Draft PWS DOMOPS Program.pdf

PERFORMANCE WORK STATEMENT (PWS) 1

DOMESTIC OPERATIONS (DOMOPS) ANALYTICAL SERVICE 3

NGB J3/4/7 OPERATIONS DIRECTORATE 4

6 January 2026 6

1.0 General 8

1.1 Scope: The Contractor shall provide all personnel, equipment, tools, materials, supervision, 10 and quality control necessary, except as specified in Paragraph 3.0 as Government Furnished, to 11 perform Domestic Operations (DOMOPS) Analytical Services, as defined in this Performance 12 Work Statement (PWS). 13

1.2 Background: This is a non-personal services requirement to provide the necessary 15 level of professional, technical and program management support required to facilitate the overall 16 objectives of the National Guard Bureau’s (NGB) J3/4/7 Operations Directorate. The NGB-J3/4/7 17 has numerous Divisions within the Directorate, however, under this contract only the following 18 Divisions and support staff require services: (1) the Continuity Program Management Office 19 (NGB-J31); (2) Logistics, Engineering & Protection Division (NGB-J34); (3) The Future 20 Operations Division (NGB-J35); (4) The Cyber Operations Division (NGB-J36); (5) The 21 Combatting Weapons of Mass Destruction (WMD) Division (NGB-J39); and (6) and The Joint 22 Force Development and Training Division (NGB-J37). The Government shall not exercise any 23 supervision or control over the Contractor employees performing the services herein. Such 24 contract employees shall be accountable solely to the Contractor who, in turn, is responsible to 25 the Government. 26

1.2.1 The NGB-J31 Continuity Program Management Office (CPMO) is unique within the 28 NGB Staff, because it is charged with planning and policy development at the National level, while 29 functioning at the Strategic, Operational and Tactical levels. Accordingly, Contractors are 30 designated as Emergency Mission Essential Personnel and their uninterrupted support to the 31 CPMO must be agile and able to cross multiple disciplines. CPMO projects range from single 32 event tasks and planning to the development of crisis and continuity recommendations presented 33 through the Chief of the National Guard Bureau (CNGB) to the National Security Council. All 34 members of the CPMO require TS clearances with SCI access, are subject to involuntary recall to 35 support crisis and continuity of operations and are members of Emergency Relocation Group. 36

1.2.2 The NGB-J3/4/7-L Logistics, Engineering & Protection Division The NGB-J3/4/7-L 38 Logistics, Engineering & Protection Division requirements include (1) support to the NG Mission 39 Assurance (MA) and Critical Infrastructure Protection (CIP), (2) Force Protection (FP) activities 40 including threat analysis, and (3) NG support to civilian law enforcement, which includes the 41 National Guard Response Force (NGRF)/Non-Lethal Weapons Program. These requirements also 42 include knowledge management, gap analysis, resource monitoring and information sharing. 43 National Guard Mission Assurance (MA) and Critical Infrastructure Protection (CIP) activities 44 with federal, state and local interagency partners, DoD Mission Assurance initiatives related to the 45 Mission Assurance Control Board (MACB) activities, Coordination of Anti-Terrorism Force 46

Protection (ATFP) /Threat Information sharing and risk analysis with other NGB Staff 47 Directorates, DHS, interagency Law Enforcement (LEA) partners, and the National Guards of the 48 States, Territories and District of Columbia as well as federal state and local Law Enforcement 49 interagency partners, National Guard domestic operations programs, activities and capabilities for 50 State National Guard support to Civilian Law Enforcement Agencies (LEAs) in a state or Title 32 51 status, and Coordination of National Guard input to DoD policy related to physical security, law 52 enforcement activities, law enforcement information sharing with federal, state and local partners, 53 mission assurance activities, force protection and antiterrorism issues. 54

1.2.3 The NGB-J35 The Future Operations Division activities include support to Deliberate 56 Operations Branch for disaster operations, complex catastrophes, and the spectrum of special 57 events through predicting, analyzing, and incorporating trends into defense and interagency plans 58 and NGB activities. The Contractor will provide Planning Officer services for National Special 59 Security Events (NSSE), and Special Events with a Department of Homeland Security (DHS) 60 Special Events Assessment Rating (SEAR) of 2 or higher. The Department maintains situational 61 awareness of all National Guard (NG) equities involved with the United States Secret Service, 62 Department of Justice, including the Federal Bureau of Investigation, Department of Homeland 63 Security, Department of Defense, and State and Local Law Enforcement Agencies. They support 64 disaster preparedness and resource allocation efforts with Federal, State, and Local partner 65 agencies; and participates in interagency information sharing between the 54 states and 66 Territories to support the planning and execution of NSSE and SEAR events. NGB-J35 provides 67 the focal point for coordination with the Office of the Secretary of Defense, Department of 68 Defense (DoD), Army and Air Force National Guard, Joint Force Headquarters of the States and 69 other interagency partners for the integrated employment of Army and Air Force National Guard 70 capabilities for domestic operations. This includes linking strategy, plans and policies to 71 domestic operations with the focus including planned events, emergency preparedness, and 72 response to natural and manmade disasters. 73

1.2.4 The NGB-J36 Cyberspace Operations Division requirements involve cyberspace 75 operations activities to include knowledge management, gap analysis, resource monitoring and 76 information sharing. There has been a steady increase in the requirements of additional program 77 oversight and records management for several J3-DSS Division. Due to the sensitivity and security 78 of the data, the Contractors are required to have a TS/SCI clearance. 79

1.2.5 The NGB-J37 Joint Force Development and Training Division functions as the staff 81 proponent for NGB doctrine, exercises, training, and lessons learned. It coordinates NGB 82 participation in joint or interagency exercises, doctrine development, and continuous process 83 improvement through the lessons learned program. The NGB-J37 assists the Adjutants General, 84 Governors, and State National Guard leadership in the preparation of supporting plans, programs, 85 activities, and training relevant to exercises and domestic operations. 86

1.2.6 The NGB-J39 Combating Weapons of Mass Destruction (WMD) Division supports the 88 Title 32 components of the National Guard CBRN Responses Enterprise (NG-CRE) across the 89 Doctrine, Organization, Training, Materiel, Leadership and Education, Personnel, Facilities and 90 Policy (DOTMLPF-P), logistical, and funding requirements. Due to the sensitivity and security of 91 the data, Contractors are required to have a TS/SCI clearance. 92

1.2.7 The NGB-J1 Manpower Strategy and Policy Division (J1X) develops and executes 93 personnel strategy and policy for the Army and Air National Guard across all 54 states, 94 territories, and D.C., ensuring a compliant, aligned, and ready force for domestic and global 95 operations. Through expert analysis, innovative solutions, and stakeholder engagement, we 96 optimize benefits, compensation, and manpower policies to support Total Force effectiveness. 97

1.3 Period of Performance (PoP): The Period of Performance shall be 1 Base Year of 12 months 98 and four (4) 12-month option years. The Extension of Services Clause will be included in the 99 Solicitation, which allows the Government to Extend Services for up to Six Months. 100

1.4 General Information: 102

1.4.1 Place and Performance of Services: The Contractor shall provide services between the 104 hours of 0730-1800 on Monday through Friday, except on recognized US holidays or when the 105 Government facility/installation is closed due to local or national emergencies, administrative 106 closings, or similar Government-directed facility/installation closings. Performance shall be at the 107 National Guard Bureau’s Herbert R. Temple, Jr., Army National Guard Readiness Center (TARC), 108 111 South George Mason Drive, Arlington, Virginia. Enduring NGB-J34, NGB-J35, and NGB-109 J36 duties require Contractor support at the Pentagon multiple days a week during normal duty 110 hours. Travel between TARC and the Pentagon will be at no cost to the government as shuttle 111 services are provided. The Contractor shall at all times maintain an adequate workforce for the 112 uninterrupted performance of all tasks defined within this PWS when the Government 113 facility/installation is not closed for the above reasons. When hiring personnel, the Contractor shall 114 keep in mind that the stability and Continuity of the workforce is essential. Telecommuting is not 115 authorized. Teleworking or remote work is not authorized in support of this requirement. 116

1.4.1.1 Telework: The Government does not permit teleworking by Contractor employees in 118 support of this requirement, with the exception of situational case-by-case basis; and will not be a 119 recurring event. This will be decided when it is determined to be in the best interest of the 120 Government in meeting work requirements. In furtherance of Continuity of Operations Planning 121 (COOP), a telework program may be enacted to ensure that the Government's mission-critical 122 operations stay operational during times of national emergency or incidents of national 123 significance. 124

1.4.1.2 Remote Work. The Government does not permit the Contractor to work remotely in 126 support of this requirement. 127

1.4.1.3 Unscheduled gate closures by the Security Police may occur at any time causing all 129 personnel entering or exiting a closed installation to experience a delay. This cannot be predicted 130 or prevented. Contractors are not compensated for unexpected closures or delays. Vehicles 131 operated by Contractor personnel are subject to search pursuant to applicable regulations. Any 132 moving violation of any applicable motor vehicle regulation may result in the termination of the 133 Contractor employee’s installation driving privileges. 134

1.4.1.4 The Contractor’s employees shall become familiar with and obey the regulations of the 136 installation, including fire, traffic, safety and security regulations while on the installation. 137

Contractor employees should only enter restricted areas when required to do so and only upon 138 prior approval. All Contractor employees shall carry proper identification with them at all times 139 and shall be subject to such checks as may be deemed necessary. The Contractor shall ensure 140 compliance with all regulations and orders of the installation, which may affect performance. The 141 Government reserves the right to direct the removal of an employee from Government property or 142 revoke access to Government systems for misconduct, security reasons, or any overt evidence of 143 communicable disease. Removal of Contractor employees for reasons stated above does not 144 relieve the Contractor from responsibility for total performance of this contract. 145

1.4.2 Recognized Holidays: The Contractor shall not perform services on recognized U.S. 147 Holidays or those declared by an Executive Order by the President, Office of Management and 148 Budget or the Office of Personnel Management. All recognized holidays can be found at: 149 https://www.opm.gov/policy-data-oversight/pay-leave/federal-holidays/. Most Federal employees 150 work on a Monday through Friday schedule. For these employees, when a holiday falls on a non-151 workday (Saturday or Sunday) the holiday usually is observed on Monday (if the holiday falls on 152 Sunday) or Friday (if the holiday falls on Saturday). The Contractor shall be responsible for 153 knowing when Federal holidays are recognized as this may impact the status of Federal facilities 154 and Contractor access to such facilities. During closures at Government facilities impacting 155 Contractor performance (other than by Executive Orders), the Contractor will be notified in writing 156 by the COR. The Contractor will communicate with the COR to verify any pending or Government 157 declared closure(s). 158

1.4.3 Quality Control (QC): The Contractor shall develop and maintain an effective QC Plan 160 (QCP) to ensure services are performed in accordance with this PWS. The Contractor shall develop 161 and implement procedures to identify, prevent, and ensure non-recurrence of defective services. 162 The Contractor’s QCP is the means by which it assures itself that its work complies with the 163 requirements of the contract. As a minimum, the Contractor shall develop QC procedures that 164 address the areas identified in Technical Exhibit 1, Performance Requirements Summary (PRS). 165 A final QCP shall be submitted to the Contracting Officer Representative (COR) no later than 10 166 calendar days after contract award. After acceptance of the QCP, the contractor shall obtain the 167 Contracting Officer’s (KO’s) acceptance in writing of any proposed changes to its QCP. 168

1.4.4 Quality Assurance (QA): The Government will evaluate the Contractor’s performance 170 under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan 171 is primarily focused on what the Government will do to ensure that the Contractor has performed 172 in accordance with the performance standards. It defines how the performance standards will be 173 applied, the frequency of surveillance, and acceptable quality level(s) or defect rate(s). 174

1.4.5 Installation Access and Security Requirements. The Contractor shall comply with all 176 applicable installation/facility access and local security policies and procedures, which may be 177 obtained from the Contracting Officer’s Representative (COR). The Contractor and all associated 178 subcontractor employees shall provide all information required for background checks to meet 179 installation access requirements to be accomplished by installation Provost Marshal Office, 180 Director of Emergency Services, or Security Office. The Contractor shall ensure compliance with 181 all personal identity verification requirements as directed by Department of Defense (DOD), 182 Headquarters Department of Army (HQDA) and/or local policy (see PWS 6.0). Should the Force 183 http://www.opm.gov/policy-data-oversight/pay-leave/federal-holidays/

Protection Condition (FPCON) change, the Government may require changes in Contractor 184 security matters or processes. 185

1.4.5.1 Access and General Protection/Security Policy and Procedures. The Contractor shall 187 comply with all applicable installation/facility access and local security policies and procedures, 188 which may be obtained from the COR. The Contractor shall also provide all information required 189 for background checks to meet installation access requirements to be accomplished by the local 190 installation’s Security Forces, Director of Emergency Services or local Security Office. The 191 Contractor shall ensure compliance with all personal identity verification requirements as directed 192 by DOD, Headquarters Air Force (HAF) and/or local policy. Should the Force Protection 193 Condition (FPCON) change, the Government may require changes in contractor security matters 194 or processes. 195

1. The Contractor shall obtain base identification and vehicle passes, if required, for all 196 contractor personnel who make frequent visits to or perform work on the Air Force 197 installation(s) cited in the contract. Contractor personnel are required to wear or 198 prominently display installation identification badges or Contractor-furnished Contractor 199 identification badges while visiting or performing work on the installation. 200

2. The Contractor shall submit a written request on company letterhead to the Contracting 201 Officer listing the following: contract number, location of work site, start and stop dates, 202 and names of employees and subcontractor employees needing access to the base. The 203 letter will also specify the individual(s) authorized to sign for a request for base 204 identification credentials or vehicle passes. The Contracting officer will endorse the 205 request and forward it to the issuing base pass and registration office or Security Forces 206 for processing. When reporting to the registration office, the authorized Contractor 207 individual(s) should provide a valid driver s license, current vehicle registration, valid 208 vehicle insurance certificate, and to obtain a vehicle pass. 209

3. During performance of the contract, the Contractor shall be responsible for obtaining 210 required identification for newly assigned personnel and for prompt return of credentials 211 and vehicle passes for any employee who no longer requires access to the work site. 212

4. When work under this contract requires unescorted entry to controlled or restricted areas, 213 the Contractor shall comply with AFI 31-101, Integrated Defense, and 214 DODMAN5200.02_AFMAN 16-1405, Air Force Personnel Security Program. 215

5. Upon completion or termination of the contract or expiration of the identification passes, 216 the Prime Contractor shall ensure that all base identification passes issued to employees 217 and Subcontractor employees are returned to the issuing office. 218

1.4.5.1 For Contractors requiring Common Access Card (CAC): The CAC is the DoD Federal 219 Personal Identity Verification (PIV) credential. For installation(s) National Guard Bureau’s 220 Herbert R. Temple, Jr., Army National Guard Readiness Center (TARC), 111 South George 221 Mason Drive, Arlington, Virginia. Before CAC issuance, the Contractor employee requires, at a 222 minimum, a favorably adjudicated Tier 1 or an equivalent or higher investigation in accordance 223 http://static.e-publishing.af.mil/production/1/af_a4/publication/afi31-101/generic_wms.pdf https://static.e-publishing.af.mil/production/1/saf_aa/publication/dodman5200.02_afman16-1405/dodm5200.02_afman16-1405.pdf with Army Directive 2014-05. Contractors shall ensure Common Access Cards (CACs) are 224 obtained by all contract or subcontract personnel who meet one or both of the following criteria: 225

(a) Require logical access to DOD computer networks and systems in either: 226

(i) the unclassified environment; or 228

(ii) the classified environment where authorized by governing security directives. 230

(b) Perform work, which requires the use of a CAC for installation entry control or physical 232 access to facilities and buildings. 233

(c) The Contractor employee will be issued a CAC only if duties involve one of the 235 following: (1) both physical access to a DoD facility and access, via logon, to DoD networks on-236 site or remotely; (2) remote access, via logon, to a DoD network using DoD-approved remote 237 access procedures; or (3) physical access to multiple DoD facilities or multiple non-DoD federally 238 controlled facilities on behalf of the DoD on a recurring basis for a period of 6 months or more. 239 At the discretion of the sponsoring activity, an initial CAC may be issued based on a favorable 240 review of the FBI fingerprint check and a successfully scheduled Tier 1 investigation at the Office 241 of Personnel Management 242

(d) While visiting or performing work on installation(s)/location(s), Contractor personnel 244 shall wear or prominently display the CAC as required by the Governing local policy. 245

1.4.5.1.1 Sponsorship and enrollment information about each applicant must be registered in the 247 Defense Enrollment Eligibility Reporting System (DEERS) through either the Real-Time 248 Automated Personnel ID System (RAPIDS) using the DD Form 1172-2 or the Trusted Associate 249 Sponsorship System (TASS). Before CAC issuance, the Contractor employee requires, at a 250 minimum, a favorably adjudicated Tier 1 (T1) or higher investigation IAW DODI 5200.46. The 251 Contractor employee will be issued a CAC only if duties involve one of the following: (1) Both 252 physical access to a DOD facility and access, via logon, to DOD networks on-site or remotely; (2) 253 Remote access, via logon, to a DOD network using DOD-approved remote access procedures; or 254

(3) Physical access to multiple DOD facilities or multiple non-DOD federally controlled facilities 255 on behalf of the DOD on a recurring basis for a period of six-months or more. At the discretion of 256 the sponsoring activity, an initial/interim CAC may be issued based on a successfully scheduled 257 T1 with the Office of Personnel Management (OPM) and a favorable completion of a Federal 258 Bureau of Investigation (FBI) fingerprint check. 259

1.4.5.1.2 Homeland Security Presidential Directive (HSPD)-12 Background Investigation 261 Requirements: The Contractor shall ensure that all Contractors and Subcontractor personnel whose 262 duties require CAC card issuance obtain them and shall process all CAC card applications. The 263 Contractor shall ensure that all employees requiring an initial background investigation complete 264 a Personnel Security Investigation Portal (PSIP) form, at the earliest possible date and that this 265 form is forwarded to the COR immediately. The COR will review the form for completeness and 266 accuracy and forward it to the NGB Personnel Security manager who will initiate the investigation 267 process via the PSIP. Contractor personnel will then receive two e-mail messages; the first will 268 confirm that the investigative service provider has received the request, and the second will provide 269 instructions for the completion of the appropriate form via the Electronic Questionnaires for 270 Investigations Processing (e-QIP) system. Upon completion of the e-QIP questionnaire and 271 submittal of all required documents, including fingerprint cards to the security manager, the 272 background investigation (BI) will be initiated. The Contractor shall ensure immediate compliance 273 with all instructions regarding background investigation processing, including those provided 274 verbally, by e-mail or via a Government system. The Contractor is cautioned that the entire process 275 from submittal of the PSIP form to return of the FBI fingerprint check may routinely take from 276 two to six weeks and shall factor this lead-time into its hiring/placement process. The Contractor 277 shall make all reasonable efforts to ensure that Contractor employees meet CAC eligibility 278 standards upon assignment to the contract and shall be held responsible for delays, failure to meet 279 performance requirements or decreases in efficiency in accordance with the applicable inspection 280 clause. 281

1.4.5.1.3 Mission Partner Identity, Credential and Access Management (MP ICAM) (formerly 283 known as Trusted Associate Sponsorship System (TASS)): The Contractor shall process CAC 284 applications through the MP ICAM, the procedures for which are described below. Although there 285 is no requirement for the Contractor to designate a “Corporate Facility Security Officer" (FSO) to 286 serve as its single point of contact for the BI, the MP ICAM application process and other CAC 287 and security-related matters, such designation facilitates these processes. If a Corporate FSO is not 288 established, all Contractor employees requiring a CAC will be required to process their own 289 applications. The submission process for CAC applications is as follows: 290

1. The Contractor's FSO or Contractor employee shall submit requests for a CAC via email 292 to the designated Mission Partner Affiliation Sponsor (MPAS) (formerly known as the Trusted 293 Agent (TA) 294

2. The Government will establish a TASS application account for each CAC Request and 296 will provide each Contractor employee with a user ID and password, via email, to the Contractor’s 297 FSO or Contractor employee. The FSO or Contractor employee shall access the TASS account 298 and complete the CAC application (entering/editing Contractor information as applicable) at: 299 https://tass.dmdc.osd.mil/tass/. The Contractor’s FSO or contractor employee shall follow up to 300 ensure that the TA is processing the request. 301

3. The Government will inform the Contractor's applicant, via email, of one of the 303 following: 304

a. Approval. * Upon approval, the information is transferred to the DEERS 306 database, and an email notification is sent to the Contractor with instructions on obtaining their 307 CAC. The Contractor proceeds to a RAPIDS station (RAPIDS Site Locator: 308 https://idco.dmdc.osd.mil/idco/). 309

b. Rejection. * The Government, in separate correspondence, will provide 311 reason(s) for rejection. 312 https://tass.dmdc.osd.mil/tass/ https://idco.dmdc.osd.mil/idco/

c. Return. Additional information or correction to the application required by the 314 Contractor employee. 315

*The Contractor shall maintain records of all approved and rejected applications 317

1.4.5.1.4 At the RAPIDS station, the RAPIDS Verification Officer will verify the Contractor 319 employee by Social Security Number (SSN) and two forms of identification. Identity source 320 documents must come from the list of acceptable documents included in Form I-9, OMB No. 1615-321 0047, "Employment Eligibility Verification". Consistent with applicable law, at least one 322 document from the Form I-9 list shall be a valid (unexpired) State or Federal Government-issued 323 picture ID. The Identity documents will be inspected for authenticity and scanned and stored in 324 the DEERS upon issuance of an ID. The photo ID requirement cannot be waived, consistent with 325 applicable statutory requirements. The Verification Officer will capture primary and alternate 326 fingerprints, pictures, and updates to DEERS, and will then issue a CAC. Issued CACs will be 327 valid for no longer than three years, or until the individual's contract end date (inclusive of any 328 options), whichever is earlier. Contractors, and their personnel shall use the following procedures 329 to obtain CACs: 330

(a) The Contractor shall manage requests for new or renewal CAC cards in time to 332 ensure that all Contractor employees have them when needed to perform work under this contract. 333 The Contractor shall provide at least 10 calendar days advance notice to the TA, unless there are 334 extenuating circumstances approved by the COR or KO. 335

(b) Contractors shall provide a listing of personnel who require a CAC to the 336 contracting officer. The Government will provide the Contractor with instructions on how to 337 complete the Contractor Verification System (CVS) application and then notify the Contractor 338 when approved. 339

(c) The Contractor shall manage requests for new or renewal CAC cards in sufficient 340 time to ensure that all contractor employees have them when needed to perform work under this 341 contract. The Contractor shall provide at least 10 calendar days advance notice to the TA, unless 342 there are extenuating circumstances approved by the COR or KO. 343

(d) The Contractor shall return issued CACs to the DEERS office upon departure or 344 dismissal of each Contractor employee, and shall obtain a receipt for each card and provide it to 345 the TA/COR. 346

(e) Failure to comply with these requirements may result in withholding of final 347 payment. 348

1.4.5.1.5 Mission Partner Identity, Credential and Access Management (MP ICAM) Application 350 Account. The Government will establish an MP ICAM application account for each CAC request, 351 to the Contractor’s FSO or Contractor employee. The FSO or Contractor employee shall access 352 the MP ICAM account and complete the CAC application (entering/editing contractor information 353 as appliable) at: MP ICAM – Mission Partner Respiration Web Application – DMDC (osd.mil). 354 The Contractor’s FSO or Contractor employee shall follow up to ensure that the MPAS is 355 processing the request. 356

1.4.5.1.6 Contractor personnel shall obtain a CAC from the nearest Real Time Automated 358 Personnel Identification Documentation System (RAPIDS) Facility (typically the local Military 359

Personnel Flight (MPF). At the RAPIDS station, the RAPIDS Verification Officer will verify the 360 Contractor employee by Social Security Number (SSN) and two forms of identification. Identity 361 source documents must come from the list of acceptable documents included in Form I-9, Office 362 of Management and Budget (OMB) No. 1615-0047, "Employment Eligibility Verification." 363 Consistent with applicable law, at least one document from the Form I-9 list shall be a valid 364 (unexpired) State or Federal Government-issued picture ID. The Identity documents will be 365 inspected for authenticity and scanned and stored in the DEERS upon issuance of an ID. The photo 366 ID requirement cannot be waived, consistent with applicable statutory requirements. The 367 Verification Officer will capture primary and alternate fingerprints, pictures, and updates to 368 DEERS, and will then issue a CAC. Issued CACs will be valid for no longer than three years, or 369 until the individual's contract end date (inclusive of any options), whichever is earlier. 370

1.4.5.1.7 The Contractor shall manage requests for new or renewal CAC cards in sufficient time 372 to ensure that all Contractor employees have them when needed to perform work under this 373 contract. The Contractor shall provide at least 10 calendar days advance notice to the MPAS, 374 unless there are extenuating circumstances approved by the COR or KO. During the performance 375 period of the contract, the Contractor shall: 376

1. Within seven (7) working days of any changes to the listing of the contract personnel 378 authorized a CAC, provide an updated listing to the Contracting Officer who will provide the 379 updated listing to the authorizing Government official. 380

2. Return CACs in accordance with local policy/directives within seven (7) working days 382 of a change in status for Contractor personnel who no longer require logical or physical access. 383

3. Return CACs in accordance with local policy/directives within seven (7) working days 385 following a CACs expiration date; and 386

4. Report lost or stolen CACs in accordance with local policy/directives. 388

1.4.5.1.8 The Contractor shall return issued CACs to the COR or MPAS within seven (7) working 390 days upon departure or dismissal of each Contractor employee and shall obtain receipt for each 391 card and provide it to the COR or MPAS (Deliverable 5). 392

1.4.5.1.9 Within seven (7) working days following completion/termination of the contract, the 394 Contractor shall return all CACs issued to their personnel to the issuing office or the location 395 specified by local policy/directives. A receipt for each returned card shall be provided to the 396 TA/COR (Deliverable 5). 397

1.4.5.1.9.1 Failure to comply with these requirements may result in delay or withholding of final 399 payment. 400

1.4.5.1.10 The Contractor shall obtain an Army Knowledge Online (AKO) email address for each 402 applicant, including Subcontractors, who may be deployed or require logical access to a 403 Government computer network. Note: If employees of a Contractor lose the privilege to access 404

AKO, they lose the ability to renew their CAC. Therefore, it is critical that Contractor employees 405 maintain their AKO accounts. 406

1.4.5.1.11 For an Air Contractor that need access to the Army network this can be done by going 408 to: http://www.us.army.mil and registering as an "Army Guest," with the sponsor being the COR 409 or a COR- designated individual if the COR is ineligible to Serve as an AKO Sponsor. 410

1.4.5.2 For Contractors that do not require a CAC, but require access to a DOD facility or 412 installation: The Contractor and all associated Subcontractors employees shall comply with 413 adjudication standards and procedures using the National Crime Information Center Interstate 414 Identification (NCIC-III) and Terrorist Screening Database (TSDB) (Army Directive 2014-05), 415 and applicable installation, facility and area commander installation/facility access, and local 416 security policies and procedures (provided by a Government representative). 417

1.4.5.3 For Contractors that do not require CAC but require access to a DOD Facility and/or 419 Installation. Contractor and all associated Subcontractors’ employees shall comply with 420 adjudication standards and procedures using the National Crime Information Center Interstate 421 Identification Index (NCIC-III) and Terrorist Screening Database (TSDB) (Air Force Instruction 422 (AFI) 10-245, AFI 31-101 and Air Force Manual (AFMAN) 31-113), applicable installation, 423 facility and area commander installation/facility access and local security policies and procedures 424 (provided by Government representative) 425

1.4.5.4 Awareness Training (AT) Level 1: All Contractor employees, including Subcontractor 427 employees, requiring access to Army installations, facilities, and controlled access areas shall 428 complete AT Level 1 training within 30 calendar days after contract start date and within 30 429 calendar days of new employees commencing performance. The Contractor shall submit 430 certificates of completion for each affected Contractor and Subcontractor employee to the COR 431 within 15 calendar days after completion of training by each employee or subcontractor personnel. 432 AT Level 1 awareness training is available at: 433 https://home.army.mil/campbell/about/Garrison/DPTMS/training-division/civilian-employee-434 one-stop-shop/training/mandatory-online-training. 435

1.4.5.5 Antiterrorism Awareness Level I Training (AT Level I). All Contractor employees, to 437 include Subcontractor employees, requiring access to US Government installations, facilities and 438 controlled access areas shall complete AT Level I training within 15 calendar days after contract 439 start date or effective date of incorporation of this requirement into the contract, whichever is 440 applicable. AT Level I may be accomplished by a Level I qualified instructor, completing the 441 Force Protection computer-based training (CBT) course on the Advanced Distributed Learning 442 System (ADLS) or Joint Knowledge Online at http://jko.jten.mil. Tracking for each Contractor or 443 Subcontractor employee is the responsibility of the COR or unit AT Representative. The 444 Contractor shall submit certificates of completion for each affected Contractor and Subcontractor 445 employee to the COR within 15 calendar days after completion of training by each Contractor or 446 Subcontractor personnel. 447

1.4.5.6 iWATCH Training: The Contractor and all associated Subcontractors with an area of 449 performance within an Army-controlled installation, facilities, or area; shall brief all employees 450 http://www.us.army.mil/ https://home.army.mil/campbell/about/Garrison/DPTMS/training-division/civilian-employee-one-stop-shop/training/mandatory-online-training https://home.army.mil/campbell/about/Garrison/DPTMS/training-division/civilian-employee-one-stop-shop/training/mandatory-online-training http://jko.jten.mil/ on the local iWATCH program (training standards provided by the requiring activity Antiterrorism 451 Officer (ATO). This local developed training shall be used to inform employees of the types of 452 behavior to watch for and instruct employees to report suspicious activity to the COR or the KO. 453 This training shall be completed within 30 calendar days of contract award and within 30 calendar 454 days of new employees commencing performance. The Contractor shall report completion for 455 each Contractor employee and Subcontractor employee to the COR, within 15 calendar days after 456 completion of training. 457

1.4.5.7 Communications Security/Information Technology (COMSEC/IT) Security. All 459 communications with DOD organizations are subject to COMSEC review. All telephone 460 communications networks are continually subject to intercept by unfriendly intelligence 461 organizations. DOD has authorized the military departments to conduct COMSEC monitoring and 462 recording of telephone calls originating from, or terminating at, DOD organizations. Therefore, 463 the Contractor is advised that any time Contractor personnel place or receive a call they are subject 464 to COMSEC procedures. The Contractor shall ensure wide and frequent dissemination of the 465 above information to all employees dealing with DOD information. The Contractor shall abide by 466 all Government regulations concerning the authorized use of the Government's computer network, 467 including the restriction against using the network to recruit Government personnel or advertise 468 job openings. 469

1.4.5.8 Use of Government Information Systems (IS) and access to Government networks is a 471 revocable privilege, not a right. Users are the foundation of the DOD strategy, and their actions 472 affect the most vulnerable portion of the Army Enterprise Infostructure (AEI) or Air Force 473 Infostructure. Contractor employees shall have a favorable background investigation or hold a 474 security clearance and access approvals commensurate with the level of information processed or 475 available on the system. Contractor employees shall: 476

1.4.5.8.1 Comply with the command's Acceptable Use Policy (AUP) for Government owned IS 478 and sign an AUP prior to or upon account activation. 479

1.4.5.8.2 Mark and safeguard files, output products, and storage media per classification level 481 and disseminate them only to individuals authorized to receive them with a valid need to know. 482

1.4.5.8.3 Protect IS and IS peripherals located in their respective areas in accordance with 484 physical security and data protection requirements. 485

1.4.5.8.4 Practice safe network and Internet operating principles and take no actions that threaten 487 the integrity of the system or network. 488

1.4.5.8.5 Complete initial and/or annual Information Assurance (IA) training as defined in the IA 490 Best Business Practices (BBP) training https://atc.us.army.mil/iastar/docs/Training_BBP.pdf). 491

1.4.5.9 Army Training Certification Tracking System (ATCTS): All Contractor employees 493 with access to a Government information system shall be registered in ATCTS 494 (https://atc.us.army.mil/iastar/index.php) at commencement of services, and shall successfully 495 https://atc.us.army.mil/iastar/docs/Training_BBP.pdf https://atc.us.army.mil/iastar/index.php complete the DOD Information Assurance awareness training prior to access to the IS and then 496 annually thereafter (https://cs.signal.army.mil/login.asp). 497 Contract personnel who are members of the ERG must complete the following requirements: 498

• IS-100.b: Intro to Incident Command System (ICS) (3) 500

• IS-546.a: COOP Awareness Course (1) 501

• IS-547.a: Introduction to COOP (2) 502

• Visit the primary Alternate Site to become familiarized and credentialed 503

1.4.5.10 Advanced Distributed Learning Service (ADLS). All Contractor employees and 505 associated Subcontractor employees assigned to work on a Government site and/or requiring 506 access to a DOD network will be required to register with ADLS at commencement of services in 507 order to complete the necessary training required of them initially and annually for the duration of 508 the contract (i.e., DOD IAA Cyber Awareness, Protecting Sensitive Information, Force Protection, 509 etc.). ADLS website: https://golearn.csd.disa.mil/kc/rso/login/ADLS_login.asp. 510

1.4.5.11 Cyber Awareness Challenge and Authorized Use Policy (AUP) (formerly referred to 512 as Information Assurance (IA) Training). All Contractor employees and associated 513 Subcontractor employees shall complete the DOC Cyber Awareness Training and sign the AUP 514 (as defined in the IA Best Business Practices (BBP) training 515 (https://atc.us.army.mil/iastar/docs/Training_BBP.pdf) before issuance of network access and 516 annually thereafter. Training is available online at: 517 https://cs.signal.army.mil/UserMngmt/UserPortal.asp. 518

1.4.5.11.1 Complete initial and/or annual Information Assurance (IA) training as required by 520 applicable Air Force/ANG policy. Information Assurance (IA) Training. All Contractor employees 521 and associated Subcontractor employees shall complete the DOD Information Assurance 522 Awareness Cyber Awareness Challenge before issuance of network access and annually thereafter. 523 All Contractor employees performing services involving IA/IT functions shall comply with DOD 524 and Air Force training requirements in Department of Defense Directive (DODD) 8140.01, DOD 525 8570.01-M and AFMAN 17-1301 within 180 days of the start of contract performance. 526

1.4.5.12 Information Assurance (IA)/Information Technology (IT) certification. All 528 Contractor employees performing services involving IA/IT functions shall comply with DOD and 529 Army workforce training requirements in Department of Defense Directive (DODD) 8140.01, 530 DOD 8570.01-M and AR 25-2 within six months of the start of contract performance or 531 appointment to IA/IT functions. In accordance with DOD 8570.01-M, Defense Federal 532 Acquisition Regulation Supplement (DFARS) 252.239.7001, and Army Regulation (AR) 25-2, 533 Contractor employees supporting or performing IA/IT functions shall be appropriately certified 534 upon contract award. The baseline certification as stipulated in DOD 8570.01-M shall be 535 completed upon contract award. 536

1.4.5.13 Information Assurance (IA) / Information Technology (IT) Certification. In 538 accordance with DOD 8570.01-M, Defense Federal Acquisition Regulation (DFARS) 539 252.239.7001, and Air Force Policy Directive (AFPD) 17-1 Contractor employees performing 540 https://cs.signal.army.mil/login.asp https://golearn.csd.disa.mil/kc/rso/login/ADLS_login.asp https://atc.us.army.mil/iastar/docs/Training_BBP.pdf)%20f https://cs.signal.army.mil/UserMngmt/UserPortal.asp services supporting IA/IT functions shall be appropriately certified upon contract award. The 541 baseline certification as stipulated in DOD 8570.01-M shall be completed upon contract award. 542

1.4.5.14 Protection of Personally Identifiable Information (PII). The Contractor shall protect 544 all PII encountered in the performance of services in accordance with DFARS 224.103, Personally 545 Identifiable Information, and DODD 5400.11, Department of Defense Privacy Program, and DOD 546 5400.11-R. If a PII breach results from the Contractor’s violation of the aforementioned policies, 547 the Contractor shall bear all notification costs, call-center support costs, and credit monitoring 548 service costs for all individuals whose PII has been compromised. 549

1.4.5.15 OPSEC Training: In accordance with AR 530-1, Operations Security, new Contractor 551 employees shall complete Level I OPSEC training within 30 calendar days of their reporting for 552 duty and annually thereafter. The Contractor shall submit certificates of completion for each 553 Contractor employee to the COR within 15 calendar days after completion of training. Level 1 554 OPSEC training is available at https://securityawareness.usalearning.gov/opsec/index.htm . 555

1.4.5.16 Requirement for OPSEC Training. In accordance with AFI 10-701, Operations 557 Security, OPSEC PMs/Signature Managers/Coordinators will provide OPSEC training or training 558 materials to Contractor employees within 30 calendar days of employees’ initial assignment to the 559 contract and prior to having access to any critical information (CI) and annually thereafter. General 560 organizational orientations may need to be supplemented by duty-related orientations in the work 561 center targeted toward specific critical information and vulnerabilities associated with the work. 562 Initial training (OPSE 1301 - OPSEC Fundamentals) is located on the ADLS website and refresher 563 OPSEC training is conducted annually (at Commander's Call). The Contractor shall submit 564 certificates of completion for each Contractor employee to the COR within 15 calendar days after 565 completion of training. 566

1.4.5.17 OPSEC SOP/Plan. The Contractor shall develop an OPSEC Standard Operating 568 Procedure (SOP)/Plan and provide it to the COR within 90 calendar days of contract award to be 569 reviewed and approved by the responsible Government OPSEC officer, per AR 530-1, Operations 570 Security. This SOP/Plan shall include a process to identify the Government's critical information, 571 why it needs to be protected, where it is located, who is responsible for it, and how to protect it. 572 The Contractor shall implement OPSEC measures as required by the Government. In addition, the 573 Contractor shall identify an individual who will be an OPSEC Coordinator. The Contractor shall 574 ensure this individual becomes OPSEC Level II certified within 90 days of appointment as OPSEC 575 coordinator in accordance with AR 530-1. The Contractor shall provide a copy of the certification 576 to the COR NLT 15 days after completion. 577

1.4.5.18 OPSEC Plan. The Contractor shall develop an OPSEC Plan and provide it to the COR 579 or KO within 15 calendar days of contract award to be reviewed and approved by the responsible 580 Government OPSEC officer, per AFI 10-701, Operations Security. This Plan shall include the 581 Government's critical information, why it needs to be protected, where it is located, who is 582 responsible for it, and how to protect it. For the Contractor to effectively comply with OPSEC 583 provisions of the contract, the organization will provide the following guidance: (1) Organization’s 584 Critical Information; (2) Adversaries’ collection threat information as it applies to the 585 https://securityawareness.usalearning.gov/opsec/index.htm organization’s mission and the contract; (3) Operations Security guidance; and (4) Specific 586 OPSEC measures the organization requires (as appropriate). 587

1.4.5.19 Access to Classified Information. The Contractor shall comply with FAR52.204-2, 589 Security Requirements. This clause applies to contracts that involve access to information 590 classified “Confidential,” “Secret,” or “Top Secret,” and requires Contractors to comply with the 591 Security Agreement (DD Form 441), including the National Industrial Security Program Operating 592 Manual (DOD 5220.22-M) and applicable updates/changes. 593

1.4.5.20 Contracts that require Handling or Access to Classified Information. For contracts 595 that require handling or access to classified information, the Contractor shall comply with FAR 596 52.204-2, Security Requirements, including the National Industrial Security Program Operating 597 Manual (DOD 5220.22-M) and applicable updates/changes. This clause involves access to 598 information classified “Confidential,” “Secret,” or “Top Secret” and requires contractors to 599 comply with (1) The Security Agreement (DD Form 441), including the National Industrial 600 Security Program Operating Manual (DoD 5220.22-M) and (2) any revisions to DOD 5220.22-M, 601 notice of which has been furnished to the Contractor. Contractor personnel assigned to support 602 NGB-J33, NGB-J34, NGB-J35, NGB-J36 and NGB-J39 require Top Secret, SCI. The Contractor 603 assigned to support NGB-J3-DSS requires a Secret Clearance Completion of localized security 604 training (information protection related material) will be accomplished at the Wing/Unit level. 605 Derivative Classification and Marking Classified CBTs may also be required as per assigned duties 606 (i.e., SIPRNet). 607

1.4.5.21 Threat Awareness and Reporting Program (TARP). Per AR 381-12, Threat 609 Awareness and Reporting Program (TARP) or Counterintelligence Awareness and Reporting 610 (CIAR) course, Contractor employees with security clearances must receive annual TARP training 611 by a counterintelligence (CI) agent or other training platform as specified in Chapter 2 Threat 612 Awareness and Education, Section II, paragraph 2-4b. The Contractor shall identify annual TARP 613 training, personnel trained, and date of training within 15 days of training completion. 614

1.4.5.22 Controlled Unclassified Information (CUI). The Contractor is required to comply with 616 NIST 800-171. It will be verified that Contractors have adequate NIST SP 800-171 summary 617 assessment score within the Supplier Performance Risk System (SPRS) (within the Procurement 618 Integrated Enterprise Environment (PIEE) system). If the score doesn’t show a medium – or high-619 level assessment with a score of 110 or better (as described in the “NIST SP 800-171 DOD 620 Assessment Methodology”), clause 252.204-7020 may be applicable to the Contractor’s “system 621 security plan” and “plan of action” for NIST SP 800-171 verification and assurance by Army 622 security officials may be obtained. 623

1.4.5.23 Controlled Unclassified Training. In accordance with DODI 5200.48, all personnel 625 with access to CUI are required to complete the CUI training provided by the Combined Defense 626 Services Examination (CDSE) at https://securityawareness.usalearning.gov/cui/index.html. All 627 Contractor employees, including Subcontractor employees, shall complete CUI training within 628 30 calendar days after contract start date, and within 30 calendar days of new employees 629 commencing performance. The Contractor shall submit certificates of completion for each 630 affected Contractor and Subcontractor employee to the COR within 15 days after completion of 631 https://securityawareness.usalearning.gov/cui/index.html the training.