DRAFT PWS.docx

DRAFT: Performance Work Statement (PWS) Requirements

Enterprise Microfiche Digitization & Modernization Project

Date: May 15, 2026

Defense Finance and Accounting Service (DFAS) Ricky Sklenar/ZTEC/1-667-894-8284

UNCLASSIFIED

DEPARTMENT OF DEFENSE

Table of Contents

Enterprise Microfiche Digitization & Modernization Project

1.0 PROJECT OVERVIEW & OBJECTIVE

The Defense Finance and Accounting Service (DFAS) requires comprehensive, enterprise-scale digitization services to convert approximately 5.88 million physical microfiche sheets and films into a dual-format, legally admissible digital records repository.

To satisfy the stringent evidentiary requirements of the DoD Financial Management Regulation (FMR), support FIAR audit readiness, and ensure the digital records meet the legal threshold for source record destruction under NARA 36 CFR § 1236.32 and GRS 4.5, DFAS mandates the FADGI 3-Star standard for the preservation master images.

By meeting these standards, this effort will enable DFAS to achieve two primary objectives:

1. NARA-Authorized Destruction: Secure the legal authority to permanently destroy the physical source media, eliminating associated facility and maintenance costs.

2. Operational Modernization: Dramatically improve mission efficiency by generating fully text-searchable PDF Access Copies, providing the DFAS workforce with instantaneous, universal retrieval capabilities.

2.0 General Requirements

2.1 Personnel

The Contractor shall ensure all personnel performing work on this effort are U.S. citizens and that all services are sourced from within the United States. See Specific Requirements in Section 3.0 Security Requirements.

2.2 Recognized Holidays

With the exception of customer support calls, contractors are not expected to perform on any federally recognized holidays, to include but not limited to:

· New Year’s Day Labor Day

· Martin Luther King Jr.’s Birthday Columbus Day

· President’s Day Veteran’s Day

· Memorial Day Thanksgiving Day

· Juneteenth Christmas Day

· Independence Day If the holiday occurs on a Saturday the holiday will be observed on Friday. If the holiday occurs on Sunday the holiday will be observed on Monday.

2.3 Hours of Operation

The contractor shall conduct business between the hours of 0600 - 1800 hours Monday through Friday Eastern Time except federal holidays. Any labor to be performed outside of normal business hours or during federal holidays must be approved in advance by the DFAS System Manager (SM). Overtime rates are not authorized. When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the workforce are essential. The contractor shall, at all times, maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS.

2.4 Place of Performance

The primary place of performance will be by remote working or teleworking at the Contractor’s location.

2.5 Type of Contract

The contract will be a Firm, Fixed Price contract.

2.6 Travel

The Government does not anticipate any travel.

2.7 Relocation

Relocation costs and travel costs incident to relocation are not allowable and will not be reimbursed hereunder.

2.8 Shared Data

The DFAS SM will determine what CUI contractor personnel are given access to. CUI may not be disclosed to contractor personnel unless required for contract performance. Contractor personnel shall safeguard CUI in accordance with DoDI 5200.48 and DFAS 5200.1-I. The sponsoring DFAS activity will provide storage capability for all CUI required for contract performance.

2.9 Identification of Contractor Employees

All contractor personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious to third parties shall identify themselves as contractors to avoid creating an impression, they are Government officials. Contractor personnel shall ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed. The Common Access Card (CAC) used for building entrance, computer access, and other situations will identify the individual as a contractor.

3.0 Security Requirements.

3.1 General Requirements.

Contractor personnel must meet the following conditions of employment.

1. Must be a U.S Citizen or National.

2. Registered for Selective Service (males born after 12-31-1959). A Status Information Letter is required for any male born after 12-31-1959 that is not registered with Selective Service.

3. This is a national security position which requires a favorable fitness review and background investigation as a condition of employment. Failure to maintain security eligibility may result in termination.

3.2 Personnel Security Investigation (PSI) Requirements.

Contractor personnel working on this contract will require a favorably adjudicated Tier 3, or equivalent Noncritical-Sensitive (formerly IT-II) or higher-level Investigation granting National Security eligibility. Contractor personnel must also have current enrollment (within 5 years) in the Continuous Vetting program, in accordance with Trusted Workforce 2.0 standards. No access to classified information is required. In accordance with standard DFAS Personnel Security policy, ALL incoming contractors must submit a new set of fingerprints (taken within the last 30 days) *.

Contractor personnel must apply for a fingerprint appointment immediately (the next business day) upon award date.

Contractor personnel shall submit the Contractor Request for Investigation (CRI) (DFAS Form 9035) immediately (the next business day after providing fingerprints) to the Contracting Officer Representative (COR). The information needed in the Declaration for Federal Employment (OF-306) shall also be submitted to the COR by contractor personnel.

The COR will submit the OF-306, DFAS Form 9035, and proof of fingerprints to DFAS Personnel Security all at once. Under no circumstances should this documentation be submitted less than fifteen (15) calendar days prior to the intended performance start date. DFAS Personnel Security will review all submitted documentation to validate whether contractor personnel meet personnel security requirements to perform work on the contract or if a new background investigation is required.

Contractors obtaining favorable security evaluations and DoD CACs for required contractor employees performing on this contract are a prerequisite for contractor performance and invoicing. Also, the failure of a contractor to provide employees who can obtain a favorable security adjudication and a DoD CAC in a timely manner may be considered negatively when assessing contractor performance, termination, or other.

*New fingerprints are not required if any of the following apply:

1. The person has been fingerprinted for the Defense Counterintelligence and Security Agency (DCSA) within the past 30 days.

2. The person is currently undergoing a background investigation, or reinvestigation, by DCSA or any other Federal agency.

3. The person has a background investigation currently being adjudicated by the DCSA Adjudication and Vetting Services (DCSA AVS) or another AVS.

4. The person has been favorably adjudicated within the past 30 days by the DCSA AVS or a AVS from any other Federal agency: or

5. The person comes directly from another DoD agency, with no break in service. This includes any of the military branches as well as the U.S. Coast Guard; however, service members in an inactive reserve status are not included.

6. The DFAS Personnel Security Office otherwise determines that no new fingerprints are required.

3.3 Regulatory Requirements.

Contractor personnel shall follow the security and training requirements in DoDM 5220.23, “Industrial Security Procedures For Government Activities,” DoDM 5200.01, Volumes 1-3, “DoD Information Security Program,” DoDI, 5200.48, “Controlled Unclassified Information,” DFAS 2000.1-I, “Force Protection Mission,” DFAS 5200.1-I, “Information Security Program,” DFAS 5200.8-I, “Physical Security Program,” and DFAS 5200.10-I, “Counter Insider Threat Program.” Contractor personnel shall follow all host security requirements in accordance with Part 117 of Title 32, Code of Federal Regulations; paragraph 117.16. Ensure that all contracting officers include applicable clauses in all contracts that require work to be performed for a DFAS location. The contractor shall immediately report any occurrences of violation of stated regulations to the DFAS Manager of the area to which they are assigned, Contracting Officer (CO), COR, Director, Force Protection, and the DFAS Personnel Security Office.

DoD Issuances can be located at the following web link:

https://www.esd.whs.mil/dd/dod-issuances/ DFAS Instructions can be located at the following agency portal web link:

Official Forms and Pubs - All Documents

3.4 DFAS Personnel Security Incident Reporting Requirements, the National Industrial Security Program and Due Process as it Relates to DFAS Contractor Personnel.

The National Industrial Security Program (NISP) is a partnership between the federal government and private industry to safeguard classified information and CUI.

Executive Order 12829, as amended, "National Industrial Security Program," further amended by Section 6 of E.O. 13691, was established to achieve cost savings and to ensure that industry safeguards the classified information with which it is entrusted while performing work on contracts, programs, bids, or research and development efforts while working for the United States Government.

It is important to note that personnel employed as contractors for DFAS are not covered under the National Industrial Security Program (NISP) and are exempt from the provisions of 5 C.F.R. 731. This means that DFAS contractor personnel involved in an incident that potentially violates one or more of the National Security Adjudicative Guidelines found at https://www.dni.gov/files/NCSC/documents/Regulations/SEAD-4-Adjudicative-Guidelines-U.pdf , are not entitled to Due Process rights normally afforded to federal civilian employees and those personnel covered under NISP; more specifically, DFAS Personnel Security may suspend or revoke contractor personnel access to DFAS IT systems, sensitive information and/or DFAS facilities.

3.5 Incident Reporting Requirements.

In all cases, whenever a DFAS contractor displays conduct, or is involved in any incident, which is in violation of any of the thirteen National Security Adjudicative Guidelines*, the contractor must immediately report the incident to the contractor company Security Office/Facility Security Officer, the DFAS Manager of the area to which they are assigned, the CO, the COR, the Director, Force Protection, and the DFAS Personnel Security Office. Reporting to DFAS Personnel Security may be made by phone to (317) 212-7888, by email to dfas.indianapolis-in.zh.mbx.dfas-inhrsecurity@mail.mil, or, in the case of personnel physically located at DFAS Indianapolis Center, in person to the DFAS Personnel Security Office located on the third floor center hallway at Column 320T.

All incidents will be investigated by DFAS Personnel Security and, depending on the date of the subject’s most recent investigation, may need to have an updated background investigation initiated. Those that do not require a new investigation will have all relevant information regarding the incident forwarded to the DCSA AVS for review and re-adjudication.

*The thirteen National Security Adjudicative Guidelines are:

Some Examples of Incidents That Require Reporting to DFAS Personnel Security:

a) An arrest for any criminal offense, not including minor traffic violations, by any law enforcement agency. This DOES include the traffic offenses of Driving Under the Influence of Alcohol or Drugs, and Reckless Driving.

b) Violation of any court order.

c) Civil judgements.

d) Delinquencies on any debt for 180 days or longer.

e) Federal, State or Local tax issues or delinquencies.

f) Delinquencies on any Federal debt (including Federal Student Loans and Federally backed home mortgage loans).

g) Child Support delinquencies.

h) Filing for Chapter 7 or Chapter 13 bankruptcy in any Federal Bankruptcy Court.

i) Foreign Travel.

j) Marriage or Cohabitation with a Foreign National (person from a foreign country).

k) Having a close personal friendship with a Foreign National with regularly occurring contact.

l) Ownership of property or financial accounts in a foreign country; and

m) Being approached by a person know to be, or suspected to be, working as an agent of a foreign government or terrorist organization, or any other person, who seeks any information about DFAS, the Department of Defense, or the U.S. Government, especially if the person offers money or something of value to the contractor employee.

It should be noted that a person’s delinquency on Federal debt of any kind may not obtain or maintain favorable personnel security adjudication or be considered for a contractor position with DFAS unless they can provide documentary proof that a payment plan has been established with the Government agency to whom the debt is owed, and that regularly recurring payments are being made. Contractor personnel who cannot obtain and maintain a favorable personnel security adjudication may not have access to government data, facilities, and/or equipment required under the contract.

NOTE: This list does not cover every potential incident or offense; any incident in which a contractor is involved, and a question exists as to whether it should be reported, should report the incident to DFAS Personnel Security, who will then determine if further action is warranted. Failure to report an incident is, in and of itself, an incident involving personal conduct, and may, in some cases, be more serious than the original incident.

3.6 Foreign Travel by DFAS Contractor Personnel

Official and Unofficial (Personal) Travel: Official U.S. Government Business: persons employed as contractor employees with DFAS, to include those with Noncritical Sensitive (formerly IT-II) access, Critical Sensitive (formerly IT-I) access, access to critical program information (related to Research, Development, Test, and Evaluation), sensitive compartmented information, and/or special access program information, in accordance with DoD Directive 5240.06, are required to complete a DFAS Form 9133, Notification of Foreign Travel, not less than 30 calendar days prior to the scheduled travel.

One copy shall be sent the DFAS Personnel Security group box at dfas.indianapolis-in.zh.mbx.dfas-inhrsecurity@mail.mil and one copy shall be turned into the Site Force Protection Office of the DFAS site where they are stationed. Site Force Protection POC information:

https://dfasportal.dfas.mil/ddss/force_protection/Pages/SiteSpecificForceProtectionSecurityServices.aspx Upon receipt of the completed Form 9133, the Site Force Protection Office will contact the contractor employee to validate training, complete the country/theater clearance package, as required, and schedule a Foreign Travel briefing. Immediately prior to travel, contractor employees will check with the State Department at https://travel.state.gov/en/international-travel/travel-advisories.html/ for any travel advisories for the country or region being traveled to and take the appropriate steps to ensure their safety for any location covered by a travel advisory or warning.

3.7 Security Education and Training.

Contractor personnel shall receive initial, continuous and refresher security education training in accordance with DoDM 5200.01, Volume 3, “DoD Information Security Program – Protection of Classified Information,” DoDI 5200.48, DFAS 2000.1-I, DFAS 5200.1-I, DFAS 5200.8-I, and DFAS 5200.10-I. Contractor personnel shall also complete all required contractor training requirements identified in this SOW/PWS.

3.8 Access To, Accountability For, and Safeguarding of Controlled Unclassified Information (CUI).

The DFAS manager of the requiring office will determine what CUI contractor personnel are given access to. CUI may not be disclosed to contractor personnel unless required for contract performance. Contractor personnel shall safeguard CUI in accordance with DoDI 5200.48 and DFAS 5200.1-I. The sponsoring DFAS activity will provide storage capability for all CUI required for contract performance. Contractor personnel must monitor CUI for aggregation and compilation based on the potential to generate classified information. Contractor personnel must report the potential classification of aggregated or compiled CUI to the DFAS Manager of the area to which they are assigned, the CO, the COR, and the Director, Force Protection.

3.9 Installation Entry and Common Access Card (CAC) Requirements.

The Contractor shall comply with established security procedures for entering government installations and facilities. Contractor employees shall be required to obtain and wear identification (ID) badges that will permit access into the facility.

Contractors shall work with the assigned DFAS COR/Mission Partner Account Sponsor (MPAS) to obtain a CAC using Mission Partner Identity Credential Account Management (MP ICAM). Under no circumstances will a CAC be issued to any person unless that person has been cleared by the DFAS Personnel Security Office to work on the contract.

All CACs and badges issued to Contractor personnel are government property and must be returned to the assigned DFAS COR/MPAS upon departure from the program or at the conclusion of the contract, whichever comes first. CACs can also be mailed in or turned into RAPIDS locations. Contractors whose CAC is lost or stolen must report the loss as soon as possible to the assigned DFAS COR/MPAS and present documentation that the CAC is missing and describe the circumstances under which the loss occurred. The assigned DFAS COR/MPAS will follow agency CAC procedures to issue a new CAC.

Contractors must not share their CACs and passwords with any other staff members. The assigned DFAS COR/MPAS will report any violation or suspected violation to the Contracting Officer and DFAS MP ICAM Account Security Manager (MPASM). Any violators will be temporarily or permanently removed from the project. If a Contractor has a CAC issued from another agency, that CAC must be revoked and returned before issuance of a new CAC.

3.10 Training.

DoD Mandatory Contractor Personnel Training Requirements: The contractor shall direct that its employees performing under this contract complete the annual mandatory training in accordance with the DoD mandate identified for each training module.

Contractor personnel working at a DFAS site who require a CAC, or contractor personnel working remote via VPN, need to complete the following training modules within 30 days after receipt of CAC, (note for Cyber Awareness Challenge Module 003, completion of this module is required prior to requesting a new DFAS network or VPN account), as a precondition for continued attendance and/or network access.

In addition, these modules shall be completed annually to retain accessibility. Noncompliance will negatively impact contract performance and lead to the loss of CAC and/or network access for contractor personnel.

Continuity of Operations and Crisis Management Organization. Contractor personnel will take the training through the DFAS Portal upon receipt of Network access.

Cyber Awareness Challenge. Completion of this module is required prior to requesting a new DFAS network or VPN account. For contractor personnel unable to access the DFAS Portal, the same training is available at:

Cyber Awareness Challenge Upon completion of the training Contractor personnel shall maintain a copy of the training certificate in PDF, submit a copy to the COR, attached to the request for network access as proof of completion.

Keeping DFAS Safe: Physical Security, Information Security, Personnel Security, CBRNE, Counterintelligence and Operations Security. Contractor personnel shall take the training through the DFAS Portal upon receipt of Network access.

Level I Antiterrorism Awareness Training. All contractor personnel shall take this training. For contractor personnel who will not require or receive access to the DFAS Portal, this training is available at:

Level I Antiterrorism Awareness Training All other contractor personnel shall take the training through the DFAS Portal upon receipt of network access.

Privacy Act (PA) and Personally Identifiable Information (PII). Contractor personnel shall take the training through the DFAS Portal upon receipt of Network access.

Records Management. Contractor personnel shall take the training through the DFAS Portal upon receipt of Network access.

Insider Threat (InT) Awareness Training. Contractor personnel shall take the training through the DFAS Portal upon receipt of Network access.

DoD Mandatory Controlled Unclassified Information (CUI) Training. All contractor personnel shall take this CUI training. For contractor personnel who will not require or receive access to the DFAS Portal, this training is available at:

DoD Mandatory Controlled Unclassified Information (CUI) Training

All other contractor personnel will take the training through the DFAS Portal upon receipt of network access.

Unauthorized Disclosure of Classified Information and CUI. All contractor personnel shall take this training. For contractor personnel who will not require or receive access to the DFAS Portal, this training is available at:

Unauthorized Disclosure of Classified Information and Controlled Unclassified Information

All other contractor personnel will take the training through the DFAS Portal upon receipt of network access.

NOTE: This list of training requirements is subject to change.

Training Time. The average estimated time for completion of each training module is approximately one hour or less. The Keeping DFAS Safe: Physical Security, Information Security, and Personnel Security training module will take approximately 90 minutes to complete.

Training Methods:

Network Training. Network training through the DFAS Portal is the required method for those Contractor personnel who have an existing DFAS network account.

Web-based Training. All contractor personnel are required to take the following web-based training: Cyber Awareness Challenge (When system/network access is required), Level I Antiterrorism Awareness Training, DoD Mandatory Controlled Unclassified Information Training, and Unauthorized Disclosure of Classified Information and CUI. If an individual does not have network access through the DFAS Portal, they can complete the training through a DoD authorized Web source. All other contractor personnel shall take the training through the DFAS Portal upon receipt of DFAS network access. The contractor personnel shall retain a PDF copy of the “Certificate of Completion” or a “screen shot” with the date of the completion of the training. The COR will maintain a file for proof of completion.

Contractor personnel who do not require network access but require unescorted access into a DFAS facility shall receive applicable security training through the site Force Protection Office. To identify Site Force Protection Officers at each DFAS location consult the Agency Force Protection Portal Page: https://dfasportal.dfas.mil/ddss/force_protection/Pages/SiteSpecificForceProtectionSecurityServices.aspx The prime contractor official representative shall provide the COR with a group list of its personnel requiring completion of the training. The COR will submit the ‘group list’ to the Site Force Protection Officer to schedule training. As a reminder, the prime contractor official representative shall submit this group list of names within 30 days after contract award. Requests for individual training shall be justified in writing and submitted to the COR for evaluation. Special arrangements will be determined by the Site Force Protection Officer, other training Module POCs and the COR.

Interaction with Contractor Personnel. The COR shall forward questions or concerns directly to the prime contractor official representative who is directly responsible for managing its own employees/subcontractor personnel.

The prime contractor official representative shall coordinate with the COR a training schedule without causing undue delays to contract performance.

The prime contractor official representative (including subcontractor’s personnel when applicable) shall provide the COR, within 30 days after contract award/exercise of an option, a written report identifying:

Contractor personnel shall direct their training questions or concerns to their contractor management chain and/or company representative.

Monthly Training Status Reports. The prime contractor official representative shall submit a monthly status update to the COR, identifying the initial and annual training status of all contractor personnel.

Training Point of Contact (POC). The COR is the POC for the Contractor. The Contractor shall provide regular training updates to the COR and keep an updated registry to assure employees who come on board at any time in the contract life have completed all required training.

4.0 SCOPE OF WORK (THE COLLECTION)

The Contractor shall provide all labor, specialized equipment, secure logistics, and project management necessary to digitize the following dispersed physical collections:

4.1 Indianapolis Facility (Army & Army Reserve)

· Media Type: 105mm Microfiche Sheets

· Date Range: Approx. 1972 – 1993

· Estimated Volume: 3,400,000 sheets (Approx. 901,000,000 individual frames/records)

4.2 Cleveland Facility (Military Retired and Annuitant Pay - All Branches)

· Media Type: Computer Output Microfilm (COM) – Mix of Microfiche Films and Reels

· Date Range: 1970s and beyond

· Estimated Volume: 2,229,990 microfiche sheets (stored across 41 cabinets) and 4,700 Microfiche Reels. (Approx. 590,947,350 individual frames/records).

4.3 Texarkana Facility (Non-Appropriated Funds - NAF)

· Media Type: 105mm Microfiche Sheets

· Date Range: 1980s

· Estimated Volume: 288,000 sheets (stored in 24 boxes). (Approx. 76,320,000 individual frames/records).

Total Estimated Project Volume: ~5.91 Million Sheets/Films; ~1.56 Billion individual frames.

5.0 TECHNICAL DIGITIZATION STANDARDS (FADGI 3-STAR)

Due to the degraded nature of the historical microfiche and the high liability of the financial and PII data they contain, FADGI 3-Star is the minimum acceptable technical baseline. It is the only federally recognized, mathematically verifiable method to guarantee the digital replicas possess the unadulterated fidelity required to serve as legally admissible replacements for the destroyed physical media.

Therefore, the Contractor shall execute all scanning and image processing in strict accordance with the FADGI 3-Star performance level for modern textual records.

5.1 Image Capture & Format Requirements

For every physical frame/image on the microfiche, the Contractor must deliver two distinct digital files:

· The Preservation Master: A high-resolution, uncompressed TIFF (Tagged Image File Format) that accurately represents the original physical record, including all flaws, without heavy digital manipulation or "clean-up" (e.g., no aggressive contrast enhancement or artifact removal that alters the original data).

· The Access Copy: A compressed, highly legible PDF/A (Portable Document Format for Archiving) derived directly from the Preservation Master, optimized for network transmission and daily operational use.

5.2 Equipment Calibration & Verification

· The Contractor must utilize scanners capable of meeting FADGI 3-Star spatial resolution, tone, and noise metrics.

· The Contractor must perform and document daily equipment calibration using FADGI-approved targets (e.g., DICE targets) to prove ongoing compliance.

5.3 File Sizing & Storage Forecasting

To enable the Government to accurately provision and budget for cloud storage capacity (e.g., AWS S3 and Glacier Deep Archive), the Contractor must provide average file size metrics for the digitized records.

· Proposal Estimate: In their technical proposal, the Contractor shall provide an estimated average file size per individual microfiche frame for both the Preservation Master (uncompressed TIFF) and the Access Copy (compressed PDF/A), based on the mandated FADGI 3-Star parameters.

· Validated Baseline: The exact average file sizes shall be formally baselined and validated during the post-award Pilot Project (see Section 7.0).

6.0 METADATA & INDEXING (BASIC OCR)

The Contractor is not required to perform advanced, structured data extraction from within individual document frames. However, the Contractor must provide the following:

6.1 Header Indexing

The Contractor shall extract the human-readable text from the title header of each physical microfiche sheet/film (e.g., Record System, Date Range, Roll/Fiche Number) and associate this metadata with the corresponding digital batch.

The Contractor shall extract the human-readable text from the title header of each physical microfiche sheet/film and deliver this as structured metadata. As part of the Pilot Project (Section 7.0), the Contractor shall deliver a formal Ingestion Manifest Schema document. This document will define the exact structure, data types, and field names for the chosen manifest format (e.g., CSV, JSON). This schema must be approved by the Government to ensure it provides all necessary metadata for automated ingestion into the Government's Document Management System (DMS).

6.2 Full-Text OCR

The Contractor shall perform Optical Character Recognition (OCR) on all Access Copies (PDFs) to render the documents fully text-searchable.

7.0 QUALITY CONTROL (QC) & VALIDATION FOR DESTRUCTION

This process is the critical legal trigger that allows DFAS to authorize the destruction of the physical media under NARA 36 CFR 1236.

7.1 Contractor Quality Control (QC)

· The Contractor shall implement a rigorous, documented internal QC plan to ensure image fidelity, metadata accuracy, and 100% frame capture (no missed images).

· The Contractor shall deliver digital records in logical "Batches." Each Batch must be accompanied by a formal QC Certification Report delivered in a machine-readable format (e.g., JSON or XML). This report must include, at a minimum: a unique Batch ID, a list of all microfiche identifiers included in the batch, total frame count, the QC sample size used, a summary of findings against the AQL, and a cryptographic hash (e.g., SHA-256) for each digital file to ensure data integrity upon transfer.

7.2 Government Quality Assurance (QA) & Validation

· Upon receipt of a digital Batch and Contractor QC Report, the Government (DFAS) will perform a QA validation review based on statistically valid random sampling.

· The sample size and acceptance/rejection criteria shall be determined using ANSI/ASQ Z1.4 (General Inspection Level II) based on the size of the delivered batch.

· The Government requires a strict Acceptable Quality Level (AQL) of [e.g., 1.0%] for critical errors (e.g., illegibility, missing frames) and [e.g., 2.5%] for minor errors (e.g., metadata inaccuracies).

· The Government will verify legibility, completeness, and metadata accuracy of the statistical sample against the original physical media. Failure to meet the AQL will result in the rejection of the entire batch for Contractor rework at no additional cost to the Government.

7.3 Authorization for Destruction

· Upon the Government's successful validation of the sample and formal acceptance of the digital Batch, the Government will issue a written Certificate of Destruction Authorization.

· Only upon receipt of this authorization may the Contractor securely shred, incinerate, or otherwise permanently destroy that specific batch of physical microfiche in accordance with DoD and NARA secure destruction protocols.

8.0 SECURE LOGISTICS & CHAIN OF CUSTODY

Given the presence of sensitive Personally Identifiable Information (PII) and financial data:

· The Contractor must provide secure, climate-controlled transportation of the physical media from the three DFAS sites to the Contractor's scanning facility.

· The Contractor must maintain a strict, auditable, item-level Chain of Custody log from the moment the records leave the DFAS facility until their authorized, verified destruction.

9.0 PILOT PROJECT & TECHNICAL VALIDATION

Prior to commencing full-scale production scanning, the Contractor shall execute a Pilot Project to validate workflows, FADGI 3-Star compliance, and data delivery formats.

9.1 Pilot Scope

Within [e.g., 30] days of contract award, the Contractor shall securely transport and digitize a representative sample of [e.g., 1,000] microfiche sheets from each of the three identified collections (Army, Retiree/Annuitant, and NAF).

9.2 Pilot Deliverables

The Contractor shall deliver the resulting digital batches to the Government along with a Technical Baseline Report. This report must formally establish:

· Proof of FADGI 3-Star compliance (via DICE target reports for the sample).

· The verified, exact average file size (in Megabytes) for a standard Preservation Master (TIFF) and Access Copy (PDF/A) produced from DFAS physical media.

· The total estimated data volume (in Terabytes/Petabytes) for the full 5.88 million-sheet collection based on the pilot averages.

9.3 Full Production Authorization

Full-scale production scanning shall not commence until the Government has formally reviewed and accepted the Pilot deliverables and Technical Baseline Report.

image1.png