DMOC_ DoD ERG PWS_20220405 (Revised - Final).pdf

1 Ver: Aug 2021

Performance Work Statement (PWS) Employee Resource Group (ERG) Support

1.0 INTRODUCTION

The Diversity Management Operations Center (DMOC) requires expertise to assist with establishing DoD Employee Resource Group (ERG) guidance through training workshops, ERG reference materials, and industry/ERG best practices. Guidance and training will educate leadership and ensure proper utilization/management of DoD resources supporting ERGs and provide standardization/consistency of practices within the department.

2.0 BACKGROUND

DMOC is establishing guidance and developing training to bring oversight, standardization of policy, and proper use of DoD ERGs to support diversity and inclusion. The Secretary of Defense made diversity, equity, and inclusion (DEI) a priority within the department. On July 14, 2020, OSD released immediate actions to address diversity, inclusion, and equal opportunity in the military services. A message to the Force on March 4, 2021, outlined priorities to address growing talent by focusing on efforts to build a range of skills and capabilities in the workforce and remove barriers that limit people from realizing their full potential. Further stated were ways to build resilience and readiness in the force, a need to embrace diversity of backgrounds, experiences, and thoughts that strengthen DoD’s core values, to build diversity, equity and inclusion into all aspects of the Department’s work and drive toward innovative solutions across the enterprise.

A Defense Equity Team (DET), co-chaired by the DMOC Director and Office of Diversity, Equity and Inclusion is responsible for providing oversight for all internal and external requirements with D&I equities. The Associate Director, Diversity and Inclusion (D&I) provides support for the DET by tracking and maintaining accountability of information reported to OSD. Additionally, many recently issued National Defense Authorization Acts (NDAAs), Executive Orders, and Government Accountability Office reports have Diversity, Equity, Inclusion, and Accessibility (DEIA) requirements and ERGs are outlined as one of the initiatives.

ERGs are a value-proven asset and tool to assist leaders with understanding DEIA perspectives within the organization, workplace culture/barriers impacting employees, and formulate potential solutions to organizational challenges. They also facilitate educational and cultural events that foster inclusivity and awareness. Finally, ERGs provide opportunities for leaders to address gaps in development and barriers impacting underrepresented groups at the senior ranks.

3.0 SCOPE

The Contractor shall provide the expertise, personnel, management and materials necessary to conduct ERG training sessions, present networking opportunities, formulate model ERG constructs, benchmark best ERG practices, and advise on DoD ERG development.

2 Ver: Aug 2021

4.0 REQUIREMENTS The Contractor shall:

4.1 Develop and provide a comprehensive ERG Impact Study that showcases industry best practices and recommendations.

4.2 Develop a plan that includes best practices and provides recommendations in support of a

DoD-level ERG Strategic Implementation Plan.

4.2.1 Conduct an analysis on the current-state of DoD ERG programs and present a comparison that includes industry standards.

4.2.2 Conduct assessments within the DoD Components and provide recommendations for ERG success and sustainability.

4.3 Conduct ERG Trainings virtually or in person.

4.3.1 Offer and provide ERG Executive Sponsor training forum for DoD Executive Leadership annually.

4.3.2 Offer and conduct three ERG trainings for D&I Program Managers and ERG Leadership, in DoD Components annually.

4.3.3 Provide access to minimum of 35 registrations per session to facilitate four (interactive) development sessions with ERG Leaders annually.

4.3.4 Offer and facilitate one consulting with industry ERG Leaders for the DoD Components annually.

4.3.5 Conduct minimum of one ERG Leader Series (Mastermind Group) for Program Managers, Executive Sponsors, and DEI Executives annually.

4.3.6 Provide access to minimum of 15 registrations for National ERG Summit and Leadership

Forum annually.

4.4 Develop and create Reference materials:

4.4.1 Review and provide annual progress assessment of DMOC D&I with DoD ERG Manual.

4.4.2 Create visual aids and presentations for all training at least 10 days in advance of event.

4.5 The Contractor shall provide a monthly written status report documenting task support, issues, and progress. The report shall detail contractor activities during the reporting month and plan for the following two months. The report shall also include a summary of work performed, deliverables completed, current or projected problems and issues and their resolution, an explanation of the deviations from the last month’s projections, and any recommendations related to the effort.

3 Ver: Aug 2021

5.0 DELIVERABLES

The Contractor shall provide deliverable(s) in a format mutually a greed upon by the Government and the Contractor. All deliverables will be reviewed for timeliness, accuracy and must be submitted in Microsoft Word or Adobe PDF format. If a deliverable due date falls on a weekend or holiday, the Contractor shall submit the deliverable on the last work day prior to the due date. In fulfillment of this effort, the Contractor shall provide the following deliverables to the COR:

PWS Reference Deliverable Delivery Date

Base Year, 4.1, 4.4.2

Impact Study, results presented in a written brief with infographic and concise recommendations and benchmarks

NLT 90 days after contract award

Base Year 4.4.2

Synergize Toolbook (min 50 copies) NLT 90 days after contract award

Base Year, 4.2, 4.2.1, 4.2.2, 4.4.2

DoD ERG Strategic Implementation Plan Session

NLT 150 days after contract award

Base Year 4.4.1

DoD ERG Guide Review and Recommendations

NLT 180 days after contract

Base year and Option 1-4 4.3.1

Annual Executive Forum/Conference (virtual or in-person

300 days after completion of contract to include all option periods

Base year 4.3.2, 4.4.2

Three Virtual/In-person customized ERG Development Training for D&I Manager and ERG Leads

Base year plus option periods

Base year 4.3.3, 4.4.2

Four Virtual/In-person Interactive Mentorship Session

Base Year 4.3.5

One Mastermind Group Series for ERG Leaders, Executive Sponsors, and DEI Executives (max participants) annually

Option years 1-4 4.3.4

Minimum one Virtual/In-Person Mentoring sessions and consulting with industry ERG Leaders for the DoD Components annually

Base year and Option years 1-4 4.3.6

Annual ERG training conference Base year plus option periods

Base year and Option years 1-4 4.4.1, 4.4.2

Progress Assessment 345 days after contract award and after option periods 1-4

4 Ver: Aug 2021

PWS Reference Deliverable Delivery Date

Base year and Option years 1-4 4.4.2

Presentation Documents Initial draft due 10 days before each event

Final due 3 days before each event

Base year and Option years 1-4 4.5

Monthly Status Report 15 days after each month

Base year and Option years 1-4 13.0

Contractor Training Certificates 30 days after contract award 30 days after the start of new personnel, and annually

6.0 CONTRACTOR TRAVEL

Travel is required to various CONUS locations. Commuting expenses within the National Capital Region will not be reimbursed. The contractor shall provide a written request for travel to the COR prior to finalizing any travel arrangements. All travel must be approved by the COR prior to purchase of tickets and commencement of travel. The contractor shall be reimbursed for actual allowable, allocable, and reasonable travel costs incurred during performance of this effort in accordance with the FAR 31.205-46 “Travel Costs”. Requests for approval of costs in excess of maximum per diem rates in accordance with the procedures contained in FAR 31.205-46(a)(3) must be submitted to the Contracting Officer for final approval prior to commencement of travel. Travel not to exceed $7,000 per year.

Note: Contractor travel for contract related meetings or performance reviews at the Government’s location is considered a cost of doing business.

7.0 SECURITY

7.1.1 Personnel Security. All Contractor personnel assigned to this contract are required to obtain and maintain the appropriate background investigation (BI) and adjudication or suitability determination in accordance with DODI 5200.02-DoD Personnel Security

Program (PSP) and per individual’s job assignment that meets access requirements according to this contract. This includes, but is not limed to those who, in order to perform the work specified under the contract, will require access to space, information, information technology systems, staff, or other assets of the Federal Government. Including, personnel requiring a DoD credential, also known as the Common Access Card (CAC) for physical and logical access to federally controlled facilities and or information systems (IS).

7.2 All persons on this contract will be designated in a Non-Critical Sensitive position (IT-II) as determined by the Government per position responsibilities. The contractor shall assure that individuals assigned to the positions of this task order, as determined by the

Government, have completed the designated Tier BI or equivalent according to the Defense

Counterintelligence and Security Agency (DCSA) and The Office of Personnel Management

(OPM) investigative alignment.

5 Ver: Aug 2021

7.2.1 Provide personnel already vetted or able to undergo a background investigation (BI) according to Department of Defense (DoD) regulations. The BI must meet or exceed the sensitivity designated by the Government.

7.2.2 Prior to requesting access to DHRA sponsored resources (e.g., DoD ID/CAC, Computer, Systems, email or facility), the appointed contractors will be expected to already have sufficient background that meets the contract requirements. At minimum the contractor have obtained interim eligibility from the Department of Defense (DoD) Consolidated

Adjudications Facility (CAF) or interim IT-I/IT-II/IT-III Position of Trust eligibility sponsored by the DHRA-DEOC Security and approved by the Defense Logistics Agency

(DLA) Personnel Security (PERSEC). Eligible interim Position of Trust personnel expectations include, but are not limited to:

7.2.2.1 Contractor also known as the Applicant shall have completed all personnel security requirements as specified by DHRA-DEOC Security and DLA PERSEC.

7.2.2.2 The interim sponsored contractors are expected to comply with all investigative and adjudicative requirements, which includes responsiveness to time-sensitive requests (e.g., interview(s), additional information or clarification) from the DLA PERSEC, investigator or the adjudicative agency (DoD CAF).

7.2.2.3 Attained a favorable eligibility to the designated BI.

7.2.2.4 If at any time, any Contractor personnel are unable to obtain/maintain an adjudicated Tier

BI, the Contractor or Program Manager shall immediately notify the COR and coordinate removal of such a person from work under this contract.

7.2.3 Per Executive Order E.O 13488, Granting Reciprocity on Excepted Service and Federal Contractor Employee Fitness and Reinvestigating Individuals in Positions of Public Trust.

The DHRA-DEOC Security and DLA PERSEC, will use reciprocity to the extent possible and if necessary will request re-adjudication by the (DoD) Consolidated Adjudications Facility (CAF) to support the DoD standards. Reciprocity consideration includes verifying break in service longer than 24 months as a US Military, US Civilian or Contractor from the last favorable investigation.

7.2.4 The BI process for designated Contractor employees supporting this contract shall be initiated immediately after contract award and shall be completed prior to the end of the transition period. Submit a request and list of personnel for security investigation to the DoD Government Security Office point of contact(s) -to be provided by the COR- NLT five

(5) business days after contract award.

7.2.5 Submit confirmation via contractor-generated email to the COR NLT five (5) business days after submission of the request and list of personnel to the Government Security Office.

7.2.6 It is the responsibility on the contractor to ensure their employees and sub-contractors (if applicable) comply with DHRA and DLA PERSEC Security requirements.

6 Ver: Aug 2021

7.2.7 The contractor shall have personnel that are Citizens of the United Sates. All contractor/subcontractor personnel must be U.S Citizens. This includes personnel who bill the DoD Government for goods or services or that are assigned or working on the contract at any remote sites.

7.2.8 Contractor personnel with Tier background investigation who are assigned to perform work under this contract shall be suitable to obtain a DoD Credential, also known as the Common Access Card (CAC). The cost is borne by the Government. All CAC applicant must meet the minimum HSPD-12 security requirements with favorable FBI fingerprint check an open Tier BI, which meets job, functions or need-to-know for access.

7.2.9 Personnel assigned to perform work under this contract may require access to Government resources (e.g., websites requiring CAC, Public Key Infrastructure [PKI], local badges, Contractor CACs and facility specific identification badges). Personnel required to obtain a CAC may be issued GFE (e.g., computer/laptop, etc.).

7.2.10 Provide a list of all contractor personnel requiring entry to on-site staffed locations/installations to the QAE and the COR NLT 60 calendar days prior to the service start date. List shall be submitted via contractor-generated email and include the individuals’ full name, aliases, Social Security Number (SSN) (if applicable), and home address and shall indicate the location(s) which each individual will require entry.

7.2.11 Provide personnel capable of obtaining and maintaining access to all DoD installations/Military bases by utilizing the appropriate personnel identification/force protection system applicable at each site/location. The cost to obtain and maintain base access shall be borne by the Contractor.

7.3 Off boarding. If at any time, any Contractor personnel requiring a CAC are unable to obtain/maintain an adjudicated Tier BI, the Contractor shall immediately notify the COR and coordinate removal of such a person from work under this contract and replace the individual with appropriate level background investigation knowledge, skill and ability (KSA) set to do the job.

7.3.1 As the contractor replaces employees or upon completion of the contract, relocation or termination of an employee, or upon request from the COR in accordance with facility information and security policies. The contractor shall submit the outgoing employee’s installation access and return all CACs/badge(s)/identification card(s) immediately to the local Installation Access Control Office or Government Security Office.

7.3.2 Submit confirmation via contractor-generated email to the QAE and the COR within three

(3) business days of turning in the outgoing employee’s access badge/identification card(s).

The confirmation email shall include the employee name, location(s)/installation(s) and date the installation access badge/identification card(s) were turned in to the local Installation Access Control Office or Government Security Office.

7.3.3 The Contractor Personnel list shall be updated within three (3) business days of changes or every 90-calendar days whichever comes first.

7 Ver: Aug 2021

7.4 Access to Sensitive Information. To the extent that the work under this contract requires the Contractor to have access to DoD sensitive information the Contractor shall after receipt thereof, treat such information as confidential and safeguard such information from unauthorized use and disclosure. The Contractor agrees not to appropriate such information for its own use or to disclose such information to third parties unless specifically authorized by the Government in writing.

7.4.1 The Contractor shall allow access only to those employees who need the sensitive information to perform services under this contract and agrees that sensitive information shall be used solely for the purpose of performing services under this contract. The Contractor shall ensure that its employees will not discuss, divulge or disclose any such sensitive information to any person or entity except those persons within the Contractor’s organization directly concerned with the performance of the contract.

7.4.2 The required investigation shall be completed or interim access granted for individuals assigned to sensitive duties.

7.5 Position of Trust Requirements. The Defense Counterintelligence and Security Agency

(DCSA) and The Office of Personnel Management (OPM) offers Tier background investigations (BI), Tier-1 (T1)/Tier-3 (T3)/Tier-5 (T5) for Position of Trust (POT) determination. The T5 being the most stringent investigation and T1 being the least stringent. The Government is responsible for the cost of POT or sponsor a DoD-determined equivalent background check for UNCLASSIFIED access. A BI equivalency will be according to the investigative alignments offered by the Office of Personnel Management and the Defense Counterintelligence and Security Agency (DCSA) here, https://www.dcsa.mil/Portals/91/Documents/pv/GovHRSec/Position_Designation_Investi gation_Type_Chart_Sept_2017.pdf

7.5.1 The DoD BI for Position of Trust determination requires fingerprints, proof of US

Citizenship and a Personnel Security Questionnaire (PSQ) on the Standard Form (SF) 85/86 using the Electronic Questionnaire for Investigations Processing (eQIP) and if required, an OF306. The Contractor employees shall provide all requested information pursuant to the Privacy Act of 1974 when requested by the Government. The Government Security Office will provide instructions according to the individual case and Tier BI to access the eQIP system. For information visit: eQIP: https://www.dcsa.mil/is/eqip.

7.5.2 The Position of Trust applicants under this contract must obtain at a minimum interim eligibility from the Defense Logistics Agency (DLA) prior to the assignment and performance of sensitive duties. All POT applicants must comply with the respective agency conducting the investigation and obtain a favorable adjudicated determination from the DoD CAF.

7.6 Information Technology (IT) Level Investigation Requirements. Contractor personnel, who perform work on sensitive networks, IT systems or applications, will be required to obtain and maintain the appropriate investigation and adjudication determination. The Contractor shall assure that individuals assigned to the positions determined by the Government, undergo the respective BI and have obtained the proper eligibility, based on job function or tasks performed by the contractor personnel.

https://www.dcsa.mil/Portals/91/Documents/pv/GovHRSec/Position_Designation_Investigation_Type_Chart_Sept_2017.pdf https://www.dcsa.mil/Portals/91/Documents/pv/GovHRSec/Position_Designation_Investigation_Type_Chart_Sept_2017.pdf https://www.dcsa.mil/is/eqip

8 Ver: Aug 2021

7.6.1 The designation of one of three IT access levels, IT-I/IT-II/IT-III will determine the access level needed to perform work on the DoD IT Systems/Networks. The IT access level is designated based on the IT system/network requirements according to the DoD Cyber, Security Technical Implementation Guides (STIGs) and the individual contractor’s job functions, which may include, but not be limited to the following for all DHRA IT systems/Applications:

7.6.2 IT- I – Privilege – High Risk: All personnel in positions in which the individual is responsible for the planning, direction, and implementation of a computer security program. Significant involvement in life-critical or mission-critical systems or relatively high risk for causing grave damage to National Security. All personnel identified in one or of the job, functions or roles described here must complete Tier-5 (T5) BI. Tier 5/Tier 5R for Special-Sensitive/Critical-Sensitive role. Roles may include, but is not limited to:

Enterprise Administrator Domain Administrator (AD Admin) Server or System Administrator Network Administrator Desktop/Workstation Administrator Database Design and Administration Database – System DBA (Sudo to Oracle, Remove Logs, Modify items that change STIG posture) Database – Application DBA (Select / add / update data, can deploy objects: SQL types, packages, triggers, etc.)

Application Administrator Web Design and Administration Other: Positions with major responsibility include the direction, planning, design testing, maintenance, operation, monitoring, and/or management of systems hardware and software; or, can access a system during the operation or maintenance. (e.g., privileged access and/or systems security oversight).

7.6.3 IT-II – Authorize – Moderate Risk: All personnel in positions in which the individual is responsible for the-direction, planning, design, operation, or maintenance of a computer system, and whose work is technically reviewed by a higher authority of the IT-I to ensure the integrity of the system. All personnel identified in one or of the job, functions or roles described here must complete a Tier 3/Tier 3R for Noncritical-Sensitive role. Roles may include, but is not limited to:

Access to and/or processing of proprietary data, information requiring protection under the Privacy Act of 1974.

Those with the ability to aggregate and extract data en masses from an automated records repository containing PII.

Other positions designated by the Agency head that involve a degree of access to a system that creates a significant potential for damage or personal gain less than that in IT-I positions.

9 Ver: Aug 2021

7.6.4 IT-III – Other – Low Risk: All other non-sensitive determined low-risk positions involved in computer activities requiring a Common Access Card (CAC) to access. Positions designated by the Agency head that involve a degree of access to a system that creates minimum to low damage less than that in IT-II positions. For IT-III, designations at minimum shall obtain a favorable Tier-1 (T1) or equivalent BI for Non-Sensitive roles.

7.6.5 In establishing the IT categories of positions, other factors may enter into the determination, permitting placement in higher or lower categories based on the Agency's judgement as to the unique characteristics of the system or the safeguards protecting the system.

7.6.6 IT-Level position category designation does not imply or convey access to classified information. Instructions for access to classified information, if necessary, will be included on the DD Form 254 attached to this contract.

7.7 Personal Identifiable Information (PII) and Tier Investigations. All personnel requiring

Information Technology (IT) or access to DoD Information Systems that contain military active duty, guard, or reservists’ personally identifiable information (PII) or information pertaining to Service members that are otherwise protected from disclosure where such access has the potential to cause serious damage to national security. Access to PII data, include, but is not limited to the abilities and capability according to the job functions.

7.7.1 The Contractor shall report immediately to the DHRA Privacy Office and secondly to the

COR discovery of any Privacy breach.

7.7.2 Tier 5/Tier 5R for Special-Sensitive/Critical-Sensitive – High Risk: All personnel with administrative capabilities in a system storing PII, personnel security investigations or adjudication determination requires a Tier-5 (T5) BI.

7.7.3 Tier 3/Tier 3R for Noncritical-Sensitive – Moderate Risk: All personnel with the ability to aggregate and extract military PII en masses from an automated records repository requires at a minimum, a favorably adjudicated Tier-3 (T3) BI or equivalent.

7.7.4 Tier 1 for Non-Sensitive – Low Risk: All Personnel whose access to military PII is limited to data entry or singular search capability require, a minimum, a favorably adjudicated Tier-1

(T1) BI.

7.8 Listing of Employees & Clearance Documentation. The Contractor shall maintain a current listing of employees. Within 10 calendar days of contract award, the Contractor shall provide the COR a list with the names, location of performance and clearance requirements of all company employees assigned to this effort. The list shall be validated and signed by the company and provide copy to DHRA-DEOC Personnel Security. An updated listing shall be provided when an employee's status or information changes.

7.9 Controlled/Restricted Areas. The Contractor shall be compliant with local procedures for entry to DHRA controlled/restricted areas where Contractor personnel will work.

7.10 Physical Security. The Contractor shall safeguard all Government property and controlled forms provided for Contractor use and adhere to the Government property requirements

10 Ver: Aug 2021 contained in this contract. At the end of each work day, all Government facilities, equipment and materials shall be secured.

7.11 Pass and Identification Items. The Contractor shall ensure the pass and identification items required for contract performance are obtained for employees and non-government owned vehicles.

7.11.1 Comply with HSPD-12 Personal Identity Verification (PIV) issuance requirements, known as the Common Access Card (CAC).

7.11.2 Contractor personnel shall be immediately CAC ready prior to reporting for work. Obtaining CAC or PIV ready status is the responsibility of the contractor.

7.11.3 At a minimum, all Contractor personnel must obtain/maintain a favorable Tier 3 or equivalent BI. This requirement is critical in order to access the database systems within DHRA and its Directorates. The DHRA-DEOC Security Office or COR will notify the Contractor if security requirements change.

7.11.4 All Contractor personnel must obtain/maintain a favorable FBI National Criminal History

Check (fingerprint check).

7.11.5 Provide two forms of identification (I-9 document).

7.11.6 Personnel must be citizens of the United States.

7.11.7 Personnel must comply with the DCSA investigative requirements that meets CAC and the individual’s access designation according to their job, functions and need-to-know.

7.11.8 Maintain favorable FBI National Criminal History checks and ensure completion and successful adjudication as required for Federal employment.

7.11.9 Obtaining CAC or PIV ready status is the responsibility of the Contractor and is the responsibility of the Contractor to notify DMDC when this is complete.

7.12 Retrieving Identification Media. The Contractor shall retrieve all identification media, including vehicle passes from employees who depart for any reason before the contract expires; e.g. terminated for cause, retirement, etc.

7.13 Weapons, Firearms, and Ammunition. Contractor employees are prohibited from possessing weapons, firearms, or ammunition, on themselves or within their contractor-owned vehicle or privately-owned vehicle while on all DHRA installations.

7.14 Controlled Unclassified Information Requirements for DoD Contractors. The following procedures will be used to protect Controlled Unclassified Information (CUI) documents and materials:

7.14.1 HANDLING: Access to CUI material shall be limited to those employees needing the material to perform their duties. The CUI marking is assigned to documents and material created by a DoD User Agency. CUI is not a classification, but requires extra precautions to ensure it

11 Ver: Aug 2021 properly safeguarded and disseminated and is not released to the public without government authorization.

7.14.2 MARKING: Mark unclassified documents containing CUI: “CUI" at the top and bottom of each page, include the CUI warning box, and the CUI Designation Indicator Block as required in DoDI 5200.48. In a classified document:

7.14.2.1 Mark individual paragraph containing only CUI, but not classified material by placing “(CUI)" at the beginning of the portion.

7.14.2.2 Mark top and bottom of each page with classified material with the highest security classification of the material on the page.

7.14.2.3 If the document or material contains CUI under the category of Controlled Technical Information (CTI), use of distribution statements is required. See DoDI 5200.48.

7.14.2.4 If a classified document contains CUI material or if the classified material becomes CUI when declassified, place the following statement on the bottom of the cover or the first page under the classification marking: “NOTE: If declassified, review the document to make sure the material is not still CUI. If it does, then it must have the appropriate safeguarding, dissemination controls, and CUI markings applied.

7.14.2.5 Mark other records such as computer print outs, photographs, films, tapes, or slides in accordance with DoDI 5200.48 so the receiver or viewer knows that it contains CUI material.

7.14.2.6 Mark a message containing material in accordance with DoDI 5200.48. Unclassified messages containing CUI material must show the abbreviation (CUI) before the text begins.

7.14.2.7 Ensure documents transmitting CUI material call attention to any attachments containing CUI.

7.14.2.8 CUI material released to a contractor by a DoD user agency must have the following statement on the front page or cover: “THIS DOCUMENT CONTAINS CUI MATERIAL AND

MUST BE REVIEWED BY A GOVERNMENT REPRESENTATIVE UNDER THE

REQUIREMENTS OF DODI 5200.48, DODI 5230.09, and DODI 5230.29.”

7.14.3 STORAGE: During normal duty hours, place CUI material in an out-of-sight location if your work area is accessible to persons who do not have an authorized government purpose for access to the material. After normal duty hours, store CUI material to prevent unauthorized access. File with other unclassified records in unlocked files or desks when internal building security is provided and the file is marked as CUI. When there is no internal security, locked buildings or rooms usually provide adequate after hours’ protection. For additional protection, store CUI material in locked containers such as file cabinets, desks, or bookcases.

Expenditure of funds for security containers or closed areas solely for the protection of CUI material is prohibited.

7.14.4 TRANSMISSION: CUI documents and materials may be transmitted via first class mail, parcel post or for bulky shipments-fourth class mail. Within the CONUS discussion of CUI material on the telephone is authorized if necessary for the performance of the contract and

12 Ver: Aug 2021 no alternative is available. Electronic transmission of CUI (voice, data, or facsimile) should be by approved secure communications systems whenever practical. If there is a fax transmission, the sender must ensure the intended receiver is available to receive it or a cover sheet will be used to allow carrying it to the final recipient to avoid unauthorized disclosure of the CUI.

7.14.5 RELEASE: CUI material shall not be released outside of the contractor’s facility except to the representative of DoD or DHRA.

7.14.6 DESTRUCTION: When the CUI material no longer meets the threshold for safeguarding and dissemination, it shall be immediately decontrolled, be processed through the records management process, and destroyed by the approved methods identified in DoDI 5200.48 precluding its disclosure to unauthorized individuals by rendering it unreadable, indecipherable, and irrecoverable.

7.15 Reporting Requirements. Contractor personnel shall report to an appropriate authority any information or circumstances of which they are aware may pose a threat to the security of DOD personnel, Contractor personnel, resources, and classified or unclassified defense information.

7.16 Key Control/Access Badge Control. The Contractor shall establish and implement methods of making sure all keys/badges issued to the Contractor by the Government are not lost or misplaced and are not used by unauthorized persons. The Contractor shall not duplicate any keys issued by the Government.

7.17 Prohibited Use. The Contractor shall prohibit the use of keys, issued by the Government, by any persons other than the Contractor’s employees and the opening of locked areas by Contractor employees to permit entrance of persons other than Contractor employees engaged in performance of contract work requirements in those areas.

7.18 Government Furnished Equipment (GFE). The Contractor shall establish and implement procedures to ensure all GFE to include laptops and other data processing devices, issued to the Contractor by the Government are not lost or misplaced, are not used by unauthorized persons or are not subject to unauthorized external devices. The Contractor shall immediately report to the COR any occurrences of lost GFE within two (2) hours of discovery of occurrence. In the event that GFE is lost, the Contractor may be required, upon written direction of the CO, to replace the equipment at no additional cost to the Government. The Government may replace the equipment and deduct the cost of such from the monthly payment due the Contractor.

7.19 Conduct while on Government Installation. The CO may direct the contractor to remove an employee(s) from an assignment under this contract for reasons of security or misconduct. Where the reasons for the removal request is due solely for security or misconduct by the employee(s), the replacement shall be at the contractor’s expense and not chargeable to the government.

7.20 Information System Security. The Contractor shall implement Information System (IS) security protections and ensure the protections are appropriate to the confidentiality, integrity, and availability needs of the Government. Establish appropriate administrative, technical, and physical safeguards to protect any and all nonpublic Government data.

13 Ver: Aug 2021

7.21 Cyber Incident Reporting. Within one (1) hour of discovery of any cyber incident, the Contractor shall notify the DHRA Incident Response (IR) team by emailing an Initial cyber incident report to the following organizational box: dodhra.dodc-mb.dmdc.list.ir-team@mail.mil, with subsequent reporting every 24 hours until the incident is closed. The Contractor shall also notify the COR and CO at the time the incident is reported to DHRA/IR.

7.22 Compliance with Cybersecurity and Privacy DoD Instructions and Directives.

Establish appropriate administrative, technical, and physical safeguards to protect any and all non-public Government data to ensure the confidentiality, integrity, and availability of Government data. All Contractor personnel under this contract shall comply with all security directives and instructions and be in compliance with the latest versions of:

DoD Instruction (DoDI) 8500.01, Cybersecurity The Privacy Act (5 U.S.C. 552a) DoD Instruction 5400.11 DoD Privacy and Civil Liberties Programs, January 2019 DoD Instruction 6025.18 Health Insurance Portability and Accountability Act (HIPAA)

Privacy Rule Compliance in DoD Health Care Programs, March 2019 DoD Instruction (DoDI) 5200.02 DoD Personnel Security Program (PSP) (Incorporating

Change 2, Effective May 11, 2018) HSPD-12, Homeland Security Presidential Directive DoD Instruction (DoDI) 5200.46, DoD Investigative and Adjudicative Guidance for

Issuing the Common Access Card (CAC), (Incorporating Change 2, Effective November 2, 2020)

NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations NIST SP 800-137, Information Security Continuous Monitoring DODI 8140, Cybersecurity Workforce DOD 8570.01-M, Information Assurance Workforce Improvement Program Executive Order (E.O.) 13488 of January 16, 2009, Granting Reciprocity on Excepted

Service and Federal Contractor Employee Fitness and Reinvestigating Individuals in Positions of Public Trust.

8.0 PLACE OF PERFORMANCE

Work will be performed onsite* and offsite (virtual). Costs for travel will be reimbursed.

Note: Work will be conducted onsite based on the COVID-19 status as outlined by OMB.

9.0 HOURS OF WORK

Core hours of work are from 0900 to 1500 daily. The contractor shall be available by phone during core hours, excluding Federal holidays. Recognized Federal holidays are listed at www.OPM.gov.

10.0 QUALITY CONTROL

The contractor shall implement and maintain a Quality Control Plan (QCP) to ensure work performed conforms to the scope of work and meets the requirements under this PWS.

The QCP shall, at a minimum provide a method for performing inspections; identifying, mailto:dodhra.dodc-mb.dmdc.list.ir-team@mail.mil mailto:dodhra.dodc-mb.dmdc.list.ir-team@mail.mil http://www.opm.gov/

14 Ver: Aug 2021 correcting and preventing problems/defective service; addressing customer complaints, and improving the quality of services over the life of the contract.

11.0 QUALITY ASSURANCE

11.1. The Government reserves the right to perform inspections and surveillance to evaluate the Contractor’s compliance to the contract terms and performance of the requirements in the PWS.

11.2. Contract Discrepancy Report (CDR). In the event of unsatisfactory contractor performance, the COR or CO will issue a CDR that will explain the circumstances and findings concerning the incomplete or unsatisfactory service. The contractor shall acknowledge receipt of the CDR and respond in writing as to how he/she shall correct the unacceptable performance and avoid a recurrence. The Government will review the contractor's corrective action response to determine acceptability and will use any completed CDR as part of an overall evaluation of Contractor performance when determining present or future contractual actions.

12.0 PERFORMANCE REQUIREMENT SUMMARY (PRS)

Performance

Objective

PWS

Paragraph Performance Standard/Acceptable

Quality Level Method of Surveillance

Provide support personnel to meet PWS requirements

3.0 Performance is acceptable when all

contractor personnel possess the skills needed to perform the required tasks as specified in the PWS within 30 days after contract award.

COR

review/government personnel feedback

Provide draft presentation documents

4.4.2 Performance is acceptable when

draft documents are received 10 days prior to each event, missing no more than one deadline per quarter

COR review

Monthly Status Report

4.5 Performance is acceptable when

the report is submitted by the 15th of every month without more than one instance per quarter where a monthly report is submitted after the 15th.

COR review

13.0 MANDATORY TRAINING REQUIREMENT FOR CONTRACTOR:

Contractor employees performing under this contract shall complete the following mandatory trainings within 30 days of contract award and date of any option exercised. If additional mandatory training is required, amendment or modification will be issued to incorporate the changes.

1. OPSEC Awareness for Military Members, DoD Employees and Contractors IAW DoDM 5205.02, “DoD Operations Security (OPSEC) Program Manual,” dated October

15 Ver: Aug 2021

29,2020 is currently available at:

https://securityawareness.usalearning.gov/opsec/index.htm

2. Unauthorized Disclosure of Classified Information and Controlled Unclassified Information IAW DoDI 5200.48, “Controlled Unclassified Information (CUI),” dated March 6, 2020 is currently available at:

https://securityawareness.usalearning.gov/disclosure/index.html

3. Insider Threat Awareness IAW DoDD 5205.16, “The DoD Insider Threat Program,” dated August 28, 2017 is currently available at:

https://securityawareness.usalearning.gov/itawareness/index.htm

4. DoD Initial orientation and Awareness Training IAW DoDM 5200.01 Volume 3, Enclosure 5, is available at:

https://securityawareness.usalearning.gov/initialorientation/index.htm

5. Privacy Act and Personally Identifiable Information IAW DoDI 5400.11, “DoD Privacy and Civil Liberties Programs,” dated January 29, 2019 and the training is currently available at: https://public.cyber.mil/training/identifying-and-safeguarding-personally-identifiable-information-pii/

6. IT Security Awareness IAW title 5, Code of Federal Regulations, section 930.301 and the training is currently available at: Cyber Awareness Challenge 2022 – DoD Cyber Exchange <https://public.cyber.mil/training/cyber-awareness-challenge/>

7. Counterintelligence Awareness and Reporting Training IAW DoD Directive 5240.06, “Counterintelligence Awareness and Reporting (CIAR),” dated July 21, 2017 and the training is currently available at:

https://securityawareness.usalearning.gov/cidod/index.html

8. Annual OSD Records and Information Management Training (J3OP-US1639) IAW Administrative Instruction 15, “OSD Records and Information Management Program,” dated November 17, 2020 and the training is currently available at:

https://jkodirect.jten.mil/

The Contractor program manager shall provide a copy of its employee(s)’ training certificate to the COR to meet the mandatory training requirements https://securityawareness.usalearning.gov/opsec/index.htm https://securityawareness.usalearning.gov/disclosure/index.html https://securityawareness.usalearning.gov/itawareness/index.htm https://securityawareness.usalearning.gov/initialorientation/index.htm https://public.cyber.mil/training/identifying-and-safeguarding-personally-identifiable-information-pii/ https://public.cyber.mil/training/identifying-and-safeguarding-personally-identifiable-information-pii/ https://public.cyber.mil/training/cyber-awareness-challenge/ https://public.cyber.mil/training/cyber-awareness-challenge/ https://public.cyber.mil/training/cyber-awareness-challenge/ https://securityawareness.usalearning.gov/cidod/index.html https://jkodirect.jten.mil/