Department of War Defense Health Agency

Resources and Personnel Integration (R&PI) J-1 Administrative Management & Privacy Division (AM&P)

Headquarters Support

Performance Work Statement General Operations Support Services (GOSS)

Date: 03/26/2026

DRAFT

PART 1

1.0 GENERAL INFORMATION

1.1 This is a non-personal services contract to provide Defense Health Agency (DHA) general operational support services. The Government shall not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn is responsible to the Government.

1.2 Description of services/introduction: The contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform general operational support services as defined in this Performance Work Statement (PWS) except for those items specified as government furnished property and services. The contractor shall perform to the standards in this performance work statement.

1.3 Background: The DHA is a Combat Support Agency supporting the Military Services. The DHA supports the delivery of integrated, affordable, and high-quality health services to beneficiaries of the Military Health System (MHS), and executes responsibility for shared services, functions, and activities of the MHS and other common clinical and business processes in support of the Military Services. The DHA serves as the program manager for the TRICARE health plan, medical resources, and the market manager for the National Capital Region (NCR) enhanced Multi-Service Market. The DHA manages the execution of policy as issued by the Assistant Secretary of Defense for Health Affairs and exercises authority, direction, and control over the inpatient facilities and their subordinate clinics assigned to the DHA in the NCR Directorate.

1.4 Objectives: The objective of this work is to provide mission-essential headquarters support functions including inventory and logistics management, duplication center operations, fitness center management, graphic design services, mailroom operations, parking office support, and pavilion and executive conference room scheduling and event support. The Contractor shall deliver cost-effective, performance-based solutions that ensure efficient daily operations, enhance customer service delivery, improve reporting accuracy, automate tracking systems where feasible, and maintain operational continuity across all assigned functional areas. Support shall enable DHA leadership and staff to execute mission requirements by ensuring administrative, technical, and facility-related services are responsive, compliant with applicable DoD policies and aligned with organizational priorities.

1.5 Scope: The Contractor shall provide integrated headquarters support services as defined in Section 5 of the PWS. Services include operational, administrative, technical, and facility support functions necessary to sustain daily operations for AM&P Division. Detailed functional requirements, performance standards, service expectations are set forth in Part 5 (Specific Tasks).

The contractor is responsible for internal management, quality control, and execution of all services in accordance with the performance standards established in this PWS.

The Contractor shall perform to the standards set forth within this contract.

1.6 Period of Performance (PoP): The period of performance for this effort is date of award for a period of twelve (12) months thereafter, hereto referred to as the Base Period, which includes a Transition-In Period as defined in Section 1.6.1.1.

This effort includes Four (4) 12-month option period, which may be unilaterally exercised by the Government. Each option period is subject to the availability of funds.

The last option period will include a Transition-Out Period as defined in Section 1.6.1.2.

Anticipated date of award September 27, 2026.

1.6.1 Transition

1.6.1.1 Transition-In Period: During the Transition-In Period, the contractor shall prepare to meet all contract requirements and ensure incoming personnel are functionally trained and qualified on the full performance start date. Transition-in performance is defined as 10 days of the contract. The contractor shall provide the Government with a Transition-In Plan – See (CDRL A003 – Transition- In Plan). The Transition-In Plan shall include:

a. Coordination with Government representatives,

b. Review, evaluation, and transition of current support services,

c. Orientation phase and program to introduce Government personnel, programs, and users to the Contractor's team, tools, methodologies, and business processes,

1.6.1.2 Transition-Out Period: Transition-Out performance is defined as period of performance where the incumbent contractor will orient the new contractor and/or Government entity/personnel to project status, including all standard procedures/processes and functional design capabilities.

This 30-day period will run concurrently with the final days of the PoP and at no additional cost to the Government. The contractor shall prepare a Transition-Out Plan – See (CDRL A004 – Transition-Out Plan) will be implemented during the last option period to be approved by the Government. The Transition-Out Plan shall include the following items:

a. Coordination with Government representatives,

b. Review, evaluation, and transition of current support services,

c. Transition of historic data to new Contractor system,

d. Transfer of hardware warranties and software licenses (if applicable),

e. Transfer of all necessary business and/or technical documentation,

f. Transfer of compiled and uncompiled source code, to include all versions, maintenance updates and patches (if applicable),

g. Orientation phase and program to introduce Government personnel, programs, and users to the Contractor’s team, tools, methodologies, and business processes,

1.7 Administrative specifications

1.7.1 Place of performance: This is an on-site requirement; the Contractor shall perform primary activity at the Government’s facilities in the National Capitol Region; to include but not limited to:

a. 7700 Arlington Blvd, Falls Church, VA 22042 Telework and/or offsite will be based upon DHA workplace contingencies.

1.7.1.1 On-Site Parking: Parking of single occupancy vehicles is very limited on the DHHQ complex. The Contractor may not be provided reserved parking spaces located on the DHHQ campus. Public transportation is accessible to the DHHQ campus by means of metro and buses.

The following details potential public transportation for contactors supporting this requirement:

• Sheltered bus stop on Route 50 West bound at Jaguar Trail

• DHHQ provided shuttle service to and from the Dunn Loring and Pentagon Metro

1.7.1.2 Telework: The contractors supporting this requirement shall perform duties onsite at the government location; however, when telework is required it will be coordinated with the Government worksite POC, the COR and the Program Manager. The contractors supporting this requirement shall perform duties onsite at the government location; however, when teleworking is required it will be coordinated with the Government worksite POC, the COR and the Program Manager. The telework alternate may be used for government or building closure(s). In the event the Contractor is approved to telework by the Contract Program Manager, the Contract Program Manager must ensure that all work activities and functions associated with the individual teleworking is accomplished. The Contract Program Manager will not approve telework in lieu of vacation or sick leave. The Program Manager shall ensure members requesting telework:

a. Has access to DHA issued laptop.

b. Has VPN access.

c. Coordinates the transfer of office desk phone calls to a home/or cell telephone line.

d. Monitor the work to be accomplished.

e. Designates an accessible onsite EA that can address requirements or requests that cannot be addressed on email or telephone; and must be handled on site.

f. Individuals working in a classified area will not perform classified duties at alternate locations.

The Government will provide access to Government controlled facilities, equipment, and materials for daily business use of staff called for under this order. This shall include office space, desk, telephone, chair, computer, shared printer, and requisite consumable materials.

The Contractor will be provided keys or codes for access to the Government facility. These keys and codes shall be controlled, tracked, and protected. Upon termination of the period of performance, all keys and/or access badges to the Government facility shall be turned into the

COR.

In accordance with (IAW) FAR 7.108, teleworking is allowed as permitted by the COR. Contractor must provide a copy of their company’s telework policy in advance, which must meet OPM guidelines for telework and support the terms of this contract as determined by the Contracting Officer (KO). Contractor must have signed telework agreements in place for each Contractor employee. Telework schedules, recurring or Ad Hoc, must be approved by COR or Task Manager before teleworking begins. Contractor personnel must comply with responsiveness standards and specific deliverables for telework periods that may be set by the Government to ensure the privilege of teleworking is being utilized appropriately; standards and deliverables must be applied equitably. Contractor personnel shall utilize the Virtual Private Network (VPN) and their Common Access Card (CAC) when performing telework and stay connected with teammates and Government personnel using the DoD-approved instant messaging tools or other options approved by DoD. The Government will not be responsible for any costs associated with travel related to performing telework under this contract. The Government reserves the right to remove the telework privilege at their discretion, including for adverse impact to mission readiness or operational security. Teleworking personnel will be required to attend in-person meetings unless prior exception is granted by COR or Task Manager. Situational telework is determined on certain temporary situations where the designated workplace has no Government oversight due to emergency or weather closures.

1.7.2 Recognized Federal holidays: The contractor is not required to perform services on holidays.

New Year’s Day Labor Day Martin Luther King Jr.’s Birthday Columbus Day President’s Day Veteran’s Day Memorial Day Thanksgiving Day Juneteenth Day Christmas Day Independence Day

1.7.3 Hours of operation: The contractor is responsible for conducting business Monday thru Friday except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. The contractor must always maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons.

1.7.4 Emergency Services: On occasion, services may be required to support an activation or exercise of contingency plans outside the normal duty hours.

1.8 Contractor travel: There is no travel authorized for this contract.

1.9 Other Direct Costs (ODC): There are no ODCs authorized for this contract.

1.10 Quality

1.10.1 Quality Control (QC): The contractor shall develop and maintain an effective QC program to ensure services are performed in accordance with this PWS. The contractor shall develop and implement procedures to identify, prevent, and ensure nonrecurrence of defective services. The contractor’s QC program is how the work complies with stated requirements. The Quality Control Plan (QCP) is to be delivered within 30 days after contract award. A comprehensive written QCP shall be submitted to the Contracting Officer (CO) and COR within five (5) working days when changes are made thereafter. After acceptance of the Quality Control Plan (QCP) the contractor shall receive the CO’s acceptance in writing of any proposed change to his QC system. See (CDRL A001 – Quality Control Plan).

1.10.2 Quality assurance (QA): The government will evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan provides a systematic method for the Government to evaluate performance and to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s). Attachment 10 – Quality Assurance Surveillance Plan (QASP)

1.11 Contractor personnel

1.11.1 CAC requirements: For all contractors who will work in Government facilities, the Facilities Security Officer (FSO)/Company's Security point of contact (POC) will provide the Government all the required information per the DHA CAC request process current version 2.1, January 2018, or more recent when updated. A CAC is the standard identification for eligible DoD contractor personnel. Attachments 3 and 4

1.11.1.1 The Contractor shall return all CACs to the COR upon the departure of the contractor(s).

1.11.2 Contractor onboarding and training. The Contractor shall complete all requirements, training, and forms as prescribed in the following requirements:

1.11.2.1 The DHA’s “Onboarding Checklist for Contractor Employees” is located at the DHA Onboarding and Offboarding Portal at https://info.health.mil/cos/admin/hr/IO/SitePages/Home.aspx

1.11.2.2 The DHA’s contractor training instructions – Attachment 5

1.11.2.3 The contractor shall comply with onboarding requirements of the DHA for contractors needing to be issued CAC identification, including DoD- and DHA-directed training and forms submission, prior to network access, as displayed in the In/Out-Processing Portal at:

https://info.health.mil/cos/admin/hr/IO/SitePages/home.aspx (note: Public Key Infrastructure (PKI)-restricted, printed versions available).

1.11.2.4 The DHA’s new employee handbook – Attachment 6

1.11.3 PHYSICAL Security: The contractor shall be responsible for safeguarding all government equipment, information and property provided for contractor use. At the close of each work period, government facilities, equipment, and materials shall be secured.

1.11.4 Key control: The contractor shall establish and implement methods of making sure all keys/key cards issued to the contractor by the Government are not lost or misplaced and are not used by unauthorized people. NOTE: All references to keys include key cards. No keys issued to the contractor by the Government shall be duplicated. The contractor shall develop procedures covering key control that shall be included in the QCP. Such procedures shall include turn-in of any issued keys by personnel who no longer require access to locked areas. The contractor shall immediately report any occurrences of lost or duplicate keys/key cards to the CO.

1.11.4.1 In the event keys, other than master keys, are lost or duplicated, the contractor shall, upon direction of the CO, re-key or replace the affected lock or locks; however, the Government, at its option, may replace the affected lock or locks or perform re-keying. When the replacement of locks or re-keying is performed by the Government, the total cost of re-keying or the replacement of the lock or locks shall be deducted from the monthly payment due the contractor. In the event a master key is lost or duplicated, all locks and keys for that system shall be replaced by the Government and the total cost deducted from the monthly payment due the contractor.

1.11.4.2 The contractor shall prohibit the use of Government issued keys/key cards by any person other than the contractor’s employees. The contractor shall prohibit the opening of locked areas by contractor employees to permit entrance of people other than contractor employees engaged in the performance of assigned work in those areas, or personnel authorized entrance by the CO.

1.11.5 Lock Combinations: Reserved

1.12 Key personnel (Contractor): The contractor shall provide a contract manager who shall be responsible for the performance of the work. The name of this person and an alternate who shall act for the contractor when the manager is absent shall be designated in writing to the CO. The contract manager or alternate shall have full authority to act for the contractor on all contract matters relating to daily operation of this contract. The contract manager or alternate shall be available between 8:00a.m. to 4:30p.m., Monday through Friday except Federal holidays or when the government facility is closed for administrative reasons. Qualifications for all key personnel are listed below:

https://info.health.mil/cos/admin/hr/IO/SitePages/Home.aspx https://info.health.mil/cos/admin/hr/IO/SitePages/home.aspx

a. Possess substantive experience in tasks and responsibilities associated with providing support to Senior Executives and Field Officers

b. Have familiarity with enterprise correspondence systems.

c. Ability to recognize the military ranks and how to address senior military members

d. The Program Manager must have a bachelor’s degree in business administration and a minimum of 5-7 years of qualified work experience

e. Experience coaching and mentoring subordinate personnel

1.13 Data rights: The Government has unlimited rights to all documents/material produced under this contract. All documents and materials, to include the source codes of any software, produced under this contract shall be Government owned and are the property of the Government with all rights and privileges of ownership/copyright belonging exclusively to the Government. These documents and materials may not be used or sold by the contractor without written permission from the Contracting Officer. All materials supplied to the Government shall be the sole property of the Government and may not be used for any other purpose. This right does not abrogate any other Government rights.

1.14 Reporting

1.14.1 Contractor Manpower Reporting (CMR): Reserved

1.14.2 Non-Disclosure Agreement (NDA): All contractor personnel who will obtain access to proprietary, classified, or confidential information or any information release of which is protected or governed by law or regulation associated with DHA acquisitions shall be required to complete and sign a DHA contractor NDA (DHA Form 49) prior to beginning work on the subject contract.

The contractor shall execute an NDA on behalf of the company and shall ensure that all staff assigned to, including all subcontractors and consultants, or other personnel performing on contract/Task order execute an NDA protecting the procurement sensitive information of the Government and the proprietary information of other contractors. The NDA shall be executed not later than first day of employment and to be renewed upon exercising a contract option period.

Assignment of staff who has not executed this statement or failure to adhere to this statement shall constitute default on the part of the contractor. The contractor shall maintain originally signed NDAs of individual employees and provide copy to the COR. (Attachment 2 – Non-Disclosure Agreement (NDA)). CDRL A002 - NDA

1.14.3 Government’s COR: The COR monitors all technical aspects of the contract and assists in contract administration. The COR is authorized to perform the following functions: assure that the contractor performs the technical requirements of the contract; perform inspections necessary in connection with contract performance; maintain written and oral communications with the contractor concerning technical aspects of the contract; issue written interpretations of technical requirements, including Government drawings, designs, specifications; monitor contractor's performance and notifies both the CO and contractor of any deficiencies; coordinate availability of government furnished property; and provide site entry of contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the contractor, states the responsibilities and limitations of the COR, especially regarding changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting contract.

1.14.4 Post award conference/periodic progress meetings: The contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with FAR Subpart 42.5. The CO, COR, and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor's performance. At these meetings the CO will apprise the contractor of how the government views the contractor's performance and the contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the government.

1.15 Contractor Identification

1.15.1 Contractor personnel performing services in a contractor capacity in a government facility are required to possess and wear an identification badge that displays his or her name and the name of their company. All contractor personnel shall identify themselves as contractor support personnel in all forms of communication with all entities with whom DHA/Deputy Assistant Director for Acquisition (DAD-A)/Head of the Contracting Activity (HCA) has business dealings.

The contractor shall: Answer all telephone calls and have a personalized voice message with an introductory statement that includes the fact that the person is contractor support personnel. Ensure all those with whom the person interacts in any face-to-face dealings while supporting the DAD- A understands that the person is contractor support personnel. Include a title block in all emails that states the fact that the person is contractor support personnel. Ensure all those with whom the person interacts in any face-to-face dealings while supporting DHA/DAD-A/HCA understands that the person is contractor support personnel.

1.15.2 Contractor personnel will be required to attend meetings or otherwise communicate with Government and/or other contract representatives to meet the requirements of this order.

Contractor personnel shall make their contractor status known during introductions.

1.15.3 Contractor personnel, while performing in a contractor capacity, are prohibited from using their retired or reserve component military rank or title in any written or verbal communications associated with the contracts in which they provide services.

1.16 Contractor Access to Health Affairs (HA)/DHA Network(s)

1.16.1 FSO/Company's Security POC shall notify the DHA Personnel Security Office after being awarded a contract that requires access to a DoD system. Contractor personnel requiring access to the HA/DHA networks for performance of their tasks require a background investigation and security awareness training. The contractor shall be prepared for this process as it could take two

(2) or more weeks. The FSO/Security POC shall submit a Standard Form (SF) 85/86 to DHA's Personnel Security Office for a background investigation.

1.16.2 Company’s FSO/Security POC must notify the Personnel Security Office when the contractor has submitted the SF-85/86. The FSO/Security POC, or the COR must notify the DHA Personnel Security Office in writing of a contractor's termination from the contract, including the termination date.

1.17 Personnel Security Requirements - FOR USE ON UNCLASSIFIED CONTRACTS This clause establishes requirements and processes for the Personnel Security Screenings for Defense Health Agency Contractor personnel and any subcontractors in performance of this contract, in accordance with Department of Defense (DoD) and federal regulations.

1.17.1 General Requirements

The Contractor shall ensure that all personnel performing work under this contract comply with the applicable Department of Defense (DoD) personnel security requirements as outlined in DoD Manual 5200.02, DoD Instruction 5200.46, DoD Instruction 1402.05, and all other relevant regulations. The Contractor shall verify that all personnel performing duties under this contract are suitable for access to Controlled Unclassified Information (CUI) and/or secure facilities, as determined by the appropriate security clearance level and background checks.

1.17.2 Background Investigations

All personnel performing duties on this contract must be vetted by the Defense Health Agency (DHA) Administration Security Division (ASD). Procedures and requirements for submission can be found in DHA Administrative Instruction 5200.04, 5200.05, and DHA Internal Policy Memorandums. Vetting packages must be submitted for processing by the assigned Contracting Officers Representative (COR) or Facility Security Officer (FSO) depending on Personnel Security office of primary responsibility.

1.17.2.1 Minimum Background Investigation

All personnel performing duties on this contract must undergo, at a minimum, a Tier 1, or equivalent background investigation as required by the Office of Personnel Management Federal Investigation Standards. The Contractor shall submit all required background investigation requests the appropriate security office as described in paragraph 1.17.2. Any personnel who are found to be unsuitable shall be removed from the project at the direction of the Contracting Officer or ASD Personnel.

1.17.2.2 Access to Sensitive Information and Moderate Risk Information Systems Personnel assigned to this contract who require access to specific categories of sensitive/controlled unclassified information and access to Unclassified Moderate Risk Information Systems may be subject to a higher Tier background investigation with a favorable final determination. Personnel falling into this category must have a valid need-to-know, determined by the Contracting Officer or COR. In situations where this paragraph applies, a justification memorandum must be submitted with the security package as described in paragraph

1.17.3 At a minimum, this memorandum should clearly identify the contract employee; Names, access requirements, and permission levels of the information system(s) required to perform duties on this contract; shall be endorsed by the applicable Information Systems Security Officer (ISSM), confirming the system requirements; signed by the government official validating the contract employee’s need-to know.

Access to classified information is not required to perform duties on this contract therefore investigations processed by ASD will not result in a National Security determination. The Contracting Officer has identified the staffing requirement to be base number (xx). The US Government will initiate up to base number + 25 % (xx) background investigations over the life of the contract. Requests in excess of this amount will require Contracting Officer approval.

1.17.3.1 Background Checks Supporting Local Anti-Terrorism/Force Protection Requirements Screenings conducted by ASD will be limited to those required to perform duties as described in this statement of work. The Defense Health Agency does not control Military Installation Physical Security requirements; supplemental background checks may be required to for entry. Additional costs associated with processing supplemental background checks are not covered within this contract.

1.17.4 Controlled Unclassified Information

Controlled Unclassified Information under this contract shall be safeguarded as specified in DoD Instruction 5200.48 Controlled Unclassified Information (CUI).

1.17.4.1 Access to CUI

Prior to accessing CUI, all personnel must have completed a Personnel Security screening as described in paragraph 1.17.2 Background Investigations and received, at a minimum, a favorable HSPD-12 interim determination CUI requires safeguarding measures identified by the CUI EA in Part 2002.14 of Title 32, CFR and, as necessary, in the law, regulation, or government-wide policy with which it is associated. DoD CUI may be disseminated to DoD personnel to conduct official DoD and U.S. Government business in accordance with a law, regulation, or government-wide policy.

• (1) No individual may have access to CUI information unless it is determined he or she has an authorized, lawful government purpose.

• (2) The person with authorized possession, knowledge, or control of CUI will determine whether an individual has an authorized, lawful government purpose to access designated CUI.

• (3) CUI information may be disseminated within the DoD Components and between DoD Component officials and DoD contractors, consultants, and grantees to conduct official business for the DoD, provided dissemination is consistent with controls imposed by a distribution statement or limited dissemination controls (LDC).

• (4) CUI designated information may be disseminated to a foreign recipient in order to conduct official business for the DoD, provided the dissemination has been approved by a disclosure authority in accordance with Paragraph 3.4.c. and the CUI is appropriately marked as releasable to the intended foreign recipient.

Contractors shall ensure all employees and subcontractors granted access to CUI are informed of their responsibilities under this clause and applicable laws and policies.

1.17.4.2 CUI Protection, Handling, and Marking Requirements

Handling: Access to CUI material shall be limited to those employees needing the material to perform their duties. The CUI marking is assigned to documents and material created by a DoD User Agency. CUI is not a classification but requires extra precautions to ensure its properly safeguarded and disseminated and is not released to the public without government authorization.

Marking: All CUI shall be marked in accordance with DoDI 5200.48 and 32 CFR Part 2002. The minimum marking shall include:

• The "CUI" designation at the header and footer of each page, presentation, spreadsheet, e-mail, etc.

• Category markings (if applicable) and dissemination controls;

• The first page or cover of any document or material containing CUI, including a document with commingled classified information, will include a CUI designation indicator.

• Portion markings are encouraged but not required unless specified.

Emails containing CUI must include the acronym "CUI" in the subject line, attachments containing CUI and appropriate CUI markings in the header and footer. E-mails containing CUI should be encrypted.

CUI material released to a contractor by a DoD user agency must have the following statement on the front page or cover:

THIS DOCUMENT CONTAINS CUI MATERIAL AND MUST BE REVIEWED BY A

GOVERNMENT REPRESENTATIVE UNDER THE REQUIREMENTS OF DODI 5200.48,

DODI 5230.09, and DODI 5230.29.

Storage: During normal duty hours, steps will be taken to minimize the risk of access by unauthorized personnel, such as not reading, discussing, or leaving CUI information unattended where unauthorized personnel are present. Use a CUI cover sheet for single layer protection. After normal duty hours, CUI information will be stored in unlocked containers, desks, or cabinets if the government or government-contract building provides security for continuous monitoring of access. If building security is not provided, the information will be stored in locked desks, file cabinets, bookcases, locked rooms, or similarly secured areas. The concept of a controlled environment means there is sufficient internal security measures in place to prevent or detect unauthorized access to CUI. Expenditure of funds for security containers or closed areas solely for the protection of CUI material is prohibited.

Transmission: CUI information and material may be transmitted via first class mail, parcel post, or, bulk shipments. When practical, CUI information may be transmitted electronically (e.g., data, website, or e-mail), via approved secure communications systems or systems utilizing other protective measures such as Public Key Infrastructure or transport layer security (e.g., https).

Avoid wireless telephone transmission of CUI when other options are available. CUI transmission via facsimile machine is permitted; however, the sender is responsible for determining whether appropriate protection will be available at the receiving location before transmission (e.g., facsimile machine attended by a person authorized to receive CUI; facsimile machine located in a controlled government environment).

Unauthorized Disclosure: Report misuse, mishandling, or Unauthorized Disclosure of CUI to the Unauthorized Disclosure Program Management Office, the Controlling Agency and the appropriate Military Department Counterintelligence Organization. While Unauthorized Disclosure of CUI does not constitute a security violation, a formal security inquiry/investigation is required if administrative action will be taken against the individual(s) responsible. Unauthorized Disclosure of certain CUI, such as export controlled-technical data, may also result in civil and criminal sanctions against responsible persons based on procedures codified in relevant law, regulation, or government-wide policy.

Processing: Unclassified Automated Information Systems (AIS) used to process CUI under this contract must meet the basic security requirements listed in the NIST SP 800-171 REV 2, “Protecting Controlled Unclassified Information in Non-Federal Systems and Organizations”, 21 February 2020. AIS accredited and approved for processing classified information under this contract are also approved to process DoD CUI.

Dissemination: CUI may be disseminated between officials of DoD Agencies, DoD contractors, consultants and grantees to conduct official business for the DoD provided the dissemination is consistent with controls imposed by a Distribution Statement or Limited Dissemination Controls

(LDC). Guidance on Distribution Statements and LDCs will be provided separately by the government for any prescribed CUI Specified information. For classified contracts, this information will be contained in the program SCG. CUI always requires Foreign Disclosure Decision before release outside of DoD Agencies, DoD contractors, consultants and grantees.

Destruction: When the CUI material no longer meets the threshold for safeguarding and dissemination, it shall be immediately decontrolled, be processed through the records management process, and destroyed by the approved methods identified in DoDI 5200.48 precluding its disclosure to unauthorized individuals by rendering it unreadable, indecipherable, and irrecoverable.

1.17.5 Common Access Card Issuance

Common Access Card (CAC) issuance requires, at a minimum, a favorably adjudicated Tier 1 (T1) or higher investigation in accordance with DODI 5200.46. The contractor employee will be issued a CAC only if duties involve one of following:

(1) Both physical access to a DOD facility and access, via logon, to DOD networks on-site or remotely

(2) Remote access, via logon, to a DOD network using DOD-approved remote access procedures; or

(3) Physical access to multiple DOD facilities or multiple non-DOD federally controlled facilities on behalf of the

DOD on a recurring basis for a period of six months or more. A CAC may be issued on an interim basis once a Tier 1 has been successfully scheduled with the Defense Counterintelligence and Security Agency (DCSA) and a favorable Federal Bureau of Investigation (FBI) fingerprint results.

1.17.6 Mission Partner Identity, Credential and Access Management Process Mission Partner Identity, Credential and Access Management (MP ICAM) (formerly known as Trusted Associate Sponsorship System (TASS)): The contractor shall process CAC applications through the MP ICAM, the procedures for which are described below. Although there is no requirement for the contractor to designate a “Corporate Facility Security Officer" (FSO) to serve as its single point of contact for the BI, the MP ICAM application process and other CAC and security-related matters, such designation facilitates these processes. If a Corporate FSO is not established, all contractor employees requiring a CAC will be required to process their own applications. The submission process for CAC applications is as follows:

1. The contractor's FSO or COR shall submit requests for a CAC via email to the designated Mission Partner Affiliation Sponsor (MPAS) (formerly known as the Trusted Agent (TA)).

2. The Government will establish a MP ICAM application account for each CAC Request and each contractor employee will receive (2) automated emails from MP ICAM; a user ID and password. The contractor employee or designated proxy shall access the MP ICAM account and complete the CAC application. Once completed, the contractor employee will submit the completed application to the MPAS for next steps.

3. An automated email triggered by the MPAS will inform the contractor applicant one of the following:

a. Approval * Upon approval, the information is transferred to the DEERS database and an email notification is sent to the contractor with instructions on obtaining their CAC. The contractor proceeds to a RAPIDS station (RAPIDS Site Locator:

https://idco.dmdc.osd.mil/idco/).

b. Rejection * The Government sponsor, in separate correspondence, will provide reason(s) for rejection.

c. Return * Additional information or correction to the application required by the contractor employee.

d. Transfer * Upon transfer, the contractors MP ICAM profile is now assigned to a different contract and/or MPAS for further management.

1.17.7 Foreign Nationals

The Contractor shall immediately notify the Contracting Officer of any foreign national personnel assigned to work on this contract. The Contracting Officer, in consultation with the Security Office and Foreign Disclosure Officer, will determine the eligibility of foreign national personnel for access to sensitive information and ensure compliance with applicable security protocols.

1.17.8 Security Training

The Contractor shall provide personnel security training to all employees working under this contract. Such training shall cover all applicable security requirements, including handling of classified material, protection of sensitive information, and security breach reporting procedures.

1.17.9 Reporting of Security Violations

The Contractor shall immediately report any security violations or potential security risks, including unauthorized access, mishandling of protected information, or any personnel security issues, to ASD through the COR. The Contractor shall cooperate fully with any security investigations and take any prescribed corrective action as required by the Contracting Officer.

1.17.10 Termination of Personnel

The Contractor must immediately notify the Contracting Officer and ASD if the employment of any personnel performing duties on this contract is terminated. If applicable, all visit authorizations should be canceled as soon as reasonably practicable.

1.17.11 Documentation and Records

The Contractor shall maintain records of all personnel security clearances, background investigations, and security training for the duration of the contract. These records shall be made available to the Contracting Officer or authorized ASD representatives upon request.

1.18 OTHER PERFORMANCE REQUIREMENTS

1.18.1 Program Management Plan

The Contractor shall develop a Program Management Plan (CDRL A005 – PMP).

The Management Plan shall consist of the organizational structure, the assignment of functions, duties, and responsibilities, the procedures and policies and the reporting requirements that are established for the initiation, monitoring, control, completion, test, and verification, and reporting of contractual tasks, projects, and programs. The Contractor shall submit a draft plan with initial proposal and a final copy will be submitted 30 calendar days after contract award. The Management Plan shall cover the program management methodology, personnel, security, and the reports as described herein.

https://idco.dmdc.osd.mil/idco/

a. Standardization of program management (PM) processes and procedures

b. Maintenance of PM guidelines to ensure they are current (at least on annual basis)

c. Communication/coordination with other Contractor staff

d. Identification of milestones where Government information/activity is required and timeline dependencies for subsequent Contractor activities, and

e. A detailed staffing plan

1.18.2 Monthly Performance Review

The Contractor shall submit a Monthly Progress Report (CDRL A006 - MPR) that details the previous month’s achievements and progress on emerging and existing tasks, staffing plans and forecasts, as well as financial analysis of contract expenditures including variance analysis compared to baselined and forecasted plans and section.

The Contractor shall require all subcontractors to provide input to the MPR where there are critical or significant tasks related to the prime contract. Critical or significant tasks shall be defined by mutual agreement between the Government and Contractor.

a. Program status to include objectives met, work completed and work outstanding

b. Notable achievements

c. Issues or obstacles impeding progress and recommended solution

d. Status of deliverables/milestones

e. Issues and resolutions

f. Resource planning/status

g. Topics or issues identified by the COR

h. Description of work completed and plans for next month

i. Planned leave and coverage

1.18.3 Contingency Operations Plan

The Contractor shall prepare and submit a Contingency Operations Plan to the Government (CDRL A007 - COOP). The Contingency Operations Plan shall be due ten (10) calendar days after the award of the contract and shall be updated on a quarterly basis. The Contingency Operations Plan shall document Contractor plans and procedures to maintain DHA support during an emergency. The Contingency Operations Plan shall include the following:

a. A description of the Contractor’s emergency management procedures and policy

b. A description of how the Contractor will account for their employees during an emergency

c. Planned temporary work locations or alternate facilities

d. How the Contractor will communicate with DHA during emergencies

e. A list of primary and alternate Contractor points of contact, each with primary and alternate:

1. Work phone numbers,

2. Home phone numbers,

3. Cell phone numbers, and

4. E-mail addresses

f. Procedures for protecting Government furnished equipment (if any)

g. Procedures for safeguarding sensitive and/or classified Government information (if applicable)

PART 2

2.0 DEFINITIONS, ACRONYMS, AND APPLICABLE

PUBLICATIONS/INSTRUCTIONS

2.1 Definitions:

2.1.1 Category D: Information Technology (IT) and Telecommunications Services (called D- Services)

2.1.2 Category R: Support (Professional/Administrative/Management) Services (called R- Services)

2.1.3 Contracting Officer (CO): A person with the authority to enter into, administer, and/or terminate contracts and make related determinations and findings.

2.1.4 Contracting Officer’s Representative (COR): An individual, including a contracting officer’s technical representative (COTR), designated, and authorized in writing by the CO to perform specific technical or administrative functions. This individual does NOT have authority to change the terms and conditions of the contract.

2.1.5 Nonpersonal services contract: a contract under which the personnel rendering the services are not subject, either by the contract’s terms or by the manner of its administration, to the supervision and control usually prevailing in relationships between the Government and its employees.

2.1.6 Quality Assurance Surveillance Plan (QASP): An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance. The Government may either prepare the QASP or require the offerors to submit a proposed quality assurance surveillance plan for the Government’s consideration in development of the Government’s plan.

2.1.7 Contract Administrator: The official Government representative delegated authority by the Contracting Officer to administer a contract. This individual is normally a member of the appropriate Contracting/Procurement career field and advises on all technical contractual matters

2.1.8 Contractor: A supplier or vendor awarded a contract to provide specific supplies or services to the Government. The term used in this contract refers to the prime.

2.1.9 Defective Service: A service output that does not meet the standard of performance associated with the Performance Work Statement.

2.1.10 Deliverable: Anything that can be physically delivered but may include non-manufactured things such as meeting minutes or reports.

2.1.11 Government Furnished Property (GFP) or Government Property (GP): Property in the possession of, or directly acquired by, the Government and subsequently made available to the Contractor.

2.1.12 Key Personnel: Contractor personnel that may be required to be used in the performance of a contract by the Key Personnel listed in the PWS.

2.1.13 Physical Security: Actions that prevent the loss or damage of Government property.

2.1.14 Quality Assurance: The Government procedures to verify that services being performed by the Contractor are acceptable in accordance with established standards and requirements of this contract.

2.1.15 Quality Assurance Specialist: An official Government representative concerned with matters pertaining to the contract administration process and quality assurance/quality control.

Acts as technical advisor to the Contracting Officer in these areas.

2.1.16 Quality Control: All necessary measures taken by the Contractor to assure that the quality of an end product or service shall meet contract requirements.

2.1.17 Subcontractor: One that enters into a contract with a prime contractor. The Government does not have privity of contract with the subcontractor.

2.1.18 Workday: The number of hours per day the Contractor provides services in accordance with the contract.

2.1.19 Work Week: Monday through Friday, except for Federal holidays unless specified otherwise.

2.2 Acronyms:

AIS Automated Information System AO Authorizing Official AQL Acceptable Quality Level CAC Common Access Card CDRL Contract Data Requirement List CMR Contractor Manpower Reporting CO Contracting Officer(s) CONUS Continental United States (excludes Alaska and Hawaii) COR Contracting Officer Representative COTR Contracting Officer's Technical Representative CUI Controlled Unclassified Information DAD-A Deputy Assistant Director for Acquisition DD Form 254 Department of Defense Contract Security Requirement List (if applicable) DFARS Defense Federal Acquisition Regulation Supplement DHA Defense Health Agency DISA Defense Information System Agency DoD Department of Defense DoDD Department of Defense Directive DoDI Department of Defense Instruction DoDM Department of Defense Manual DPCLO DHA Privacy and Civil Liberties Office DUA Data Use Agreement FAR Federal Acquisition Regulation FCI Federal contract information FSO Facilities Security Officer HA Health Affairs HIPAA Health Insurance Portability and Accountability Act HCA Head of the Contracting Activity iRAPT Invoicing, Receipt, Acceptance, and Property Transfer (formerly Wide Area Workflow) IGCE Independent Government Cost Estimate IA Information Assurance I/O In/Out Processing Portal IS Information System ISP Internet Service Provider IT Information Technology MHS Military Health System MTFs Military Treatment Facilities NCR National Capitol Region NDA Non-Disclosure Agreement NIAP National Information Assurance Partnership NIST National Institute of Standards and Technology OCONUS Outside Continental United States (includes Alaska and Hawaii) ODC Other Direct Costs OPM Office of Personal Management OSD Office of the Secretary of Defense P-ATO Personal Authorization to Operate P&R Personnel and Readiness PA Provisional Authorization PGI Procedures, Guidance, and Information PDT Project Delivery Team PHI Protected Health Information PII Personally Identifiable Information PIT Platform Information Technology PK Public Key PKI Public Key Infrastructure POA&M Plan of Action and Milestones POC Point of Contact PMO Program Management Office PoP Period of Performance PP Personal Property PPSM Ports, Protocols, and Services Management PRS Performance Requirements Summary PSP Personnel Security Program PWS Performance Work Statement QA Quality Assurance QAP Quality Assurance Program QASP Quality Assurance Surveillance Plan QC Quality Control QCP Quality Control Plan RFP Request for Proposal RFQ Request for Quotation RMF Risk Management Framework SP Special Publication

SPRS Supplier Performance Risk System SRM Sustainment, Restoration and Modernization SRG Security Requirements Guides STIG Security Technical Implementation Guides TE Technical Exhibit TOS Terms of Service US United States UFC Unified Facilities Criteria VPN Virtual Private Network XML Extensible Markup Language

2.3 Applicable Publications, DHA Administrative Instructions (AI), etc. The Contractor (to include subcontractors) must abide by all applicable regulations, publications, manuals, and local policies and procedures.

PART 3

3.0 GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICES

The Requiring Activity Authority has assessed the need for Government Furnished Property, Equipment, and Services and determined:

3.1 Services: The Government:

☐ Will NOT provide Government Furnished Services in support of this contract/task order. As a result, this paragraph is Not Applicable.

☒ WILL provide Government Furnished Services required in support of this contract/task orders.

These Services are described below:

a. Local Area Network

b. VPN

3.2 Facilities: The Government:

☐ Will NOT provide Facilities in support of this contract/task…