PWS_Cardstock v6 11052024.pdf

1 Ver: Nov 2023

Performance Work Statement (PWS) Defense Manpower Data Center (DMDC)

Cardstock Warehousing and Logistical Support

1.0 INTRODUCTION

The Defense Manpower Data Center (DMDC) requires cardstock and consumables logistical support to maintain the Department of Defense (DoD) Identity Credential Management program.

2.0 BACKGROUND

DMDC is the component organization within the DoD responsible for the DoD’s Department-wide Identity Credential Management program. DMDC delivers various identity credentials and tokens to include the Common Access Card (CAC) the Uniformed Services Identification (USID) cards, NIPRNet Alternate Tokens and SIPR Tokens. DMDC requires logistical support to include warehousing, card and consumables distribution, shipping, and the card return processing.

The DoD Identity Credential is accepted by more than 20 DoD and non-DoD agencies in compliance with HSPD-12 with approximately 11 million cards currently in circulation with an additional average of 350,000 cards issued monthly. DMDC is required to ensure that cardstock is available and distributed to approximately 1,900 Real-time Automated Personnel Identification System (RAPIDS) sites worldwide. DMDC also centrally manages cardstock for all non-CAC populations such as military retirees, family members, inactive reserve members and others which qualify for the credential. These are referred to as Uniformed Services Identification (USID) cards. DMDC anticipates minimal shipping support of the Alternate Tokens with an estimate of less than 50,000 annually and no support for SIPR tokens. The collective requirement for CACs, USIDs, and Alt Tokens is referred in this document as the “cardstock program.”

3.0 SCOPE

The scope of this acquisition is to provide cardstock warehousing and logistical support for the cardstock program to effectively and efficiently maintain the DoD Identity Credential Management program for DoD and other Federal agencies. The scope includes supporting the program by warehousing, distributing, shipping, processing, and storing associated cardstock and consumable products including:

• Cardstock - (CAC/Alt Token/USID)

• Electromagnetic Sleeves - (CAC only)

• Consumables - (Color Ribbons/Transfer Film/Front Laminate/Back Laminate/Cleaning

Kits) Attachment A - “Dimensions of Cardstock Items” provides the dimensions of the items for the scope of the requirement.

4.0 REQUIREMENTS The Contractor shall:

2 Ver: Nov 2023

4.1 Warehousing for Cardstock and Consumables

4.1.1 The Contractor shall provide a warehouse storage facility that is International

Organization for Standardization (ISO) 9001:2015 compliant. The storage facility must be able to hold approximately 400,000 unissued cardstock, approximately 200,000 returned cardstock, approximately 170,000 returned cardstock palletized for destruction, approximately 5,000 failed cardstock and approximately 50 pallets of consumables.

4.1.2 The warehouse must be located in the contiguous United States (CONUS). There is no geographical restriction to warehouse location in the CONUS.

4.1.3 Printed Cardstock (i.e. returned cardstock) contains Personally Identifiable Information (PII) and therefore must be stored in a locked secure area only accessible to authorized contractor personnel approved by the Government.

4.1.4 The Contractor shall utilize the First In, First Out (FIFO) distribution method to avoid shelf-life expiration unless otherwise requested by the Government. Cardstock and consumable materials require well-ventilated storage areas to comply with Occupational Safety and Health Administration (OSHA) standards. The Contractor shall replace, at no cost to the Government, any cardstock and consumables that are damaged or expired because of non-compliance with FIFO or OSHA requirements and/or mismanagement.

4.1.5 Contractor shall adhere to National Institute of Standards and Technology (NIST) Special Publication 800-53: This publication provides guidelines for security and privacy controls for federal information systems and organizations. Compliance with NIST SP 800-53 ensures that storage facilities and warehousing operations meet stringent security standards mandated under HSPD-12.

4.1.6 The contractor shall conduct a wall-to-wall inventory assessment of all cardstock and consumables at a minimum annually. A coordinated Government and Contractor warehouse wall-to-wall inventory and assessment of cardstock and consumables is required within 30 days after Government request. The Contractor shall replace, at no cost to the Government, any cardstock and consumables not accounted for during inventory assessment.

4.2 Inventory Receipt and Maintenance

4.2.1 The Government will provide the consumable printer supplies used in card production to the Contractor (no card printing is required). Examples of printer consumables include color ribbons, front and back laminates, retransfer film, test cardstock, and cleaning kits.

4.2.1.1 The contractor shall store these consumables until requested by customers or otherwise requested by the Government.

4.2.2 The Contractor shall maintain at least six (6) months of supply of consumables to support the daily shipping requirements. The Contractor shall notify the Government with a 30-day advance notice for the replenishment of supplies to ensure timely delivery. It is expected that the Contractor request replenishment of supplies monthly.

3 Ver: Nov 2023

The minimum amount of consumables to maintain at least six (6) months of supply are as follows:

4.2.2.1 Color Ribbon – 5,000

4.2.2.2 Transfer Film – 4,000

4.2.2.3 Front Laminate – 8,500

4.2.2.4 Back Laminate – 8,500

4.2.2.5 Cleaning Kits - 850

4.2.3 The Government will provide the cardstock used in card production to the Contractor

(no card printing is required).

4.2.3.1 The contractor shall store the cardstock until requested by customers or otherwise requested by the Government.

4.2.4 The Contractor shall provide a Daily Cardstock and Consumable Order Report

(Attachment K) to DMDC upon request to facilitate the required approvals including the current inventory on-hand at the warehouse of individual cards/tokens brands and types. The Daily Cardstock and Consumable Order Report captures all orders emailed/faxed to the warehouse/DMDC.

4.2.5 The Contractor shall provide the Cardstock and Consumable Inventory Report (Attachment B) for the weekly report of the current inventory on hand and the weekly shipments of cardstock and consumables.

4.3 Distribution of Cardstock and Consumables

4.3.1 The Contractor shall ship emergency and out-of-cycle shipments of cardstock to

RAPIDS sites within the same day of request by the government. Typically supply orders are submitted from the RAPIDS sites to the contractor to fulfill. The Contractor shall notify the government of any unforeseen surge in emergency and out-of-cycle requests. Informational Only: Cardstock releases in support of DMDC’s cardstock program are routinely processed directly by the card manufacturers from their vaults under separate contracts. Regular cardstock releases are shipped from the cardstock manufacturers directly to the RAPIDS sites and are not included in the scope of this PWS. However, the contractor will be required to provide the shipping labels to the manufacturers to support their regular cardstock releases and will be reimbursed under the Time and Materials (T&M) CLIN.

4.3.1.1 All emergency shipments of cardstock orders shall be processed and ready for commercial pick-up the same business day of receipt of order, unless it is received too late in the day to process for same day shipping, then it will be processed the next day. The Contractor shall process emergency shipment orders the same day as requested by the government. Emergency shipments will be shipped via overnight mail.

4.3.1.2 Out-of-cycle requests for cardstock shall be processed and ready for commercial pick-up within 48 hours. Shipping method is dependent on request.

4 Ver: Nov 2023

4.3.1.3 The Contractor shall keep a register of all boxes shipped via commercial carrier using the Monthly Government Shipping and Return Account Usage Report (Attachment D).

4.3.2 For all shipments, the Contractor shall manage cardstock inventory by card type, card vendor, and stack identification (ID) number via the Inventory Logistics System (ILS) which is used to track cardstock and consumables for inventory and shipments.

Cardstock is packaged in “stacks” of 100 cards each. A CAC is required to access the Inventory Logistics System (ILS) through the Inventory Logistic Portal (ILP) on the DMDC network. Contractors must be eligible to obtain a CAC for access. ILS includes the database, background services and ancillary infrastructure used to store data process input via ILP. The ILP is the user interface (determined by role) to input data and process transactions. The government will furnish the Contractor with a laptop(s) for ILP usage. The government will also furnish CAC and USID card readers to use with contractor furnished computers to scan the cards. Non-GFE approved software is required to scan cards, thus requiring a non-GFE furnished computer. The Government will coordinate with the third-party contractor providing card failure analysis to provide their non-GFE approved software for use.

4.3.3 The Contractor shall provide distribution of consumables. All supply orders are automated and generated by the ILS and/or from the RAPIDS sites to the Contractor.

Requests for re-supply are received via standard mail, e-mail via a Government email box accessed by GFE (provided upon award), FAX and regular automated reorders generated via the ILS.

4.3.3.1 All emergency shipments of consumable orders shall be processed and ready (for commercial pick-up) the same business day of receipt of order, unless it is received too late in the day to process for same day shipping, then it will be processed the next day. The Contractor shall process emergency shipment orders the same day as requested by the government. Emergency shipments will be shipped via overnight mail. The Contractor shall keep a register of all boxes shipped via commercial carrier using the Monthly Government Shipping + Return Account Usage Report, Attachment D.

4.3.3.2 Out-of-cycle requests for consumables shall be processed within 48 hours. Shipping method is dependent on the request.

4.3.3.3 All routine shipments of consumable orders shall be processed and ready (for commercial pick-up) within two (2) business days of receipt of order. All routine consumable shipments will be shipped 3-day mail.

4.3.4 The government will provide the Contractor with directions for shipment releases.

The Contractor shall then package the individual site's items of cardstock and/or consumables for shipment and capture the associated shipment tracking data. The Contractor shall record the appropriate cardstock and/or consumables in the appropriate report(s) and the ILP within 24 hours after the shipments have been made.

5 Ver: Nov 2023

4.3.5 For reporting requirements, the inventory released, and shipment tracking data is entered into the Cardstock and Consumables Shipping Report (Attachment C) for the respective sites that will receive the shipments.

4.3.5.1 On a monthly basis, the Contractor shall submit the DMDC Cardstock and Consumable Shipping Report (Attachment C). This reports the cumulative of all orders to include auto generated and emergency manual orders.

4.3.6 The contractor will verify customer’s need for additional cardstock and consumable supplies using the Inventory Logistics Portal prior to shipment. Only requests specifically received from the Service Project Officer (SPO) will be honored.

4.3.7 The contractor will provide proof of shipping to the customer by providing a tracking number from the shipping carrier.

4.3.8 The Contractor shall ship cardstock and consumables using the T&M shipping account(s) referenced in section 4.6.

4.3.9 The Contractor shall provide all packaging and shipping materials however, the Contractor shall use commercial shipping suppliers free packaging materials to the extent possible.

4.3.9.1 The Contractor shall order shipping supplies from the shipping carrier(s) website as necessary to support the daily shipments.

4.4 Real-time Automated Shipment Tool

4.4.1 The Contractor shall utilize a shipping and tracking tool to coordinate and account for all shipping activities. All shipments shall be tracked. The tool must be ready to be utilized at beginning of contract. The tool must include the following requirements:

4.4.1.1 The shipment tool shall create shipments and necessary documentation, get quotes, generate shipping labels, generate packing slips, provide proof of delivery, signature information and scan details from carriers, schedule pick-ups, export and import shipment data, track and monitor shipments, manage shipments, manage contacts and address books, create reports and provide administrative controls and account security.

4.4.1.2 Access should extend to authorized personnel only. Authorized personnel may include RAPIDS/DEERS site personnel, cardstock manufacturing facilities, contractor personnel, and other authorized DMDC personnel. Account profiles will be tailored to the needs of the authorized personnel and must be approved by DMDC.

4.4.2 The shipment tool must include a reporting function. Reporting must include billing, shipment, and delivery information. This information includes but is not limited to:

4.4.2.1 Description of exact shipment contents, originating site information, destination information, size and weight of shipment, estimated delivery date, actual date delivered, carrier, shipment cost, tracking numbers, shipment labels generated but not mailed, site ID, DEERS site ID, shipment date, any additional fees.

6 Ver: Nov 2023

4.4.2.2 The shipment tool shall allow for individual shipment feedback to allow recipient to provide information such as condition of package, if the shipment was packed in accordance with requirements, if there were any significant delays, etc.

4.4.3 DMDC shall approve the recommended shipping solution prior to implementation.

4.5 Cardstock and Consumables Shipping Requirements and Metrics

4.5.1 The Contractor shall be responsible for managing the shipments (e.g. labels) of all cardstock and consumables using the required carrier shipment software and web interfaces. The contractor shall be responsible for the physical shipment originated from their warehouse. The following are the types of shipments that are expected under the Shipping (T&M) CLIN:

4.5.1.1 Cards and PIN shipments from the Central Issuance Facility (CIF) are shipped from DMDC locations. Shipments are daily and consist of envelopes and boxes.

4.5.1.2 Cardstock and consumable shipments from the contractor to RAPIDS sites.

4.5.1.3 Cardstock returned from RAPIDS sites to contractor.

4.5.1.4 Cardstock shipped from cardstock manufacturers to RAPIDS sites, contractor warehouse and DMDC.

4.5.1.5 Returned cardstock shipped from the contractor to National Security Agency

Classified Material Conversion (NSA/CMC).

4.5.1.6 Failed cardstock shipments from the RAPIDS sites, warehouse and DMDC to Card

Failure Facility and DMDC.

4.5.1.7 Ad hoc shipments which may be shipped to/from areas not covered in the above.

4.5.2 Annual Shipment Quantities are estimated at the following:

4.5.2.1 7,500 cardstock and consumable shipments are anticipated annually from the warehouse.

4.5.2.2 6,250 return card shipments are anticipated annually from RAPIDS sites.

4.5.2.3 Annual shipments from the CIF to customers are approximately 1,050 envelopes and

2,450 boxes.

4.5.2.4 60 cardstock manufacturers’ shipments are anticipated annually from the manufacturer to the warehouse.

4.5.2.5 5,400 cardstock manufacturers’ shipments are anticipated annually from the manufacturer to the RAPIDS sites.

4.5.2.6 Approximately 200,000 returned cards are shipped to NSA/CMC each month for destruction.

4.5.2.7 USPS Priority Mail Large Flat Rate Box with no weight limit addressed to APO/FPO destination is estimated at 75 packages annually and USPS Priority Mail Medium Flat

7 Ver: Nov 2023

Rate Box with no weight limit addressed to APO/FPO destination is estimated at 75 packages annually.

4.5.2.8 Shipments of failed cards are typically made monthly (or upon request) to the third-party contractor for testing and analysis. Approximately 30,000 failed cards are shipped annually.

4.5.2.9 Ad hoc shipments of cardstock or consumables. Estimate is under 50 shipments annually.

4.5.3 Shipping Administration

4.5.3.1 For any undeliverable shipments, the contractor shall contact the Government for further instructions. This may result in changes to the address and reshipping.

4.5.3.2 The Contractor shall make every effort to consolidate shipments of cardstock and consumables.

4.5.3.3 The Contractor shall use the lowest cost service available that meets the timeframe for delivery as outlined in the PWS.

4.5.3.4 The Contractor shall review all shipments to process orders and validate inventory through the ILP.

4.5.4 Lost or Damaged Shipment

4.5.4.1 Contractor shall work with shipping supplier for damage to, or loss of, cargo occurring from and after the time it takes possession until delivered to the consignee.

4.5.4.2 Claims must be filed by the shipper within 30 calendar days after delivery, planned delivery, or from the time the carrier declares the package/shipment is lost.

4.5.4.3 The Government will be informed of any lost or damaged shipment.

4.5.4.4 Returned cards include PII data and are subject to PII reporting requirements. Any lost shipment of returned cards will be reported to the Government immediately upon loss notification. The contractor will be notified if any further action is required, such as a privacy or police report.

4.5.4.4.1 All cardstock shipments going to NSA/CMC and/or the Card Failure vendor (third party contractor) of returned cards require a manifest of card unique identification numbers (CUID) associated with the pallet/box and tracking number of the shipment.

4.6 Shipping Accounts/Services (T&M CLIN)

4.6.1 The Contractor shall obtain the necessary account(s) from the USTRANSCOM Next

Generation Delivery Service 2 (NGDS2) contract to utilize the discount rates. The NGDS2 contract provides express small package delivery services for international packages and United States domestic express and ground small package delivery services.

4.6.1.1 The Contractor shall follow the procedures as outlined in Attachment L titled, “Account_Approval_NGDS” to obtain authorization to create an account with the shipping carrier(s).

8 Ver: Nov 2023

4.6.1.2 The Contractor shall follow the guidelines provided in the NGDS2 Shipper’s Guide located at: https://ww2.ustranscom.mil/commair/ngds.cfm.

4.6.2 The Contractor will obtain the necessary account(s) from the USTRANSCOM Global Heavyweight Service 2 (GHS2) contract to utilize the discounted rates. The GHS2 contract provides for freight shipping within the 48 contiguous states (CONUS) for shipments over 150 lbs. and over 300 lbs. for Alaska, Hawaii, and international shipments.

4.6.2.1 The Contractor shall follow the guidelines provided in the GHS2 Shipper’s Guide located at: https://ww2.ustranscom.mil/commair/ghs.cfm.

4.6.3 The Contractor shall provide shipping to Army Post Office (APO) and Fleet Post Office (FPO) sites utilizing the United States Postal Service (USPS).

4.6.3.1 USPS shipments are used to accommodate OCONUS shipping to APO/FPO address.

Shipments are sent using large and medium flat rate boxes. Customs form documentation is required.

4.6.3.2 APO/FPO shipping is considered domestic shipping in relation to USPS costs. No international shipping is permitted.

4.6.3.3 APO/FPO shipments are to be shipped based on the timeframe provided within this PWS however, delivery timeline is set by USPS and is therefore not required to be delivered in the timeframe for domestic/OCONUS shipments.

4.6.4 The T&M CLIN includes the cost for shipping utilizing the specific methods provided in this section.

4.7 Returned Cardstock and Consumables

4.7.1 World-wide RAPIDS sites are instructed to return all cardstock that are used, expired, replaced or encountered production issues to the Contractor’s location IAW the RAPIDS user’s guide. Based on historical scanning data, the average cardstock return rate is approximately 175,000 each month.

4.7.2 For all returned cardstock, the Contractor shall:

4.7.2.1 When requested by RAPIDS sites, order complimentary packaging from the shipping carriers and have them delivered to the RAPIDS site. These requests typically occur when RAPIDS sites request labels for returned cards.

4.7.2.2 Track and report the number of returned cards received and the number of returned cards processed each month.

4.7.2.2.1 Track shipping tracking numbers, Site name, Site ID, Shipment Date, Carrier Type, Receipt Date, Card Type and Quantity received.

4.7.2.3 This information shall be provided in the electronic Monthly Government Shipping Account and Usage Report (Attachment D). The Contractor shall report any sites that are non-compliant with the required packaging to the Government immediately.

https://ww2.ustranscom.mil/commair/ngds.cfm https://ww2.ustranscom.mil/commair/ghs.cfm

9 Ver: Nov 2023

4.7.2.4 Inspect all returned cardstock boxes to determine whether they were double packaged when mailed to DMDC, as required by the Privacy Act of 1974. The Contractor shall notify the Government of any non-compliance with this requirement immediately.

4.7.3 Sorting and Scanning

4.7.3.1 Sort all returned cardstock based on failure reason/code. Occasionally cardstock is returned with no failure codes attached, which will be marked as “U1” unknown.

4.7.3.2 Using a government furnished reader, the Contractor shall scan all returned cards

(hand-entering when damage prevents scanning) to record the Card Unique Identifier/Card Identification Number (CUID/CIN) and the error code from the sorted cardstock.

4.7.3.3 The generated files from scanning and error codes are consolidated and sent to DMDC at the end of each month.

4.7.3.4 All cardstock delivered to the warehouse must be processed within 30 days to ensure ILS/ILP records are at most 30 days out of date. The scanned files are used to update the ILS to account for all returned cardstock and to ensure the cards are terminated in ILP to remove them from the RAPIDS site inventory. Any timeframe in excess of 30 days significantly affects the RAPIDS sites reported inventory levels in ILS/ILP which leads to unnecessary shipments and inventory control concerns.

4.7.3.5 All scanned cardstock shall be shipped for destruction within 30 days of being scanned.

4.7.3.6 RAPIDS sites have been instructed not to return consumables without Government authorization however, for any consumables that are returned to the Contractor, the Contractor shall notify the Government within 24 hours as to which site returned the items, what was returned, how many, used or unused. For the unused consumables, they will be put into inventory for reuse for new shipments. The used transfer film and ribbon consumables will be kept at the Contractor’s location until the end of the performance period for shredding. The Contractor shall provide the government with the following information to provide the shredding service: number of boxes of used consumables, dimensions of the boxes, and approximate weight. The government will provide the shredding service. Receipt of returned consumables is minimal and therefore expected to be no more than 1 pallet full throughout the length of the contract.

4.8 Returned Cardstock Shipping for Destruction and Analysis

4.8.1 The government will provide specific instructions for shipments to the Contractor upon award.

4.8.2 The Contractor shall follow the provided procedures to return cards for proper destruction as required to adequately support the cardstock program and use the shipping return process outlined in the Cardstock Return Card Overview (Attachment F). Deviating from NSA instructions poses great risk of continued use of NSA’s cardstock destruction support. The Contractor shall ensure the first package includes a large envelope or box with a Privacy Act Data Cover Sheet, which identifies the

10 Ver: Nov 2023 cardstock as containing Personally Identifiable Information (PII) data. The second outer package shall be a box from a third-party courier or from the Contractor’s site that has the words “For Official Government Use Only” stated on it. The first package shall be inserted into the second outer package for return shipment.

Destruction shipments to NSA are to be sent every month.

4.8.3 Returned cards with certain error codes will require monthly shipments to the third-party card failure vendor for further analysis per the government’s instructions. Third party documentation requirements for shipping may vary. PII shipment requirements are to be followed.

4.8.4 The Contractor shall ensure all required documents are included with shipping.

4.8.5 All shipments must include a DD Form 2923, Privacy Act Data Cover Sheet.

4.8.6 The Contactor shall print the Privacy Act Data Cover Sheet in color.

4.8.7 The Contractor shall inspect the outer box to ensure that it is in good condition and can be properly sealed and ensure that the box for shipping can withstand the weight of the cardstock and will not break when in transit. If a box breaks or opens in transit, Privacy Act data contained on the returned ID cards is at risk of being exposed. The Contractor shall follow the instructions in the DMDC and NSA Cardstock Return Card Overview (Attachment F) for shipping the returned cards that have been processed to NSA for final destruction. The Contractor shall also follow the CMC Required Procedures (Attachment G) when processing each shipment of the returned cards to NSA. The Contractor shall verify and complete the CMC Receipt for Destruction of Classified Materials (Attachment H) from the NSA Website https://www.nsa.gov/Portals/70/documents/news-features/initiatives/classified-materiel-conversion/cmc_receipt.pdf?ver=2018-08-07-110456-643 to ensure it is still a valid form, then complete the form for each shipment to NSA. This contract does not deal with any classified material; however, it is the name of the form. The Contractor shall complete the Contractor Approval Form for the Destruction of Classified Material at NSA/CMC facility (Attachment I) annually and forward to the COR for review and signature, then submit to NSA after it has been signed by the COR. CAC Return Instructions – Informational (Attachment E) explains how RAPIDS sites return the cardstock to the Contractor/DMDC.

4.9 Senior Management Review Report (SMR)

4.9.1 The Contractor shall provide a Senior Management Review (SMR) Report monthly.

See SMR template, Attachment J for required content and format. The Contractor shall meet and participate in a monthly SMR and will change to quarterly when requested by the government. There will be no travel required. The purpose of the SMR is to provide a monthly program review including any issues requiring government escalation. The contractor shall provide meeting minutes within five (5) business days following each SMR.

4.10 Participate in a Post-Award Conference

https://www.nsa.gov/Portals/70/documents/news-features/initiatives/classified-materiel-conversion/cmc_receipt.pdf?ver=2018-08-07-110456-643 https://www.nsa.gov/Portals/70/documents/news-features/initiatives/classified-materiel-conversion/cmc_receipt.pdf?ver=2018-08-07-110456-643

11 Ver: Nov 2023

4.10.1 This meeting shall provide an introduction between the Contractor personnel and Government personnel who will be involved with the contract. The meeting shall provide the opportunity to discuss technical, management and security issues. The Post Award Conference will aid both the Government and Contractor in achieving a clear and mutual understanding of all requirements and identify and resolve any potential issues. The Contractor shall be prepared to discuss any items requiring clarification and gather information as necessary to support each deliverable.

4.11 Risk Mitigation Plan

4.11.1 The contractor shall provide an initial Risk Mitigation Plan as part of the proposal and a final plan 15 business days after award for alleviating any potential risks that may affect performance. The plan shall, in addition to other risk mitigation actions, address:

4.11.1.1 PII loss and recovery of lost cardstock containing PII.

4.11.1.2 Access controls for the secured area to avoid PII leakage and unauthorized access.

4.11.1.3 Inventory issues/delays

4.11.1.4 Shipping issues/delays

4.11.1.5 Returned shipment issues/delays.

4.12 Transition In

4.12.1 A smooth transition between the incumbent Cardstock and Consumables Warehouse

Contractor and the successor Contractor is necessary to ensure there is no disruption to vital Government business. The Contractor shall cooperate fully in the transition.

There will be a thirty (30) day transition period for a new contractor.

4.12.2 During this 30-day period, the Contractor shall be responsible for:

4.12.2.1 Attending the kick-off meeting with Government POCs.

4.12.2.2 Ordering shipping supplies.

4.12.2.3 Obtaining necessary CAC cards for employees.

4.12.2.4 Communication with NSA to obtain contract information to prepare shipments of returned cards for final disposition.

4.12.2.5 Preparing warehouse space with inventory received from the Government.

4.12.2.6 Preparing contractor forms for DMDC to review and sign for NSA returns.

4.12.2.7 Conduct services required to connect to the Government network with the

Contractor’s computer/s.

4.12.2.8 Receive consumables/inventory from the Government.

4.12.2.9 Conduct inventory of all Government furnished equipment, supplies and consumables.

4.12.2.10 Setting up necessary TRANSCOM accounts for shipping CLIN.

4.12.2.11 Ensure shipping services are functional.

12 Ver: Nov 2023

4.12.3 The government will transfer all inventory, and card readers, and supply any inventory of packaging supplies to the Contractor during this transition period. A joint inventory will be agreed upon between the Contractor and the government. Once all inventory, card readers, and packing supplies has been provided by the government, a joint inventory will be agreed upon between the contractor and government. All transition activities shall be coordinated with the COR.

4.13 Transition Out

4.13.1 The Contractor shall submit a transition plan within 60 days prior to the end of the final performance period, addressing the following, at a minimum:

4.13.1.1 Transition of the DMDC initiatives to ensure a smooth transition from performance.

4.13.1.2 Proposed sequence of transition tasks, which shall be accomplished to progress from the start of the transition to the successor Contractor’s control of tasks, as specified in the PWS.

4.13.1.3 Maintain DMDC’s schedule, specifically in the transition of existing, on-going efforts and working concurrently with the successor Contractor on existing efforts.

4.13.1.4 Follow the proposed process for the GFE/GFP/GFI transfers to the government.

4.13.1.5 Identification of associated risks and issues.

4.13.1.6 Propose risk mitigation strategies to address any issues.

4.13.1.7 Provide additional resources, if any, required for the transition.

4.13.1.8 Plan how the transition will be implemented and managed in transition planning for order close-out.

4.13.2 DMDC will coordinate with the Contractor to conduct a joint inventory.

5.0 DELIVERABLES

The Contractor shall provide deliverable(s) in a format mutually agreed upon by the Government and the Contractor. All deliverables will be reviewed for timeliness, accuracy and format. If a deliverable due date falls on a weekend or holiday, the Contractor shall submit the deliverable on the last work day prior to the due date. In fulfillment of this effort, the Contractor shall provide the following deliverables to the COR.

Deliverable PWS Reference Delivery Date Daily Cardstock and Consumable Order Report

4.2.4 Updated continuously and provided

upon request

Cardstock and Consumable Inventory Report

4.2.5 Weekly

Government Shipping and Return Account Usage Report

4.3.1.3, 4.3.3.1, 4.7.2.2 Within 5 business days following the previous month

13 Ver: Nov 2023

Cardstock and Consumables Shipping Report

4.3.5, 4.3.5.1, 4.5.2.1 Within 5 business days following the previous month

Senior Management Review

(SMR)

4.9 Within 5 business days following

the previous month or quarterly at the request of the Government

SMR Minutes 4.9 Within 5 business days following the SMR meeting

Risk Mitigation Plan 4.11 Due at proposal submission and within 15 business days after award

Transition In Plan 4.12 Due at proposal submission and updated within 5 business days after award

Transition Out Plan 4.13 Within 60 calendar days prior to the end of the period of performance

Quality Control Plan 12.0 Within 30 calendar days after award

5.1 The contractor shall report contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract via the System for Award Management (SAM) (https://sam.gov) in accordance with DFARS 252.204-7023.

6.0 CONTRACTOR TRAVEL

Travel is not anticipated for this requirement. Should travel become necessary, a proposal will be requested and the contract modified to reflect travel.

7.0 RECORDS MANAGEMENT

7.1 Contractor shall comply with all applicable records management laws and regulations, as well as National Archives and Records Administration (NARA) records policies, including but not limited to the Federal Records Act (44 U.S.C. chs. 21, 29, 31, 33), NARA regulations at 36 CFR Chapter XII Subchapter B, and those policies associated with the safeguarding of records covered by the Privacy Act of 1974 (5 U.S.C. 552a). These policies include the preservation of all records, regardless of form or characteristics, mode of transmission, or state of completion.

7.2 In accordance with 36 CFR 1222.32, all data created for Government use and delivered to, or falling under the legal control of, the Government are Federal records subject to the provisions of 44 U.S.C. chapters 21, 29, 31, and 33, the Freedom of Information Act (FOIA) (5 U.S.C. 552), as amended, and the Privacy Act of 1974 (5 U.S.C. 552a), as amended and must be managed and scheduled for disposition only as permitted by statute or regulation.

7.3 In accordance with 36 CFR 1222.32, Contractor shall maintain all records created for Government use or created in the course of performing the contract and/or delivered to, or under the legal control of the Government and must be managed in accordance with Federal law.

https://sam.gov/

14 Ver: Nov 2023

Electronic records and associated metadata must be accompanied by sufficient technical documentation to permit understanding and use of the records and data.

7.4 Defense Human Resources Activity and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Records may not be removed from the legal custody of Defense Human Resources Activity or destroyed except for in accordance with the provisions of the agency records schedules and with the written concurrence of the Contracting Officer’s Representative (COR). Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. In the event of any unlawful or accidental removal, defacing, alteration, or destruction of records, Contractor must report to the COR and the Defense Human Resources Activity Component Records Management Officer at dodhra.mc-alex.dhra-hq.mbx.records@mail.mil so DHRA may report promptly to NARA in accordance with 36 CFR 1230.

7.5 The Contractor shall immediately notify the COR upon discovery of any inadvertent or unauthorized disclosures of information, data, documentary materials, records or equipment.

Disclosure of non-public information is limited to authorized personnel with a need-to-know in accordance with all applicable privacy, security, and information protection policies. The Contractor shall ensure that the appropriate personnel, administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, documentary material, records and/or equipment is properly protected. The Contractor shall not remove material from Government facilities or systems, or facilities or systems operated or maintained on the Government’s behalf, without the express written permission of the COR.

When information, data, documentary material, records and/or equipment is no longer required, it shall be returned to DHRA or the Contractor must hold it until otherwise directed. Items returned to the Government shall be hand carried, mailed, emailed, or securely electronically transmitted to the COR. Destruction of records is EXPRESSLY PROHIBITED unless in accordance with Paragraph (7.4).

7.6 The Contractor is required to obtain the Contracting Officer's approval prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under, or relating to, contracts.

The Contractor (and any sub-contractor) is required to abide by Government and Defense Human Resources Activity guidance for protecting sensitive, proprietary information, classified, and controlled unclassified information.

7.7 The Contractor shall only use Government IT equipment for purposes specifically tied to or authorized by the contract and in accordance with Defense Human Resources Activity policy.

7.8 The Contractor shall not create or maintain any records containing any non-public Defense Human Resources Activity information that are not specifically tied to or authorized by the contract.

mailto:dodhra.mc-alex.dhra-hq.mbx.records@mail.mil mailto:dodhra.mc-alex.dhra-hq.mbx.records@mail.mil

15 Ver: Nov 2023

7.9 The Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected from public disclosure by an exemption to the Freedom of Information Act.

7.10 The Defense Human Resources Activity owns the rights to all data and records produced as part of this contract. The contractor shall not include any contractor markings on deliverables created under the contract. All deliverables under the contract are the property of the U.S.

Government for which Defense Human Resources Activity shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest.

The contractor shall not use or disclose any data or deliverables under this contract for any purposes other than performing the contract, unless expressly approved by the Government.

8.0 SECURITY

8.1 Personnel Security. Overarching security requirements are UNCLASSIFIED. Contractor and subcontractor personnel require unclassified access to DoD network(s), Information Technology (IT) systems, and Government Furnished Equipment (GFE). Contractor and subcontractor personnel must obtain DoD credentials (also known as the Common Access Card (CAC)) for physical and logical access to federally controlled facilities and DoD Information Systems (IS) containing Personally Identifiable Information (PII) or Controlled Unclassified Information (CUI).

8.1.1 All Contractor personnel assigned to this contract are required to obtain and maintain the appropriate background investigation (BI) and adjudication or suitability determination in accordance with DODI 5200.02-DoD Personnel Security Program (PSP).

8.1.2 The contractor/subcontractor personnel on this contract who require access to the ILP/ILS will be designated performing in Noncritical-Sensitive positions for Unclassified access in accordance with Defense Counterintelligence and Security Agency (DCSA) and the Office of Personnel Management (OPM) investigative alignment, and DoDI 5200.02, DoDM 5200.02 and 32 C.F.R. Part 156. All other contractor/subcontractor personnel will be designated performing in Non-Sensitive positions for Unclassified access.

8.1.3 No employee may perform under this contract or have access to information or systems under this contract until they have completed the background investigation (BI) that meets their position sensitivity requirement or be in the process of a Personnel Security Investigation (PSI) with a minimum of interim eligibility.

8.3 Staffing. The personnel supporting this contract who require a DHRA sponsored CAC, access to DoD network(s), DoD information systems with CUI/PII data, or DoD IT/Information Systems must be Citizens of the United States. The citizenship requirement also applies to personnel assigned or working on the contract at any remote sites.

8.4 Onboarding. Prior to requesting access to DHRA sponsored resources (e.g., DoD credential(s), Network(s), IT systems, Information Systems (IS) or facility), the contractor must provide an official request via DHRA’s onboarding system(s)/encrypted email/DoD SAFE

16 Ver: Nov 2023 accompanied by a complete Defense Logistics Agency Headquarters (DLAH) Form 1728 - Request for HQC Contractor Badge and/or Information Technology (IT) Access. The DHRA Security and the Defense Logistics Agency (DLA) Personnel Security (PERSEC) will validate the contractor meet the requirement.

8.5 Listing of Employees & Clearance Documentation. The Contractor shall maintain a current listing of employees. Within 10 calendar days of contract award, the Contractor shall provide the COR a list of all company employees assigned to this effort. The employee list should include the following information: Contract number, employee information (full legal names), DHRA center/office, location of performance, Tier BI level needed (for Position of Trust determination), IT access level needed (e.g., privilege, authorize or other). The list shall be validated by the company and DHRA Personnel Security (PERSEC). The Contractor shall provide the COR with an updated listing when any employee’s status or information changes.

8.6 Access to Sensitive Information. To the extent that the work under this contract requires the Contractor to have access to DoD sensitive information the Contractor shall after receipt thereof, treat such information as sensitive and safeguard such information from unauthorized use and disclosure. The Contractor shall not appropriate such information for its own use or disclose such information to third parties unless specifically authorized by the Government in writing.

8.6.1 The Contractor shall allow access only to those employees who need the sensitive information to perform services under this contract and who have acknowledge that sensitive information shall be used solely for the purpose of performing services under this contract. The Contractor shall prevent its employees from discussing, divulging, or disclosing any such information to any person or entity except those persons within the Contractor’s organization directly performing the contract.

8.7 Information Technology (IT) Level Investigation Requirements. The contractor/subcontractor personnel, with access to the ILP/ILS through the DMDC network, supporting this contract will require Authorize (Moderate) access to DHRA IT & Information.

8.7.1 Contractor personnel, who perform work on sensitive networks, IT systems or applications, must possess and maintain the appropriate investigation and adjudication determination. The Contractor shall assure that individuals assigned to the contract undergo the respective BI and have obtained the proper eligibility, based on job function or tasks performed, before performing any work or accessing any systems or information under the contract.

8.7.2 IT-Level position category designation does not imply or convey authorization to access classified information.

8.7.3 The IT Level will determine the access level needed to perform work on the DoD IT Systems/Networks. The IT access level is designated based on the IT system/network requirements according to the DoD Cyber, Security Technical Implementation Guides (STIGs) https://public.cyber.mil/stigs/.

https://public.cyber.mil/stigs/

17 Ver: Nov 2023

8.7.4 It is the responsibility of the contractor to ensure the employees meet the appropriate Tier investigation prior to requesting IT access.

8.7.5 Authorize – Moderate Risk: All personnel in positions in which the individual is responsible for the-direction, planning, design, operation, or maintenance of a computer system, and whose work is technically reviewed by a higher authority of the Privilege to ensure the integrity of the system. All personnel identified in one or more of these job functions must complete a Tier 3 (T3) or Tier 3 Reinvestigation (T3R), an equivalent or higher BI to meet the Noncritical-Sensitive role. Roles may include, but are not limited to:

• Access to and/or processing of proprietary data, information requiring protection under the Privacy Act of 1974.

• Those with the ability to aggregate and extract data en masses from an automated records repository containing PII.

• Other positions designated by the Agency head that involve a degree of access to a system that creates a significant potential for damage or personal gain less than that in Privilege positions.

8.8 Personal Identifiable Information (PII) and Tier Investigations. All personnel supporting this contract must protect PII data according to the Privacy Act of 1974. Personnel requiring access to Information Technology (IT) or access to DoD Information Systems that contain military active duty, guard, or reservists’ PII or information pertaining to Service members that are otherwise protected from disclosure where such access has the potential to cause serious damage to national security, must be vetted accordingly and protect the data. BI levels required for each job function or necessary access, include, but are not limited to, the following:

8.8.1 Tier 1 for Non-Sensitive – Low Risk: All Personnel whose access to military PII is limited to data entry or singular search capability require, a minimum, a favorably adjudicated Tier-1

(T1) BI.

8.8.2 The Contractor shall report immediately to the DHRA Privacy Office and secondly to the COR discovery of any Privacy breach.

8.9 Controlled Unclassified Information Requirements for DoD Contractors. The following procedures will be used to protect Controlled Unclassified Information (CUI) documents and materials:

8.9.1 HANDLING: Access to CUI material shall be limited to those employees needing the material to perform their duties. The CUI marking is assigned to documents and material created by a DoD User Agency. CUI is not a classification, but requires extra precautions to ensure it is properly safeguarded and disseminated and is not released to the public without government authorization.

18 Ver: Nov 2023

8.9.2 MARKING: The Contractor shall mark unclassified documents containing CUI as follows: “CUI" at the top and bottom of each page, include the CUI warning box, and the CUI Designation Indicator Block as required in DoDI 5200.48.

8.9.2.1 Mark other records such as computer print outs, photographs, films, tapes, or slides in accordance with DoDI 5200.48 so the receiver or viewer knows that it contains CUI material.

8.9.2.2 Mark a message containing material in accordance with DoDI 5200.48. Unclassified messages containing CUI material must show the abbreviation (CUI) before the text begins.

8.9.2.3 Ensure documents transmitting CUI material call attention to any attachments containing CUI.

8.9.2.4 CUI material released to a contractor by a DoD user agency must have the following statement on the front page or cover:

THIS DOCUMENT CONTAINS CUI MATERIAL AND MUST BE REVIEWED BY A

GOVERNMENT REPRESENTATIVE UNDER THE REQUIREMENTS OF DODI

5200.48, DODI 5230.09, and DODI 5230.29.

8.9.3 STORAGE: The Contractor shall, place CUI material in an out-of-sight location during normal work hours, if the work area is accessible to persons who do not have an authorized government purpose for access to the material. After normal duty hours, the Contractor shall store CUI material to prevent unauthorized access by filing it with other unclassified records in unlocked files or desks when internal building security is provided and the file is marked as CUI.

When there is no internal security, locked buildings or rooms usually provide adequate after hours protection. For additional protection, store CUI material in locked containers such as file cabinets, desks, or bookcases.

8.9.4 TRANSMISSION: CUI documents and materials may be transmitted via first class mail, parcel post or, for bulky shipments, fourth class mail. Within the CONUS discussion of CUI material on the telephone is authorized if necessary for the performance of the contract and no alternative is available. Electronic transmission of CUI (voice, data, or facsimile) should be by approved secure communications systems whenever practical. If there is a fax transmission, the sender must ensure the intended receiver is available to receive it or a cover sheet will be used to allow carrying it to the final recipient to avoid unauthorized disclosure of the CUI.

8.9.5 RELEASE: CUI material shall not be released outside of the contractor’s facility except to the representative of DoD or DHRA.

8.9.6 DESTRUCTION: When the CUI material no longer meets the threshold for safeguarding and dissemination, the Contractor shall immediately decontrol it, process it through the records management process, and destroyed by the approved methods identified in DoDI 5200.48 to preclude its disclosure to unauthorized individuals by rendering it unreadable, indecipherable, and irrecoverable.

19 Ver: Nov 2023

8.10 Position of Trust (POT) Requirements. DCSA and OPM offers the Tier background investigations, Tier 1 (T1) – Tier 5 (T5) for Position of Trust determination.