DRAFT_PWS_STEaKMM_06172026.docx

PERFORMANCE WORK STATEMENT (PWS)

Contract Number:

Task Order Number:

Contractor Name

Tracking Number:

Follow-on to Previous Contract and Task Order Number:

1. Contracting Officer’s Representative (COR).

a. Primary COR. See DITCO Additional Text G1 - Points of Contact

b. Alternate COR. See DITCO Additional Text G1 - Points of Contact

c. Property Administrator See DITCO Additional Text G1 - Points of Contact

2. Contract or Task Order Title. Services for Technology Engineering and Knowledge Management Modernization (STEaKMM)

3. Background. The Defense Information Systems Agency (DISA), a Combat Support Agency dedicated to globally connecting the Armed Forces and partners through advanced networking and information-sharing infrastructure, is leveraging its Enterprise Integration and Innovation Center’s (EIIC) Emerging Technology (EM) directorate to drive rapid technological transformation and implementation across the Department of Defense Information Networks (DODIN). Aligning with the DISA Director's strategic priorities of Readiness, Continuous Modernization, and Establishing Lethality, DISA utilizes agile methodologies to deliver comprehensive Knowledge Management (KM) development, maintenance, and support services for the DoD365-J and DoD365-SEC Microsoft 365 environments, ultimately maximizing the platform's capabilities to enhance secure collaboration, rapid technology transfer, and informed decision-making for the warfighter.

4. Objectives: The primary objective of this effort is to obtain contractor support to provide technical, engineering, integration, and testing support to the Defense Information Systems Agency (DISA) Emerging Technology (EM) directorate to facilitate Technology Assessments, Technology Prototypes, and Innovative Pilots that meet the evolving needs of the Department of Defense. Concurrently, the contractor shall provide support to design, develop, implement, and maintain a robust, scalable, and user-centric Knowledge Management (KM) ecosystem within the Microsoft 365 for DoD platform, focusing on process automation and efficiency.

5. Scope. The work accomplished for this task order will include technical, engineering, integration and testing support to EM for Technology Assessments, Technology Prototypes, and Innovative Pilot capabilities. The work will include testing and evaluating hardware, software and application deployments to determine readiness for enterprise use. The work will include developing knowledge management solutions, content and records migration, systems maintenance and support, agile project management and reporting, and agile methodologies.

The Government may require surge support during the base or any option period, and surge modifications will be within the scope of the contract and provide increased support for the defined task areas of this PWS. Surge support over the life of the contract will not exceed 15% of the contractor’s total proposed cost/price for the base and all option periods, excluding any six-month extension of services pursuant to FAR 52.217-8.

6. Performance Requirements. The work described herein involves integration, implementation, and continued assistance of capabilities into programs and services of record. All work performed under this task order must be compliant with all appropriate and relevant DoD and DISA, NetOps, Systems Engineering Process, Information Assurance, and Knowledge Management retentions, policies and guidelines.

6.1 Task 1 – Contract Management

6.1.1 Subtask 2 – Kickoff Meeting

The Contractor shall host a formal presentation that shall, at a minimum, identify Government and Contractor personnel supporting the contract, detail the contract information (i.e. contract number, title, Periods of Performance, type of contract and lifecycle amount), review deliverables and proposed deliverable formats, provide onboarding details, and review billing cycles. The formal presentation shall be held in-person at DISA Headquarters, Ft. Meade, MD or virtually, no later than ten (10) business days after contract award. An agenda shall be specified at least five (5) calendar days prior to the meeting. The Contracting Officer (KO), COR and Government PMs shall be invited at a minimum.

6.1.2 Subtask 1 – Contract Management Plan.

The contractor shall prepare a Contract Management Plan (CMP) describing the technical approach, organizational resources including, personnel and management controls to be employed to satisfy, at minimum, the baseline functional requirements, and meet performance and schedule requirements throughout contract execution. A project schedule will be provided with the CMP as separate documents. The CMP schedule data will serve as the guide against which the government will monitor task order progress/status. The contractor will submit changes to the CMP if conditions change during the life of this task order (TO).

6.1.3 Subtask 3 – Monthly Status Report (MSR)

The Contractor shall provide a MSR that will include project schedules, technical progress, quality assurance, configuration management, risks, and security management, as applied to execute the requirements of this contract. The Contractor shall provide appendices to the MSR as appropriate, or as directed by the terms of this task order, such as new capabilities that were reviewed, trip reports, and summary reports on topics addressed during the month. At a minimum, the MSR shall include:

· The project task schedule showing proposed changes, reason(s) for said change(s), and the potential impact(s) on the TO

· Progress of work accomplished for that reporting period, to include descriptions of activities for each task/subtask and deliverables

· Planned and accomplished travel with trip reports attached

· Planned activities for the next reporting period to include technical data to be submitted

· A roster of contract staff working on the effort, to include start and separation dates and GFE information (serial numbers, make/model, and other identifying information for the devices)

· Identification of problems or issues occurring during the reporting period and recommendations for resolution, with attention to issues involving risk management activities

· Outstanding issues from prior monthly reports and the status of each issue. This will be provided monthly until the issues are resolved or the Government Contracting Officer Representative (COR) has instructed deletion

6.1.4 Subtask 4 – In-Progress Review (IPR)

The contractor shall meet monthly with the DISA COR, Program Manager (PM) and other DISA staff to report status and progress and to identify and resolve issues. The contractor is expected to provide briefing slides, in a contractor developed, government-approved format. An electronic copy of briefings and other explanatory documents will be provided to the COR and PM 24-hours prior to any IPR. These IPRs may be virtual, held at government or contractor’s facilities, at the discretion of the government. One copy of the Monthly IPR briefings and associated explanatory material shall be submitted as a deliverable on the date the IPR is held. The contractor shall track issues and/or action items identified at the IPR and shall report status to the COR monthly in the MSR until the COR declares the action item resolved.

Deliverables:

6.2 Task 2 – Technology Engineering Services Evaluation and Execution DISA’s Emerging Technology Directorate requires engineering support in several s Engineering areas. The contractor shall provide support in these areas:

Estimated number of:

· Technology Assessments – twelve (12) per agreement Period of Performance (PoP)

· Technology Evaluations – up to seven (7) per agreement PoP

· Technology Pilots – up to four (4) per agreement PoP

· Technology Monitoring – presented during IPR

6.2.1 Subtask 1 – Technology Assessment

Estimated number of technology evaluations per agreement year up to twelve (12) delivered on a monthly cadence.

The contractor shall do an initial Technology Assessment to determine the technology maturity and suitability for DISA and DoD. The Technology Assessment is a research informed report that captures specific areas to include, but not limited to:

· Maturity – is the solution a mature capability?

· Useability – is the solution widely used in the commercial space?

· Security – has the solution been scanned for vulnerabilities?

· Scalability – can the solution scale to meet larger demand?

· DoD deployments – has the solution been accredited and deployed in DoD?

· Cost – how is the solution priced / what is costing model?

· Market Research – include prominent contractors in this technology area.

· Problem Space – define how the new technology addresses a problem space.

· Technology Readiness Level – identify the TRL of the solution.

· Architectural View – what components make up the solution

· System Integration Plan - how different system parts combine into a cohesive whole, resources, and interfaces to an existing platform

The contractor shall generate a report to support the decision to move the solution to the Technology Evaluation phase and assist in developing relevant use case scenarios for the evaluation.

6.2.2 Subtask 2 – Technology Evaluation

Estimated number of technology evaluations per agreement year up to five (5).

The contractor will setup, configure, deploy, and operationalize the new technology during the Technology Evaluation phase. The intent of this phase is to independently validate that the solution works as advertised, meets initial requirements, can be secured, and works effectively in an environment consisting of test data and test users.

Outputs in the Technology Evaluation Phase include, but are not limited to:

· Concept diagrams, illustrations, and briefing slides that show how the system works.

· Solution architecture diagrams, system/operational views, and flowcharts.

· Ports, protocols, services, and interfaces documentation.

· Vulnerability scanning results and recommendations for securing the solution.

· System specs, software, and hardware requirements.

· Work with potential stakeholders to develop requirements and use cases.

· Identify notional costs for Technology Pilot phase.

· Call out any red flags that may limit the solution from being deployed into Production.

· Developing measures, test planning, conducting testing, and developing test reports.

6.2.3 Subtask 3 – Technology Pilot Execution

Estimated number of pilot deployments per agreement year up to four (4).

The contractor will set-up, configure, deploy, secure, and operationalize the new technology in production or production-like environment during the Technology Pilot phase. The intent of this phase is to validate that the solution continues to work as expected, meets stakeholder requirements, is secure, and works effectively in an environment consisting of real data and actual users.

The contractor shall assist in refining feedback from operational stakeholders to support a pilot, assist in determining pilot environment location, and equipment needed for execution.

The contractor shall assist on generating pilot architecture material for the environment, assist on generating the bill of materials including hardware and software licensing requirements, and applications for the pilot to meet the success criteria.

The contractor shall assist with the installation and configuration of the solution in the environment selected, conduct pilot testing which includes the evaluation of the pilot against requirements and operational use cases as well as the suitability of the design and overall function of the solution.

The contractor shall generate pilot results and reports. The contractor shall also assist in the development of documentation required for pilot decisions. This includes generation of pilot architecture documents, develop notional timeline for the pilot to be developed, executed, and completed. This includes assisting in the generating of the initial pilot plan and post-pilot findings.

The contractor shall assist in refining the requirements to execute the pilot. This includes obtaining and refining feedback from the ops team to support the pilot.

This also includes assisting in generating pilot architecture documentation.

The contractor shall assist from the technical perspective in generating the necessary documents and artifacts required to deploy the pilot in the environment.

The contractor shall assist with the pilot execution process. This includes installing and configuring the pilot environment according to the plan and architecture.

The contractor shall assist with the pilot testing and evaluate against success criteria, generate reports, and prepare documents for briefing to leadership.

The contractor shall assist in conducting security assessments and generating cyber security documents, support Authorizing Official with briefs and artifacts, create supporting documentation and generate documentation necessary for a deployment configuration.

The contractor shall assist in generating documentation for transition decision point. This includes identifying stakeholders, pilot report, ATO documentation, transition plan, initial operational plan, and briefings.

6.2.4 Technology Monitoring

The contractor shall monitor technological trends and identify emerging technologies that have potential to provide capability advantage, cost reduction or risk mitigation in areas that align with the agency’s mission set.

The contractor shall maintain a watchlist, a living document, that lists identified emerging technologies, assigns a an estimated maturity rating, impact rating, strategic relevance and source references. Ratings in the watchlist should be qualitative (low, medium, high) with respect to the anticipated effect of the technology.

Deliverables:

6.3 Task 3 – Technology Analysis Center (TAC) Lab Support

The contractor shall provide the following level of support for the TAC lab.

The contractor shall provide system administration of the TAC environments with the following duties that include and are not limited to the following: generation of system builds, execute tuning/optimizations, customizations, patching, perform backups, infrastructure as code, create user accounts, manage Active Directory, manage groups, user access and permissions provisioning, manage the complete physical, virtual and containerized environments, and all relevant system administration type work necessary to maintain the security and performance posture of systems across the lab infrastructure for operations and accreditation. Contractor shall work with ISSO/ISSM to ensure continued security compliance and shall provide remediation actions and/or mitigations for risks identified with necessary artifacts to support the development of a Plan of Action and Milestone (POA&M). Contractor personnel performing this work shall have and maintain, at minimum, the Basic proficiency level (451) personnel certification as outlined in Section 13.j Certification.

The contractor shall provide database administration support that includes and is not limited to the following: provide recommendations, execute DB health checks, update software, secure DBs, rudimentary troubleshooting to ensure the DB is up and operational, configure and maintain backup, redo, and undo logs for DB continuity, and all relevant DBA type work necessary to maintain the databases in the lab infrastructure for operations. Contractor personnel performing this work shall have and maintain, at minimum, the Basic proficiency level (421) personnel certification as outlined in Section 13.j. Certification.

The contractor shall provide network administration support with the following roles that include and are not limited to the following: manage and maintain the physical and virtual switching infrastructure, manage and maintain firewalls, track and allocate network addresses, perform software updates, provide security updates, update configurations, execute backups, infrastructure as code, manage VLANs, manage service meshes, maintain documentation regarding IPs and subnets, ensure network connectivity is always there between all assets within the TAC Lab location, establish and maintain VPN connectivity, and provide troubleshooting support to assist JITC personnel in identifying and resolving network issues at or above the TAC Lab point of presence. Contractor personnel performing this work shall have and maintain, at minimum, the Basic proficiency level (441) personnel certification as outlined in Section 13.j. Certification.

6.3.1 Subtask 1 – Cloud Support

The contractor shall provide cloud administration support that includes, but not limited to the following: deployment, management, optimization, and operation of systems on cloud services provides to include, but not limited to Amazon Web Services, Google Cloud, Microsoft Azure, and Oracle Cloud. The contractor shall deploy and scale applications and services, configure templates for repeatable deployments, infrastructure as code, configure virtual machines, networks, user accounts, monitor health and performance, enforce security policies and access, perform regular system maintenance, including patches and updates, troubleshoot as issues arise, interact with service contractors, document configurations and procedures, and other relevant cloud administration type work necessary to maintain the systems and services hosted on cloud resources for operations. Contractor personnel performing this work shall have and maintain, at minimum, the Basic proficiency level (451) personnel certification as outlined in Section 13.j Certification in addition to an industry cloud certification. This requirement can be substituted through attainment of an Intermediate proficiency level (451) personnel certification as outlined in Section 13.j. Certification.

Deliverables:

6.3 6.3.1 Architectural Diagrams

6.3

Ports and Protocols Document

6.3

Configuration/SOP Documentation

6.3

Service Level Agreement

6.4 Knowledge Management (KM)

6.4.1 Knowledge Management Solution Development

The contractor shall:

· Design, develop, and deploy custom KM solutions using the full suite of Microsoft 365 tools including SharePoint Online, Teams, Power Platform (Power Apps, Power Automate, Power BI), and Viva.

· Lead the digital SCRMtransformation of existing work products and processes into modern, sustainable formats. It is expected that process automation will be a primary outcome following most digital transformation efforts.

· Leverage appropriate Artificial Intelligence (AI) toolsets to create efficiencies in knowledge discovery, content summarization, and process automation.

· Develop solutions that incorporate data modeling, data analysis, and visualizations to provide actionable insights.

· Utilize JSON, CSS, REST, XML, SPFx, Power Query, and DAX to create and customize solutions.

6.4.2 Content and Record Migration

· Upon receipt of a migration request from the Government, the contractor shall analyze the source data and provide a detailed Migration Mapping. The contractor will then execute the migration utilizing existing government-approved processes and technologies upon approval of the mapping.

· Ensure the integrity, security, and accessibility of all migrated data in accordance with government procedures.

6.4.3 System Maintenance and Support

· Provide ongoing maintenance and support for all developed KM solutions.

· Monitor system performance, availability, and interoperability. Recommendations for enhancements shall be submitted into the Government's designated Change Management System for review and potential inclusion in the backlog. A list of all submitted enhancements will be included in the Monthly Progress Report.

· Troubleshoot and resolve any issues that may arise in the Microsoft 365 environment.

6.4.4 Agile Project Management and Reporting

· The Government will own and manage the master KM backlog. The contractor shall actively participate in all Government-led agile activities, including but not limited to sprint planning, daily stand-ups, sprint reviews, and retrospectives.

· The contractor shall contribute to the Government-owned backlog by providing analysis, estimates, and recommendations for new features, enhancements, and technical debt remediation.

· The contractor shall work on both new development and maintenance tasks as assigned by the Government from the backlog within each sprint.

· Develop and maintain agile documentation for all complex solutions.

6.4.5 Agile Methodology

· The project will be executed using an Agile Scrumban framework. This hybrid approach combines the structure of Scrum with the flexibility of Kanban. Work will be conducted in sprints, which are planned to be, on average, two-week intervals. This methodology allows for both structured planning of new features and the continuous flow of high-priority maintenance and support tasks.

Deliverables:

7. Performance Standards.

days of plan changes and be error-free 95% of the time.

Monthly review to ensure CMP aligns with conditions and milestones. 100% inspection of all updates and changes.

the PWS.

Monthly inspection of MSRs by COR with PMO technical manager input.

the time.

Monthly inspection of IPR briefing charts and summary by COR with PMO technical manager input.

receives error-free and on time products 95% of the time.

Monthly inspection of deliverables by COR with PMO technical manager input.

demonstrations and test results 95% of the time.

Monthly inspection of deliverables by COR with PMO technical manager input.

with the approved schedule 95% of the time.

Monthly inspection of deliverables by COR with PMO technical manager input.

with the approved schedule 95% of the time.

Monthly inspection of deliverables by COR with PMO technical manager input.

6.3 - Technology Analysis Center (TAC) Lab Support Contractor meets technical requirements on running the TAC lab and without significant problems encountered as stated in the PWS. The Government will expect the TAC Lab be maintained and running without issues 95% of the time Continuous inspections to ensure the lab is working as expected in support of EM efforts

8. Incentives. Contractor positive/negative performance on this Agreement will be evaluated and documented in the Contractor Performance Assessment Reporting System (CPARS). The Government will include performance evaluation results in the decision to exercise option periods included in this agreement.

The Contractor shall ensure that invoices are submitted monthly to ensure funds obligated are expended without delay. Monthly invoicing is the sole responsibility of the prime contractor, and they will be responsible for submitting the invoices monthly for themselves as well as all sub-contractors. If invoices are not submitted monthly, the COR will make a negative entry on the prime’s CPARS to reflect as a part of their performance.

9. Place of Performance. Upon Facility Security Clearance (FCL) approval, unclassified activities may be also required at DISA, DoD locations and other locations as mutually agreed and as needed. The classified work up to Secret shall be performed at various Government locations in the CONUS. The main DISA work location is in DISA facilities in Fort Meade, Maryland. The work schedule is considered hybrid, consisting of both onsite and telework. The specific balance of onsite and telework for contractor personnel will be determined and approved by the Government's Contracting Officer's Representative (COR) at the time of award and is subject to change based on mission requirements.

The contractor is expected to provide daily coverage (Monday – Friday, excluding federal holidays) at the DISA location (6914 Cooper Avenue, Fort Meade, Maryland 20755), in meetings and discussing the schedules and other programmatic details with DISA program personnel. Core hours of support are from 0900 to 1500 Eastern Time (ET)

Travel in and around the primary place of performance may be required throughout the period of performance. Additional travel within CONUS may be required to support the requirements of this PWS.

Any travel shall be required to participate in technical exchange, integration meetings, and training. Specific travel requirements will be coordinated with the COR and Program Manager and must be in accordance with the Federal Acquisition Regulation (FAR). Written approval from the COR is required before commencing any travel or incurring any expenses. Reimbursement for travel expenses will be made in accordance with the FAR 31.205-46 “Travel costs” and will not exceed the Government allowance for travel and per diem. Copies of all travel receipts must be attached in Wide Area Workflow to ensure timely invoice approval.

Secondary Place of Performance – Contingency Only. As determined by the Contracting Officer’s Representative (COR), contractor employees may be required to work at a secondary place of performance (e.g., home, the contractor's facility, or another approved activity within the local travel area) in cases of unforeseen conditions or contingencies (e.g., pandemic conditions, exercises, government closure due to inclement weather). Additionally, the contractor may be required to account for the physical location of their personnel should this information be requested by the COR. Non-emergency/non-essential contractors should not report to a closed government facility. Contractor shall prepare all deliverables and other contract documentation utilizing contractor resources. To the extent possible, the contractor shall use best efforts to provide the same level of support as stated in the PWS. In the event the services are impacted, reduced, compromised, etc., the Contracting Officer or the contractor may request an equitable adjustment pursuant to the Changes clause of the contract.

10. Period of Performance. The base period of performance is one year after contract award; with two (2) optional periods of performance.

Recognized Federal Holidays: The contractor is not required to perform services on Federal Holidays (as specified on the U.S. Office of Personnel Management website), unless otherwise specified by the COR.

Unplanned Federal Government Closure: In the event an authorized official, by either executive or legislative order, declares Federal offices closed (treated as a holiday for pay and leave purposes), the order only applies to Federal employees (unless otherwise stated in the order).

11. Security Requirements. This section supplements Block 13 of the Government provided DD Form 254, Contract Security Classification Specification. The following security requirements shall apply to this effort.

NOTE: This Indefinite Delivery Contract’s security requirements/DD254 will cover all future Tasks Orders; DD254s will not be required for individual task orders.

The contractor shall coordinate visits with site Point of Contract (POC)s providing at least a 72-hour notice (or according to each site security requirements) prior to any site access. Contractor personnel without security clearances performing any task under this PWS must be escorted by cleared DISA personnel (civilian, military, or contractor).

References:

11.1 Facility Security Clearance. Work performed under this contract/order is up to the Secret level and will require Sensitive Compartmented Information (SCI) access eligibility for some personnel. Therefore, the company must have a final Secret Facility Clearance from the Defense Counterintelligence and Security Agency (DCSA) Facility Clearance Branch.

11.1.2 Invalidated Facility Clearance. Companies with invalidated facility clearances (including those in partnerships, subcontracts, and Joint Ventures) are not eligible to bid on or be awarded any new or additional DISA classified contracts, subcontracts, or receive additional classified information except for information necessary for the completion of your current classified contracts. In addition, those companies with invalidated facility clearances will not be permitted access to all DISA networks. Performance on any DISA classified contracts, at any location, will not be authorized until it has been granted a Facility Security Clearance (FCL) at the appropriate level by DCSA.

11.2 Security Clearance. All personnel performing on or supporting a DISA contract/order in any way shall be United States citizens. The personnel security requirements for this contract/order cover the individuals supporting the Task Areas delineated in the table below. Contractor personnel must possess the interim or final security clearance eligibility delineated in the table below when performance starts.

11.3 All personnel requiring Secret access under this contract/order shall undergo a favorably adjudicated Tier 3 (T3) Investigation formerly known as a National Agency Check, Local Agency Check and Credit Check or Access National Agency Check and Inquiries as a minimum investigation. Enrollment into Continuous Evaluation current within 5 years and, reflected in DISS, would meet the requirement for a current PR.

11.3.1 The contractor is required to have personnel cleared with an interim Secret (as specified in the table located in section 11.2) at agreement start date. If contractor personnel are replaced during performance of the agreement, replacement personnel should also have interim Secret clearance (as specified in the table located in section 11.2).

11.4 Visit Authorization . Visit requests shall be processed and verified through the DISS to the Security Management Office (SMO) SMO DKAWMD-DISA RME-129. DISS visits for contracts/orders are identified as “Other” or “Temporary Additional Duty (TAD)/Temporary Duty (TDY)” and will include the Contract/Order Number of the contract/order in the Additional Information section. Contractors that do not have access to DISS may submit visit authorizations by e-mail in a password protected portable document format file (.pdf) to the COR/ACOR specified in PWS/SOW Section 1.0.

*Prior coordination with the DISA COR should be made via email to ensure the Visit Authorization Letter (VAL)/ Visit Authorization Request (VAR)/ Visit Termination Notification (VTN) process is agreed upon and properly secure.

11.4.1 VAR Package. VAR Centers must receive VAR packages from the Security Manager (via email and require pre-approval from the assigned DISA COR) at a minimum of five business days in advance of the initial report date or renewal. For option years, VARs should be renewed 30-90 days prior to the expiration date unless modified sooner for changes such as name, COR/sponsor, contract modification, etc. As an option, a VAR can be approved for up to a maximum of three (3) years within the POP for contractors. The VAL/VAR/VTN should be sent via email to the appropriate COR. The VAL/VAR/VTN should be sent using in a locked “Zip” file in one e-mail and then followed up by another e-mail with the password to unlock the Zipped file, because it contains sensitive information covered by the Privacy Act.

Documents to include in the VAR Package (DISA Field Sites may have site specific VAR requirements):

NOTE: If DISS is not available, the VAL must contain the following information on company letterhead:

11.4.2 VTN Package. The Contractor FSO will forward a VTN letter to the DISA COR identified in the PWS/TO/Sub for all employees leaving the contract/task order/subcontract.

11.4.2.1 In addition, the DISA CORs and security managers shall inform the DISA Security Office when contractor personnel are removed for cause from a contract supporting DISA. This step is to identify contractor personnel removed for security related issues in case of a return to DISA without appropriate vetting.. This step will also provide security with pertinent information to make an informed decision regarding potential contractor employees’ access to secure facilities and sensitive information. “For Cause” is information regarding an individual that falls into one or more of the actions or incidents that are within one of the 13 adjudicative guidelines as cited in the Security Executive Agent Directive (SEAD) 4:

Other actions:

The VTN must contain the following information on company letterhead:

*Any VAL/VAR submitted without the above information will be denied.*

11.5 Security Contacts. DISA Security Personnel can be contacted for Industrial or Personnel Security related issues at the following:

Defense Information Systems Agency

Defense Information Systems Agency

ATTN: J-16, Industrial Security

ATTN: J-16, Personnel Security

Command Building

Command Building

6910 Cooper Ave.

6910 Cooper Ave.

Fort Meade, MD 20755-7088

Fort Meade, MD 20755-7088 disa.meade.j1.mbx.mp6-industrial-security@mail.mil disa.meade.j-1.list.mp6-personnel-security@mail.mil

For Center or Directorate-specific security related matters, contact the Directorate or Center Security Manager at:

Defense Information Systems Agency ATTN: Christine S. Armond Comm: 667-890-2958 Email: disa.letterkenny.eiic.list.security-mgmt-team@mail.mil

11.6 Information Security and other miscellaneous requirements.

11.6.1 Contractor personnel shall comply with all local security requirements including entry and exit control for personnel and property at the Government facility.

11.6.2 Contractor employees shall be required to comply with all Government security regulations and requirements. Initial and periodic safety and security training and briefings will be provided by Government security personnel. Failure to comply with Government security regulations and requirements shall require the company to provide the Government with a written remediation/corrective action plan; furthermore, failure to comply with such requirements can be cause for removal and the contractor will not be able to provide service on this contract/order.

11.6.3. Contractor employees with an incident report in DISS who have had their access to classified suspended will not be permitted to fill positions requiring access to classified information on a DISA contract/order.

11.6.4 The Contractor shall not divulge any information, classified or unclassified, about DoD files, data processing activities or functions, user identifications, passwords, or any other knowledge that may be gained, to anyone who is not authorized to have access to such information. The Contractor shall observe and comply with the security provisions in effect at the DoD facility. Identification shall be worn and displayed as required.

11.6.5 The authority for the contractor personnel to regain access must be granted by DISA Chief of Security.

11.6.5.1 DISA retains the right to request removal of contractor personnel regardless of prior clearance or adjudication status, whose actions, while assigned to this contract, clearly conflict with the interest of the Government.

11.6.5.2 DISA retains the right to revoke access to DISA facilities and networks from contractor personnel who violate one or more of the National Security Adjudicative Guidelines, harassment, insider threat, counterintelligence, or violence in the workplace while assigned to a contract clearly conflict with the interest of the Government.

11.6.5.3 If contractor employee is accused of violating state or federal laws and/or Government professional conduct policies or regulations, then the Government may require that such contractor employee be removed from Government premises and/or that such contractor employee be removed from supporting this contract, pending the duration and outcome of a Government investigation if the Contracting Officer finds that the conduct or violation alleged has the potential to negatively interfere with contract performance or operations at a Government facility. Only the Contracting Officer can make such a request on behalf of the Government. Removal of contractor employee shall not negatively impact contract performance.

11.6.6 Contractor personnel will generate or handle documents that contain Unclassified or Controlled Unclassified Information (CUI) at the [Government and/or contractor] facility. (If appropriate to the contract/order, insert: Contractor personnel will generate or handle documents that contain Proprietary, Contract Sensitive, or similarly designated information at the [Government and/or contractor] facility.) Contractor personnel will have access to, generate, and handle classified material up to CONFIDENTIAL/ SECRET/TOP SECRET/TOP SECRET SCI level only at the [Government and/or contractor] location(s) (Ref: Block 8 Place of Performance on DD254) and listed in the place of performance section of this document. All contractor deliverables shall be marked in accordance with DoDM 5200.01, Vol. 2, DoD Information Security Program: Marking of Information; DoDI 5200.48, Controlled Unclassified Information (CUI); and DoDM 5400.07, Freedom of Information Act Program, unless otherwise directed by the Government. The contractor shall comply with the provisions of 32 CFR Part 117, “National Industrial Security Program Operating Manual (NISPOM)” for handling classified material and producing deliverables. The contractor shall comply with DISA Instruction 630-230-19, Cybersecurity.

11.6.7 The Contractor shall afford the Government access to the contractor’s facilities, installations, operations, documentation, databases and personnel used in performance of the contract/order. Access shall be provided to the extent required to carry out a program of IT inspection (to include vulnerability testing), investigation and audit to safeguard against threats and hazards to the integrity, availability and confidentiality of data or to the function of information technology systems operated on behalf of DISA or DoD, and to preserve evidence of computer crime.

11.6.8 Foreign Travel Requirements: DISA Contractors are required to submit their official and unofficial foreign travel and foreign contacts via the Corporate Management Information Systems (CMIS) which may require a dual reporting requirement in accordance with DISA Instruction 240-110-35; DISA Instruction 240-110-43; Security Executive Agent Directive 3 (SEAD 3) Reporting Requirements for Personnel with Access to Classified Information or Who Hold a Sensitive Position.

11.6.9 Mandatory Security Training. All DISA Contractors are required to complete the DoD initial and annual security training for the following in accordance with (IAW) 32 CFR Part 117, National Industrial Security Program Operating Manual (NISPOM):

11.6.9.1 Contractors supporting DISA onsite are required to complete the DoD initial or annual training through the DISA mandatory training system.

11.6.9.2 Contractors supporting DISA offsite are required to meet the DoD initial or annual training requirement through their employers who are to provide this training and maintain training documentation. The contractor supervisor needs to certify in writing and email completion certificates to the COR and DISA Security Manager that off-site contractors completed the training before receiving credit. The DISA Security Manager will update CMIS records, if available.

12. Government Furnished Property (GFP)/Government-Furnished Equipment (GFE)/ Government-Furnished Information (GFI).

GFP will be provided for this contract as indicated in the GFP attachment included at solicitation, distributed at award and incorporated via the GFP Module in PIEE. GFP shall be managed IAW the terms of FAR 52.245-1, corresponding GFP Defense Federal Acquisition Regulation Supplement (DFARS) clauses and additional DITCO Instructions incorporated in award.

Contractors shall accept and/or report provided GFP via the Shipping and Receiving document in the GFP module upon acceptance and/or IAW Additional DITCO Instruction H9. Serially managed items are provided to the contractor by DoD and require all events identified in DFARS 252.245-7005 (and/or any subsequent DFARS or Agency GFP reporting requirements) to be reported by the contractor.

Contractors in possession of GFP shall provide the COR or PA an annual report of all GFP in its possession to include the item description, make, model, serial number, IUID, and last inventory date; the report should be minimally provided on an annual basis and 30 days prior to the expiration of any performance period (base and options) IAW with Additional DITCO Instruction H9.

Deliverable:

13. Other Pertinent Information or Special Considerations.

a. Identification of Possible Follow-on…