DRAFT PWS FY25 Micro Hardness Tester PM 03Dec2024.pdf

PERFORMANCE WORK STATEMENT (PWS)

FOR

Rockwell Hardness and Micro Hardness Tester PM

PART 1

GENERAL INFORMATION

1.0 General: This is a non-personal services contract to provide Preventive Maintenance (PM) of the Rockwell Hardness and Micro Hardness Testers. The Government will not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn is responsible to the Government.

1.1 Scope: The Contractor shall provide all personnel, equipment, supplies, transportation, tools, materials, supervision, quality control, and other items and non-personal services necessary to perform Rockwell Hardness and Micro Hardness Tester PMs and repair as defined in this PWS, except for those items specified as government furnished. The Contractor shall perform to the standards of this contract.

1.2 Background: The Rockwell Hardness and Micro Hardness Tester are used by the Material and Process Engineering lab to analyze material components prior to final assembly.

1.2.1 A Rockwell Hardness Testers only measures the surface hardness of a component. This type of hardness tester is used extensively by the laboratory, throughout our local manufacturing shops and in the Heat Treatment Area.

1.2.2 Given various processes such as gaseous carburizing, nitriding, cyaniding, flame hardening and quenching; A Micro-Hardness Tester is used to measure hardness and its’ change of gradient as it moves from an exposed surface, into and through the thickness of a component’s section. Post process, sacrificial parts, and/or witness coupons, mixed with production parts are sectioned, mounted, ground & polished, then micro-hardness tested using Knoop, or Vickers diamond indenters to determine hardness gradients and rates of progression. This Type of hardness tester is used extensively by the Laboratory.

1.3 Description of Services: See paragraph 5.

1.4 Period of Performance (POP): The POP shall be one Base year of twelve (12) months plus two (2) twelve (12) month option years to be funded and exercised at the government’s discretion. One PM visit annually and repair visit(s) as needed.

1.5 General Information:

1.5.1 Quality Control (QC): The Contractor shall develop and maintain an effective QC Program (QCP) to ensure services are performed in accordance with this PWS. The Contractor shall develop and implement procedures to identify, prevent and ensure non-recurrence of defective services. The Contractor’s QCP is the means by which it assures itself that its work complies with the requirements of the contract. As a minimum, the Contractor shall develop QC procedures that address the areas identified in the Performance Requirements Summary.

1.5.2 Quality Assurance (QA): The Government will evaluate the Contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan is primarily focused on what the Government must do to ensure that the Contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

1.5.3 Recognized Holidays: The following are recognized US holidays. The Contractor shall not perform services on these days:

New Year’s Day Labor Day Martin Luther King Jr.’s Birthday Columbus Day President’s Day Veteran’s Day Memorial Day Thanksgiving Day Independence Day Christmas Day Juneteenth

1.5.4 Hours of Operation: The Contractor shall provide services between the hours of 6:00 AM – 3:30 PM Monday thru Friday, except US Holidays or when the Government facility/installation is closed due to local or national emergencies, administrative closings, or similar Government-directed facility/installation closings. For other than firm fixed price contracts, the Contractor shall not be reimbursed when the Government facility is closed for the above reasons. The Contractor shall maintain at all times an adequate work force for the uninterrupted performance of all tasks defined within this PWS (SOW) when the Government facility/installation is not closed.

CCAD may schedule a “compressed work schedule” during various times of the year.

The Contracting Officer may authorize a “compressed work schedule” for Contractor operations during the planned CCAD “compressed work schedule.” The Contracting Officer will inform the Contractor of any planned CCAD “compressed work schedule” at least 7 calendar days prior to the change via email or memo.

1.5.5 Place of Performance: Performance for work under this contract shall be at

CCAD.

1.5.6 N/A

1.5.7 Conservation of Utilities: The Contractor shall instruct employees in utilities conservation practices. The Contractor shall operate under conditions that preclude the waste of utilities which include turning off the water faucets or valves after using the required amount.

1.6 Security Requirements: The following information is provided on security related matters.

1.6.1 N/A

1.6.2 Reserved

1.6.3 Installation Access: Access to U.S. installations, buildings and controlled areas is limited to personnel who meet security criteria and are authorized. Failure to submit required information/data and obtain required documentation or background investigations will be grounds for denying access to U.S. installations, buildings and controlled areas. The Contractor shall ensure that any subcontractors used in performance of this contract complies with these requirements and that all employees, of both the Contractor and any subcontractor utilized by the Contractor, are made aware of and comply with these requirements.

1.6.3.1 The Contractor shall be aware of and comply with the requirements associated with Installation Access Control. The Government is not liable for any costs associated with performance delays due solely to a firm’s failure to comply with Installation Access Control processing requirements.

1.6.3.2 The Contractor shall return installation and CCAD passes to the issuing Security office when the contract is completed or when a Contractor employee no longer requires access.

1.6.3.3 The contractor shall obtain a Base Access Pass through Navy Pass & Tag not to exceed contract expiration. The government Contracting Officer Representative (COR) will coordinate badging and briefing with Navy and CCAD Security. CCAD personnel will escort contractor at all times while onboard CCAD unless approved in advanced by CCAD Security. Contractors are not authorized to escort anyone on the installation or

CCAD.

1.6.3.1 Installation Pass Log: The Contractor shall provide the Contracting Officer, via the COR, an Initial Installation Pass Log within 3 calendar days after contract award Deliverable 7.2 Attachment 2. The log must at a minimum contain the following information Full Legal Name, type of access (e.g. DBIDS, base pass) and working hours. The log shall be updated as employees are added or removed. The Updated Installation Pass Log shall be current and available at any time upon request by the Government and submitted to the COR within 3 days after any changes to the log.

Deliverable 7.2 Attachment 2.

1.6.3.2 Individual Termination or Expiration of Employment: The Contractor shall collect the installation access passes the same day employment of an individual has expired or has been terminated and shall return them to the issuing office within 3 working days.

Deliverable 7.2 Attachment 2.

1.6.3.3 Contract Termination or Cancellation: Upon termination or cancellation of this contract, the Contractor shall collect all outstanding installation access passes and return them to the issuing office within 3 working days Deliverable 7.2 Attachment 2.

1.6.4.1 Reserved

1.6.4.2 Reserved

1.6.5: Physical Security: The Contractor shall safeguard all Government equipment, information, and property provided for Contractor use. At the close of each work period, Government facilities, equipment, and materials shall be secured IAW the Army Physical Security Program (AR 190-13).

1.6.6 Operations Security (OPSEC) Requirements: Contractor personnel shall adhere to facility security policies and restrictions. The Contractor shall immediately report suspicious activities to security personnel. Government issued access badges shall not be worn outside designated facilities where visible to the general public.

1.6.7 Safeguarding Covered Defense Information: Contractors and subcontractors are required to safeguard covered defense information that resides in or transits through covered contractor information systems by applying specified network security requirements and reporting of cyber incidents in accordance with 48 CFR 204.73.

1.6.8 Identification of Contractor Employees: All Contractor personnel attending meetings, answering Government telephones, and working in other situations where their Contractor status is not obvious to third parties must identify themselves, to include proper marking of signature blocks in correspondence, to avoid creating an impression in the minds of members of the public that they are Government officials. The Contractor shall ensure that all documents or reports, produced by Contractors are suitably marked as Contractor products or that Contractor participation is appropriately disclosed.

1.6.9 Contractor workspace: DELIVERABLE (PWS para 5.0 All) staging site, on-site office, desk or work area, etc.) shall contain a sign signifying the space is occupied by Contractor employee(s) to ensure that Government employees and the public know that they are not Government employees. The proposed sign shall be submitted to the Contracting Officer via the COR for review and acceptance 10 calendar day after contract award. Workspace sign location shall be coordinated with the COR. Contractor employees shall identify themselves by name and company affiliation when answering the telephone, presenting briefings, conducting or attending meetings, and seminars. All Contractor correspondence (written, facsimile, and email display) shall include their company name. Requirements for Contractor vehicles is addressed under Contractor Furnished Items and Services.

1.6.10 Data Rights: The Government has unlimited rights to all documents and materials produced under this contract. All documents and materials, to include the source codes of software, produced under this contract shall be Government owned and are the property of the Government with all rights and privileges of ownership and copyright belonging exclusively to the Government. These documents and materials may not be used or sold by the Contractor without written permission from the Contracting Officer. All materials supplied to the Government shall be the sole property of the Government and may not be used for any other purpose. This right does not abrogate any other Government rights.

1.6.11 Non-Disclosure Requirements: Performance under this contract may require the Contractor to access data and information proprietary to a Government agency, another Government Contractor, or of such nature that its dissemination or use other than as specified in this work statement would be adverse to the interests of the Government or others. The Contractor and Contractor personnel, shall not divulge or release data or information developed, or obtained under performance of this PWS, except to authorized Government personnel or upon written approval of the Contracting Officer.

The Contractor shall not use, disclose, or reproduce proprietary data, which bears a restrictive legend, other than as specified in this PWS. All documentation showing individual names or other personal information shall be controlled and protected under the provisions of the Privacy Act of 1974, Public Law 93-579, 5 United States Code (U.S.C.) Section 552a.

1.6.12 Protection of Government and Contract Information: Per Public Use Notice of Limitations stated by Defense imagery Management operations Center and contained at www.dimoc.mil/resources/limitations/, the Contractor shall not cite any information (e.g., contract information, pictures, locations, etc.) obtained through this contract on any hard copy or digital marketing tools to include its company website.

1.13 Required Training: The following provides information on training requirements.

1.13.1 Anti-Terrorism (AT) Level I Training: All Contractor employees, including subcontractor employees, who are employed under the contract, shall complete AT Level I Training within thirty (30) calendar days as required on the AT/OPSEC Cover Sheet Deliverable 7.2 Attachment 2 after contract start date or effective date of incorporation of this requirement into the contract, whichever applies, or thirty (30) calendar days after employment of new personnel. Contractor personnel travelling overseas shall complete area of responsibility (AOR) specific AT awareness training for U.S. based Contractor employees and associated subcontractor employees. The Contractor shall submit certificates of completion Deliverable 7.2 Attachment 2 for each affected Contractor employee and subcontractor employee to the COR (or to the Contracting Officer, if a COR is not assigned) within five (5) business days after completion of this training by all employees and subcontractor personnel. AT Level I awareness training is available at https://jkodirect.jten.mil, (course JS-US007).

Contractor personnel shall complete refresher training Deliverable 7.2 Attachment 2 every twelve (12) months except AOR specific AT Level I training which shall be completed as required by local AT policies.

http://www.dimoc.mil/resources/limitations/ https://jkodirect.jten.mil/

1.13.2 If training cannot be conducted on the website, the Contractor shall coordinate with the COR who will contact the local AT Officer at their assigned location for classroom training. Contractor personnel completing training in the classroom will receive a certificate or the training attendance roster signed by the AT Officer.

Verification of the training shall be provided to the COR within five (5) business days after completion of the training Deliverable 7.2 Attachment 2.

1.13.3 OPSEC Training: All Contractor employees, including subcontractors, shall complete Level I OPSEC training within thirty (30) calendar days of employment under this contract Deliverable 7.2 Attachment 2. Verification of the training shall be provided to the COR within five business days after completion of the training Deliverable 7.2 Attachment 2.

OPSEC Level I training is available at https://securityawareness.usalearning.gov.

Contractor personnel must complete refresher training every 12 months Deliverable 7.2 Attachment 2. Verification of the training shall be provided to the COR within five (5) business days after completion of the training Deliverable 7.2 Attachment 2.

1.13.4 iWATCH Training: The Contractor and all associated subcontractors shall brief all employees on the local iWATCH program (training standards provided by the requiring activity ATO). This locally developed training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the COR. This training shall be completed within thirty (30) calendar days after the contract is awarded and within five (5) business days after new employees commence contract performance, with the results reported to the COR within five (5) business days after the contract is awarded and within thirty (30) calendar days} after new employees commence contract performance Deliverable 7.2 Attachment 2. Verification of the training shall be provided to the COR within five (5) business days after completion of the training Deliverable 7.2 Attachment 2.

1.13.5 DoD Cyber Awareness Training: Contractor will not have access to Government information systems.

1.14.1 The Contractor shall comply with FAR 52.236-13, Accident Prevention (November 1991).

1.14.2 The Contractor shall conduct all work in a safe manner and in compliance with Federal, State, Local, Department of Defense, Army, and Depot regulations and national consensus standards.

1.14.3 The Contractor shall provide a Site-Specific Safety and Occupational Health Accident Prevention Plan (APP) and Activity Hazard Analysis (AHA).

1.14.3.1 Site-Specific Safety and Occupation Health Accident Prevention Plan (APP).

The Contractor shall develop, promulgate, and enforce a written site-specific safety and occupational health accident prevention plan (Herein referred to as safety plan). The safety plan shall identify protocols and procedures to ensure a safe and healthful workplace. The safety plan shall be reviewed and deemed acceptable by the COR before beginning any on-site activities.

1.14.3.2 Activity Hazard Analysis (AHA). The Contractor shall identify in sequence the activities being performed, the specific anticipated hazard, equipment, materials, and the control measures to implemented to eliminate or minimize each hazard to an acceptable level of risk. The contractor shall use the more stringent standard when standards are different. The names of the competent and qualified person required for a particular activity (e.g., excavation, scaffolding, fall protection, or other activities as specified by OSHA) shall be identified and included in the activity hazard analysis, as well as proof of their competency and qualification. The analysis shall be reviewed and deemed acceptable by the COR before beginning any on-site activities.

1.14.4 Service Condition. No part of the services covered by the McNamara-O’Hara Service Contract Act of 1965 will be performed in buildings or surroundings or under working conditions, provided by or under the control or supervision of the Contractor or any Subcontractor, which are unsanitary or hazardous or dangerous to the health or safety of service employees engaged to furnish the services.

PART 2

DEFINITIONS & ACRONYMS

2.0 DEFINITIONS AND ACRONYMS:

2.1 Definitions:

2.1.1 CONTRACTOR. A supplier or vendor awarded a contract to provide specific supplies or services to the Government. The term used in this contract refers to the prime.

2.1.2 CONTRACTING OFFICER (KO). A person with authority to enter into, administer, and/or terminate contracts, and make related determinations and findings on behalf of the Government. Note: The only individual who can legally bind the Government.

2.1.3 CONTRACTING OFFICER’S REPRESENTATIVE (COR). An employee of the U.S. Government designated by the KO to monitor Contractor performance. Such appointment shall be in writing and shall state the scope of authority and limitations.

This individual has authority to provide technical direction to the Contractor as long as that direction is within the scope of the contract, does not constitute a change, and has no funding implications. This individual does NOT have authority to change the terms and conditions of the contract.

2.1.4 DEFECTIVE SERVICE. A service output that does not meet the standard of performance associated with the PWS.

2.1.5 DELIVERABLE. Anything that can be physically delivered and includes non-manufactured items such as meeting minutes or reports.

2.1.6 KEY PERSONNEL. Contractor personnel that are evaluated in a source selection process that may be required to be used in the performance of a contract by the Key Personnel listed in the PWS. When key personnel are used as an evaluation factor in best value procurement, an offer can be rejected if it does not have a firm commitment from the persons that are listed in the proposal.

2.1.7 PHYSICAL SECURITY. Actions that prevent the loss or damage of Government property.

2.1.8 QUALITY ASSURANCE. The Government procedures to verify that services being performed by the Contractor are performed according to the acceptable standards.

2.1.9 QUALITY ASSURACNE SURVEILLANCE PLAN (QASP). An organized written document specifying the surveillance methodology to be used for surveillance of Contractor performance.

2.1.10 QUALITY CONTROL. All necessary measures taken by the Contractor to assure that the quality of an end product or service shall meet contract requirements.

2.1.11 SUBCONTRACTOR. One that enters into a contract with a prime contractor.

The Government does not have privity of contract with the subcontractor.

2.1.12 WORK DAY. The number of hours per day the Contractor provides services in accordance with the contract.

2.1.13 WORK WEEK. Monday through Friday, unless specified otherwise.

2.2 Acronyms:

AFARS Army Federal Acquisition Regulation Supplement AR Army Regulation CCAD Corpus Christi Army Depot CFR Code of Federal Regulations DA Department of the Army DFARS Defense Federal Acquisition Regulation Supplement DOD Department of Defense FAR Federal Acquisition Regulation KO Contracting Officer OCI Organizational Conflict of Interest PM Preventative Maintenance POC Point of Contact PRS Performance Requirements Summary PWS Performance Work Statement QA Quality Assurance QAP Quality Assurance Program QASP Quality Assurance Surveillance Plan QC Quality Control QCP Quality Control Program TE Technical Exhibit WAWF Wide Area Workflow

PART 3

GOVERNMENT FURNISHED PROPERTY, EQUIPMENT AND SERVICES

3.0 GOVERNMENT FURNISHED ITEMS AND SERVICES:

3.1 Utilities: The Government will provide all utilities available in the facility for the Contractor’s use in the performance of this contract. The Contractor shall instruct employees in utilities conservation practices. The Contractor shall be responsible for operating under conditions that preclude the waste of utilities, which include turning off the water faucets or valves after using the required amount to accomplish cleaning vehicles and equipment.

3.1.1 Training: The Government will provide the following training: AT Level 1 Awareness, OPSEC, and iWATCH, etc.

3.1.2 Security Training – See section 1.23

3.1.3 Identification Cards: The Government will provide Base Passes and CCAD Badges.

PART 4

CONTRACTOR FURNISHED ITEMS AND SERVICES

4.0 CONTRACTOR FURNISHED ITEMS AND RESPONSBILITIES:

4.1 General: Except for those items specifically stated to be Government-Furnished in paragraph 3.0, the Contractor shall furnish everything required to perform these services as indicated in paragraph 1.1.

4.1.1 Vehicles and Equipment: The Contractor shall provide all necessary vehicles (no GSA vehicles provided to Contractor for use on this contract) and equipment to perform the work described in this PWS. All Contractor provided vehicles and equipment shall have the company name prominently displayed on both sides of the vehicle or equipment and present a neat, professional appearance. Contractor's vehicles and equipment used in the performance of this contract shall meet all local traffic, safety, and environmental requirements. Vehicles and equipment found to be unsafe shall be removed from the installation and replaced. The Contractor shall not use any Government-owned tools, materials, or parts to maintain Contractor vehicles and equipment without prior written approval of the Contracting Officer. The COR may inspect the Contractor’s vehicles and equipment at any time.

4.1.2 Background Checks: The Contractor shall provide Background Checks in accordance with this PWS and as determined by the Government.

PART 5

SPECIFIC TASKS

5.0 REQUIREMENTS:

5.1 The Contractor shall perform annual Rockwell Hardness Tester WH2003T, barcode T0008982, PM and repair in accordance to ASTM 18 (most current version) on HRC, HRBW, HR30TW, and HR30N scales as one standard located at CCAD Heat Treat.

5.1.2 The Contractor shall perform annual Rockwell Hardness Tester RB2000T (Size 3), barcode T0006440, PM and repair in accordance to ASTM 18 (most current version) on HRC, HRBW, HR30TW, and HR30N scales as one standard located at CCAD Lab.

5.1.3 The Contractor shall perform annual Rockwell Hardness Tester LCR 500, barcode T0003836 M and repair in accordance to ASTM 18 (most current version) on HRC, HRBW, HR30TW, and HR30N scales as one standard located at CCAD Lab.

5.1.4 The Contractor shall perform annual Micro-Hardness Tester 4TTBB, barcode Y7501, PM and repair in accordance to OEM standards located at CCAD Metal Spray.

5.1.5 The Contractor shall perform annual Micro-Hardness Tester Tukon 1202, barcode T0007430, PM and repair in accordance to ASTM E 384 (most current version) located at CCAD Lab.

5.1.6 The Contractor shall perform annual Newage Hardness Tester Versitron 7741, barcode WOMUAAG4918, PM and repair in accordance to ASTM E 384 (most current version) located at CCAD Jigs and Fixtures.

5.1.7 The Contractor shall perform annual Newage Hardness Tester Versitron 7758, barcode WOMUAAG4919, PM and repair in accordance to ASTM E 384 (most current version) located at CCAD Heat Treat.

5.1.8 The Contractor shall perform annual Wilson Wolpert H1668, barcode WOMUAAK9739, PM and repair in accordance to ASTM 18 (most current version) on HRC, HRBW, HR30TW, and HR30N scales as one standard located at CCAD Machine Shop.

5.2 The Contractor shall perform the preventative maintenance (PM) per ASTM 18 (most current version).

5.4 The Contractor shall provide, upon completion of the PM, hardcopy or electronic copy of the service report to the COR.

PART 6

APPLICABLE PUBLICATIONS

6.0 APPLICABLE PUBLICATIONS: NONE

PART 7

ATTACHMENTS

7.0 Attachment List: (List all attachments that will be useful for the Contractor to submit an appropriate proposal).

7.1 Attachment 1: Performance Requirements Summary

ATTACHMENT 1 / TECHNICAL EXHIBIT 1

Performance Requirements Summary

This Performance Requirements Summary includes performance standards. The Government will use these standards to determine Contractor performance and shall compare contractor performance to the Acceptable Quality Level (AQL).

PWS Paragraph Task Performance Standard

Acceptable Quality Levels (AQL)

Surveillance Method / By Whom

5.0 all

On-site engineering, technical support, maintenance and repair

The Contractor shall perform On-site engineering and technical support within 100% of the scheduled time each month.

0% failure to perform on-site engineering and technical support within the established timeframes each

Periodic Inspection – COR will review monthly work order logs.

1.5.6, 5.6.5, Attachment 7.1 all

Adherence to CCAD regulations (Safety, security, fire and environmental).

The Contractor shall be in Adherence to CCAD regulations (Safety, security, fire and environmental) 100% of the time each

0% failure to Adherence to CCAD regulations (Safety, security, fire and environmental) each month.

100% Inspection COR will review on site and also the monthly work order logs.

ATTACHMENT 2 / TECHNICAL EXHIBIT 2

Deliverables Schedule

Deliverable Frequency Number of Copies Medium/Format Submit To

Service report.

PWS

Paragraph 5.0 All

Within 1 week of a Service Visit

One

Paper (hard copy), email attachment.

COR

Updated Installation Pass Log 1.6.3.1

Initial within 3-calendar days and updates within 5-calendar days

1 Hard copy or electronic

COR

Individual Termination or Expiration of employment para. 1.6.3.2

Within 3-working days

N/A Access passes COR

Contract Termination or Cancellation 1.6.3.3

Within 3 working days

1 Hard copy or electronic

COR

iWATCH Training para.1.6.3.2

Within 30-calendar days of contract award and within 5-business days for new employees

1 Hard copy or electronic)

COR

Anti-Terrorism (AT) Level I Training 1.23.1

Within 30 calendar days after award and annually thereafter

1 Hard copy or electronic

COR

OPSEC Level I Training Para 1.23.2

Within thirty

(30) calendar days of employment and annually thereafter

1 Hard copy or electronic

COR

Part 8.0 Security CAO: April 2019

ADDITIONAL SECURITY REQUIREMENTS FOR CONTRACTS PERFORMED AT

CORPUS CHRISTI ARMY DEPOT

Place these security requirements in all Statement of Works (SOW’s) and Performance Work Statements (PWS’s) for contracts performed at Corpus Christi Army Depot

(CCAD).

******************** This document is a brief overview of rules and regulations of Naval Air Station Corpus Christi (NASCC) and Corpus Christi Army Depot (CCAD). It is not intended to be all-inclusive or cover all contingencies.

Direct specific security requirements questions to the following numbers:

CCAD: (361) 961-3313

NASCC: (361) 961-2480

Regulations:

Army Directive 2014–05 (or its successor) Policy and Implementation Procedures for Common Access Card Credentialing and Installation Access for Uncleared Contractors

AR 25-1, Army Knowledge Management and Information Technology AR 25-2, Information Assurance AR 25-55, The Department of the Army Freedom of Information Act AR 70-31, Standards for Technical Reporting

AR 190-13, Department of the Army Physical Security Program AR 360-1, The Army Public Affairs Program AR 380-5, Department of the Army Information Security Program

AR 380-10, Foreign Disclosure and Contact with Foreign Representatives AR 380-49, Industrial Security Program

AR 380-67, Personnel Security (PERSEC); AR 530-1, Operations Security (OPSEC)

AR 530-1, AMC Supp Operations Security (OPSEC) AR 530-1, CCAD Plan Operations Security (OPSEC) AMC-R 525-13, AMC Force Protection Program

DoD 5220.22-M National Industrial Security Program Operating Manual DoD Directives 5230.24, Distribution Statements on Technical Documents

DoD Directives 5230.25, Withholding of Unclassified Technical Data from Public Disclosure DoD Regulation 5200.2 Personnel Security Program

DoD 5400.11-R, Department of Defense Privacy Program UFC 4-010-01 9 February 2012 Change 1, 1 October 2013

DoD MINIMUM ANTITERRORISM STANDARDS FOR BUILDINGS UNIFIED

FACILITIES CRITERIA (UFC)

DoDI 1000.13, Identification (ID) Cards for Members of the Uniformed Services, Their Dependents, and other Eligible Individuals

DoDD 5400.11, Department of Defense Privacy Program, October 29, 2014

DoDM 1000.13, Volume 1, DoD Identification (ID) Cards: ID Card Life-Cycle DoDI

5200.02 DoD Personnel Security Program

DoDM 5200.02 Procedures for the DoD Personnel Security Program

Federal Acquisition Regulation Subpart 24.1 CFR Part 24 and Part 39.105

U.S. Office of Personnel Management Memorandum, "Final Credentialing Standards for Issuing Personal Identity Verification Cards under HSPD-12," July 31, 2008Federal Acquisition Regulation (FAR), March 2005

1.Conduct and Behavior: IAW DoD Directive 5200.8, “Security of DoD Installations and Resources”, the NAS Commander has broad authority to remove or exclude any person or persons from the military installation to protect personnel and property, to maintain good order and discipline, and to ensure the uninterrupted and successful performance of the installations mission. In the exercise of this authority, the commander may refuse to grant entry or may bar Contractor employees. Refusal of entry or barment of any employee does not relieve the Contractor of the responsibility to continue performance under this contract.

1.1. All personnel entering and working at CCAD are subject to all rules, regulations and applicable laws. All personnel and their effects are subject to search, to include vehicles and company belongings.

1.2. No person shall willfully fail or refuse to comply with lawful orders or direction of any civilian or military security police officer.

1.3. The Contractor shall not employ persons for work on this contract if such employees are identified to the Contractor by the Government as a potential threat to the health, safety, security, general well-being or operational mission of the installation and its population. Disrespectful behavior, failure to obey orders or regulations, fighting, horseplay, stealing, illegal use of drugs (using/transporting/selling), consuming or being under the influence of alcohol, or being in the possession of illegal weapons are prohibited and subject to appropriate penalties. This may include being detained, banned from entering the Government facility, or remanded to civilian authorities.

1.4. All Contractor personnel will limit their travel on the installation only to specific areas required for performance of the contract, specified break and meal areas, or in travel directly to and from these locations. Employees found on the installation away from officially identified areas may be detained and/or debarred from the installation.

1.5. Subcontracts; if the Contractor enters into a Subcontractor arrangement with another Contractor, the prime Contractor is responsible for Subcontractor performance and compliance. The prime Contractor must provide a copy of the security requirements to the subcontractor. The contracting officer must ensure any questions of adequacy of the Subcontractor are resolved to the mutual satisfaction of the prime Contractor, Subcontractor, security, and CCAD commander.

1.6. All prospective government and contractor employees are subject to a check of their criminal history prior to being granted access to CCAD. Adverse or derogatory information revealed by these checks, or failure to provide full disclosure, may result in denial of access.

2.Support:

2.1 Security support provided by CCAD to the Contractor includes (if applicable) storage containers for classified information/material, use of base destruction facilities, classified reproduction facilities, use of base classified mail services, security badging, investigation of security incidents, base traffic regulations, use of security forms, and conducting inspections required by DoD 5220.22-M “Industrial Security Regulation”, AR 380-49 “Industrial Security Program”, AR 380-5 “Department of Army Information Security Program”, and AR25-2 “Information Assurance” and others as required or deemed necessary by the Government.

2.2 Security support requiring joint Army and Contractor coordination includes packaging classified information, mailing and receiving classified materials, implementing emergency procedures for protection of classified information, security checks, and internal security controls for protection of classified material, sensitive material, and high value pilfer able property.

3.Security Investigation Requirements:

3.1. Investigation requirements including IT level and CAC requirements should be clearly indicated in the contract and Performance Work Statement (PWS) as prescribed in paragraph 4.1303, of the FAR:

Personal Identity Verification of Contractor Personnel (a)The Contractor shall comply with agency personal identity verification procedures identified in the contract that implement Homeland Security Presidential Directive-12 (HSPD-12), Office of Management and Budget (OMB) guidance M-05-24 and Federal Information Processing Standards Publication (FIPS PUB)Number 201.

(b)The Contractor shall account for all forms of Government-provided identification issued to the Contractor employees in connection with performance under this contract.

The Contractor shall return such identification to the issuing agency at the earliest of any of the following, unless otherwise determined by the Government:

(1)When no longer needed for contract performance.

(2)Upon completion of the Contractor employee’s employment.

(3)Upon contract completion or termination.

(c)The Contracting Officer may delay final payment under a contract if the Contractor fails to comply with these requirements.

(d)The Contractor shall insert the substance of this clause, including this paragraph (d), in all subcontracts when the subcontractor’s employees are required to have routine physical access to a Federally-controlled facility and/or routine access to a Federally-controlled information system. It shall be the responsibility of the prime Contractor to return such identification to the issuing agency in accordance with the terms set forth in paragraph (b) of this section, unless otherwise approved in writing by the Contracting Officer.

3.2. Subcontracts; if the Contractor enters into a Subcontractor arrangement with another Contractor, subcontractors must be clearly identified in the contract agreement.

3.3. Contractors must maintain the same level investigation or higher as their civilian counterparts. In the absence of a civilian counterpart, CCAD Security will determine the level of investigation based on a position sensitivity review. Close coordination with the COR and company are required. All documentation required for access to CCAD for classified contracts or IT Level I & II shall be processed through the CCAD Security Personnel Security Office prior to entering CCAD facilities.

3.4. Classified Contracts: An interim clearance must be in place prior to entering CCAD facilities. All documentation (i.e. SF 86, etc.) required for security clearance shall be processed through the Contractor Facility Security Office (FSO).

3.4.1. For all contracts involving employees who require a security clearance for performance of their duties or access to classified material, the Contractor must possess or obtain a facility security clearance prior to performing contract work. If the Contractor does not possess a facility clearance, the Government (Contracting Office) may request one from the Defense Security Service (DSS).

3.4.2. Contractor employees without a clearance level or background check properly indicated in the Joint Personnel Adjudication System (JPAS) or its successor, will not be assigned to this task directly or indirectly. Contractor employee(s) will not be authorized access, regardless of personal clearance, without the facility first being cleared to the appropriate level by Defense Security Service (DSS).

3.4.3. The Contractor shall request security clearances for personnel requiring access to classified information or IT Level I or II within 15 days after receiving a facility clearance. If the Contractor is already cleared, they shall request security clearances for the personnel within 15 days after contract award. Due to costs involved with security investigations, requests for Contractor employee security clearances shall be kept to an absolute minimum necessary to perform contract requirements.

3.4.4. IT Level I positions; Contractor employees shall have one of the following prior to commencing work: A current, valid Tier 5 investigation or equivalent or “Interim” Top Secret eligibility by Defense Industrial Security Clearance Office (DISCO) indicated in

JPAS.

3.4.5. IT Level II positions; Contractor employees shall have one of the following prior to commencing work: A favorably completed Tier 3 investigation or equivalent or “Interim” Secret eligibility by DISCO indicated in JPAS.

3.4.6. IT Level III positions: Contractor employees shall have one of the following prior to commencing work: A favorably completed Tier 3 investigation or equivalent or “Interim” Secret eligibility by DISCO indicated in JPAS.

3.5. Unclassified Contracts requiring IT access: All documentation (i.e. SF 85*, etc.)

required for their initial security appointment for unclassified contracts to IT Level III shall be processed through the CCAD Security Personnel Security Office prior to entering CCAD facilities.

3.6. IT Level III positions; Contractor employees requiring access to CCAD Local Area Network (LAN) shall have background investigation processed through CCAD Personnel Security Office. If the Contractor employee does not possess the proper investigation, the Government (Contracting Officer Representative) will request one.

The Government assumes costs and initiates non-clearance investigation by submitting the appropriate Personnel Security Investigation request to the Army Center of Excellence. Minimum requirements for CAC issuance and access to the LAN is an initiated investigation with favorable FBI fingerprint check. Due to costs and the inherent delays involved with security investigations, requests for Contractor LAN access shall be kept to an absolute minimum necessary to perform contract requirements.

3.6.1. Fitness Issues: CCAD Security will be notify the Contracting Officer Representative (COR) when discovery of adverse information indicates potentially actionable issues that may disqualify the Contractor employee from access.

3.6.2. OPM Memorandum, Final Credentialing Standards for Issuing Personal Identity Verification Cards under HSPD-12 provides government-wide credentialing standards to be used by all Federal departments and agencies in determining whether to issue or revoke personal identity verification (PIV) cards to employees and contractor personnel.

3.6.3. Whether or not to grant access is the sole discretion of the Government. The decision not to grant access will not be grounds for contract modification and shall not constitute an excuse for Contractor performance failure.

3.7. System Authorization Access Request (SAAR): Prior to system access, a SAAR, DD Form 2875, shall be completed by the Contractor employee. The Contractor employee shall complete Part I, the COR shall complete Part II, and CCAD Personnel Security shall complete Part III.

3.8. Unclassified Contracts NOT requiring IT access: Contracts not requiring access to CCAD LAN shall be subject to installation access requirements that include the Defense Biometric Identification System (DBIDS) and/or guest sponsorship. The COR shall provide the appropriate details and contact information.

4. IT/IA Requirements:

4.1. All contract employees with access to the CCAD network must be registered in the Army Training Certification Tracking System (ATCTS) at commencement of services.

Contractors and associated subcontractor employees must also complete DoD IA Awareness Training before they can be granted access to the CCAD network and complete the training annually thereafter.

4.2. All contractors working IA/IT functions must comply with DoD and Army training requirements in DoDD 8570.01, DoD 8570.01-M, and AR 25-2 within 6 months of employment.

4.3. Per DoD 8570.01-M, DFARS 252.239.7001, and AR 25-2, the contractor employees’ supporting IA/IT functions shall be appropriately certified upon contract award. The baseline certification, as stipulated in DoD 8570.01-M, must be completed upon contract award.

5. Acquisition: All contracts will include acquisition related documents in accordance with the

Federal Acquisition Regulation Subpart 24.1 CFR Part 24 and Part 39.105.

6. Foreign Nationals:

6.1. Official Visits: All official foreign visits (visits sponsored by a foreign government) must be based on a legitimate need, be sanctioned by the appropriate foreign attaché or embassy, and approved through Department of Army channels. Access will be coordinated through the CCAD Foreign Disclosure Officer (FDO), COR, and respective NASCC/CCAD security offices.

6.2. Unofficial Visits: These are visits by foreign nationals that are not endorsed by a foreign government. The Contractor will submit a request for employee access, based on a legitimate need, to the appropriate COR. The COR will in turn notify the FDO of the request. Due to security considerations, requests for these types of visits should be kept to a minimum. Foreign nationals will require a government escort at all times while on CCAD property. The COR will ensure the foreign contractor employee provides a copy of their passport to NASCC and CCAD security offices, to ensure the appropriate background checks are completed.

7.Notifications: The following information will be submitted to the COR and the CCAD Security Manager on company letterhead, signed by the Contractor Facility Security Officer (FSO) within 15 days of awarding the contract. An updated listing shall be provided quarterly or when the company or an employee’s status or information changes. Electronic equivalents are acceptable. The notification shall include:

a. Name, address, and telephone number of company representatives.

b. Employee's name, last four of social security number, shift.

c. The contract number and contracting agency.

d. The highest level of classified information to which Contractor employees require access.

e. The location(s) of contract performance.

f. The date contract performance begins and terminates.

8.Security Point of Contact: At no cost to the Government, the Contractor shall appoint a senior Contractor employee to serve as an on-site point of contact for any security concerns at the CCAD location. This may be a full time position or an additional duty position.

9.Security Training:

9.1. All contractor employees, including subcontractor employees, requiring access to Army installations, facilities, or controlled access areas shall complete AT Level I awareness training within 30 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever applies. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee to the COR (or to the contracting officer, if a COR is not assigned) within 30 calendar days after completion of training by all employees and subcontractor personnel. AT Level I awareness training is available at https://atlevel1.dtic.mil/at.

9.2. US-based contractor and subcontractor employees who are required to travel overseas in performance of their duties must receive government provided AT awareness training that is specific to the area of responsibility (AOR), as directed by AR 525-13. Specific AOR training content will be directed by the combatant commander and the unit ATO will ensure an applicable AT foreign travel briefing is provided to the contractor.

9.3. The contractor and all associated subcontractors shall brief all employees on the local iWATCH program. This is a locally developed training is provided by CCAD security and will be used to inform employees of the types of suspicious behavior to watch for and instruct employees to report suspicious activity to the COR. This training shall be completed within 30 calendar days of contract award and within 30 calendar days of new employees’ commencing performance, with the results reported to the COR no later than 30 days after training completion.

9.3.1 Contracts with a scope of work that call for the use of CCAD specific information or equipment at off base locations and facilities must develop an OPSEC Standard Operating Procedure (SOP)/Plan within 90 days of contract award which will be reviewed by the CCAD OPSEC Officer for approval IAW AR 530- 1, Operations Security. The SOP/Plan must identify CCAD's critical information, why it needs to be protected, where it is located, who is responsible, and how the contractor intends to protect it. This plan is “For Official Use Only” and must contain appropriate document controls in accordance with AR 25-55, Chapter 4. The plan must be stored in a secure location such as a lockable container and must be properly destroyed when no longer needed in accordance with local CCAD policy CCADR 25-92, Chapter 1, Section 1-6(j).

9.4. IAW AR 530-1, new contractors and associated subcontractors who require a CAC Card and access to the CCAD network must complete Level I OPSEC training within 30 calendar days of reporting for duty and annual OPSEC contractor refresher training, thereafter.

9.5. Threat Awareness Reporting Program Training: Per AR 381-12 Threat Awareness and Reporting Program (TARP), contractor employees must receive annual TARP training presented by a Counterintelligence Special Agent.

10. Pass and Identification Items: The Contractor shall obtain the pass and identification items for employees and Contractor owned vehicles required for contract performance.

11. Retrieving Identification Media: The Contractor shall retrieve all identification media, including vehicle passes from employees who depart for any reason before the contract expires; e.g. terminated for cause, retirement, etc. and surrender to CCAD security through the COR.

12. Weapons, Firearms, and Ammunition: Contractor employees are prohibited from possessing weapons, firearms, or ammunition, on themselves or within their Contractor-owned vehicle or privately- owned vehicle while on CCAD.

13. Safeguarding Classified or Sensitive Information: Any material marked as Top Secret, Secret, Confidential, For Official Use Only (FOUO) Freedom of Information Act (FOIA), Privacy Act Information, or any other restrictively marked material discovered by the Contractor or Contractor employees will be surrendered at the earliest opportunity to any military or DoD employee of the installation. Under no circumstances will the Contractor retain such material. The Contractor and all Contractor employees will execute a SF 312, Classified Information Non-Disclosure Agreement or equivalent CCAD Non-Disclosure Agreement as directed or required.

13.1. Classified: Visitor Groups will safeguard classified information IAW DoD 5200.1-R, DoD Information Security Program, AR 380-5, Department of the Army Information Security Program, AR 380- 49, Industrial Security Program, and other directives deemed necessary by the Servicing Security Activity (SSA). The contractor shall comply with FAR 52.204-2, Security Requirements. This clause involves access to information classified “Confidential,” “Secret,” or “Top Secret” and requires contractors to comply with—(1) The Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (DoD 5220.22-M); any revisions to DOD 5220.22- M, notice of which has been furnished to the contractor.

13.2. Information Systems (IS): All Contractor personnel will protect and restrict access to all documentation (i.e. maps, test and evaluation results, vulnerability assessments, audits, results, or findings) describing operational IS architectures, designs, configurations, vulnerabilities, address listings, or user information.

13.3. FOR OFFICIAL USE ONLY (FOUO): The Contractor shall comply with DoD 5400.7-R, Chapter 4, DoD Freedom of Information Act (FOIA) Program requirements and AR 25-55, Chapter III and Chapter IV, The Department of the Army Freedom of Information Act Program. These regulations set forth policy and procedures for the disclosure of records to the public and for marking, handling, transmitting, and safeguarding FOUO material.

13.4. Privacy Act: All data associated with this task is covered by the…