HC102817R0064_NBIS_RTT_RFQ.pdf

SEE ADDENDUM

(No Collect Calls)

HC102817R0064 30-Mar-2017

b. TELEPHONE NUMBER

618-229-9462

8. OFFER DUE DATE/LOCAL TIME

10:00 AM 14 Apr 2017

5. SOLICITATION NUMBER 6. SOLICITATION ISSUE DATE

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

STANDARD FORM 1449 (REV. 2/2012)

Prescribed by GSA – FAR (48 CFR) 53.212

(TYPE OR PRINT)

(SIGNATURE OF CONTRACTING OFFICER)

ADDENDA ARE

26. TOTAL AWARD AMOUNT (For Gov t. Use Only )

23.

CODE 10. THIS ACQUISITION IS

SUCH ADDRESS IN OFFER

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT

BELOW IS CHECKED

TELEPHONE NO.

HC10289. ISSUED BY

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a. UNLESS BLOCK

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME

TIMOTHY S. STILL

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NUMBER

(TYPE OR PRINT)

30b. NAME AND TITLE OF SIGNER 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a.UNITED STATES OF AMERICA

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1. 52.212-4. FAR 52.212-3. 52.212-5 ARE ATTACHED.

25. ACCOUNTING AND APPROPRIATION DATA

1. REQUISITION NUMBER

20.

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED.

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, AND 30

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

ARE NOT ATTACHED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

SET FORTH HEREIN, IS ACCEPTED AS TO ITEMS:

. YOUR OFFER ON SOLICITATION

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

% FOR:SET ASIDE:UNRESTRICTED OR X

SMALL BUSINESS

17a.CONTRACTOR/ CODE FACILITY

OFFEROR CODE

DISA/DITCO-SCOTT-PL83

2300 EAST DRIVE

SCOTT AFB IL 62225-5406

18a. PAYMENT WILL BE MADE BY CODE

RATED ORDER UNDER

DPAS (15 CFR 700)

13a. THIS CONTRACT IS A

13b. RATING

CODE15. DELIVER TO CODE 16. ADMINISTERED BY

SEE SCHEDULE

12. DISCOUNT TERMS11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

14. METHOD OF SOLICITATION

RFQ IFB RFPX

FAX:

TEL: SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

8(A)

HUBZONE SMALL

BUSINESS

SIZE STANDARD:

$27,500,000

NAICS:

541512

X

OFFER DATED

29. AWARD OF CONTRACT: REF.

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

EMAIL:

TEL:

31c. DATE SIGNED

SEE SCHEDULE

SCHEDULE OF SUPPLIES/ SERVICESITEM NO. QUANTITY UNIT UNIT PRICE AMOUNT

24.22.21.19.

X

WOMEN-OWNED SMALL BUSINESS (WOSB)

ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

(CONTINUED)

PAGE 2 OF128

ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED: ______________________________________________________

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED

32b. SIGNATURE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32c. DATE 32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f . TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

37. CHECK NUMBER

FINALPARTIALCOMPLETE

36. PAYMENT35. AMOUNT VERIFIED

CORRECT FOR

34. VOUCHER NUMBER

FINAL

33. SHIP NUMBER

PARTIAL

38. S/R ACCOUNT NUMBER 39. S/R VOUCHER NUMBER 40. PAID BY

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42a. RECEIVED BY (Print)

42b. RECEIVED AT (Location)

42c. DATE REC'D (YY/MM/DD) 42d. TOTAL CONTAINERS

STANDARD FORM 1449 (REV. 2/2012) BACK

Prescribed by GSA – FAR (48 CFR) 53.212

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

SEE SCHEDULE

20.

SCHEDULE OF SUPPLIES/ SERVICES

21.

QUANTITY UNIT

22. 23.

UNIT PRICE

24.

AMOUNT

19.

ITEM NO.

Section SF 1449 - CONTINUATION SHEET

PWS

PERFORMANCE WORK STATEMENT (PWS)

Defense Information Systems Agency (DISA) National Background Investigative System (NBIS)

Program Management Office (PMO)

Requirements Alignment as of 2 March 2017

Contract Number:

1. Contracting Officer’s Representative (COR).

a. Primary COR.

Name: TBD

Organization:

Department of Defense Activity

Address Code (DODAAC):

HC1047

Address: 6910 Cooper Ave, Ft. Meade MD 20755

Phone Number:

Fax Number:

E-Mail Address:

b. Alternate COR.

Name: TBD

Organization:

DODAAC:

Address:

Phone Number:

2. Task Order Title: Requirements Alignment for the National Background Investigation System (NBIS)

3. Background. DISA has been tasked by the DoD CIO to serve as the system integrator for NBIS. In order to achieve a suitable and sustainable system, DISA must work with the National Background Investigation Bureau, to document user requirements, performance standards, legacy requirements, and system specifications for the new

Federal background investigation system. The vast amount of requirement sources and the amount of vetting/validation necessary, makes a Requirement Traceability Tool (RTT) a mandatory program element. The

RTT will be used to ensure alignment between DISA, NBIB, and other Federal mission partners, and serves as the primary capture point for all NBIS system requirements.

4. Objectives: The objective of this contract is to coordinate, assist in the gathering, conduct necessary analysis of requirements, and the tracking of these requirement through the implementation of a requirement traceability tool

(RTT). The RTT will consolidate and document user requirements facilitating the development of the capability development document (CDD). Finally, the contractor shall regularly update the inventory of requirements to reflect requirements planned for upcoming scheduled increments and sprints.

5. Scope. This PWS specifies the work to be performed in support of the requirements determination in the development of the National Background Investigation System. This includes research in to existing commercial and government solutions to extract appropriate requirements for the NBIS solution set. This research will involve

Requirements Gathering from stakeholder communities and the integration, testing, implementation, and analyses on interoperability and sustainment facets of a Requirement Traceability Tool (RTT). Finally, the work involves serving as the representative of the NBIS Product Owners during the NBIS Governance process.

The contractor performing this work will be excluded from participating as a prime contractor or a subcontractor on future NBIS system Requests for Proposals (RFPs) due to a Conflict of Interest (COI). The contractor and its employees and agents cannot use or disclose any technical data, noncommercial computer software, noncommercial computer software documentation, or other non-public information belonging to the

Government outside of this contract without the express written consent of the contracting officer. The contractor-employees should also be required to sign a NDA.

6. Performance Requirements.

The following paragraphs list all required support tasks for the NBIS Requirements Alignment effort. The contractor shall provide all necessary resources and knowledge to fully support the listed tasks.

6.1 Task 1 – Requirements Gathering

The goal of this task is to develop a value stream map and gather the functional, technical and other requirements for the National Background Investigation System. To construct the value stream map and gather these requirements the contractor shall conduct in person requirement gathering sessions directly with NBIS stakeholder organizations such as:

Office of Management & Budget (OMB)

Office of the Director of National

Intelligence (ODNI)

Office of Personnel & Management

(OPM)

Department of Defense (DoD)

Department of State

Department of Treasury

Department of Justice (DOJ)

Department of Energy (DOE)

Department of Homeland Security (DHS)

Federal Bureau of Investigations (FBI)

National Security Council (NSC)

National Archives and Records Administration

(NARA)

General Services Administration (GSA)

National Background Investigation Bureau

(NBIB)

HC102817R0064

These organizations are located within the National Capital Region (NCR) with the exception of the Office of Personnel and Management (OPM) that is located in Boyers, PA. To facilitate an analysis of requirements, the government anticipates that the contractor will need to conduct business within the OPM

Boyers, PA location for approximately 1 week each month during the gathering phase.

In addition to the in person interviews, the contractor shall participate and extract additional requirements through the results of associated NBIS program activities (such as value stream mapping workshops) and documented sources. First, the Government will provide legacy artifacts in a variety of formats (Word, Excel, User Stories, Waterfall, etc.). Next, the NBIS program is conducting 4 to 8 prototyping and additional business process reengineering efforts. The Contractors shall review the documented results of these efforts to identify and extract appropriate requirements. The contractor shall then incorporate them into the requirements traceability matrix inventory.

Finally, the contractor shall conclude the value and requirement gathering phase by facilitating a

Government adjudication session to review, accept, and prioritize each identified requirement within development increments and sprints supporting an agile development process.

Deliverables:

1. Meeting minutes, action items and other items from stakeholder discussions

2. Value stream map identifying the vital, important, and other functional capabilities

3. Comprehensive inventory of requirements identified through gathering process

4. Prioritization analysis of identified requirements

5. Adjudicated requirements prepared for uploading within the Requirements Traceability Tool.

6.2 Task 2 – Requirement Traceability Tool (RTT)

The goal of this task is to document and maintain the configuration control of requirements working in an agile environment through stakeholder coordination in order to implement IT solutions that address critical mission needs within the context of a large-scale integrated enterprise. The RTT will be the capture point for the IT solutions, which will be used to link product requirements from the time of their identification to their fulfilment. The accuracy of the RTT ensures the delivery of documented requirements as requested by stakeholders and tracks requirements backwards to their objectives and forward to their deliverables. The contractor will perform high level analysis on the captured requirements to avoid cases of redundancy, contradictions, and unapproved scope creep.

The contractor is required to use a RTT software tool that can export views for Government review. The contractor shall deliver all technical data (as defined by the DFARS) developed by the contractor during performance of this contract and relating to this contract, including but not limited to configuration settings of software applications. The Government will own all such technical data, as described in DFARS

252.227-7020. The contractor shall have no ownership rights in any such technical data and as described in

DFAR 252.227-7020 shall assign copyright to the Government.

The contractor shall deliver all computer data bases (as defined by DFARS 252.227-7020) developed by the contractor during performance of this contract and relating to this contract. The Government will own all such computer data bases, as described in DFARS 252.227-7020. The contractor shall have no ownership rights in any such computer data bases and as described in DFAR 252.227-7020 shall assign copyright to the Government.

The Contractor shall identify and deliver all commercial computer software licenses, including open source and all other proprietary source code used in performance of this contract, and identify and describe the scope of any such licenses and the license grant to the Government.

Deliverables:

1. Requirement Traceability Tool (RTT) populated with current government provided stakeholder requirements.

2. After delivery of the RTT within task 1, deliver updated requirement matrix(es) based upon current NBIS increment and sprint planning.

3. Technical data rights

6.3 Task 3- Represent NBIS Product Owners

The goal of this task is to track, control, document, modify and interpret requirements on behalf the of product owners interviewed during Task 1 throughout the development process. Further, this task will manage the requirement evolution through the NBIS Governance process. The Contractor shall support and enable the Government planning lead during product backlog grooming and sprint backlog planning as required within the agile development process. During the product development efforts, the contractor shall work with developer team to clarify questions on backlog items

The contractor shall further facilitate mission partners’ submission of the documentation to change requirements, and track the request for change through the configuration board. Finally, the contractor will document the decision made and update and maintain the product backlog within the Governance repository as necessary for agile development. Until the establishment of the formal NBIS Change Board, the contractor shall document proposed changes in a similar manner as described within Section 6.1:

Requirements Gathering to review, accept, and prioritize each identified requirements within planned increments and sprints.

Deliverable:

1. Updated inventory of requirements within the RTT

2. Ad hoc requirement interpretation supporting product development

6.4 Task 4. Cyber Threat Security Plan.

In conjunction with the Defense Federal Acquisition Regulation Supplement (DFARS) Subpart 204.73, Safeguarding Unclassified Controlled Technical Information, DFARS Clause 252.204-7012, Safeguarding unclassified controlled technical information, and DoD, DISA, NIST, and other Federal mandated regulations, instructions, procedures, and laws, the contractor shall develop, submit, and implement upon approval a Cyber

Threat Security Plan (plan).

The contractor shall submit the plan 30 days after contract award to the Contracting Officer and COR for acceptance. The Contracting Officer and COR have 10 working days to provide an acceptance or feedback to the contractor. If no written acceptance is received within the 10 working days, then the contractor can consider the plan accepted. If the contractor receives feedback within the 10 working days, then the contractor has 10 working days to provide the Contracting Officer and COR an updated plan based on comments provided by the Government.

This plan shall be consistent with and further detail the approach contained in the contractor’s proposal that resulted in the award of this contract and in compliance with the requirements stated in the clause mentioned under this task.

This plan shall describe the processes and procedures that will be followed to ensure appropriate security of IT resources that are developed, processed, or used under this contract. This plan shall contain the following:

a) Vulnerability Management: evaluate network components, security procedures, and processes for potential exploitation from attack.

b) Cyber Threat Intelligence: provide policy enforcement and end-point protection against unwarranted attacks on the network.

c) Analytics Monitoring: provide scalable analytics solution capable of combining potential risk indicators and developing leads.

d) Mitigation and Response: provide the process on how the threat will be mitigated and responded to upon discovery.

e) Lessons Learned and Action Plan: provide lessons learned and an action plan that will help all interested parties avoid repeated and similar attacks.

f) Subcontractors: explain how your subcontractors will be required to implement this requirement within their processes in support of this task.

Annually, anniversary date of acceptance of the plan, the contractor shall submit verification to the Contracting Officer and COR that the plan remains valid.

Deliverable: Cyber Threat Security Plan due 30 days after contract award.

Contractor Furnished Equipment

Contractor Furnished Equipment (CFE) employed for remote access to a Government network must meet or exceed equivalent Government Furnished Equipment (GFE) cyber security computing requirements. The contractor shall ensure that all CFE (hardware and software) employed to access these environments meet the following minimum

Government cyber security requirements and provide periodic certification of compliance as a pre-requisite to being granted network access.

(1) Use of personally owned systems is prohibited;

(2) Operating systems and applications must be configured for compliance with the applicable Security

Technical Implementation Guides (STIGs);

(3) DoD approved anti-virus and anti-spyware software must be installed and signatures must be configured to automatically update on a daily basis;

(4) DoD approved host-level firewall must be utilized and configured to permit traffic by exception only, dropping all other traffic. If the host-level firewall provides intrusion detection or prevention, the signatures or rules must be updated at the same intervals as the anti-virus software;

(5) Computers must be Information Assurance Vulnerability Management (IAVM) compliant;

(6) Computers must be scanned with the currently approved DoD scanner solution at a minimum of every 30 days. All vulnerabilities must be remediated and reported to the cognizant Information Assurance

Manager;

(7) Contractor employees must possess a current Government issued Common Access Card (CAC) and install

Government certified CAC readers; and

(8) Verification of compliance with these requirements must be provided to an appointed government representative on a monthly basis.

7. Performance Standards.

Performance Standard Acceptable Quality Level (AQL) Method of

Surveillance

Task 1 Requirements gathering

Timeliness: Delivered as expected and in accordance with the weekly deliverable schedule

Quality: Provided without unexpected need for significant revision or update. Anticipated revisions within draft document are documented within the weekly deliverable schedule.

Routine inspection of deliverable products and services.

Task 2 Requirement

Traceability Matrix

Timeliness: Delivered as expected and in accordance with the weekly deliverable schedule

Quality: Provided without unexpected need for significant revision or update. Anticipated revisions within draft document are documented within the weekly deliverable schedule.

Routine inspection of deliverable products and services.

Task 3 Request for Change

Governance (Optional)

Timeliness: Delivered as expected and in accordance with the weekly deliverable schedule

Quality: Provided without unexpected need for significant revision or update. Anticipated revisions within draft document are documented within the weekly deliverable schedule.

Routine inspection of deliverable products and services.

Task 4 Cyber Threat Security

Plan (Optional)

Timeliness: Delivered as expected and in accordance with the weekly deliverable schedule

Quality: Provided without unexpected need for significant revision or update. Anticipated revisions within draft document are documented within the weekly deliverable schedule.

Routine inspection of deliverable products and services.

11. Weekly Deliverable

Schedule

Timeliness: 1 business day after the weekly scheduling meeting

Quality: Provided without need of significant revision or update

Routine inspection of deliverable products

8. Incentives. NA

9. Place of Performance. The work will be performed at the contractor’s site. Travel in and around the primary place of performance may be required throughout the period of performance. Additional travel within CONUS will be required to support the requirements of this PWS from 25-50% of the time.

10. Period of Performance. The base period of performance will be 1 calendar year from Award.

11. Delivery Schedule.

The Government and contractor will establish a weekly delivery schedule projecting the Contractor’s activity. The parties shall meet weekly, unless otherwise increased or decreased at a mutually established time to review the weekly activity priorities and delivery expectations for at least the next 60 days based upon current priorities. The contractor shall document these priorities within a weekly deliverable schedule. This schedule shall include the following for the current week and at least the next 60 days:

Identified & ranked priorities

POC responsible for the completion of the priority

Anticipated deliverable (if applicable) from the priority

Any additional guidance or direction regarding the priority

Task#

Deliverable Title Format Due Date Distribution/

Copies

Frequency and

Remarks

6.1 1. Meeting minutes, action items and other items from stakeholder discussions

2. Value Stream

Map

3. Comprehensive

Inventory of requirements

4. Prioritization analysis of identified requirements

5. Adjudicated requirements prepared for the

Requirements

Traceability Tool

(RTT)

Contractor provided

Government approved format

1. 2 business days after stakeholder discussion or as otherwise established within the weekly schedule

2. As established within the weekly schedule

3. As established within the weekly schedule

4. 30 days after the conclusion of the requirement gathering activities

Standard

Distribution*

1. Follo wing every activity

2. As required

3. As required

4. As required

5. As required

Task#

Deliverable Title Format Due Date Distribution/

Copies

Frequency and

Remarks

6.2 1. Populated

Requirement

Traceability Tool

(RTT)

2. Updated inventory of requirements

3. Technical Data rights

Contractor provided

Government approved format

1. Tracking system established and initial requirements captured in the system within 30 days of contract award

2. As requested within the weekly schedule AND at the onset of each sprint planning activity

(Approximately every 4 weeks)

3. At the conclusion of the task Order

Standard

Distribution*

1. As required

2. As required

3. All /

Immediatley

6.3 1. Updated inventory of requirements within the RTT

2. Ad hoc requirement interpretation

Contractor provided

Government approved format

As requested within the weekly schedule AND at the onset of each sprint planning activity

(Approximately every 4 weeks)

Standard

Distribution*

1. As required

2. As required

6.4 Cyber Threat

Security Plan

(Optional)

Contractor provided

Government approved format

30 days after contract award

Standard

Distribution*

Once, with comment adjudication and final

11 Weekly Deliverable

Schedule

Contractor-

Determined Format

Start of business the day after the weekly activity schedule meeting

Standard

Distribution*

Weekly

12. Security Requirements. This section shall be considered a supplement to block 13 of the Government provided

DD Form 254, Contract Classification Specification. The following security requirements shall apply to this effort.

Also see the attached DD Form 254.

References:

DOD 5200.2-R, DOD Personnel Security Program.

DISAI 240-110-36, Personnel Security.

DOD 5220.22-M, National Industrial Security Program Operating Manual.

DOD 5220.22-R, Industrial Security Regulation.

DODM 5200.01, Vol 1-4 Information Security Program, 24 February 2012

DISAI 240-110-8, Information Security

DISA Policy Letter, Unauthorized Connections to Network Devices, 11 Sep 2013

DISA Form 786

12.1 Facility Security Clearance. The work to be performed under this contract may be up to the secret level.

Specifically, contractor may be required to participate in requirement gathering meetings and activities to include topics up to secret classification. Further, to fully access Government facilities to meet with mission partners requires a Secret clearance. Therefore the company must have a final Secret Facility Clearance from the Defense

Security Service Facility Clearance Branch. The Contractor and the Government, however, will ensure that no classified requirements will be captured in the RTT. The RTT shall remain an unclassified requirement repository and system.

12.2 Security Clearance and Information Technology (IT) Level. All personnel performing on or supporting a DISA contract in anyway will be U.S. citizens.

12.2.1 The following type of position(s) require(s) a final Secret security clearance and eligibility when performance starts.

12.3 Investigation Requirements. All personnel requiring Secret access under this contract shall undergo a favorably adjudicated Single Scope Background Investigation (SSBI) as a minimum investigation. The SSBI will be maintained current within 5-years and requests for Special Background Periodic Reinvestigation (SBPR) will be initiated prior to the 5-year anniversary date of the previous SSBI or SBPR.

12.3.1 All personnel requiring Secret access under this contract shall undergo a favorably adjudicated Tier 3

Investigation formerly known as a National Agency Check, Local Agency Check and Credit Check or Access

National Agency Check and Inquiries as a minimum investigation. The Tier 3 Investigation will be maintained current within 10-years and requests for Secret Periodic Reinvestigation will be initiated by submitting a Tier 3R

Investigation prior to the 10-year anniversary date of the previous Tier 3 Investigation.

12.3.2 Contract employees that do not meet the investigation requirements for Secret IT-I access may be granted such access by the DISA Personnel Security Office (DISA PSO) provided there is no disqualifying information within the adjudicative guidelines that cannot be mitigated. The DISA PSO will request the contract employee complete an Electronic Questionnaire for Investigation Processing (e-QIP). The DISA PSO will review the e-QIP and if there's no disqualifying information, the individual may be eligible for Interim Secret IT-I access. Once favorable results are returned from the Federal Bureau Investigation (FBI) name and fingerprint check, and the NAC portion of the investigation is completed favorable, DISA PSO may grant the Interim Secret IT-I provided all other conditions are met. Contract employees found ineligible for Interim Secret IT-I access will not be allowed to support a DISA contract requiring Secret IT-I access and must wait for final favorable adjudications by the appropriate adjudication facility.

12.4 Adjudication for Secret IT-I access. Favorable adjudication of any previous SSBI, SBPR, or Phased Periodic

Reinvestigation by any of the DoD CAFs or other federal adjudications facility within a five year period will be automatically accepted for final Secret IT-I access.

12.4.1 The following are the requirements, which must be met prior to granting of interim Secret IT-I authorization:

The security manager will forward a written request for interim Secret IT-I authorization to DISA PSO for approval. The request for SSBI (e-QIP, FBI name and fingerprint check) must be submitted by

DISA PSO to the OPM.

12.5 Visit Authorization Letters (VAL).

Visit requests shall be processed and verified through the Joint Personnel Adjudication System (JPAS) to SMO

DKABAA10 and SMO DKADAL. JPAS visits for contracts are identified as “Other” or “TAD/TDY” and will include the Contract Number and ADP/IT-Access Level of the contract in the Additional Information section.

Contractors that do not have access to JPAS may submit visit authorizations by e-mail in a password protected pdf to the Contracting Officer Representative (COR) or government point of contact (POC).

Primary COR: Alternate COR:

Phone Number: (xxx) xxx-xxxx Phone Number:

Email: Email:

Security Manager Contact Information:

Name: Phone:

E-mail

If JPAS is not available the VAL must contain the following information on company letterhead:

Company’s name, address, telephone number, assigned CAGE Code, facility security clearance, Cage Code, Contract Number, Name, SSN, date and place of birth, and citizenship of the employee intending to visit;

Certification of personnel security clearance and any special access authorizations required for the visit (type of investigation & date, adjudication date & agency, and IT access level).

Name of COR/POC

Dates or period the VAL is to be valid.

12.6 Security Contacts. DISA Security Personnel can be contacted for security related questions as follows:

For Industrial or Personnel Security related issues contact (301) 225-1235 or via mail at

Defense Information Systems Agency

ATTN: MP61, Industrial Security

Command Building

6910 Cooper Ave.

Fort Meade, MD 20755-7088

Defense Information Systems Agency

ATTN: MP62, Personnel Security

Command Building

6910 Cooper Ave.

Fort Meade, MD 20755-7088

12.7 Information Security and other miscellaneous requirements.

12.7.1 Contractor personnel must comply with all local security requirements including entry and exit control for personnel and property at the government facility.

12.7.2 Contractor employees will be required to comply with all Government security regulations and requirements.

Initial and periodic safety and security training and briefings will be provided by Government security personnel.

Failure to comply with Government security regulations and requirements will require the company to provide the

Government with a written remediation/corrective action plan; furthermore, failure to comply with such requirements can be cause for removal and the contractor will not be able to provide service on this contract.

12.7.3 Contractor employees with an incident report in JPAS will not be permitted to provide service on a DISA contract.

12.7.4 The Contractor shall not divulge any information about DoD files, data processing activities or functions, user identifications, passwords, or any other knowledge that may be gained, to anyone who is not authorized to have access to such information. The Contractor shall observe and comply with the security provisions in effect at the

DoD facility. Identification shall be worn and displayed as required.

12.7.5 DISA retains the right to request removal of contractor personnel regardless of prior clearance or adjudication status, whose actions, while assigned to this contract, clearly conflict with the interest of the Government.

12.7.6 Contractor personnel will generate or handle documents that contain For Official Use Only information at the

Government facility. Contractor shall have access to, generate, and handle classified material only at the location(s) listed in the place of performance section of this document. All contractor deliverables shall be marked in accordance with DoDM 5200.1, Vol. 3, Vol. 4., Information Security, DoD 5400.7-R, Freedom of Information Act

Program, unless otherwise directed by the Government. The contractor shall comply with the provisions of the DoD

Industrial Security Manual for handling classified material and producing deliverables. The contractor shall comply with DISA Instruction 630-230-19.

12.7.7 Handling of Non-Public Information

In performance of this contract, the contractor may have access to Department of Defense (DoD) information. The contractor agrees (a) to use and protect such information from unauthorized disclosure IAW DoD Instruction

8582.01: Security of Unclassified DoD Information on Non-DoD Information Systems; (b) to use and disclose such information only for the purpose of performing this contract and to not use or disclose such information for any personal or commercial purpose; (c) to comply with other current Federal and DoD information protection and reporting requirements for specified categories of information (e.g., medical, proprietary, critical program information (CPI), personally identifiable information, export controlled); (d) to obtain permission of the

Government Requiring Activity before disclosing/discussing such information with a third party; (e) to return and

/or electronically purge, upon Government request, any DoD information no longer required for contractor performance; and (f) to advise the Contracting Officer and/or Contracting Officer’s Representative of any unauthorized release of such information.

13. Government Furnished Property (GFP)/Government-Furnished Equipment (GFE)/ Government-Furnished

Information (GFI). The contractor shall have access to the NBIS program document repository and all documents not marked Acquisition Sensitive.

14. Other Pertinent Information or Special Considerations. NA

a. Identification of Possible Follow-on Work. Due to the early phase of the NBIS program, there may be a possibility of follow-on work to retain knowledge as capability increments are developed and deployed.

b. Identification of Potential Conflicts of Interest (COI). An Organization Conflict of Interest (OCI) is defined as any relationship, interest, commitment or obligation or any kind that may adversely affect, contravene, or be in conflict with the services to be performed by the contractor.

Any actual or potential OCIs / OCCIs that may arise as a result of current TO support to programs or support following successful awards shall be identified and resolved immediately. The Government is most concerned about potential OCIs in the following scenarios:

1. When a contractor’s work under one Government contract, either as a prime contractor or subcontractor, could entail its evaluating itself or a related entity, either through an assessment of performance under another contract or an evaluation of proposals (impaired objectivity OCIs).

2. When performance of all of the work under this order would place the contractor / subcontractor in a position to make design, integration, or production of systems provided by the contractor’s organization.

1. When the provision of the engineering and technical direction described in the PWS would create the situation prohibited by FAR 9.505-1 because the contractor is currently a prime contractor, subcontractor, or consultant on an order/contract for the supply of a system covered by this order or any of its major components.

Identify any situation that may influence which contractor should be awarded the contract/TO. Organizational COI is a situation where because of other relationships or activities a person (company) is unable or potentially unable to render impartial assistance or advice to the Government or cannot objectively perform contract work or has an unfair competitive advantage. FAR 9.502 states that “an organization COI may result when factors create an actual or potential conflict of interest on an instant contract, or when the nature of the work to be performed on the instant contract creates an actual or potential COI on a future acquisition.” An organizational COI exists when the nature of the work to be performed may, without some restriction on future activities, (1) result in an unfair competitive advantage to the contractor on other contracts or (2) impair the contractor’s objectivity in performing the contract work. For example, work on the Case Management Prototype will preclude the contractor from bidding on a future acquisition for a case management tool, if there is one. The primary burden is on the contractor to identify any organizational COI, however, the Government has the responsibility to identify and evaluate such conflicts. The KO is charged with avoiding, neutralizing or mitigating such potential conflicts. The Otion that no COI exist, or identify any potential COI that may exist for the execution of this contract/TO. The customer should request approval from their KO if a competitive requirement which is similar to the work on this PWS is contemplated by their agency.

c. Identification of Non-Disclosure Requirements.

All DISA Contractors must execute a DISA-provided contractor non-disclosure agreement (NDA) for all services contracts regardless of award amount. The NDA must be signed within one week of contract/TO award. The DISA contractor is responsible for obtaining and maintaining NDAs for each contractor employee assigned to the contract/TO.

nondisclosure agreement contractor.docx

d. Packaging, Packing and Shipping Instructions. NA

e. Inspection and Acceptance Criteria. NA

f. Property Accountability. The contractor shall submit the attached Electronic Product List (see below) in addition to complying with all requirements of DFARS 252.211-7003. See DARS 252.211-9000, Requirement to

Submit an Electronic Product List for additional information.

Electronic Products

List (EPL) Template - 22 May 2015.xls

g. Supply Chain Risk Management (SCRM).

This contract is subject to the Federal SCRM policies and regulations including the Defense Federal Acquisition

Regulation Supplement (DFARS) 252.239-7017 Notice of Supply Chain Risk, DFARS 252.239-7018 Supply Chain

Risk, DoD Instruction 5200.44 Protection of Mission Critical Functions to Achieve Trusted Systems and Networks, Section 806 of theFY2011 NDAA Requirements for Information Relating to Supply Chain Risk, and internal DISA

SCRM Processes and Procedures.

The contractor shall submit a SCRM plan as part of its technical proposal that describes how the contractor will reduce and mitigate Supply Chain Risk using the security controls outlined below (further described in CNSSI 1253, Appendix D and NIST SP 800-53), as applicable to your contract.

Control

Number

HW SW Srvc

SA-12 Supply Chain Protection x x x

SA-12(1) Supply Chain Protection / Acquisition Strategies / Tools / Methods x x x*

SA-12(2) Supply Chain Protection / Supplier Reviews x x x*

SA-12(5) Supply Chain Protection / Limitation of Harm x x x*

SA-12 (7) Supply Chain Protection Assessments Prior to Selection / Acceptance/ Update x x x*

SA-12 (8) Supply Chain Protection / Use of All-Source Intelligence x x x*

SA-12 (9) Supply Chain Protection / Operations Security x x x

SA-12 (10) Supply Chain Protection / Validate as Genuine and Not Altered x x x*

SA-12 (11) Supply Chain Protection / Penetration Testing / Analysis of Elements, Processes, and Actors x x x

SA-12 (12) Supply Chain Protection / Inter-Organizational System Components x x x

SA-12 (13) Supply Chain Protection / Critical Information System Components x x x*

SA-12 (14) Supply Chain Protection / Identity and Traceability x x x*

SA-12 (15) Supply Chain Protection / Process to Address Weaknesses or Deficiencies x x x

IR-4 (10) Incident Handling / Supply Chain Coordination x x x*

IR-6 (3) Supply Chain Protection / Incident Reporting / Coordination With Supply

Chain x x x*

SA-11 Developer Security Testing and Evaluation x x x*

SA-14 Criticality Analysis x x x*

SA-15 Development Process, Standards, and Tools x x x*

SI-7 Software, Firmware, and Information Integrity x x x*

CM-4 Security Impact x x x*

PM-16 Threat Awareness Program x x x

*Not required if there will be no procurement of hardware, firmware, or software systems.

There is no software being developed in support of this contract. Therefore, SA-11 does not applies.

SUPPLY CHAIN RISK MANAGEMENT PLAN UPDATE: The contractor shall provide an updated SCRM Plan to the COR and Program Manager within five (5) business days whenever there is a change that affects one or more security controls as described in the Committee on National Security Systems Instructions (CNSSI) 1253 Appendix

D (companion publication to National Institute of Standards and Technology (NIST) Special Publication (SP)). At a minimum, the following events will require a SCRM Update: changes in company ownership, changes in senior company leadership, supplier changes, subcontractor changes, and ICT supply chain compromises.

15. Section 508 Accessibility Standards. The following Section 508 Accessibility Standard(s) (Technical Standards and Functional Performance Criteria) are applicable (if box is checked) to this acquisition.

Technical Standards

1194.21 - Software Applications and Operating Systems

1194.22 - Web Based Intranet and Internet Information and Applications

1194.23 - Telecommunications Products

1194.24 - Video and Multimedia Products

1194.25 - Self-Contained, Closed Products

1194.26 - Desktop and Portable Computers

1194.41 - Information, Documentation and Support

The Technical Standards above facilitate the assurance that the maximum technical standards are provided to the

Contractors. Functional Performance Criteria is the minimally acceptable standards to ensure Section 508 compliance. This block is checked to ensure that the minimally acceptable electronic and information technology

(E&IT) products are proposed.

Functional Performance Criteria

1194.31 - Functional Performance Criteria

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

0001 12 Months Task 1 – Requirements Gathering

FFP

The CTR shall provide all equipment, materials, and labor to complete Task 1 IAW

PWS 6.1.

PoP: 365 days ARO

FOB: Destination

NET AMT

0002 12 Months Task 2 – Requirement Traceability Tool

FFP

PWS 6.2.

0003 12 Months Task 3- Represent NBIS Product Owners

FFP

PWS 6.3.

0004 1 Each OPTION Task 4. Cyber Threat Security Plan.

FFP

PWS 6.4.

PoP: 30 days ARO

0005 1 Lot Travel

COST

Travel is authorized in the amount of $42,000.00. This amount includes all charges for flight/car, per diem, and lodging. All payments must be processed in accordance with FAR 31.205-46 (reference the FAR website at

<http://farsite.hill.af.mil/vffara.htm> for stipulations and instructions) and the joint travel venture. All travel must be approved through the COR prior to trip.

ESTIMATED COST

1003 12 Months OPTION Task 3- Represent NBIS Product Owners

FFP

PWS 6.3.

PoP: 366-730 days ARO

1005 1 Lot OPTION Travel

COST

Travel is authorized in the amount of $33,000.00. This amount includes all charges for flight/car, per diem, and lodging. All payments must be processed in accordance with FAR 31.205-46 (reference the FAR website at

<http://farsite.hill.af.mil/vffara.htm> for stipulations and instructions) and the joint travel venture. All travel must be approved through the COR prior to trip.

ESTIMATED COST

INSPECTION AND ACCEPTANCE TERMS

Supplies/services will be inspected/accepted at:

CLIN INSPECT AT INSPECT BY ACCEPT AT ACCEPT BY

0001 N/A N/A N/A Government

0002 N/A N/A N/A Government

0003 N/A N/A N/A Government

0004 N/A N/A N/A Government

0005 N/A N/A N/A Government

1003 N/A N/A N/A Government

1005 N/A N/A N/A Government

DELIVERY INFORMATION

CLIN DELIVERY DATE QUANTITY SHIP TO ADDRESS DODAAC /

CAGE

0001 N/A N/A N/A N/A

0002 N/A N/A N/A N/A

0003 N/A N/A N/A N/A

0004 N/A N/A N/A N/A

0005 N/A N/A N/A N/A

1003 N/A N/A N/A N/A

1005 N/A N/A N/A N/A

CLAUSES INCORPORATED BY REFERENCE

52.203-3 Gratuities APR 1984

52.203-11 Certification And Disclosure Regarding Payments To

Influence Certain Federal Transactions

SEP 2007

52.204-4 Printed or Copied Double-Sided on Postconsumer Fiber

Content Paper

MAY 2011

52.204-10 Reporting Executive Compensation and First-Tier

Subcontract Awards

OCT 2016

52.209-2 Prohibition on Contracting with Inverted Domestic

Corporations--Representation

NOV 2015

52.209-6 Protecting the Government's Interest When Subcontracting

With Contractors Debarred, Suspended, or Proposed for

Debarment

OCT 2015

52.209-7 Information Regarding Responsibility Matters JUL 2013

52.209-9 Updates of Publicly Available Information Regarding

Responsibility Matters

JUL 2013

52.209-10 Prohibition on Contracting With Inverted Domestic

Corporations

NOV 2015

52.212-1 Instructions to Offerors--Commercial Items JAN 2017

52.212-4 Contract Terms and Conditions--Commercial Items JAN 2017

52.214-34 Submission Of Offers In The English Language APR 1991

52.214-35 Submission Of Offers In U.S. Currency APR 1991

52.215-17 Waiver of Facilities Capital Cost of Money OCT 1997

52.217-5 Evaluation Of Options JUL 1990

52.219-16 Liquidated Damages-Subcontracting Plan JAN 1999

52.219-30 Notice of Set-Aside for, or Sole Source Award to, Women-

Owned Small Business Concerns Eligible Under the Women-

Owned Small Business Program

DEC 2015

52.222-3 Convict Labor JUN 2003

52.222-46 Evaluation Of Compensation For Professional Employees FEB 1993

52.222-50 Combating Trafficking in Persons MAR 2015

52.223-18 Encouraging Contractor Policies To Ban Text Messaging

While Driving

AUG 2011

52.225-13 Restrictions on Certain Foreign Purchases JUN 2008

52.227-1 Authorization and Consent DEC 2007

52.227-2 Notice And Assistance Regarding Patent And Copyright

Infringement

DEC 2007

52.228-7 Insurance--Liability To Third Persons MAR 1996

52.232-22 Limitation Of Funds APR 1984

52.232-33 Payment by Electronic Funds Transfer--System for Award

Management

JUL 2013

52.233-3 Protest After Award AUG 1996

52.242-1 Notice of Intent to Disallow Costs APR 1984

52.242-13 Bankruptcy JUL 1995

52.242-15 Stop-Work Order AUG 1989

52.246-4 Inspection Of Services--Fixed Price AUG 1996

52.247-34 F.O.B. Destination NOV 1991

52.253-1 Computer Generated Forms JAN 1991

252.203-7000 Requirements Relating to Compensation of Former DoD

Officials

SEP 2011

252.203-7002 Requirement to Inform Employees of Whistleblower Rights SEP 2013

252.203-7003 Agency Office of the Inspector General DEC 2012

252.204-7003 Control Of Government Personnel Work Product APR 1992

252.209-7004 Subcontracting With Firms That Are Owned or Controlled By

The Government of a Country that is a State Sponsor of

Terrorism

OCT 2015

252.213-7000 Notice to Prospective Suppliers on Use of Past Performance

Information Retrieval System--Statistical Reporting in Past

Performance Evaluations

JUN 2015

252.215-7007 Notice of Intent to Resolicit JUN 2012

252.219-7004 Small Business Subcontracting Plan (Test Program) OCT 2014

252.225-7001 Buy American And Balance Of Payments Program-- Basic

(Dec 2016)

DEC 2016

252.225-7002 Qualifying Country Sources As Subcontractors DEC 2016

252.225-7012 Preference For Certain Domestic Commodities DEC 2016

252.225-7031 Secondary Arab Boycott Of Israel JUN 2005

252.225-7050 Disclosure of Ownership or Control by the Government of a

Country that is a State Sponsor of Terrorism

OCT 2015

252.226-7001 Utilization of Indian Organizations and Indian-Owned

Economic Enterprises, and Native Hawaiian Small Business

Concerns

SEP 2004

252.227-7016 Rights in Bid or Proposal Information JAN 2011

252.227-7017 Identification and Assertion of Use, Release, or Disclosure

Restrictions

JAN 2011

252.227-7028 Technical Data or Computer Software Previously Delivered to the Government

JUN 1995

252.227-7030 Technical Data--Withholding Of Payment MAR 2000

252.227-7037 Validation of Restrictive Markings on Technical Data SEP 2016

252.232-7003 Electronic Submission of Payment Requests and Receiving

Reports

JUN 2012

252.232-7010 Levies on Contract Payments DEC 2006

252.233-7001 Choice of Law (Overseas) JUN 1997

252.239-7001 Information Assurance Contractor Training and Certification JAN 2008

252.242-7006 Accounting System Administration FEB 2012

252.243-7001 Pricing Of Contract Modifications DEC 1991

252.243-7002 Requests for Equitable Adjustment DEC 2012

252.245-7001 Tagging, Labeling, and Marking of Government-Furnished

Property

APR 2012

252.245-7002 Reporting Loss of Government Property APR 2012

252.245-7003 Contractor Property Management System Administration APR 2012

252.247-7023 Transportation of Supplies by Sea APR 2014

252.247-7024 Notification Of Transportation Of Supplies By Sea MAR 2000

CLAUSES INCORPORATED BY FULL TEXT

52.203-16 Preventing Personal Conflicts of Interest (DEC 2011)

(a) Definitions. As used in this clause--

Acquisition function closely associated with inherently governmental functions means supporting or providing advice or recommendations with regard to the following activities of a Federal agency:

(1) Planning acquisitions.

(2) Determining what supplies or services are to be acquired by the Government, including developing statements of work.

(3) Developing or approving any contractual documents, to include documents defining requirements, incentive plans, and evaluation criteria.

(4) Evaluating contract proposals.

(5) Awarding Government contracts.

(6) Administering contracts (including ordering changes or giving technical direction in contract performance or contract quantities, evaluating contractor performance, and accepting or rejecting contractor products or services).

(7) Terminating contracts.

(8) Determining whether contract costs are reasonable, allocable, and allowable.

Covered employee means an individual who performs an acquisition function closely associated with inherently governmental functions and is--

(1) An employee of the contractor; or

(2) A subcontractor that is a self-employed individual treated as a covered employee of the contractor because there is no employer to whom such an individual could submit the required disclosures.

Non-public information means any Government or third-party information that--

(1) Is exempt from disclosure under the Freedom of Information Act (5 U.S.C. 552) or otherwise protected from disclosure by statute, Executive order, or regulation; or

(2) Has not been disseminated to the general public and the Government has not yet determined whether the information can or will be made available to the public.

Personal conflict of interest means a situation in which a covered employee has a financial interest, personal activity, or relationship that could impair the employee's ability to act impartially and in the best interest of the Government when performing under the contract. (A de minimis interest that would not ``impair the employee's ability to act impartially and in the best interest of the Government'' is not covered under this definition.)

(1) Among the sources of personal conflicts of interest are--

(i) Financial interests of the covered employee, of close family members, or of other members of the covered employee's household;

(ii) Other employment or financial relationships (including seeking or negotiating for prospective employment or business); and

(iii) Gifts, including travel.

(2) For example, financial interests referred to in paragraph (1) of this definition may arise from--

(i) Compensation, including wages, salaries, commissions, professional fees, or fees for business referrals;

(ii) Consulting relationships (including commercial and professional consulting and service arrangements, scientific and technical advisory board memberships, or serving as an expert witness in litigation);

(iii) Services provided in exchange for honorariums or travel expense reimbursements;

(iv) Research funding or other forms of research support;

(v) Investment in the form of stock or bond ownership or partnership interest (excluding diversified mutual fund investments);

(vi) Real estate investments;

(vii) Patents, copyrights, and other intellectual property interests; or

(viii) Business ownership and investment interests.

(b) Requirements.