HC1047-17-R-0009_AMD_01.docx

HC104717R0009

SECTION SF 30 BLOCK 14 CONTINUATION PAGE

SUMMARY OF CHANGES

SECTION SF 1449 - CONTINUATION SHEET

SOLICITATION/CONTRACT FORM

The required response date/time has changed from 13-Apr-2017 05:00 PM to 18-Apr-2017 05:00 PM.

The following have been added by full text:

PWS DATED 7 APRIL 2017

PERFORMANCE WORK STATEMENT (PWS)

as of 07 April 2017

1. Contracting Officer’s Representative (COR).

a. Primary COR.

Name:

Organization:

Department of Defense Activity Address Code (DODAAC):

Address:

Phone Number:

Fax Number:

E-Mail Address:

b. Alternate COR.

Name:

Organization:

Phone Number:

Fax Number:

E-Mail Address:

2. Contract Title. Information Technology (IT) technical services support for milCloud 1.0 Sustainment.

3. Background. Defense Information Systems Agency (DISA) milCloud 1.0 is a cloud-service portfolio that features an integrated suite of capabilities designed to drive agility into the development, deployment and maintenance of Department of Defense (DoD) applications. MilCloud leverages a combination of mature, commercial-off-the-shelf (COTS) and government-developed technology to deliver cloud services tailored to the needs of the DoD. The benefits of milCloud include cost savings compared to other alternatives as well as more flexibility and control for the mission partner to manage resources and control their computing environment. Finally, milCloud aids the DoD to deliver the most innovative, efficient, and secure information and IT services in support of the department's mission; anywhere, anytime, on any authorized device. MilCloud is a component of the DoD Enterprise Cloud Environment and is a foundational Joint Information Environment, core data center offering. MilCloud's infrastructure is maintained within DoD core data centers that incorporate strict security protocols.

The requisite infrastructure will be established in support of the DISA milCloud Program Management Office (PMO) service offering. The project entails enhancement of an infrastructure that currently resides at two geographically separate operating locations on Non-classified Internet Protocol Router Network (NIPRNet) and Secret Internet Protocol Router Network (SIPRNet). The infrastructure is comprised of 20 ESXi hosts (10 at each location), with 20 terabytes of raw storage (10 TB at each location).

4. Objectives. To acquire qualified contractor personnel to provide programmatic, technical, engineering, development, testing and integration support to the DISA milCloud PMO in order to operate, maintain, sustain, and improve the milCloud service offering. Provide the planning, management, coordination and technical support of milCloud activities related to and necessary for the fielding of cloud infrastructure in support of achieving program, agency, and department goals. The primary goal is to work with the existing milCloud service offering to improve and maintain support of operational customers and program goals.

5. Scope. Work accomplished under this contract shall include programmatic, technical, engineering, development, testing, and integration support to the DISA milCloud PMO to maintain, sustain, improve and operate the milCloud 1.0 Service Offering. The tasks described herein focus on systems engineering, testing, integration and implementation support services for the current DISA milCloud service offering. The contractor shall provide the appropriate skilled personnel to support DISA’s milCloud PMO activities under the following areas:

· Task Area 1 – Task Management

· Task Area 2 – Systems Engineering and Integration

· Task Area 3 – Application and Web Development

· Task Area 4 – Cyber Threat Security

· Task Area 5 – Key Personnel

The Government may require surge support during the base or any option period, and surge modifications will be within the scope of the contract and provide increased support for the defined task areas of this PWS. Surge support over the life of the contract will not exceed 25% of the contractor’s total proposed cost/price for the base and all option periods, excluding any six-month extension of services pursuant to FAR 52.217-8.

6. Performance Requirements.

Task 6.1 Task Area 1 – Task Management. The contractor shall prepare a Task Order Management Plan (TOMP) describing the technical approach, organizational resources; spend plan, and management controls to be employed to meet performance and schedule requirements throughout the PWS execution. This TOMP shall include a Master Project Schedule (MPS) for the overall contract to include schedules for each subtask. The MPS shall be able to be incorporated into and synchronized with the milCloud Integrated Master Schedule’s (IMS) pre-defined structure and other milCloud activities in the milCloud IMS. The MPS shall provide sufficient detail to allow effective coordination and synchronization with the Defense Enterprise Computing Centers (DECCs) and DISA managed networks. The schedules shall be developed and base-lined. Microsoft Project shall be used for maintaining the schedule. As a minimum, the MPS shall be created and maintained in a manner that:

· Delineates activities for milCloud functional areas such that as dates change, effects of that change can be seen throughout all portions of the schedule

· Allows for the identification of external organizational dependencies

· Provides a tool for identification of management metrics and program risks

· Shows progress toward implementation

Significant changes shall be communicated to the COR/ACOR(s) and Contracting Officer within three (3) business days following change. Significant changes include those that potentially affect the contractor’s ability to submit deliverables in accordance with the current work plan, or those that are expected to impact critical path or other milestone events captured in the milCloud IMS. This notification shall include any identified causal factors and potential recovery mechanisms. Changes with less significant impact may be reported via the Monthly Status Report (MSR). The contractor shall communicate at least weekly with the COR regarding percent completion against any tasks and subtasks within the MPS if there are tasks that would require adjustments to the MPS.

6.1.1 Project Management and Customer Support. The contractor shall provide experts with customer support experience for a cloud hosting environment using VMWare for the milCloud 1.0. The contractor shall provide experts who can work with milCloud 1.0 customers on issues and configurations. The contractor shall provide program and project management services required for the successful development of the business, management and operational practices and procedures necessary to effectively implement and maintain the services. The contractor shall perform and coordinate implementation management activities in support of and as required by DISA and specifically milCloud 1.0 processes and procedures. Specific project management support requirements the contractor shall provide include:

0. Providing specialized analytical services and support to resolve project management and implementation issues

0. Conducting business process analysis for DISA business practices and procedures

0. Providing support to develop new or improved processes to support the business development, management and operational procedures for the program office

0. Providing customer support on issues requiring direct customer contact

0. Providing technical support on issues related to customer engagement, project management, and implementation issues

0. Managing implementation of the project plan and schedule for all assigned projects

0. Providing technical and functional leadership and direction of complex project tasks

0. Coordinating effectively with operational units such as Datacenter personnel, implementation and network teams to implement and operate the new or existing applications

0. Coordinating with internal and external organizations and working groups by arranging, chairing, facilitating, and participating in regular/ad hoc planning, implementation, and workgroup/IPT meetings

0. Providing customer engagement and technical support expertise for Business Case Analysis (BCA), Initial Business Estimates (IBE), Letter Estimates (LE) or other similarly documented tasks necessary to provide cost estimates to the customer client. Letter estimates provide costs estimates of the service for the client planning

0. Coordinating Information Technology Service Management (ITSM) actions in support of customer requests, coordinating approvals for ITSM tickets, and helping resolve any issues that may cause delay or rejection of ticket

0. Providing management analysis support for planning, documentation and operation, as well as problem resolution of software, hardware and communication systems as related to customer engagement and implementation services from both a technical and an administrative view

6.1.2 Control Progress and Status Reporting. The contractor shall prepare the monthly Contractor Performance Review (CPR) briefing and participate in its presentation. The contractor shall provide status and progress updates of all work activity under the contract, including deviations from planned schedule in the MSR. In addition, the contractor’s MSR shall provide a monthly status of work completed against the baseline plan.

At a minimum, this data shall include:

1. The project schedule showing any proposed changes from the baseline set in the TOMP, the reasons for changes, and the potential impact on the program

1. Descriptions of activities and deliverables during the current month for the contract. The descriptions shall include problem definitions and recommendations for program resolutions. Particular attention shall be given to risk management activities

1. Brief descriptions of all trips and technical visits for the reporting period

1. Personnel reassignments including all personnel added or removed from the contract by task

In addition, the contractor shall include a list of personnel supporting the contract within the MSR; noting any changes in personnel status that occurred during the period of the report. The contractor shall utilize the Government provided Personnel Listing template to accomplish this task.

The contractor shall submit the MSR as identified and in accordance with section 11, Delivery Schedule. The contractor shall also provide a listing of all Government-Furnished Equipment (GFE) monthly. The final GFE report shall include a disposition plan for all GFE and shall be fully executed prior to the end of the contract.

Deliverables: Monthly Contractor Performance Review Personnel Listing Report Government Furnished Equipment Report

6.1.3 Travel Authorization Requests (TARs). The contractor shall provide a TAR at least 5 working days prior to the planned travel to the COR via email for approval. The contractor shall use the provided TAR PDF template to complete this task. The contractor shall provide a travel expense report to the COR within 10 working days of return from travel. The report shall include receipts, invoices, and the approved TAR and be submitted with the monthly Wide Area Work Flow (WAWF) invoice upon billing.

6.1.4 Visit Authorization Requests (VARs). The contractor shall provide a VAR to the COR as described in the Security Section of this PWS prior to award or option year renewal or at least 10 working days before inclusion of a new contractor employee.

Deliverables: Visit Authorization Request

6.1.5 Non-Disclosure Agreements (NDAs). The contractor shall submit a signed government-provided NDA for each employee prior to award or at the inclusion of a new contractor employee on the contract.

Deliverables: Non-Disclosure Agreement

6.2 Task Area 2 – Systems Engineering and Integration. The contractor shall provide systems engineering solutions and technical support for design, analysis, configuration and implementation of enhancements necessary to the milCloud infrastructure which currently uses VMware vSphere 5.1 and vCloud software.

6.2.1 Systems Engineering. In order for DISA to deliver maximum value to its milCloud mission partners, the contractor shall provide technical expertise for engineering solutions and sustaining the milCloud infrastructure which supports Windows, Solaris x86 and Red Hat Enterprise Linux operating environments. The milCloud environment utilizes DISA’s processor and storage capacity services contracts for requisite hardware and support of infrastructure. Infrastructure includes, but is not limited to, VMware vSphere 5.1 Enterprise Plus, vCloud Director, vCNS/ Edge 5.1, vCOPS for chargeback, and Orchestrator. The contractor shall also provide technical expertise for planning and engineering solutions for the expansion of and enhancements to the milCloud infrastructure to include both external and internal components. The contractor shall provide analytical skills essential to identifying system requirements and ensuring that the system meets the mission partner’s operational needs. The contractor work shall also include security accreditation, third-party software requirements, timelines, and any additional design requirements needed to build, install, configure, implement and integrate the engineering solution within DISA.

6.2.2 Engineering and Architecture Support. The contractor shall provide detailed technical analyses, engineering designs, architectural designs and solutions in support of requirements from new customer proposals, or other proposals. The contractor shall support technical solutions under systems architecture to include UNIX, Windows, Sun, HP systems designs as well as cloud computing services. The contractor shall provide the ability to support the writing of technical documentation in support of the production of draft revisions of documents and their appendices. The contractor shall produce and distribute needed engineering solutions, its appendices, and associated modeling data. The contractor also shall research as necessary and support the development for Bill of Materials (BOMs). The contractor shall support hardware, software and network engineering modernization, standardization and automation activities. The contractor shall participate in approximately three engineering “Tiger” teams per year to determine/recommend solutions for optimization. The contractor shall support technical discussions and meetings. The contractor shall support future studies and research on new technologies and/or initiative as necessary to sustain the service.

Deliverables: Engineering Solutions, to include white papers, technical documentation, supporting information for bills of materials and briefing materials.

6.2.3 Subject Matter Expertise (SME). The contractor shall provide subject matter experts in system and solution engineering areas. SME level engineering capability is necessary to address design, planning or implementation elements in areas such as system architecture, new technology, major upgrades, validation of major hardware/software/firmware code revisions, etc. Additionally, the contractor shall respond to and resolve critical issues to reduce implementation risks associated with unique or complex solution components.

6.2.4 Systems Integration. The contractor shall provide technical expertise in the integration of the milCloud infrastructure to ensure compatibility with existing DISA operational infrastructure, business processes, and Information Assurance (IA) requirements. Systems integration includes definition of process flow, implementation of portal requirements, implementation and enforcement of finite provisioning specifications and allocation and provisioning of raw resource requirements (processor, storage and network). The contractor shall provide integration solutions that take into account the inputs/outputs and dependencies of each system component internal and external to the infrastructure and provide guidance on how future added system components support the evolution of the milCloud infrastructure. The contractor shall produce and distribute needed integration solutions documents, appendices, and associated data. The contractor shall produce any related integration plans to includes any related schedules, and or diagrams.

6.2.5 Network/Communications Engineering Support. The contractor shall provide SMEs that are well qualified in the area of network and communication engineering. This task includes but is not limited to assisting with network and firewall configurations, ports and protocol identification, and troubleshooting. The provided SMEs shall also provide escalated troubleshooting, testing and updating standard code versions and device templates as well as remediating security findings. In addition, the provided SMEs shall engineer and configure DISA standard network and communications tools.

6.3 Task Area 3 – Application and Web Development. The contractor shall provide application development for various Application Programming Interfaces (APIs) used to orchestrate deployment of cloud virtual environments. Also, the contractor shall provide support for integrating existing DISA portal capabilities with VMware branded software to include but not limited to vCenter Orchestrator and integration with the Finance Management Liaison Office (FMLO) API for internal billing purposes. The contractor shall provide web development support that expands the capabilities provided by milCloud and offers mission partners with an easy and efficient process to order, implement, and manage their respective Virtual Data Center (VDC). All major releases shall require a series of design reviews scheduled with the related weekly boards and the milCloud program office throughout the development cycle, about five reviews per quarter. The contractor shall develop, test and document the enhancements in the contractor lab facility before deploying to the test and pre-production sites at the DECCs. There will be two or three releases a quarter. The contractor shall work with the milCloud Change and Configuration Management process to submit proper Change Management (CM) documentation, which includes as a minimum: Problem Reports, Change Requests, Authorized Service Interruption (ASI) requests, and supporting documentation, in advance of any implementation of changes to the milCloud baseline.

6.3.1 Application and Web Programming. The contractor shall develop, enhance and maintain an ordering portal and multiple APIs to other system components. These interfaces support the back-end and front-end management of the milCloud infrastructure environment. The solution was developed against the following toolset, but is not limited to:

1. VMware vCloud API and VMware vCloud SDK for Java

1. vCloud Architecture Toolkit, Chargeback API

1. vCenter Chargeback Manager SDK for Java, Management SDK, SDK for Perl, Orchestrator Plug-in SDK, Lab Manager API, Converter SDK, vNetwork APIs

1. Virtual Disk Development Kit

1. VMware vCenter

1. vSphere Web Client SDK, Client Plug-ins, Guest SDK, CLI and PowerCLI, Management Assistant, SDK for Java

1. CIM PDK (SMASH, SMI-S)

1. VMRC SDK

1. VIX API

1. Open Virtualization Format Tool

6.3.1.1 The contractor shall provide software development lifecycle engineering support, integration support and technical expertise to the milCloud program.

6.3.1.2 The contractor shall work with the Government to derive software requirements, and to design, implement, test and deliver software services and applications. The contractor shall provide software development for the Cloud Service Management (CSM) portal and enhancements to support milCloud and milCloud Plus. The contractor shall modernize the CSM Portal and provide further usability enhancements.

6.3.1.3 The contractor shall assist in integrating, implementing, operating and maintaining cloud orchestration tooling for automated provisioning and business workflows. The contractor shall coordinate and conduct integration of the CSM Portal with external data services within milCloud as needed.

6.3.1.4 The contractor shall conduct technical evaluations and provide solution recommendations to the milCloud product suite.

Any solutions, programs, or code developed in support of this effort shall be delivered with unlimited rights in computer software and computer software documentation. The solution shall be delivered with a detailed user manual and training documentation. Such documentation shall be adequate for the Government to develop additional training materials as required (e.g., training slide shows, computer based training CDs, quick start guides, Defense Acquisition University (DAU) Continuous Learning Module (CLC), etc.). Upon delivery, the Government retains ownership of the solution, programs and/or code delivered in support of this effort. The contractor shall deliver copies of all software versions and appropriate release documents (architecture and design documentation, software version descriptions, installation guides, system administrator manuals, etc.) to the Government after all contractor testing has completed and before installation at any remote site as an official Government configuration item. This task shall include:

0. Technical documentation

0. Software code

0. Software test plan

0. Software maintenance and sustainment plan

Deliverables: Solution recommendations Solutions, programs, software, architecture and design documentation, software version descriptions, installation guides, system administrator manuals, etc.) and/or code

6.3.2 Orchestration Support. The contractor shall provide engineering, development, and sustainment support to the milCloud Program Office for the orchestration tool. The orchestration tool is the cloud management software used to automate the provisioning (new orders and modifications) of VDCs based on Mission Partner CSM orders.

6.3.2.1 The contractor shall provide solution engineering support to the DISA milCloud Program Office to evolve and mature the orchestration service. Tasks include participation in governance and technical review board activities, documentation reviews, and lifecycle management process reviews (i.e. System Requirements Review (SRR), Preliminary Design Review (PDR), Critical Design Review (CDR), Test Readiness Review (TRR), Deployment Readiness Review (DRR), etc.). Projects will include the automation of the full lifecycle of a mission partner’s VDC, to include but not limited to, provisioning, modifying and decommissioning.

6.3.2.2 The contractor shall design, develop, test, implement and sustain the Orchestration service which currently consists of the HP Cloud Service Automation (CSA) and Operations Orchestration (OO). This task includes any follow-on or future orchestration tools that are implemented by the milCloud PMO.

6.3.2.3 The contractor shall maintain the API between the Orchestration service and CSM Portal. Coordinate with CSM Portal developers and milCloud PMO any changes or upgrades required to the orchestration software by following the processes approved by the governance and technical review boards. The contractor shall prepare and provide the government the technical documentation, Software code, Software test plan, Software maintenance and sustainment plan related to each orchestration software change or upgrade. The contractor shall also maintain the related project schedules.

Deliverables: Technical Documentation Software code, Software test plan, Software maintenance and sustainment plan related to each orchestration software change or upgrade.

6.4 Task Area 4 - Cyber Threat Security

6.4.1 Handling of Non-Public Information. In performance of this contract, the contractor may have access to DoD information. The contractor agrees (a) to use and protect such information from unauthorized disclosure IAW DoD Instruction 8582.01: Security of Unclassified DoD Information on Non-DoD Information Systems; (b) to use and disclose such information only for the purpose of performing this contract and to not use or disclose such information for any personal or commercial purpose; (c) to comply with other current Federal and DoD information protection and reporting requirements for specified categories of information (e.g., medical, proprietary, critical program information (CPI), personally identifiable information, export controlled); (d) to obtain permission of the government requiring activity before disclosing/discussing such information with a third party; (e) to return and /or electronically purge, upon government request, any DoD information no longer required for contractor performance; and (f) to advise the Contracting Officer and/or COR of any unauthorized release of such information.

6.4.2 Contractor Furnished Equipment. Contractor Furnished Equipment (CFE) employed for remote access to a government network must meet or exceed equivalent Government Furnished Equipment (GFE) cyber security computing requirements. The contractor shall ensure that all CFE (hardware and software) employed to access these environments meet the following minimum government cyber security requirements and provide periodic certification of compliance as a pre-requisite to being granted network access.

1. Use of personally owned systems is prohibited;

1. Operating systems and applications must be configured for compliance with the applicable Security Technical Implementation Guides (STIGs);

1. DoD approved anti-virus and anti-spyware software must be installed and signatures must be configured to automatically update on a daily basis;

1. DoD approved host-level firewall must be utilized and configured to permit traffic by exception only, dropping all other traffic. If the host-level firewall provides intrusion detection or prevention, the signatures or rules must be updated at the same intervals as the anti-virus software;

1. Computers must be Information Assurance Vulnerability Management (IAVM) compliant;

1. Computers must be scanned with the currently approved DoD scanner solution at a minimum of every 30 calendar days. All vulnerabilities must be remediated and reported to the cognizant Information Assurance Manager;

1. Contractor employees must possess a current government issued Common Access Card (CAC) and install government certified CAC readers; and

1. Verification of compliance with these requirements must be provided to an appointed government representative on a monthly basis.

6.5 Task Area 5- Key Personnel Requirements.

Due to the nature of services to be provided, it is necessary that test management personnel be experienced and knowledgeable in the field of Cloud Computing and Web Development. At a minimum the following key personnel shall possess the following education and experience requirements:

7. Performance Standards.

Management Plan

Engineering

Integration The contractor shall submit to the Technical Review Board, per the MilCloud IMS, required Technical Systems Integration Documentation, Project Plans or Schedules with 95% of all Systems Integration Documentation will meet requirements and be error-free. Problems that occur are minor and are resolved in a satisfactory manner.

Periodic Inspection and Customer Input

Management

8. Incentives.

Positive Incentives:

None

Negative incentives:

All Tasks are important, however the majority of support currently falls under Task Area 2, System Engineering and Integration and Task Area 3, Application and Web Development. If two deliverables are late and or incomplete in one quarter, 2% will be deducted from each month of the next quarter’s labor invoices.

Task 6.1 including subtasks 6.1.1- 6.1.4 deliverables were established to keep the contract properly maintained throughout the course of the lifecycle. CDRs will be filed for consistently late deliveries of any of these deliverables; additionally, on the fourth late delivery 2% will be deducted from the invoice until the issue is corrected.

9. Place of Performance.

The contractor may perform the services at their off-site locations, however limited space is available at DISA Ft. Meade and DISA Denver if the contractor chooses to have some FTEs on-site. All FTEs must be available to support meetings and mission partner engagements and obtain SIPR access at the locations at DISA Denver or DISA HQ Fort Meade listed below:

DISA HQ Ft Meade: 6916 Cooper Avenue Ft Meade, MD 20755 DISA Denver: 6162 S. Willow Dr; Suite 200 Greenwood Village, CO 80111

The contractor shall perform services under this contract within a cleared facility or within a DISA facility, unless directed otherwise by the COR

Travel in and around the primary place of performance may be required throughout the period of performance. Additional travel within CONUS may be required to support the requirements of this PWS.

Alternate Place of Performance - Contingency Only. As determined by the Contracting Officer’s Representative (COR), contractor employees may be required to work at an alternate place of performance (e.g., home, the contractor's facility, or another approved activity within the local travel area) in cases of unforeseen conditions or contingencies (e.g., pandemic conditions, exercises, government closure due to inclement weather, etc.). Non-emergency/non-essential contractors should not report to a closed government facility. Contractor shall prepare all deliverables and other contract documentation utilizing contractor resources. To the extent possible, the contractor shall use best efforts to provide the same level of support as stated in the PWS. In the event the services are impacted, reduced, compromised, etc., the Contracting Officer or the contractor may request an equitable adjustment pursuant to the Changes clause of the contract.

10. Period of Performance. The base period of performance will be 365 calendar days (366 calendar days for a leap year), with four (4) one-year options. Period of performance shall be in accordance with the dates specified for each CLIN in this contract.

The contractor shall perform Monday through Friday excluding all Federal holidays, with core hours of 8:00 am to 3:00 pm. Normal duty hours are 8 hours per day. The contractor shall have a protocol that their employees are to follow when the government work site is closed due to inclement weather, hazardous conditions, or other special circumstances. The COR may direct the contractor in these instances to provide sufficient personnel under non-hazardous conditions to complete or continue work already in process or provide on-call response in accordance with the PWS.

As directed by the COR, the contractor shall continue performance in emergency or mission essential conditions. Additionally, the contractor may be required to account for the whereabouts of their personnel should this information be requested by the COR.

11. Delivery Schedule.

6.16.2, 6.2, 6.3, 6.4

*Standard Distribution: 1 copy of the transmittal letter without the deliverable to the Contracting Officer; 1 copy of the transmittal letter with the deliverable to the Primary COR and government stakeholders

12. Security Requirements. This section shall be considered a supplement to block 13 of the government provided DD Form 254, Contract Classification Specification. The following security requirements shall apply to this effort. Also see the attached DD Form 254.

References:

DOD 5200.2-R, DOD Personnel Security Program.

DISAI 240-110-36, Personnel Security.

DOD 5220.22-M, National Industrial Security Program Operating Manual.

DOD 5220.22-R, Industrial Security Regulation.

DODM 5200.01, Vol 1-4 Information Security Program, 24 February 2012 DISAI 240-110-8, Information Security DISA Policy Letter, Unauthorized Connections to Network Devices, 11 Sep 2013 DISA Form 786

12.1 Facility Security Clearance. The work to be performed under this contract is up to the Secret level. Therefore the company must have a final Secret Facility Clearance from the Defense Security Service Facility Clearance Branch.

12.2 Security Clearance and Information Technology (IT) Level. All personnel performing on or supporting a DISA contract in any way shall be U.S. citizens. There is one level of personnel security requirement under this contract covering the following types of positions:

12.2.1 The following type of position(s) and task(s) require(s) an interim secret IT-I eligibility when performance starts.

12.2.2 The following type of position(s) and task(s) require(s) an interim secret IT-II eligibility when performance starts.

12.3 Investigation Requirements. All personnel requiring Secret IT-I access under this contract shall undergo a favorably adjudicated Single Scope Background Investigation (SSBI) as a minimum investigation. The SSBI will be maintained current within 5-years and requests for Special Background Periodic Reinvestigation (SBPR) will be initiated prior to the 5-year anniversary date of the previous SSBI or SBPR.

12.3.1 All personnel requiring Secret access under this contract shall undergo a favorably adjudicated Tier 3 Investigation formerly known as a National Agency Check, Local Agency Check and Credit Check or Access National Agency Check and Inquiries as a minimum investigation. The Tier 3 Investigation will be maintained current within 10-years and requests for Secret Periodic Reinvestigation will be initiated by submitting a Tier 3R Investigation prior to the 10-year anniversary date of the previous Tier 3 Investigation.

12.3.2 Contract employees that do not meet the investigation requirements for Secret IT-I access may be granted such access by the DISA Personnel Security Office (DISA PSO) provided there is no disqualifying information within the adjudicative guidelines that cannot be mitigated. The DISA PSO will request the contract employee complete an Electronic Questionnaire for Investigation Processing (e-QIP). The DISA PSO will review the e-QIP and if there's no disqualifying information, the individual may be eligible for Interim Secret IT-I access. Once favorable results are returned from the Federal Bureau Investigation (FBI) name and fingerprint check, and the NAC portion of the investigation is completed favorable, DISA PSO may grant the Interim Secret IT-I provided all other conditions are met. Contract employees found ineligible for Interim Secret IT-I access will not be allowed to support a DISA contract requiring Secret IT-I access and must wait for final favorable adjudications by the appropriate adjudication facility.

12.4 Adjudication for Secret IT-I access. Favorable adjudication of any previous SSBI, SBPR, or Phased Periodic Reinvestigation by any of the DoD CAFs or other federal adjudications facility within a five year period will be automatically accepted for final Secret IT-I access.

12.4.1 The following are the requirements, which must be met prior to granting of interim Secret IT-I authorization:

· The security manager will forward a written request for interim Secret IT-I authorization to DISA PSO for approval. The request for SSBI (e-QIP, FBI name and fingerprint check) must be submitted by DISA PSO to the OPM.

12.5 Visit Authorization Letters (VAL).

Visit requests shall be processed and verified through the Joint Personnel Adjudication System (JPAS) to SMO DKABAA10 and SMO DKADAL. JPAS visits for contracts are identified as “Other” or “TAD/TDY” and will include the Contract Number and ADP/IT-Access Level of the contract in the Additional Information section. Contractors that do not have access to JPAS may submit visit authorizations by e-mail in a password protected pdf to the Contracting Officer Representative (COR) or government point of contact (POC).

Primary COR: *Please see COR information in section 1 of the PWS.

Phone Number: *Please see COR information in section 1 of the PWS.

Email: *Please see COR information in section 1 of the PWS.

Security Manager Contact Information:

Name: Aide Cisneros Phone: 301-225-7059 E-mail: aide.cisneros.civ@mail.mil

If JPAS is not available the VAL must contain the following information on company letterhead:

Company’s name, address, telephone number, assigned CAGE Code, facility security clearance.

Cage Code Contract Number Name, SSN, personal email address, date and place of birth, and citizenship of the employee intending to visit;

Certification of personnel security clearance and any special access authorizations required for the visit (type of investigation & date, adjudication date & agency, and IT access level).

Name of COR/POC Dates or period the VAL is to be valid.

12.6 Security Contacts. DISA Security Personnel can be contacted for security related questions as follows:

For Industrial or Personnel Security related issues contact (301) 225-1235 or via mail at:

Defense Information Systems Agency ATTN: MP61, Industrial Security Command Building 6910 Cooper Ave.

Fort Meade, MD 20755-7088

Defense Information Systems Agency ATTN: MP62, Personnel Security Command Building 6910 Cooper Ave.

Fort Meade, MD 20755-7088

12.7 Information Security and other miscellaneous requirements.

12.7.1 Contractor personnel must comply with all local security requirements including entry and exit control for personnel and property at the government facility.

12.7.2 Contractor employees will be required to comply with all government security regulations and requirements. Initial and periodic safety and security training and briefings will be provided by government security personnel. Failure to comply with government security regulations and requirements will require the company to provide the government with a written remediation/corrective action plan; furthermore, failure to comply with such requirements can be cause for removal and the contractor shall not be able to provide service on this contract.

12.7.3 Contractor employees with an incident report in JPAS will not be permitted to provide service on a DISA contract.

12.7.4 The contractor shall not divulge any information about DoD files, data processing activities or functions, user identifications, passwords, or any other knowledge that may be gained, to anyone who is not authorized to have access to such information. The contractor shall observe and comply with the security provisions in effect at the DoD facility. Identification shall be worn and displayed as required.

12.7.5 DISA retains the right to request removal of contractor personnel regardless of prior clearance or adjudication status, whose actions, while assigned to this contract, clearly conflict with the interest of the government.

12.7.6 Contractor personnel will generate or handle documents that contain For Official Use Only information at the contractor and government facility. Contractor shall have access to, generate, and handle classified material only at the location(s) listed in the place of performance section of this document. All contractor deliverables shall be marked in accordance with DoDM 5200.1, Vol. 3, Vol. 4, Information Security, DoD 5400.7-R, Freedom of Information Act Program, unless otherwise directed by the government. The contractor shall comply with the provisions of the DoD Industrial Security Manual for handling classified material and producing deliverables. The contractor shall comply with DISA Instruction 630-230-19.

13. Government-Furnished Equipment (GFE)/Government-Furnished Information (GFI).

The Government will provide the following when the contractor is working at the Government’s site:

-Access to government personnel with functional, activity, management information and business process expertise.

-Identification badges for each of the Contractor personnel, office space and personal computers.

-Telephone service for local/long distance call for Government business only, copying and office supplies as needed.

-If necessary to carry out task, as determined by the COR, the Government may provide a mobile communication device to be carried off-site.

14. Other Pertinent Information or Special Considerations.

a. Identification of Possible Follow-on Work. The government may require surge support during the base or any option period, and surge modifications will be within the scope of the contract and provide increased support for the defined task areas of this PWS. Surge support over the life of the contract will not exceed 25% of the contractor’s total proposed cost/price for the base and all option periods, excluding any six-month extension of services pursuant to FAR 52.217-8.

b. Identification of Potential Conflicts of Interest (COI). The contractor shall identify any potential conflicts of interest and provide documentation as to their remediation strategy. Due to the nature of the DoD IA Program, Organizational Conflict of Interest (OCI) issues are a significant concern as they hold the potential to disrupt the performance of this contract and other contracts awarded and administered by DISA. As such, OCI will also be evaluated as part of the management practices sub factor for proposal risk in terms of your company’s approach to identifying and mitigating potential OCIs for both you and any teammates. This is the case whether an OCI mitigation plan is required or not, and is a consideration above and beyond the acceptability of the OCI mitigation approach IAW FAR Subpart 9.5

DISA would like to remind companies deciding to pursue proposing on this effort in any prime, subcontractor, or teaming arrangement capacity of their responsibility to ensure they address, and take steps to avoid and/or mitigate, any potential OCI issues. This is especially important for companies supporting government entities that will be involved in providing support activities for this effort. Guidance is found in the Federal Acquisition Regulation (FAR) Part 9. Such companies should examine any support contracts it has in place with the government for provisions addressing OCI issues. A company finding it has a potential OCI situation must submit and have approved a mitigation plan prior to the government’s consideration of any proposal for award. Since the approval process can be lengthy and approval of any plan is not assured, it is highly recommended that potential OCI identification and resolution processes begin as soon in this pre-award phase as possible. An OCI may result in the canceling of an order or determining an offeror ineligible for award.

OCI Policies and Programs: Each plan should describe any OCI policies or programs currently in effect or planned for each offeror team member as appropriate, such as:

1. In-house OCI Training for new and existing employees

1. OCI Certification Statements

1. OCI Enforcement Policies

1. Employee OCI reporting requirements

1. Consequences for OCI violations

1. Disclosure of violations to the government

1. OCI policies related to employee transfer; separation; and compensation

1. Use Nondisclosure Agreements / Transfer of Information Agreements (include models drafts where appropriate)

As part of the proposal, the contractor’s team shall provide an OCI Plan.

Additionally, any OCI identified during the performance of the effort, not already mitigated, shall be brought…