Draft PWS PRMA DAI FY27.pdf

Performance Work Statement (PWS) Accounting and Defense Agency Initiative (DAI) Support

1.0 INTRODUCTION. The Personnel Readiness Management Agency (PRMA)/Comptroller/Accounting Directorate requires Accounting and Defense Agency Initiative (DAI) Tier 1 Help Desk Support.

1.1 The objectives of the Accounting work is to ensure accounting transactions are properly accounted for in accordance with the Department of War (DoW) Financial Management Regulations (FMR) accounting processes, which include but is not limited to, recording obligations, supporting Agency Financial Reporting function, performing data cleansing for unmatched disbursements and in-transits, and ensuring other miscellaneous accounting requirements are adhered to.

1.2 The objectives of the DAI Help Desk support are to provide program management, help desk and training support for the PRMA DAI Program in the form of a dedicated response center designed to address all functionalities and modules within the DAI system.

2.0 BACKGROUND

2.1 PRMA implemented DAI, an Enterprise Resource Planning (ERP) system based on the Oracle E-Business Suite. The Defense Logistics Agency (DLA) is the DAI Program Office (PMO) for WAR. DAI is PRMA’s timekeeping system and accounting system of record. PRMA went live with the Time and Labor capability in July 2016 and with DAI Financials in October 2016, Oracle Release 12.2.3 was completed in May 2015 (DAI Increment 2, Release 1.0). DAI process areas are Budget to Report, Cost Accounting, Order to Cash, Procure to Pay, Acquire to Retire, Time and Labor, Reporting (Oracle Business Intelligence Enterprise Edition, (OBIEE), and User Management (UMX). The initial contract requirement PRMA entered into involved a transition from the legacy system to DAI. The DAI system implementation requirement then evolved to system support, developing processes, and training. Now that DAI is an established system at PRMA, the focus of the contract support requirement shifted from implementation to sustainment. The users are now experienced with the processes and the system stability is at a much higher level than 8 years ago. In FY26 PRMA continues to prepare for an independent audit, and the primary focus of the accounting team will be audit readiness. With the impending Audit, and given the fact DAI system is now in a mature sustainment stage, the requirement of the DAI and accounting contract support is shifting focus from the DAI system towards accounting functions. The contract will continue to support DAI functions, but will increase the accounting support to meet growing Office of under Secretary of War (OSW) and Defense Finance Accounting Service (DFAS) requirements in preparation for the audit. The primary areas of increased support will include financial reporting with the emphasis on trading partner transaction reconciliation, reimbursable program (O2C) end to end support, capital assets accounting (A2R), and budget formulation DAI module utilization.

2.2 DAI is mandated by OSW to be the accounting system of record for most Defense Agencies within the 4th Estate to support the congressionally mandated audit readiness requirements of the National Defense Authorization Act (NDAA) 2010 to use a Standard Financial Information System (SFIS) compliant system.

3.0 SCOPE:

The Contractor shall provide the personnel, management and materials necessary to sustain and support the DAI system and accounting operations at PRMA. PRMA requires support in the broad categories of accounting and budget, financial reporting, program management, help desk, training, and audit preparation.

3.1 Under the Government guidance, and subject to Government review and approval, primary areas for Accounting and Budget support include recording of obligations, supporting all aspects of financial reporting function with emphasis on performing trading partner transaction reconciliation, supporting reimbursable program, data cleansing, unmatched disbursements (UMD) maintenance, and providing any other related accounting support as required to include support with internal PRMA Financial Improvement and Audit

Readiness (FIAR), OSW and DFAS inquiries responses, and any new and ad hoc requirements that may be asked of PRMA during the duration of the contract, and delivering this support this support directly to PRMA Government POC.

3.2 Primary areas for the DAI system support include: Tier 1 Help Desk, program management, planning, process analysis, workflow, user management, testing, workforce preparation, liaising with the Program Management Office (PMO), Government Purchase Card (GPC) and Defense Travel System (DTS) program support, and functional expertise of all DAI modules. The scope of the support encompasses issues supporting and deriving from G-Invoicing as it relates to DAI transactions. The support also includes responding to related FIAR, OSW and DFAS inquiries, under the review and subject to Government approval.

3.3 Optional Line Item scope: Upcoming Military Entrance Processing Command (MEPCOM) transition to PRMA presents potential need for an additional workload. With the potential increase in workload, the optional Line Item includes two additional resources. One resource for Accounting support in the area of obligation, and one resource for DAI system support in the area of Time and Labor.

4.0. REQUIREMENTS:

4.1 ACCOUNTING SUPPORT: The Contractor shall:

4.1.1 The Contractor shall provide Accounting support to PRMA. The Accounting support shall have Accounting or Financial Management experience and or education to effectively support the DAI modules, accounting transactions, and Agency Financial Reporting functions. The Accounting support shall be staffed during core hours 0700- 1700 EST, Monday through Friday, excluding federal holidays. The contractor shall provide services outlined in this PWS, outside the core hours during fiscal year end closeout. Fiscal year end closeout occurs between 1 July through 30 September every fiscal year. During fiscal year end closeout, contractor personnel work hours will be adjusted to ensure coverage. The hours the Government needs coverage will be coordinated between the Contracting Officer’s Representative (COR) and the Program Manager at least two weeks prior to the coverage dates.

4.1.2 The contractor shall designate an individual who will also function as an on-site PM in addition to the duties of their position. The COR requires PM to meet for monthly status updates.

4.2 Under the Government guidance, and subject to Government review and approval, support all aspects of Financial Reporting function. Financial Reporting includes timely review and in-depth analysis of JVs per DFAS MOU, analysis of all monthly and quarterly JVs using a spreadsheet, utilizing Advanced Enterprise Analytics at the Defense Department (ADVANA) and Defense Departmental Reporting System (DDRS), preparing Accounts Payable (AP) and Accounts Receivable (AR) accrual Journal Vouchers (JV), review of monthly reports and feeder system reconciliations.

4.2.1. Participate in quarterly Statements and Journal Vouchers (JV) review meetings with DFAS.

4.2.2. With Government oversight, and under the Government guidance, review, and approval, perform Trading Partner transactions reconciliation using DAI and ADVANA, and continue to support development of processes to fully meet the OSW requirement for eliminating Trading Partner transactions JVs.

4.2.3. Coordinate and collaborate with PRMA’s Trading Partners (TP) in order to correct all discrepancies between Accounts Payable (AP) and Accounts Receivable (AR) accounts of PRMA and Trading partners, with the goal of eliminating any discrepancies and TP elimination JVs.

4.2.4. With Government oversight, and under the Government guidance, review, and approval, respond to DFAS and OSW data calls, and Support all OSW inquiries and taskers regarding any aspects of financial reporting discrepancies, to include abnormal balances.

4.2.5. Propose fixes to abnormal balances and incorrect postings.

4.2.6. Exercise/obtain expertise and maintain access to all financial reporting related systems to include DAI, Department of Defense Reporting System (DDRS), ADVANA, and DFAS portal.

4.2.7. Participate and support government accounting team in all related Financial Improvement and Audit Readiness (FIAR) meetings, testing, walkthroughs and examinations, under government guidance and oversight.

4.2.8. Under government guidance and oversight support communications between PRMA and DFAS financial reporting branches to include GL accounting and departmental reporting.

4.2.9. Under the government guidance, review and subject to government approval, record all obligation document types in DAI system. Examples of the type of obligation documents include: Purchase Orders, Military Purchase Requests (MIPRs), and Intragovernmental Agencies Agreements (IAAs), manual travel and Permanent Change of Station (PCS) documents not processed by DTS, utility bills, all non-labor manual transactions, and Miscellaneous Obligation Documents (MORDs). All recorded transactions require system approval of the appropriate government official.

4.2.10. Monitor the accuracy, reliability, and adequacy of the accounting and financial systems information and maintain a 99% accuracy rate on transaction input.

4.2.11. Process/record routine obligating documents within 24 business hours and emergency requests within 4 business hours. If an issue arises at the end of the business day, the contractor is not expected to remain after the core hours to process the documents, the clock will resume the next business day.

Business hours are defined as the core hours in paragraph 4.1.

4.2.12. Review and reconcile all system postings and month-end balances for commitments, obligations, and expenses to ensure that all financial postings are correctly annotated. The contractor is responsible for pulling data and reviewing for accuracy, the final review of all reconciliations and approval is performed by the Government

4.2.13. Resolve outbound payment and inbound collection discrepancies based on system information and knowledge of PRMA/DFAS business processes. The contractor shall research outbound payment and inbound collection data, and draft discrepancy resolution recommendations for final Government review and adjudication.

4.2.14. Resolve issues related to accounts payable processing requirements such as processing unmatched disbursements, vendor invoices, resolve invoice discrepancies, and processing vendor payments. Coordinates with the COR on budgeting and funding issues related to operations. The contractor is pulling the data and doing research to identify discrepancies, the final approval for resolution and required actions belongs solely to the Government.

4.2.15. The contractor will work with PRMA and DFAS to provide support and participate in working groups to identify and resolve vendor invoice issues and discrepancies by gathering data for government personnel; final guidance and resolution is provided by the Government.

4.2.16. Assist with vendor non-payment issues to resolution to ensure that vendors receive payment in a timely manner to avoid interest penalties related to operations. The contractor will work with PRMA and DFAS to provide support and participate in working groups to identify discrepancies by gathering data for government personnel; final guidance and resolution is provided by the Government.

4.2.17. Under government guidance and oversight, provide travel related support, analysis, and auditing of DAI-Defense Travel System (DTS) system.

4.2.18. Assist with and maintain the documentation of standard operating procedures for all Accounting and Budget related processes created by the Government.

4.2.19. Under government guidance and oversight, and subject to government approval, report Analysis and Feeder File Reconciliations.

4.2.20. Validate the interface labor files to ensure they are processed accurately and that the file accurately updates the accounting system.

4.2.21. Coordinate with the DFAS Financial Services Analyst and the PRMA Budget and Accounting Analyst to resolve any interface violations associated with feeder systems transactions to ensure interfaced transactions are accurately reconciled and reflected in DAI.

4.2.22. Under government guidance and oversight and subject to Government approval, correct failed transactions to include: Intragovernmental Payment and Collection (IPAC) errors, unmatched disbursement, in-transit, and all other interface reporting issues.

4.2.23. Ensure the Defense Travel System (DTS) interface files update the PRMA DAI accounting system accurately. In the case of interface violations, validate proper posting with DFAS. (Coordinate with PRMA/ DFAS to resolve DTS/ DAI payment rejects.)

4.2.24. Review and reconcile monthly DFAS reports to include DTS reports. Assist PRMA Travel Office with centrally billed account (CBA) reconciliation.

4.2.25. Analyze daily transaction reports to identify variances and provide resolution recommendations of all reported incidents to the government.

4.2.26. Under government guidance, oversight, and subject to Government approval, conduct trend analysis to identify potential issues, root causes, and opportunities for improvement.

4.2.27. Assist with and maintain the documentation of standard operating procedures, work instructions and job aids for all reporting and feeder file reconciliation related process.

4.3.1. Provide support to the PRMA Dormant Account Review – Quarterly (DAR-Q) process by validating, and correcting any Unliquidated Obligations, Open Commitments, Negative Unliquidated Orders, Accounts Payable, Accounts Receivable, and DTS transactions in the system.

4.3.2. Under Government guidance, oversight, and subject to Government approval, assist with the PRMA reimbursable program:

4.3.2.1 Support with performing the reimbursable revenue and billing process in DAI to include sending invoices through IPAC and DCAS for collection and provide PRMA with the generated reports.

4.3.2.2 Support with the review the revenue and billing DAI output reports and resolve any problems identified.

4.3.2.3 Support with Research and apply necessary corrective actions for invoices with exceptions before sending the outbound IPAC and DCAS files.

4.3.2.4 Support correcting failed IPAC and DCAS transactions and coordinate with DFAS and DAI PMO to resolve any system interface issues to ensure IPAC and DCAS files are certified and sent to Treasury.

4.3.2.5 Support resolving DAI issues related to unmatched collections, open receivables, and no talkback transactions, such as processing IPAC chargebacks and rebill, manually posting cash receipt and processing credit memos, subject to government review and approval

4.3.2.6 Work with DFAS and DAI PMO to resolve complex aged receivable issues

4.3.2.7 Provide support with ongoing transactions reconciliation

4.3.2.10 Perform research and process any necessary corrective actions to clear the undistributed balance to include submitting tickets in ADVANA and reconciling Funds Balance with Treasury

4.3.3. Perform data cleansing for the agency reimbursable program. Identify, validate, reconcile, and correct all account balances, subject to government review and approval.

4.3.4. Provide support with ongoing transactions reconciliation. Provide recommendations on data cleansing based on an analysis and understanding of data volumes and data quality, and propose a detailed approach and timeline for executing such data cleansing.

4.3.5. Gather and maintain supporting documentation for all transactions in accordance with the FMR and the PRMA Records Management guidance. This will require working with internal and external stakeholders to obtain documentation as well as researching various financial systems to include: Mechanization of Contract Administration Service (MOCAS), Wide Area Workflow (WAWF), and Electronic Data Access (EDA), to gather invoices, receipts, and acceptance documentation, and ADVANA.

4.3.6. Under Government guidance, oversight, and subject to Government approval, perform financial analysis and research on issues related to the operational review period prior to month end close and determine the need for adjusting entries.

4.3.7. Under Government guidance, oversight, and subject to Government approval, investigate and resolve issues related to overdue accounts receivable and payable balances and determine appropriate follow-on action for operations.

4.3.8. Generate accounts payable and accounts receivable reports, analyze relevant accounting information, and provide PRMA COR a summary of findings.

4.3.9. Under Government guidance, oversight, and subject to Government approval, resolve complex issues/ problems related to operational accounts payable and accounts receivable that cannot otherwise be resolved between DFAS and the customer or supplier representative.

4.3.10. Assist with the creation and updating of standard operating procedures, work instructions and desk aids for all accounting related processes.

4.4. DAI SYSTEM SUPPORT: The Contractor shall:

4.4.1. Provide sustainment support with respect to the PRMA Enterprise operation of DAI. This support shall include providing expertise related to all DAI individual modules, technical assistance, system readiness and training for DAI.

4.4.2. Provide development and sustainment support for any new DAI modules introduced to PRMA.

4.4.3. Provide support and assistance with all G Invoicing related DAI issues.

4.4.4. Assist with a gap analysis of financial and operational issues.

4.4.5. Under Government guidance, oversight, and subject to Government approval, perform an analysis of how PRMA business is accomplished with DAI, address gaps as well as the impact of Software Change Requests (SCR), production fixes, and new DAI versions or application upgrades such as future Oracle Releases or patches.

4.4.6. Monitor/track proposed changes, and conduct research, and propose revisions to the application, technical documents, policy and procedures as necessary.

4.4.7. Under Government guidance, oversight, and subject to Government approval, assist with development and status updates of Agency approved plans and milestones. The contractor will assist by being a liaison between PRMA and DAI PMO for the implementation of pre-approved plans and milestones for new components, programs, and/or system releases.

4.4.8. Report on the program’s status, risks and issues.

4.4.9. Assist with role mapping, user management, and workflow.

4.4.10. The contractor shall draft updates and compile revisions to existing Agency test plans, test materials, and desktop procedures (with latest DAI work processes and procedures) for final Government review and approval.

4.4.11. Participate in design reviews and testing.

4.4.12. Provide recommendations on training and help desk support.

4.4.13. Assist with development of cutover plans for new releases.

4.4.14. Provide help desk support to the PRMA personnel during testing and operations of DAI. The helpdesk shall be staffed during the hours of 0700-1900 EST, Monday through Friday, excluding federal holidays. Help desk support shall include issue identification, troubleshooting, event escalation, and closure of the problem resolution process in support of DAI.

4.4.15. Under Government guidance, and subject to Government oversight, provide training to all PRMA DAI users to ensure that they are fully capable of independently accessing and operating DAI for their job functions. Training support shall include supplementing the Defense Logistics Agency (DLA) training materials for PRMA specific requirements so that the training materials can serve as an accurate reference following training. The trainers shall work closely with the help desk personnel for account access management and to address subject areas that receive frequently asked questions. Training shall be administered quarterly to PRMA personnel based on new additions or changes to processes and procedures to DAI modules. This training shall also be provided to new employees to ensure they become fully capable of independently accessing and operating DAI for their job functions. This training shall be instructor led computer based training and training materials shall be updated and provided based on DLA PMO updates. The contractor shall update PRMA training materials within 5 days after DLA’s updates, when applicable, subject to Government approval.

4.4.16. Update help desk operational manual when changes are required based on DAI and organizational business changes.

4.4.17. Document issues received via phone, email, and in-person in a ticket tracking system and analyze and resolve issues by transferring the issue to the joint Services Provider (JSP) as needed and creating a standard escalation process to ensure issues that require escalation to the DAI PMO (DLA) help desk is standardized in process and in format.

4.4.18. Report metrics and recommend focus areas for training.

4.4.19. Assist with user account management and reporting.

4.4.20. Participate in testing as it relates to the DAI system.

4.4.21. Assist with user account and responsibility management.

4.4.22. Support PRMA audit efforts. Conduct monthly, quarterly, and annual audits in support of OUSD Complimentary User Entity Controls (CUECS) requirements.

4.4.23. Support updates to the PRMA DAI SharePoint site by ensuring the DAI site is kept current and update with training information, including upcoming training, training documents bulletins and items that are pertinent to DAI new releases.

4.4.24. Attend or teleconference into DAI meetings as scheduled by PRMA and DAI PMO.

4.4.25. Conduct brown bags and other sessions to supplement training, communicate reminders, and announce changes in the system and PRMA processes at least quarterly.

4.4.26. Report metrics on training, such as number of students registered and attended.

4.4.27. Provide reporting support including daily, weekly and monthly DoWnloads and report posting to a SharePoint site.

4.5. Upon contract expiration, provide Transition of Contract Services - The contractor shall work with the follow-on contractor, for a period of 30 days to ensure minimum disruption to service and to prevent degradation to work in progress. During this period, the incumbent contractor shall transfer all knowledge, procedures and processes related to accounting, budget and help desk functions referenced within this PWS. The contractor shall provide a Transition Plan at least 90 days prior to expiration of the contract.

4.6. Participate in a Post-Award Conference. This meeting shall provide an introduction between the Contractor personnel and/or Government personnel who will be involved with the contract. The meeting shall provide the opportunity to discuss technical, management and security issues. The Post Award Conference will aid both the Government and Contractor in achieving a clear and mutual understanding of all requirements, and identify and resolve any potential issues. The Contractor shall be prepared to discuss any items requiring clarification and gather information as necessary to support each deliverable.

4.7 Weekly & Monthly Status Reports: The contractor shall provide to the COR: weekly reports during the following week, and a monthly status report by the 5th business day of each month. The monthly reports and weekly reports formats should be standardized, created by the contractor and agreed upon by the government.

4.7.1 Provide monthly status reports depicting status on items 4.1-4.5 and participate in weekly updates/ meetings with the government on accounting and help desk metrics to address data integrity issues of significant difficulty as pertinent to the monthly business.

4.7.2 In the monthly status report, provide status on personnel vacancies and status of substitution. The information should contain status and dates on personnel who have left the contract, status of timeframe in hiring replacements. Replacements shall be in place within 15 calendar days of the departure of personnel.

4.7.3 The monthly status report must include status of mandatory training listed at section 14.0 of the PWS. The report must include the name, course title and completion date.

5.0 DELIVERABLES

Deliverable PWS Ref. Delivery Date

Weekly Status Report 4.7 Weekly on Thursdays

Monthly Status Report 4.7 Fifth Business Day of Each Month

Obligations recording 4.2.11 24 hours

Daily reports Share Point uploads 4.4.27 Daily by 10am

Transition Plan 4.5 90 days prior to contract expiration

Training Materials Updates 4.4.15 Five business days after identification of changes

6.0 CONTRACTOR MANPOWER REPORTING Use this standard paragraph:

6.1 The contractor shall report ALL contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract via SCR which has replaced the legacy Enterprise Contractor Manpower Reporting Application (ECMRA). SCR is located in in the System for Award Management (SAM) (https://sam.gov). Reporting inputs will be for the labor executed during the period of performance during each Government fiscal year (FY), which runs October 1 through September 30. While inputs may be reported any time during the FY, the reporting period for contractors in SAM is generally open from mid-October to mid-December for reporting against the prior government fiscal year, all data shall be reported no later than October 31 of each calendar year, unless a later date is otherwise authorized by the Department of Defense.

7.0 CONTRACTOR TRAVEL

Travel might be required to provide training to current components that are geographically dispersed, and or the unforeseen transfer of a geographically dispersed component. Each training session will last 3- 5 days. When travel becomes necessary, the Contracting Officer will request a firm-fixed price for the trip, and a contract modification will be executed to fund the travel.

7.1. The contractor shall obtain the COR’s approval prior to arranging and conducting any travel. Requests for travel shall be submitted to the COR for approval with estimated travel costs, at least 10 business days prior to needed travel.

8.0 SECURITY

8.0.1 Personnel Security. Overarching security requirements are UNCLASSIFIED. Contractor and subcontractor personnel require unclassified access to WAR network(s), Information Technology (IT) systems, and Government Furnished Equipment (GFE). Contractor and subcontractor personnel must obtain, DOW credentials, (also known as the Common Access Card (CAC)) for physical and logical access to federally controlled facilities and DOW Information Systems (IS) containing Personally Identifiable Information (PII) or Controlled Unclassified Information (CUI).

8.0.2 All Contractor personnel assigned to this contract are required to obtain and maintain the appropriate background investigation (BI) and adjudication or suitability determination in accordance with DODI https://sam.gov/

5200.02-DOW Personnel Security Program (PSP).

8.0.3 The contractor/subcontractor personnel on this contract will be designated performing in Noncritical- Sensitive positions for Unclassified access in accordance with Defense Counterintelligence and Security Agency (DCSA) and the Office of Personnel Management (OPM) investigative alignment, and DoDI 5200.02, DoDM 5200.02 and 32 C.F.R. Part 117.

8.0.4 No employee may perform under this contract or have access to information or systems under this contract until they have completed a Tier 3 (T3) or higher background investigation (BI) that meets the requirement or be in the process of a Personnel Security Investigation (PSI) with a minimum of interim eligibility.

8.1 Staffing. The personnel supporting this contract who require a PRMA sponsored CAC, access to DOW network(s), DOW information systems with CUI/PII data, or DOW IT/Information Systems must be Citizens of the United States. The citizenship requirement also applies to personnel assigned or working on the contract at any remote sites.

8.2 Onboarding. Prior to requesting access to PRMA sponsored resources (e.g., DOW credential(s), Network(s), IT systems, Information Systems (IS) or facility), the contractor must provide an official request via PRMA’s onboarding system(s)/encrypted email/DOW SAFE accompanied by a complete Defense Logistics Agency Headquarters (DLAH) Form 1728 - Request for HQC Contractor Badge and/or Information Technology (IT) Access. The PRMA Security and the Defense Logistics Agency (DLA) Personnel Security (PERSEC) will validate the contractor meet the requirement.

8.3 Listing of Employees & Clearance Documentation. The Contractor shall maintain a current listing of employees. Within 10 calendar days of contract award, the Contractor shall provide the COR a list of all company employees assigned to this effort. The employee list should include the following information:

Contract number, employee information (full legal names), PRMA center/office, location of performance, clearance level needed (e.g., Top Secret/SCI, Top Secret, Secret or None (Position of Trust for unclassified access)), IT access level needed (privilege, authorize or other). The list shall be validated by the company and PRMA Personnel Security (PERSEC). The Contractor shall provide the COR with an updated listing when any employee’s status or information changes.

8.4 Access to Sensitive Information. To the extent that the work under this contract requires the Contractor to have access to DOW sensitive information the Contractor shall after receipt thereof, treat such information as confidential and safeguard such information from unauthorized use and disclosure. The Contractor shall not appropriate such information for its own use or disclose such information to third parties unless specifically authorized by the Government in writing.

8.5 The Contractor shall allow access only to those employees who need the sensitive information to perform services under this contract and who have acknowledge that sensitive information shall be used solely for the purpose of performing services under this contract. The Contractor shall prevent its employees from discussing, divulging, or disclosing any such information to any person or entity except those persons within the Contractor’s organization directly performing the contract.

8.6 Information Technology (IT) Level Investigation Requirements. The contractor/subcontractor personnel supporting this contract will require Privilege or Authorized access to PRMA IT & Information.

8.6.1 Contractor personnel, who perform work on sensitive networks, IT systems or applications, must possess and maintain the appropriate investigation and adjudication determination. The Contractor shall assure that individuals assigned to the contract undergo the respective BI and have obtained the proper eligibility, based on job function or tasks performed, before performing any work or accessing any systems or information under the contract.

8.6.2 IT-Level position category designation does not imply or convey authorization to access classified information.

8.6.3 The IT Level will determine the access level needed to perform work on the DOW IT Systems/Networks. The IT access level is designated based on the IT system/network requirements according to the DOW Cyber, Security Technical Implementation Guides (STIGs) https://public.cyber.mil/stigs/.

8.6.4 It is the responsibility of the contractor to ensure the employees meet the appropriate Tier investigation prior to requesting IT access.

8.6.5 Privilege – High Risk: All personnel in positions in which the individual is responsible for the planning, direction, and implementation of a computer security program, which may include, but is not limited to:

• Enterprise Administrator

• Domain Administrator (AD Admin)

• Server or System Administrator

• Network Administrator

• Desktop/Workstation Administrator

• Database Design and Administration

• Database – System DBA (Sudo to Oracle, Remove Logs, Modify items that change STIG posture)

• Database – Application DBA (Select / add / update data, can deploy objects: SQL types, packages, triggers, etc.)

• Application Administrator

• Web Design and Administration

• Other: Positions with major responsibility include the direction, planning, design testing, maintenance, operation, monitoring, and/or management of systems hardware and software; or, can access a system during the operation or maintenance. (e.g., privileged access and/or systems security oversight).

8.6.5.1 Significant involvement in life-critical or mission-critical systems or relatively high risk for causing grave damage to National Security.

8.6.5.2 All personnel identified in one or more of these roles above must complete a Tier 5 (T5) or Tier 5 Reinvestigation (T5R), an equivalent or higher BI to meet the Special-Sensitive/Critical-Sensitive role. In accordance with the Department of Defense Cloud Computing Security Requirements Guide, all Contractor personnel requiring privileged user access to DOW impacted infrastructure on this contract must either have a T5 or T5R, or have a T3 or T3R and documentation defining "work is carried out under technical review of a person with a T5 or T5R." The Contactor will maintain at least one senior person with technical review responsibilities for all personnel with privileged access to DOW impacted infrastructure.

8.6.6 Authorize – Moderate Risk: All personnel in positions in which the individual is responsible for the-direction, planning, design, operation, or maintenance of a computer system, and whose work is technically reviewed by a higher authority of the Privilege to ensure the integrity of the system. All personnel identified in one or more of these job functions must complete a Tier 3 (T3) or Tier 3 Reinvestigation (T3R), an equivalent or higher BI to meet the Noncritical-Sensitive role. Roles may include, but are not limited to:

• Access to and/or processing of proprietary data, information requiring protection under the Privacy Act of 1974.

• Those with the ability to aggregate and extract data en masses from an automated records repository containing PII.

• Other positions designated by the Agency head that involve a degree of access to a system that creates a significant potential for damage or personal gain less than that in Privilege positions.

https://public.cyber.mil/stigs/

8.7 Personal Identifiable Information (PII) and Tier Investigations. All personnel supporting this contract must protect PII data according to the Privacy Act of 1974. Personnel requiring access to Information Technology (IT) or access to DOW Information Systems that contain military active duty, guard, or reservists’ PII or information pertaining to Service members that are otherwise protected from disclosure where such access has the potential to cause serious damage to national security, must be vetted accordingly and protect the data. BI levels required for each job function or necessary access, include, but are not limited to, the following:

8.7.1 Tier 5/Tier 5R for Special-Sensitive/Critical-Sensitive – High Risk: All personnel with administrative capabilities in a system storing PII, personnel security investigations or adjudication determinations require a Tier-5 (T5) BI.

8.7.2 Tier 3/Tier 3R for Noncritical-Sensitive – Moderate Risk: All personnel with the ability to aggregate or extract military PII en masses from an automated records repository requires at a minimum, a favorably adjudicated Tier-3 (T3) BI or equivalent.

8.7.3 Tier 1 for Non-Sensitive – Low Risk: All Personnel whose access to military PII is limited to data entry or singular search capability require, a minimum, a favorably adjudicated Tier-1 (T1) BI.

8.7.4 The Contractor shall report immediately to the PRMA Privacy Office and secondly to the COR discovery of any Privacy breach.

8.8 Controlled Unclassified Information Requirements for DOW Contractors. The following procedures will be used to protect Controlled Unclassified Information (CUI) documents and materials:

8.8.1 HANDLING: Access to CUI material shall be limited to those employees needing the material to perform their duties. The CUI marking is assigned to documents and material created by a DOW User Agency. CUI is not a classification, but requires extra precautions to ensure it is properly safeguarded and disseminated and is not released to the public without government authorization.

8.8.2 MARKING: The Contractor shall mark unclassified documents containing CUI as follows: “CUI" at the top and bottom of each page, include the CUI warning box, and the CUI Designation Indicator Block as required in DoDI 5200.48.

8.8.2.1 Mark other records such as computer print outs, photographs, films, tapes, or slides in accordance with

DoDI 5200.48 so the receiver or viewer knows that it contains CUI material.

8.8.2.2 Mark a message containing material in accordance with DoDI 5200.48. Unclassified messages containing CUI material must show the abbreviation (CUI) before the text begins.

8.8.2.3 Ensure documents transmitting CUI material call attention to any attachments containing CUI.

8.8.2.4 CUI material released to a contractor by a DOW user agency must have the following statement on the front page or cover:

“THIS DOCUMENT CONTAINS CUI MATERIAL AND MUST BE REVIEWED BY A GOVERNMENT

REPRESENTATIVE UNDER THE REQUIREMENTS OF DODI 5200.48, DODI 5230.09, and DODI 5230.29.”

8.8.3 STORAGE: The Contractor shall, place CUI material in an out-of-sight location during normal work hours, if the work area is accessible to persons who do not have an authorized government purpose for access to the material. After normal duty hours, the Contractor shall store CUI material to prevent unauthorized access by filing it with other unclassified records in unlocked files or desks when internal building security is provided and the file is marked as CUI. When there is no internal security, locked buildings or rooms usually provide adequate after hours protection. For additional protection, store CUI material in locked containers such as file cabinets, desks, or bookcases.

8.8.4 TRANSMISSION: CUI documents and materials may be transmitted via first class mail, parcel post or, for bulky shipments,-fourth class mail. Within the CONUS discussion of CUI material on the telephone is authorized if necessary for the performance of the contract and no alternative is available. Electronic transmission of CUI (voice, data, or facsimile) should be by approved secure communications systems whenever practical. If there is a fax transmission, the sender must ensure the intended receiver is available to receive it or a cover sheet will be used to allow carrying it to the final recipient to avoid unauthorized disclosure of the CUI.

8.8.5 RELEASE: CUI material shall not be released outside of the contractor’s facility except to the representative of DOW or PRMA.

8.8.6 DESTRUCTION: When the CUI material no longer meets the threshold for safeguarding and dissemination, the Contractor shall immediately decontrol it, process it through the records management process, and destroyed by the approved methods identified in DoDI 5200.48 to preclude its disclosure to unauthorized individuals by rendering it unreadable, indecipherable, and irrecoverable.

8.9 Position of Trust (POT) Requirements. DCSA and OPM offers the Tier background investigations, Tier 1 (T1) – Tier 5 (T5) for Position of Trust determination. The T5 being the most stringent investigation and T1 being the least stringent.

8.9.1 The Government is responsible for the cost of POT or sponsor a DOW-determined equivalent background check for unclassified access.

8.9.2 The Position of Trust BI process requires the DOW Government Security Office to review each request and establish the BI sponsorship. Submit a request and list of personnel for security investigation to the PRMA Security Office point of contact(s) to be provided by the COR- NLT five (5) business days after contract award.

8.9.3 Per DCSA a T3 or T3 Reinvestigation (T3R) meets the requirement for a Noncritical-Sensitive position. A new application for a DoD T3/T3R BI for Position of Trust determination requires FBI fingerprints check, proof of US Citizenship and a Personnel Security Questionnaire (PSQ) on the Standard Form (SF) 86 using the National Background Investigation Services – electronic Application (NBIS/eApp). The Contractor employees shall provide all requested information pursuant to the Privacy Act of 1974 when requested by the Government. The Government Security Office will provide instructions according to the individual case and Tier BI to access the eApp system. For information visit NBIS at https://www.dcsa.mil/is/nbis/

8.9.4 Reciprocity. The PRMA and DLA PERSEC will use reciprocity to the extent possible and if necessary will request re-adjudication by the DOW Consolidated Adjudications Facility (CAF) or DCSA Consolidated Adjudication Services (CAS) to support the DOW standards per Executive Order E.O 13467.

8.9.4.1 A BI equivalency will be according to the investigative alignments offered by the OPM and the DCSA here, https://www.dcsa.mil/Portals/91/Documents/pv/GovHRSec/Position_Designation_Investigation_Type_C hart_Sept_2017.pdf

8.9.4.2 Reciprocity consideration includes verifying break in service longer than 24 months as a US Military, US Civilian or US Contractor from the last favorable investigation.

https://www.dcsa.mil/Portals/91/Documents/pv/GovHRSec/Position_Designation_Investigation_Type_Chart_Sept_2017.pdf https://www.dcsa.mil/Portals/91/Documents/pv/GovHRSec/Position_Designation_Investigation_Type_Chart_Sept_2017.pdf

8.9.5 A new Position of Trust applicant under this contract must obtain at a minimum interim eligibility from DLA Security prior to the assignment and performance of their duties in support of the Government in this contract.

8.9.6 PRMA’s interim Position of Trust eligibility is sponsored by PRMA Security and approved by DLA

PERSEC.

8.9.7 Eligible interim Position of Trust personnel expectations include, but are not limited to:

8.9.7.1 Comply with all personnel security requirements as specified by PRMA and DLA PERSEC;

8.9.7.2 Attain and maintain favorable FBI fingerprint results;

8.9.7.3 Comply with all investigative and adjudicative requirements, which includes responsiveness to time-sensitive requests (e.g., interview(s), additional information or clarification) from the DLA PERSEC, investigator or the adjudicative agency (DOW CAF/CAS);

8.9.7.4 Attain and maintain favorable eligibility to the designated BI.

8.10 Controlled/Restricted Areas. The Contractor shall comply with local procedures for entry to DOW/PRMA controlled/restricted areas where Contractor personnel will work.

8.11 Physical Security. The Contractor shall safeguard all Government property and controlled forms provided for Contractor use and adhere to the Government property requirements contained in this contract. At the end of each work day, all Government facilities, equipment and materials shall be secured.

8.12 Pass and Identification Items. The Contractor shall ensure the pass and identification items required for contract performance are obtained for employees and non-government owned vehicles.

8.13 DOW Credentials/Common Access Card (CAC). Contractor personnel must obtain a DOW credential or CAC if they are assigned to perform work under this contract requiring access to DOW network(s), CUI/PII data, IT/Information Systems, DOW Facilities or non-DOW federally controlled facilities on behalf of the DOW on a recurring basis per DODM 1000.13, DOW Identification (ID) Cards: ID Card Life-Cycle.

8.13.1 Comply with HSPD-12 Personal Identity Verification (PIV) issuance requirements. Be responsible for obtaining a CAC or PIV and be in ready status prior to requesting access to DOW resources such as DOW Facilities, DOW IT/Information Systems (IS).

8.13.2 CAC Applicant supporting this contract will need to meet the following requirements:

8.13.2.1 Execute, obtain/maintain a favorable FBI National Criminal History Check (fingerprint check);

8.13.2.2 Have an open Tier 3 or higher BI to meet Noncritical-Sensitive role;

8.13.2.3 Be ready to provide two forms of identification (I-9 document);

8.13.2.4 Provide Proof of U.S Citizenship.

8.14 Retrieving Identification Media. The Contractor shall retrieve all identification media, including vehicle passes from employees who depart for any reason before the contract expires; e.g. terminated for cause, retirement, etc.

8.15 Key Control/Access Badge Control. The Contractor shall establish and implement methods of making sure all keys/badges issued to the Contractor by the Government are not lost or misplaced and are not used by unauthorized persons. The Contractor shall not duplicate any keys issued by the Government.

8.15.1 Prohibited Use. The Contractor shall prohibit the use of keys, issued by the Government, by any persons other than the Contractor’s employees and the opening of locked areas by Contractor employees to permit entrance of persons other than Contractor employees engaged in performance of contract work requirements in those areas.

8.16 Conduct while on Government Installation. The Contractor shall not assign work or direct its employees to access government information, systems, or installations unless the employees have and maintain the required background investigation, clearances, and authorizations.

8.17 Weapons, Firearms, and Ammunition. Contractor employees are prohibited from possessing weapons, firearms, or ammunition, on themselves or within their contractor-owned vehicle or privately-owned vehicle while on government installations.

8.18 Reporting Requirements. Contractor personnel shall report to an appropriate authority any information or circumstances of which they are aware that may pose a threat to the security of government or contractor personnel, resources, or information.

8.19 Government Furnished Equipment (GFE). The Contractor shall establish and implement procedures to ensure all GFE to include laptops and other data processing devices, issued to the Contractor by the Government are not lost or misplaced, are not used by unauthorized persons, and are not subject to unauthorized external devices. The Contractor shall immediately report to the COR any lost GFE within two (2) hours of discovery of occurrence. In the event that GFE is lost, the Contractor may be required, upon written direction of the Contracting Officer, to replace the equipment at no additional cost to the Government. The Government may replace the equipment and deduct the cost from the monthly payment due the Contractor.

8.20 Off boarding. Upon completion of the contract, an employee’s relocation or termination of an employee, or upon request from the COR in accordance with PRMA centers or offices security policies coordinate the employees removal from work under this contract with the COR.

8.20.1 If at any time, any Contractor personnel supporting this contract are unable to obtain/maintain an adjudicated T3 BI the Contractor shall immediately notify the COR and coordinate removal of such a person from work under this contract and replace the individual with appropriate level background investigation knowledge, skill and ability (KSA) required to perform services.

8.20.2 As the contractor replaces employees, the contractor shall submit the outgoing employee’s installation access and return all CACs/badge(s)/identification card(s) immediately to the COR, who will turn it in to the local Installation Access Control Office or Government Security Office.

8.20.3 Submit an Off-boarding notification to the COR and the PRMA PERSEC as soon as the contractor knows an employee is leaving the contract.

8.20.4 When personnel change, provide updated personnel security list to the COR within three business days of a change.

8.21 Information System Security. The Contractor shall implement Information System (IS) security protections and ensure the protections are appropriate to the confidentiality, integrity, and availability needs of the Government. Establish appropriate administrative, technical, and physical safeguards to protect any and all nonpublic Government data.

8.22 Cyber Incident Reporting. Within one (1) hour of discovery of any cyber incident, the Contractor shall notify the PRMA Incident Response (IR) team by emailing an Initial cyber incident report to the following organizational box: doPRMA.dodc-mb.dmdc.list.ir-team@mail.mil, with subsequent reporting every 24 hours until the incident is closed. The Contractor shall also notify the COR and CO at the time the incident is reported to PRMA/IR.

8.23 Compliance with Cybersecurity and Privacy DOW Instructions and Directives. Establish appropriate administrative, technical, and physical safeguards to protect any and all non-public Government data to ensure the confidentiality, integrity, and availability of Government data. All Contractor personnel under this contract shall comply with all security directives and instructions and be in compliance with the latest versions of:

1. DOW Instruction (DoDI) 8500.01, Cybersecurity.

2. The Privacy Act (5 U.S.C. 552a).

3. DOW Instruction 5400.11 DOW Privacy and Civil Liberties Programs, January 2019.

4. DOW Instruction 6025.18 Health Insurance Portability and Accountability Act (HIPAA) Privacy

Rule Compliance in DOW Health Care Programs, March 2019.

5. DOW Instruction (DoDI) 5200.02, DOW Personnel Security Program (PSP) (Incorporating

Change 3, Effective September 24, 2020).

6. HSPD-12, Homeland Security Presidential Directive.

7. DODI 8140, Cybersecurity Workforce

8. NIST SP 800-137, Information Security Continuous Monitoring.

9.0 GOVERNMENT FURNISHED PROPERTY/EQUIPMENT/INFORMATION (GFP/GFE/GFI) The government will provide work spaces to include seating, desks, computers, IT systems, phone systems and all the data reports and work products required to perform the work.

10.0 PLACE OF PERFORMANCE

The Contractor shall perform primary activities at…