management and security issues. The Post Award Conference will aid both the Government and Contractor in achieving a clear and mutual understanding of all requirements and identify and resolve any potential issues. The Contractor shall be prepared to discuss any items requiring clarification and gather information as necessary to support each deliverable.

4.6 Section 508 Requirements

4.6.1 The Contractor shall ensure all Electronic and Information Technology, as defined at FAR 2.101, supplied under this contract, shall conform to Section 508 of the Rehabilitation Act of 1973 (29 U.S.C

794) and the Architectural and Transportation Barriers Compliance Board’s (U.S. Access Board) information and communication technology (ICT) accessibility standards at 36 CFR 1194.1 for final Government deliverables. The following standards have been determined to be applicable to this contract:

E204, “Functional Performance Criteria”

E205, “Electronic Content”

E207, “Software”

E208, “Support Documentation and Services”

4.6.2 Section 508 compliance for deliverables includes:

4.6.3 Any outreach and engagement materials to include Contractor-produced content produced in any format that could be placed on a website or online application or intended for electronic distribution, unless otherwise directed by the Government; or any contractor-produced content written, created, or produced for any communications materials intended for public or internal use; to include reports, documents, charts, posters, presentations (such as MS PowerPoint) or video material that could be placed on a Government website or online application, a Government-funded website or online application.

4.6.4 Section 508 compliance for new documents and products. The Contractor shall coordinate the development of all new electronic media unless otherwise directed by the Government to ensure it is Section 508 compliant, including all electronic documents (Word, PowerPoint, Excel, and PDFs), audio, video, and website and online applications.

4.6.5 Section 508 compliance for legacy documents and products. The Contractor shall identify DSPO legacy content that is not Section 508 compliant, propose a timeline to make all designated legacy content Section 508 compliant.

4.6.6 Make certain all Electronic and Information Technology, as defined at FAR 2.101, supplied under this contract, conform to the Architectural and Transportation Barriers Compliance Board Electronic and Information Technology Accessibility Standards (36 CFR§1194). The applicable standards are available at https://www.accessboard.gov/ict/. The following standards have been determined to be applicable to this contract:

E204 - “Functional Performance Criteria”

E205 - “Electronic Content”

E207 - “Software”

E208 - “Support Documentation and Services”

5.0 DELIVERABLES

The Contractor shall provide deliverable(s) in a format mutually agreed upon by the Government and the Contractor. All deliverables will be reviewed for timeliness, accuracy, and format. If a deliverable due date falls on a weekend or holiday, the Contractor shall submit the deliverable on the last workday prior to the due date. In fulfillment of this effort, the Contractor shall provide the following deliverables to the

COR.

Deliverable PWS Paragraph Delivery Date Method Delivered to

Produce a Project Charter 4.1.6 NLT 30 days after award.

Microsoft Office (Word, Excel, PowerPoint, etc.)

COR

Develop a Project Plan 4.1.7 NLT 30 days after award.

Microsoft Office (Word, Excel, PowerPoint, etc.)

COR

Monthly Status Report 4.1.9 On 10th calendar day of each month for the previous month. If the 10th falls on a weekend or holiday, submit report on the first business day after the weekend/holiday.

Microsoft Office (Word, Excel, PowerPoint, etc.)

COR

Provide environmental scan of policies, initiatives, and Command priorities.

4.2.1 NLT 180 days after

award.

Microsoft Office (Word, Excel, PowerPoint, etc.)

COR

Provide a report for the updated Connect Program.

4.2.5 NLT 180 days after

approval of 4.2.1

Microsoft Office (Word, Excel, PowerPoint, etc.)

COR

Provide PowerPoint brief and letters of support template.

4.3.2 NLT 180 days after

approval of 4.2.1

Microsoft Office (Word, Excel, PowerPoint, etc.)

COR

Provide evaluation report containing metrics and real-time participant evaluation data, feedback, and recommendations.

4.3.6 Date is approved after

the program is approved by OMB and IRB for implementation.

Microsoft Office (Word, Excel, PowerPoint, etc.)

COR

Provide a sustainable evaluation plan including identified metrics and analytic methodology.

4.4.2 Date is approved after

the program is approved by OMB and IRB for implementation.

Microsoft Office (Word, Excel, PowerPoint, etc.)

COR

Post-Award Conference 4.5 No Later Than 5 days after contract award.

Microsoft Office (Word, Excel, PowerPoint, etc.)

COR

5.1

The contractor shall report contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract via the System for Award Management (SAM) (https://sam.gov) in accordance with DFARS 252.204-7023.

6.0 CONTRACTOR TRAVEL

Travel is not anticipated for this requirement. Should travel become necessary, a proposal will be requested and the contract modified to reflect travel. Travel from the contractor facilities to Government facilities is considered a cost of doing business. Local travel (within 40 miles of the National Capital Region) is considered a cost of doing business and will not be reimbursed.

7.0 RECORDS MANAGEMENT

7.1 Contractor shall comply with all applicable records management laws and regulations, as well as National Archives and Records Administration (NARA) records policies, including but not limited to the Federal Records Act (44 U.S.C. chs. 21, 29, 31, 33), NARA regulations at 36 CFR Chapter XII Subchapter B, and those policies associated with the safeguarding of records covered by the Privacy Act of 1974 (5 U.S.C. 552a). These policies include the preservation of all records, regardless of form or characteristics, mode of transmission, or state of completion.

7.2 In accordance with 36 CFR 1222.32, all data created for Government use and delivered to, or falling under the legal control of, the Government are Federal records subject to the provisions of 44 U.S.C.

chapters 21, 29, 31, and 33, the Freedom of Information Act (FOIA) (5 U.S.C. 552), as amended, and the Privacy Act of 1974 (5 U.S.C. 552a), as amended and must be managed and scheduled for disposition only as permitted by statute or regulation.

7.3 In accordance with 36 CFR 1222.32, Contractor shall maintain all records created for Government use or created in the course of performing the contract and/or delivered to, or under the legal control of the Government and must be managed in accordance with Federal law. Electronic records and associated metadata must be accompanied by sufficient technical documentation to permit understanding and use of the records and data.

7.4 Defense Human Resources Activity and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Records may not be removed from the legal custody of Defense Human Resources Activity or destroyed except for in accordance with the provisions of the agency records schedules and with the written concurrence of the Contracting Officer’s Representative (COR). Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. In the event of any unlawful or accidental removal, defacing, alteration, or destruction of records, Contractor must report to the COR and the Defense Human Resources Activity Component Records Management Officer at dodhra.mc-alex.dhra-hq.mbx.records@mail.mil so DHRA may report promptly to NARA in accordance with 36

CFR 1230.

7.5 The Contractor shall immediately notify the COR upon discovery of any inadvertent or unauthorized disclosures of information, data, documentary materials, records or equipment. Disclosure of non-public information is limited to authorized personnel with a need-to-know in accordance with all applicable privacy, security, and information protection policies. The Contractor shall ensure that the appropriate personnel, administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, documentary material, records and/or equipment is properly protected. The Contractor shall not remove material from Government facilities or systems, or facilities or systems operated or maintained on the Government’s behalf, without the express written permission of the COR. When information, data, documentary material, records and/or equipment is no longer required, it shall be returned to DHRA control or the Contractor must hold it until otherwise directed. Items returned to the Government shall be hand carried, mailed, emailed, or securely electronically transmitted to the COR. Destruction of records is EXPRESSLY PROHIBITED unless in accordance with Paragraph (7.4).

7.6 The Contractor is required to obtain the Contracting Officer's approval prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under, or relating to, contracts. The Contractor (and any sub-contractor) is required to abide by Government and Defense Human Resources Activity guidance for protecting sensitive, proprietary information, classified, and controlled unclassified information.

7.7 The Contractor shall only use Government IT equipment for purposes specifically tied to or authorized by the contract and in accordance with Defense Human Resources Activity policy.

7.8 The Contractor shall not create or maintain any records containing any non-public Defense Human Resources Activity information that are not specifically tied to or authorized by the contract.

mailto:dodhra.mc-alex.dhra-hq.mbx.records@mail.mil mailto:dodhra.mc-alex.dhra-hq.mbx.records@mail.mil

7.9 The Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected from public disclosure by an exemption to the Freedom of Information Act.

7.10 The Defense Human Resources Activity owns the rights to all data and records produced as part of this contract. The contractor shall not include any contractor markings on deliverables created under the contract. All deliverables under the contract are the property of the U.S. Government for which Defense Human Resources Activity shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest. The contractor shall not use or disclose any data or deliverables under this contract for any purposes other than performing the contract, unless expressly approved by the Government.

8.0 SECURITY

NOTE: Security Clearances are not required for access to unclassified data.

8.1 Personnel Security. Overarching security requirements are UNCLASSIFIED access. The Contractor/Subcontractor personnel under this contract will require unclassified access to DoD network(s), Government Furnished Equipment (GFE), DOD credential, also known as the Common Access Card (CAC) for physical and logical access to federally controlled facilities and or DoD Information Systems (IS) with Controlled Unclassified Information (CUI).

8.1.1 All Contractor personnel assigned to this contract are required to obtain and maintain the appropriate background investigation (BI) and adjudication or suitability determination in accordance with DODI 5200.02-DoD Personnel Security Program (PSP).

8.1.2 The contractor/subcontractor personnel on this contract will be designated a Noncritical-Sensitive position for Unclassified access.

8.1.3 Provide personnel already vetted or able to undergo a background investigation according to Department of Defense (DoD) regulations.

8.1.4 Must have or be able to obtain a completed Tier 3 (T3) an equivalent or higher BI according to the Defense Counterintelligence and Security Agency (DCSA) and the Office of Personnel Management (OPM) investigative alignment.

8.2 Security Clearances. N/A

8.3 Staffing. The personnel supporting this contract requiring a DHRA sponsored CAC, access to DoD network(s), DoD information systems with CUI/PII data or IT/Information Systems must be Citizens of the United States. This includes personnel assigned or working on the contract at any remote sites.

8.4 Onboarding. Prior to requesting access to DHRA sponsored resources (e.g., DoD credential(s), IT systems, information systems, email or facility), the appointed contractor must have a favorably adjudicated Tier 3 BI that meets the requirement for access at DHRA or be in the process of a Personnel Security Investigation (PSI) equivalent or greater in scope with a minimum of interim eligibility.

8.5 Listing of Employees & Clearance Documentation. The Contractor shall maintain a current listing of employees. Within 10 calendar days of contract award, the Contractor shall provide the COR a list with the names, location of performance and clearance requirements of all company employees assigned to this effort. The list shall be validated and signed by the company and DHRA Personnel Security (PERSEC).

An updated listing shall be provided when an employee's status or information changes.

8.6 Access To Sensitive Information. To the extent that the work under this contract requires the Contractor to have access to DoD sensitive information the Contractor shall after receipt thereof, treat such information as confidential and safeguard such information from unauthorized use and disclosure.

The Contractor agrees not to appropriate such information for its own use or to disclose such information to third parties unless specifically authorized by the Government in writing.

8.6.1 The Contractor shall allow access only to those employees who need the sensitive information to perform services under this contract and agrees that sensitive information shall be used solely for the purpose of performing services under this contract. The Contractor shall ensure that its employees will not discuss, divulge or disclose any such sensitive information to any person or entity except those persons within the Contractor’s organization directly concerned with the performance of the contract.

8.7 Personal Identifiable Information (PII) and Tier Investigations. All personnel supporting this contract must protect PII data according to the Privacy Act of 1974. Personnel requiring access to Information Technology (IT) or access to DoD Information Systems that contain military active duty, guard, or reservists’ PII or information pertaining to Service members that are otherwise protected from disclosure where such access has the potential to cause serious damage to national security, must be vetted accordingly and protect the data, including, but is not limited to the abilities and capability according to the job functions mentioned here:

8.7.1 Tier 3/Tier 3R for Noncritical-Sensitive – Moderate Risk: All personnel with the ability to aggregate and extract military PII en masses from an automated records repository requires at a minimum, a favorably adjudicated Tier-3 (T3) BI or equivalent.

8.7.2 Tier 1 for Non-Sensitive – Low Risk: All Personnel whose access to military PII is limited to data entry or singular search capability require, a minimum, a favorably adjudicated Tier-1 (T1) BI.

8.7.3 The Contractor shall report immediately to the DHRA Privacy Office and secondly to the COR discovery of any Privacy breach.

8.8 Controlled Unclassified Information Requirements for DoD Contractors. The following procedures will be used to protect Controlled Unclassified Information (CUI) documents and materials:

8.8.1 HANDLING: Access to CUI material shall be limited to those employees needing the material to perform their duties. The CUI marking is assigned to documents and material created by a DoD User Agency. CUI is not a classification, but requires extra precautions to ensure it is properly safeguarded and disseminated and is not released to the public without government authorization.

8.8.2 MARKING: Mark unclassified documents containing CUI: “CUI" at the top and bottom of each page, include the CUI warning box, and the CUI Designation Indicator Block as required in DoDI 5200.48.

8.8.2.1 Mark other records such as computer print outs, photographs, films, tapes, or slides in accordance with DoDI 5200.48 so the receiver or viewer knows that it contains CUI material.

8.8.2.2 Mark a message containing material in accordance with DoDI 5200.48. Unclassified messages containing CUI material must show the abbreviation (CUI) before the text begins.

8.8.2.3 Ensure documents transmitting CUI material call attention to any attachments containing CUI.

8.8.2.4 CUI material released to a contractor by a DoD user agency must have the following statement on the front page or cover:

THIS DOCUMENT CONTAINS CUI MATERIAL AND MUST BE REVIEWED BY A

GOVERNMENT REPRESENTATIVE UNDER THE REQUIREMENTS OF DODI 5200.48,

DODI 5230.09, and DODI 5230.29.

8.8.3 STORAGE: During normal duty hours, place CUI material in an out-of-sight location if your work area is accessible to persons who do not have an authorized government purpose for access to the material. After normal duty hours, store CUI material to prevent unauthorized access. File with other unclassified records in unlocked files or desks when internal building security is provided and the file is marked as CUI. When there is no internal security, locked buildings or rooms usually provide adequate after hours protection. For additional protection, store CUI material in locked containers such as file cabinets, desks, or bookcases.

8.8.4 TRANSMISSION: CUI documents and materials may be transmitted via first class mail, parcel post or for bulky shipments-fourth class mail. Within the CONUS discussion of CUI material on the telephone is authorized if necessary for the performance of the contract and no alternative is available. Electronic transmission of CUI (voice, data, or facsimile) should be by approved secure communications systems whenever practical. If there is a fax transmission, the sender must ensure the intended receiver is available to receive it or a cover sheet will be used to allow carrying it to the final recipient to avoid unauthorized disclosure of the CUI.

8.8.5 RELEASE: CUI material shall not be released outside of the contractor’s facility except to the representative of DoD or DHRA.

8.8.6 DESTRUCTION: When the CUI material no longer meets the threshold for safeguarding and dissemination, it shall be immediately decontrolled, be processed through the records management process, and destroyed by the approved methods identified in DoDI 5200.48 precluding its disclosure to unauthorized individuals by rendering it unreadable, indecipherable, and irrecoverable.

8.9 Position of Trust (POT) Requirements. DCSA and OPM offers the Tier background investigations, Tier 1 (T1) – Tier 5 (T5) for Position of Trust determination. The T5 being the most stringent investigation and T1 being the least stringent.

8.9.1 The Government is responsible for the cost of POT or sponsor a DoD-determined equivalent background check for unclassified access.

8.9.2 The Position of Trust BI process requires the DoD Government Security Office to review each request and establish the BI sponsorship. Submit a request and list of personnel for security investigation to the DHRA Security Office point of contact(s) to be provided by the COR- NLT five (5) business days after contract award.

8.9.3 Per DCSA a T3 meets the requirement for a Noncritical-Sensitive position. A new application for a DoD T3 BI for Position of Trust determination requires FBI fingerprints check, proof of US Citizenship and a Personnel Security Questionnaire (PSQ) on the Standard Form (SF) 86 using the National Background Investigation Services – electronic Application (NBIS/eAPP). The Contractor employees shall provide all requested information pursuant to the Privacy Act of 1974 when requested by the Government. The Government Security Office will provide instructions according to the individual case and Tier BI to access the eAPP system. For information visit NBIS at https://www.dcsa.mil/is/nbis/

8.9.4 Reciprocity. The DHRA and the Defense Logistics Agency (DLA) PERSEC will use reciprocity to the extent possible and if necessary will request re-adjudication by the (DoD) Consolidated Adjudications Facility (CAF) or DCSA Consolidated Adjudication Services (CAS) to support the DoD standards per

Executive Order E.O 13488, Granting Reciprocity on Excepted Service and Federal Contractor Employee Fitness and Reinvestigating Individuals in Positions of Public Trust.

8.9.4.1 A BI equivalency will be according to the investigative alignments offered by the OPM and the DCSA here, https://www.dcsa.mil/Portals/91/Documents/pv/GovHRSec/Position_Designation_Investigation_Type_C hart_Sept_2017.pdf

8.9.4.2 Reciprocity consideration includes verifying break in service longer than 24 months as a US Military, US Civilian or US Contractor from the last favorable investigation.

8.9.5 A new Position of Trust applicant under this contract must obtain at a minimum interim eligibility from DLA Security prior to the assignment and performance of their duties in support of the Government in this contract.

8.9.6 DHRA’s interim Position of Trust eligibility is sponsored by DHRA PERSEC and approved by

DLA PERSEC.

8.9.7 Eligible interim Position of Trust personnel expectations include, but are not limited to:

8.9.7.1 Comply with all personnel security requirements as specified by DHRA and DLA PERSEC;

8.9.7.2 Attain and maintain favorable FBI fingerprint results;

8.9.7.3 Comply with all investigative and adjudicative requirements, which includes responsiveness to time-sensitive requests (e.g., interview(s), additional information or clarification) from the DLA PERSEC, investigator or the adjudicative agency (DoD CAF/CAS);

8.9.7.4 Attain and maintain favorable eligibility to the designated BI.

8.10 Controlled/Restricted Areas. The Contractor shall be compliant with local procedures for entry to DHRA controlled/restricted areas where Contractor personnel will work.

8.11 Physical Security. The Contractor shall safeguard all Government property and controlled forms provided for Contractor use and adhere to the Government property requirements contained in this contract. At the end of each work day, all Government facilities, equipment and materials shall be secured.

8.12 Pass and Identification Items. The Contractor shall ensure the pass and identification items required for contract performance are obtained for employees and non-government owned vehicles.

8.13 DoW Credentials/Common Access Card (CAC). Contractor personnel must obtain a DoD credential or CAC if they are assigned to perform work under this contract requiring access to DoD network(s), CUI/PII data, IT/Information Systems, DoD Facilities or non-DoD federally controlled facilities on behalf of the DoD on a recurring basis per DODM 1000.13, DoD Identification (ID) Cards:

ID Card Life-Cycle.

8.13.1 Comply with HSPD-12 Personal Identity Verification (PIV) issuance requirements. Be responsible for obtaining a CAC or PIV and be in ready status prior to requesting access to DoD resources such as DoD Facilities, DoD IT/Information Systems (IS).

8.13.2 CAC Applicant supporting this contract will need to meet the following requirements:

8.13.2.1 Execute, obtain/maintain a favorable FBI National Criminal History Check (fingerprint check);

8.13.2.2 Have an open Tier 3 or equivalent BI to meet Noncritical-Sensitive role;

8.13.2.3 Be ready to provide two forms of identification (I-9 document);

8.13.2.4 Provide proof of U.S. Citizenship.

8.14 Retrieving Identification Media. The Contractor shall retrieve all identification media, including vehicle passes from employees, including those who depart for any reason before the contract expires;

e.g. terminated for cause, retirement, etc.

8.15 Key Control/Access Badge Control. The Contractor shall establish and implement methods of making sure all keys/badges issued to the Contractor by the Government are not lost or misplaced and are not used by unauthorized persons. The Contractor shall not duplicate any keys issued by the Government.

8.15.1 Prohibited Use. The Contractor shall prohibit the use of keys, issued by the Government, by any persons other than the Contractor’s employees and the opening of locked areas by Contractor employees to permit entrance of persons other than Contractor employees engaged in performance of contract work requirements in those areas.

8.16 Conduct while on Government Installation. The CO may direct the contractor to remove an employee(s) from an assignment under this contract for reasons of security or misconduct.

8.17 Weapons, Firearms, and Ammunition. Contractor employees are prohibited from possessing weapons, firearms, or ammunition, on themselves or within their contractor-owned vehicle or privately-owned vehicle while on all DHRA installations.

8.18 Reporting Requirements. Contractor personnel shall report to an appropriate authority any information or circumstances of which they are aware may pose a threat to the security of DOD personnel, Contractor personnel, resources, and classified or unclassified defense information.

8.19 Government Furnished Equipment (GFE). The Contractor shall establish and implement procedures to ensure all GFE to include laptops and other data processing devices, issued to the Contractor by the Government are not lost or misplaced, are not used by unauthorized persons or are not subject to unauthorized external devices. The Contractor shall immediately report to the COR any occurrences of lost GFE within two (2) hours of discovery of occurrence. In the event that GFE is lost, the Contractor may be required, upon written direction of the CO, to replace the equipment at no additional cost to the Government. The Government may replace the equipment and deduct the cost of such from the monthly payment due the Contractor.

8.20 Off boarding. Upon completion of the contract, an employee’s relocation or termination of an employee, or upon request from the COR in accordance with DHRA centers or offices security policies coordinate the employees removal from work under this contract with the COR.

8.20.1 If at any time, any Contractor personnel supporting this contract are unable to obtain/maintain an adjudicated T3 BI, the Contractor shall immediately notify the COR and coordinate removal of such a person from work under this contract and replace the individual with appropriate level background investigation knowledge, skill and ability (KSA) required to perform services.

8.20.2 As the contractor replaces employees, the contractor shall submit the outgoing employee’s installation access and return all CACs/badge(s)/identification card(s) immediately to the COR, who will turn it in to the local Installation Access Control Office or Government Security Office.

8.20.3 Submit an Off-boarding notification to the COR and the DHRA PERSEC as soon as the contractor knows an employee is leaving the contract.

8.20.4 When personnel change, provide updated personnel security list to the COR within three business days of a change.

8.21 Information System Security. The Contractor shall implement Information System (IS) security protections and ensure the protections are appropriate to the confidentiality, integrity, and availability needs of the Government. Establish appropriate administrative, technical, and physical safeguards to protect any and all nonpublic Government data.

9.0 Cybersecurity

9.1 Risk Management Framework. All Information Systems (IS), Platform Information Technology (PIT) and Information Technology (IT) Services or Products under this requirement, that receive, transmit, store, or process nonpublic government data must be accredited in accordance with Department of Defense (DOD) Instruction (DoDI) 8510.01, Risk Management Framework (RMF) for DoD Information Technology (IT) and comply with annual Federal Information Security Management Act (FISMA) security control testing. IS and PIT systems must be categorized in accordance with Committee on National Security Systems Instruction (CNSSI) 1253, implement a corresponding set of security controls from the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, and use assessment procedures from NIST SP 800-53A with additional DoD-specific assignment values, overlays, implementation guidance, and assessment procedures as required.

9.1.1 All systems subject to RMF must present evidence of authorization in the System Security Plan (SSP), Security Assessment Report (SAR) Plan of Action and Milestones (POA&M) and authorization decision document or show that the system has a DoD Risk Management Framework (RMF) or equivalent DoD Component PIT system accreditation decision that is current within 3 years. Evidence of FISMA compliance must be presented in the form of a POA&M. Systems must have and maintain an Authority to Operate (ATO) or, if acceptable to the Government, an Interim Authority to Operate (IATO) by contract award.

9.2 Information Security Continuous Monitoring (ISCM). ISCM is defined as maintaining ongoing awareness of information security, vulnerabilities, and threats to support organizational risk management decisions. ISCM is a critical part of the risk management process to ensure that IS and PIT operations remain within an acceptable level of risk despite any changes that occur. The Contractor shall maintain ongoing monitoring, analysis and incident response procedures for all IS and PIT systems under this requirement in accordance with NIST SP 800-137.

9.3 Cybersecurity Service Provider (CSSP). The Contractor shall perform CSSP services in accordance with DoDI 8530.01, Cybersecurity Activities Support to the DoD Information Network Operations, Change 1, July 25, 2017.

9.4 Cyber Incident Reporting. Within one (1) hour of discovery of any cyber incident the Contractor shall notify the DMDC Incident Response (IR) team by emailing an Initial cyber incident report to the following organizational box: dodhra.dodc-mb.dmdc.list.ir-team@mail.mil, with subsequent reporting every 24 hours until the incident is closed. The Contractor shall also notify the COR and CO at the time the incident is reported to DMDC/IR.

9.5 Compliance with Cybersecurity and Privacy DoD Instructions and Directives. The Contractor and all Contractor personnel with access to or responsibility for nonpublic Government data under this contract shall be in compliance with the latest versions of:

DoD Instruction (DoDI) 8500.01, Cybersecurity

DoD Instruction (DoDI) 8510.01, DoD Risk Management Framework (RMF) for DoD Information Technology (IT)

The Privacy Act (5 U.S.C. 552a)

DoD Instruction 5400.11 DoD Privacy and Civil Liberties Programs, January 2019

DoD Instruction 6025.18 Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule Compliance in DoD Health Care Programs, March 2019

DODI 5200.02 DoD Personnel Security Program (PSP) (Incorporating Change 3, Effective September 24, 2020)

HSPD-12, Homeland Security Presidential Directive

NIST SP 800-137, Information Security Continuous Monitoring

DODM 8140.03, Cyberspace Workforce Qualification and Management Program

9.6 Cloud Computing. Any commercial cloud computing services used for this requirement must comply with the DoD Cloud Computing Security Requirements Guide and DoD Cloud Computing Supplemental Guidance and Information as published by the Defense Information Systems Agency (DISA).

9.6.1 The Contractor shall have been issued an Authority to Operate (ATO) or Provisional-ATO (P-ATO) by Defense Information Systems Agency at the impact level appropriate to DHRA requirements to provide the relevant cloud computing services in accordance with DoD Cloud Computing SRG. Evidence of DISA authorization must be presented to the government.

9.6.2 The Contractor shall provide CSSP services that align with DoD Cloud Computing SRG requirements and will have a separate Service Level Agreement (SLA) initiated by the government.

9.7 Cyberspace Workforce Management Requirements. The Cybersecurity Workforce includes, but is not limited to, all individuals performing any of the cybersecurity functions described in DOD 8140.03. The cybersecurity workforce must be identified and managed, and personnel performing cybersecurity functions will be appropriately screened in accordance with DOD 8140.03 and supporting issuances. It is imperative to the DHRA mission that the cybersecurity workforce establish baseline technical and management cybersecurity skills among personnel performing cybersecurity functions across the DHRA enterprise.

9.7.1 Cybersecurity functions are focused on the development, operation, management, and enforcement of security capabilities for systems and networks. Personnel performing cybersecurity functions establish cybersecurity policies and implement security measures and procedures for DHRA and affiliated information systems and networks.

9.7.1.1 Perform cybersecurity measures to protect and defend information and information systems by ensuring their availability, integrity, authentication, confidentiality, and non-repudiation. This includes providing for their restoration by incorporating protection, detection, and reaction capabilities.

9.7.1.2 Job functions that require privilege access to DHRA assets.

9.7.1.3 Cybersecurity duties may be performed as primary or additional/embedded duties, by a contractor.

10.0 GOVERNMENT FURNISHED PROPERTY/EQUIPMENT/INFORMATION

(GFP/GFE/GFI) No GFE will be provided.

11.0 PLACE OF PERFORMANCE

Contractors will be working in Contractor’s facility.

12.0 QUALITY CONTROL

The contractor shall implement and maintain a Quality Control Plan (QCP) to ensure work performed conforms to the scope of work and meets the requirements under this PWS. The QCP shall, at a minimum provide a method for performing inspections; identifying, correcting and preventing problems/defective service; addressing customer complaints, and improving the quality of services over the life of the contract.

13.0 QUALITY ASSURANCE

13.1. The Government reserves the right to perform inspections and surveillance to evaluate the Contractor’s compliance to the contract terms and performance of the requirements in the PWS.

13.2. Contract Discrepancy Report (CDR). In the event of unsatisfactory contractor performance, the COR or CO will issue a CDR that will explain the circumstances and findings concerning the incomplete or unsatisfactory service. The contractor shall acknowledge receipt of the CDR and respond in writing as to how he/she shall correct the unacceptable performance and avoid a recurrence.