Attachment__4_PWS_Temp.DOC

PERFORMANCE WORK STATEMENT (PWS)

as of dd/mmm/yyyy

Contract Number:

Task Order Number:

Contractor Name

Tracking Number:

Follow-on to Previous Contract and Task Order Number:

1. Contracting Officer’s Representative (COR).

a. Primary COR.

Name:

Organization:

Department of Defense Activity Address Code (DODAAC):

Address:

Phone Number:

Fax Number:

E-Mail Address:

b. Alternate COR.

Name:

Organization:

DODAAC:

Address:

Phone Number:

Fax Number:

E-Mail Address:

2. Contract or Task Order Title. Defense Enterprise Office Solutions (DEOS)

3. Background. The DoD requires an integrated enterprise cloud service offering (CSO) for common communication, collaboration, and productivity capabilities that are mission-effective, efficient, more widely accessible, to facilitate DoD operations worldwide. The Defense Information System Agency (DISA) in support of the DoD Deputy Secretary of Defense direction to accelerate the DoD’s adopting of cloud computing technology, plans to acquire and implement a seamlessly integrated, enterprise CSO as a replacement for disparate DoD legacy enterprise information technology (IT) services, such as voice, video, collaboration, email, content management, records management, and office productivity.

4. Objectives: DEOS is a new procurement of a CSO that will support the Departments move towards implementing capabilities for the Joint Information Environment (JIE) vision, improving trusted information sharing, and integration of virtual enterprise services into DoD strategic environments. DEOS will unify and modernize legacy DISA IT enterprise services such as DoD Enterprise Email (DEE), DoD Enterprise Portal Service (DEPS), Defense Collaboration Services (DCS), and other disparate DoD-wide legacy enterprise collaboration, voice/video, and productivity capabilities.

The DEOS CSO will be acquired by DISA through an unrestricted, competitively awarded single-award Indefinite Delivery/Indefinite Quantity (ID/IQ) Firm-Fixed Price (FFP) contract with a Contractor who will provide a non-developmental, seamlessly integrated CSO. The contract period of performance will be a five-year base ordering period and five one-year options ordering period. The contract also will include the six-month extension of services authorized by FAR 52.217-8. The ten-year period of performance will provide the Department with the flexibility to transition users based on user demand, migration schedules, and legacy contracts or service end-of-life terms. The anticipated initial task order issued against this ID/IQ could potentially include the current 1.8M legacy United States territories and possession NIPRNet DEE user population.

5. Scope. DEOS will provide the DoD with an integrated, interoperable, enterprise CSO to support approximately 3.15 million DoD consumers, standardize adoption, and enable cross-Department collaboration at local base/post/camp/station (B/P/C/S) levels to include deployed and afloat organizations. DEOS is intended to be deployed on the Sensitive but Unclassified Internet Protocol (SBU IP) Data Network, also known as NIPRNet, the Secret Internet Protocol (IP) Data, also known as SIPRNet, to include Denied, Disconnected, Intermittent, and Limited Bandwidth (D-DIL) environments.

The capabilities within the scope of the DEOS service are highlighted in Figure 1. The green boxes highlight some of the existing DoD supporting infrastructure, services, and major integration points that will reside primarily on-premises as part of the Government’s responsibility and which the CSP must integrate with. These specific supporting infrastructure and services outline the DoD required integration points that the CSP will be responsible for ensuring interoperability and integration with. Additional, information related to the DoD supporting infrastructure and service requirements are outlined within section 4 of the Functional Requirements Document (FRD).

Figure 1 – DEOS Service Requirements

The Government requires a multifaceted implementation and deployment approach for United States territories and possessions and locations outside of the United States territories and possessions for NIPRNet, SIPRNet, and D-DIL environments.

For the United States territories and possessions NIPRNet and SIPRNet implementations the Government will leverage commercially hosted facilities to meet the DEOS requirements. However, due to DoD data sovereignty requirements, locations outside of the United States territories and possessions the Contractor will be required to implement a NIPRNet and SIPRNet CSO within a DoD data centers (e.g. Stuttgart, Wiesbaden, Capodichino).

For all implementation locations outside of the United States territories and possessions the Contractor will be required to provide a stand-alone environment within a DoD data center that includes, the required infrastructure, hardware, software, and any other additional components required to implement, management, and maintain the CSO environments. The Government will provide and identify the DoD data center facilities based on the Contractor proposed number of distributed DoD data centers, heating, ventilation, air condition (HVAC), per-rack power (e.g. - single phase, 3-phase, amperage, voltage, etc.), floor space (rack and total square footage), bandwidth (in total Mbps/Gbps), physical security/separation, physical access, remote management, and networking (e.g. - IP addressing, subnets, routing) requirements.

6. Performance Requirements.

7. Performance Standards.

8. Incentives.

9. Place of Performance.

Alternate Place of Performance - Contingency Only. As determined by the Contracting Officer’s Representative (COR), contractor employees may be required to work at an alternate place of performance (e.g., home, the contractor's facility, or another approved activity within the local travel area) in cases of unforeseen conditions or contingencies (e.g., pandemic conditions, exercises, government closure due to inclement weather, etc.). Non-emergency/non-essential contractors should not report to a closed government facility. Contractor shall prepare all deliverables and other contract documentation utilizing contractor resources. To the extent possible, the contractor shall use best efforts to provide the same level of support as stated in the PWS. In the event the services are impacted, reduced, compromised, etc., the Contracting Officer or the contractor may request an equitable adjustment pursuant to the Changes clause of the contract.

10. Period of Performance.

As directed by the COR, the contractor shall continue performance in emergency or mission essential conditions. Additionally, the contractor may be required to account for the whereabouts of their personnel should this information be requested by the COR.

11. Delivery Schedule.

*Standard Distribution: 1 copy of the transmittal letter without the deliverable to the Contracting Officer; 1 copy of the transmittal letter with the deliverable to the Primary COR.

12. Security Requirements. This section shall be considered a supplement to Block 13 of the Government provided DD Form 254, Contract Classification Specification. The following security requirements shall apply to this effort.

References:

a. DISA Form 786, DISA Statement of Information System Use and Acknowledgement of User Responsibilities

b. DISA Policy Letter, Unauthorized Connections to Network Devices, 11 September 2013

c. DISAI 240-110-8, Information Security

d. DISAI 240-110-36, Personnel Security

e. DISAI 240-110-38, Industrial Security

f. DISA Instruction 630-230-19, Cybersecurity

g. DoDM 5200.01, Vol 1-4 Information Security Program, 24 February 2012

h. DOD 5200.2-R, DoD Personnel Security Program

i. DOD 5220.22-M, National Industrial Security Program Operating Manual, February 2006 Incorporating Change 02 May 2016

j. DOD 5220.22-R, Industrial Security Regulation

k. DoDM 5105.21 Sensitive Compartmented Information (SCI) Administrative Security Manual: Administration of Information and Information Systems Security (if applicable)

12.1 Facility Security Clearance. The work to be performed under this contract/order is up to the [Secret, Top Secret] level and will require Sensitive Compartmented Information (SCI) access eligibility for some personnel. Therefore the company must have an interim or final [Secret, Top Secret] Facility Clearance from the Defense Security Service Facility Clearance Branch.

12.2 Security Clearance and Information Technology (IT) Level. All personnel performing on or supporting a DISA contract/order in any way will be U.S. citizens. The personnel security requirements for this contract/order cover the individuals supporting the Task Areas delineated in the table below. Contractor personnel must possess the interim or final security clearance and interim or final IT-level eligibility delineated in the table below when performance starts.

12.2.1 Individuals supporting PWS Tasks / Subtasks that require(s) [an interim or a final Top Secret] security clearance and an interim or a final IT-I (privileged level systems access) will, immediately upon hire, require Sensitive Compartmented Information (SCI) access eligibility adjudicated by the Defense Intelligence Agency or other federal adjudications facility to perform their duties. SCI processing for SCI eligibility will be coordinated with the supporting Government Security Manager and will begin immediately upon start of duty performance under this contract/order.

All SCI* work under this contract/order will be monitored by

12.3 Investigation Requirements. All personnel requiring [SCI, Top Secret or IT-I] access under this contract/order shall undergo a favorably adjudicated Tier 5 investigation (formerly known as a Single Scope Background Investigation (SSBI)) as a minimum requirement. The Tier 5 will be maintained current within 5-years and requests for Tier 5 reinvestigation (T5R formerly known as Single Scope Background Period Reinvestigation (SBPR) or Phased Periodic Reinvestigation (PPR)) will be initiated prior to the 5-year anniversary date of the previous Tier 5.

12.3.1 All personnel requiring Secret or IT-II access under this contract/order shall undergo a favorably adjudicated Tier 3 (T3) Investigation formerly known as a National Agency Check, Local Agency Check and Credit Check or Access National Agency Check and Inquiries as a minimum investigation. The Tier 3 Investigation will be maintained current within 10-years and requests for Secret Periodic Reinvestigations will be initiated by submitting a Tier 3R investigation prior to the 10-year anniversary date of the previous Tier 3 Investigation.

12.3.2 Contractor personnel that do not meet the investigation requirements for Secret IT-I access may be granted such access by the DISA Personnel Security Office (DISA PSO) provided there is no disqualifying information within the adjudicative guidelines that cannot be mitigated. The DISA PSO will request the contractor personnel complete an Electronic Questionnaire for Investigation Processing (e-QIP). The DISA PSO will review the e-QIP and if there’s no disqualifying information, the individual may be eligible for Interim Secret IT-I access. Once favorable results are returned from the Federal Bureau Investigation (FBI) name and fingerprint check, the National Agency Check portion of the investigation is completed favorable, DISA PSO may grant the Interim Secret IT-I provided all other conditions are met. Contract personnel found ineligible for Interim Secret IT-I access will not be allowed to support a DISA contract requiring Secret IT-I access and must wait for final favorable adjudications by the appropriate adjudication facility.

12.4 Adjudication for Secret IT-I access. Favorable Adjudication of any previous T5, T5R, SSBI, SBPR or PPR by any of the DoD Central Adjudication Facility or other federal adjudications facilities within a five year period will be automatically accepted for final Secret IT-I access.

12.4.1 Prior to granting interim Secret IT-I authorization, the supporting security manager will forward a written request for interim Secret IT-I authorization to DISA PSO for approval. The request for SSBI (e-QIP, FBI name and fingerprint check) must be submitted by DISA PSO to the OPM.

12.5 Visit Authorization Letters (VAL). Visit requests shall be processed and verified through the Joint Personnel Adjudication System (JPAS) to SMO DKABAA10 and SMO DKADAL. JPAS visits for contracts/orders are identified as “Other” or “TAD/TDY” and will include the Contract/Order Number and ADP/IT-Access level of the contract/order in the Additional Information section. Contractors that do not have access to JPAS may submit visit authorizations by e-mail in a password protected .pdf to the Contracting Officer Representative (COR) or Alternate COR specified in PWS Section 1.0.

If JPAS is not available, the VAL must contain the following information on company letterhead

· Company name, address, telephone number, assigned CAGE Code, facility security clearance

· CAGE CODE

· Contract/Order Number

· Name, SSN, date and place of birth, and citizenship of the employee intending to visit

· Certification of personnel security clearance and any special access authorizations required for the visit (type of investigation & date, adjudication date & agency, and IT access level)

· Name of COR/Alt COR

· Dates or period the VAL is to be valid

12.6 Security Contacts. DISA Security Personnel can be contacted for Industrial or Personnel Security related issues at (301) 225-1235 or via mail at:

Defense Information Systems Agency

Defense Information Systems Agency

ATTN: MP61, Industrial Security

ATTN: MP62, Personnel Security

Command Building

Command Building

6910 Cooper Ave.

6910 Cooper Ave.

Fort Meade, MD 20755-7088

Fort Meade, MD 20755-7088

For Center or Directorate-specific security related matters, contact the Directorate or Center Security Manager at:

Security Manager Contact Information:

Name:

Phone Number:

E-mail:

12.7 Information Security and other miscellaneous requirements.

12.7.1 Contractor personnel shall comply with all local security requirements including entry and exit control for personnel and property at the government facility.

12.7.2 Contractor employees shall be required to comply with all Government security regulations and requirements. Initial and periodic safety and security training and briefings will be provided by Government security personnel. Failure to comply with Government security regulations and requirements shall require the company to provide the Government with a written remediation/corrective action plan; furthermore, failure to comply with such requirements can be cause for removal and the contractor will not be able to provide service on this contract/order.

12.7.3. Contractor employees with an incident report in JPAS who have had their access to classified suspended will not be permitted to provide to fill positions requiring access to classified information on a a DISA contract/order.

12.7.4 The Contractor shall not divulge any information, classified or unclassied, about DoD files, data processing activities or functions, user identifications, passwords, or any other knowledge that may be gained, to anyone who is not authorized to have access to such information. The Contractor shall observe and comply with the security provisions in effect at the DoD facility. Identification shall be worn and displayed as required.

12.7.5 DISA retains the right to request removal of contractor personnel regardless of prior clearance or adjudication status, whose actions, while assigned to this contract, clearly conflict with the interest of the Government.

12.7.6 Contractor personnel will generate or handle documents that contain For Official Use Only information at the [Contractor and/or Government] facility. Contractor shall have access to generate and handle classified material only at the location(s) listed in the place of performance section of this document. All contractor deliverables shall be marked in accordance with DoDM 5200.1, Vol. 3, Vol. 4, Information Security, DoD 5400.7-R, Freedom of Information Act Program, unless otherwise directed by the Government. The contractor shall comply with the provisions of the DoD Industrial Security Manual for handling classified material and producing deliverables. The contractor shall comply with DISA Instruction 630-230-19.

12.7.7 The Contractor shall afford the Government access to the contractor’s facilities, installations, operations, documentation, databases and personnel used in performance of the contract/order. Access shall be provided to the extent required to carry out a program of IT inspection (to include vulnerability testing), investigation and audit to safeguard against threats and hazards to the integrity, availability and confidentiality of data or to the function of information technology systems operated on behalf of DISA or DoD, and to preserve evidence of computer crime.

13. Government Furnished Property (GFP)/Government-Furnished Equipment (GFE)/ Government-Furnished Information (GFI).

14. Other Pertinent Information or Special Considerations.

a. Identification of Possible Follow-on Work.

b. Identification of Potential Conflicts of Interest (COI).

c. Identification of Non-Disclosure Requirements.

Deliverables:

d. Packaging, Packing and Shipping Instructions.

e. Inspection and Acceptance Criteria.

f. Property Accountability. The contractor shall submit the attached Electronic Product List (see below) in addition to complying with all requirements of DFARS 252.211-7003. See DARS 252.211-9000, Requirement to Submit an Electronic Product List for additional information.

g. Supply Chain Risk Management (SCRM).

This contract and its associated delivery/task orders are subject to the Federal SCRM policies and regulations including the Defense Federal Acquisition Regulation Supplement (DFARS) 252.239-7017 Notice of Supply Chain Risk, 252.239-7018 Supply Chain Risk, DoD Instruction 5200.44 Protection of Mission Critical Functions to Achieve Trusted Systems and Networks, Section 806 of the FY2011 NDAA Requirements for Information Relating to Supply Chain Risk, and internal DISA SCRM Processes and Procedures. Each individual delivery and/or task order will submit a SCRM Plan as part of the technical proposal, which addresses, at a minimum, Supply Chain Security Controls as specified in the delivery/task order and described in the Committee on National Security Systems Instruction (CNSSI) 1253 Appendix D (companion publication to National Institute of Standards and Technology (NIST) Special Publication (SP)).

This contract and its associated delivery/task orders are subject to the Federal SCRM policies and regulations including the Defense Federal Acquisition Regulation Supplement (DFARS) 252.239-7017 Notice of Supply Chain Risk, DFARS 252.239-7018 Supply Chain Risk, DoD Instruction 5200.44 Protection of Mission Critical Functions to Achieve Trusted Systems and Networks, Section 806 of theFY2011 NDAA Requirements for Information Relating to Supply Chain Risk, and internal DISA SCRM Processes and Procedures.

The contractor shall submit a SCRM plan as part of its technical proposal that describes how the contractor will reduce and mitigate Supply Chain Risk using the security controls outlined below (further described in CNSSI 1253, Appendix D and NIST SP 800-53), as applicable to your contract.

Control Number

*Not required if there will be no procurement of hardware, firmware, or software systems.

DELIVERABLES:

SUPPLY CHAIN RISK MANAGEMENT PLAN UPDATE: The contractor shall provide an updated SCRM Plan to the COR and Program Manager within five (5) business days whenever there is a change that affects one or more security controls as described in the Committee on National Security Systems Instructions (CNSSI) 1253 Appendix D (companion publication to National Institute of Standards and Technology (NIST) Special Publication (SP)). At a minimum, the following events will require a SCRM Update: changes in company ownership, changes in senior company leadership, supplier changes, subcontractor changes, and ICT supply chain compromises.

h. Contractor employees may be required to take periodic mandatory training courses provided through the agency , such as records management training and other training required by statute, regulation, DoD, or DISA policy. (Note if there are specific courses you will require from your contractors, insert those here.) No other training of contractor personnel shall be provided by the Government unless authorized by the Contracting Officer.

15. Section 508 Accessibility Standards. The following Section 508 Accessibility Standard(s) (Technical Standards and Functional Performance Criteria) are applicable (if box is checked) to this acquisition.

Technical Standards

FORMCHECKBOX

1194.21 - Software Applications and Operating Systems

FORMCHECKBOX

1194.22 - Web Based Intranet and Internet Information and Applications

FORMCHECKBOX

1194.23 - Telecommunications Products

FORMCHECKBOX

1194.24 - Video and Multimedia Products

FORMCHECKBOX

1194.25 - Self-Contained, Closed Products

FORMCHECKBOX

1194.26 - Desktop and Portable Computers

FORMCHECKBOX

1194.41 - Information, Documentation and Support

The Technical Standards above facilitate the assurance that the maximum technical standards are provided to the Offerors. Functional Performance Criteria is the minimally acceptable standards to ensure Section 508 compliance. This block is checked to ensure that the minimally acceptable electronic and information technology (E&IT) products are proposed.

Functional Performance Criteria

FORMCHECKBOX

1194.31 - Functional Performance Criteria

PWS

Page 1 of 10 Pages

DEFENSE INFORMATION SYSTEMS AGENCY

NON-DISCLOSURE AGREEMENT FOR CONTRACTOR PERSONNEL

THIS CERTIFICATION CONCERNS A MATTER WITHIN THE JURISDICTION OF AN AGENCY OF THE UNITED STATES AND THE MAKING OF A FALSE, FICTICIOUS, OR FRAUDULENT CERTIFICATION MAY RENDER THE MAKER SUBJECT TO PROSECUTION UNDER TITLE 18, UNITED STATES CODE, SECTION 1001.

I, (print or type name), as an employee of

(insert employer name) (“the Company”), a contractor or subcontractor for the Defense Information Systems Agency/Defense Information Technology Contracting Organization (DITCO) or other relevant DoD entity, performing under Contract Number (insert contract number), understand that as a result of my assignment under this contract, I may have access to, become aware of, or possess information/data that is considered sensitive or proprietary and may be protected by law from unauthorized use or disclosure.

I agree not to disclose to any individual, business entity, organization, or anyone within or outside of the Company who has not signed a non-disclosure agreement for the purposes of performing this contract: (1) any planning, programming, and budgeting system information; (2) any contractor bid or proposal information or source selection information as defined in Federal Acquisition Regulation (FAR) 3.104-4; (3) any information exempt from disclosure under the Freedom of Information Act, 5 U.S.C. § 552(b), including any trade secrets, proprietary, or financial information protected under § 552(b)(4); (4) any personally-identifiable information or protected health information; and (5) any other sensitive information considered Confidential or For Official Use Only (FOUO). I also agree to use such information/data solely for the purposes of performing this contract, and not to use such information/data to obtain anything of value or to provide a financial benefit or a competitive advantage to any third party and/or my employer.

I continue to be bound by the obligations of this Agreement after my performance under the contract has ended, and after the contract has been terminated or closed, until such time as the information/data protected by this Agreement is approved by the United States Government for public release. Any sensitive or proprietary information/data in my possession at the end of my performance under this contract must be returned to the Government. I understand that I may be subject to administrative, civil, and criminal sanctions for violating this Agreement, and any violation of this Agreement may result in my removal from assignment to this contract.

This Agreement does not bar disclosures to Congress or to an authorized official of an executive agency or the Department of Justice that are essential to reporting a substantial violation of law, and this Agreement does not prohibit disclosures which are required under order of a court of competent jurisdiction. These provisions are consistent with and do not supersede, conflict with, or otherwise alter the obligations, rights, or liabilities created by existing statutes or Executive orders relating to (1) classified information, (2) communications to Congress, (3) the reporting to an Inspector General of a violation of any law, rule, or regulation, or mismanagement, a gross waste of funds, an abuse of authority, or a substantial and specific danger to public health or safety, or (4) any other whistleblower protection. The definitions, requirements, obligations, rights, sanctions, and liabilities created by controlling Executive orders and statutory provisions are incorporated into this agreement and are controlling. These controlling Executive orders and statutory provisions include Executive Order No. 13526, as amended; Section 7211 of Title 5, United States Code (governing disclosures to Congress); Section 1034 of Title 10, United States Code, as amended by the Military Whistleblower Protection Act (governing disclosure to Congress by members of the military); Section 2302(b)(8) of Title 5, United States Code, as amended by the Whistleblower Protection Act (governing disclosures of illegality, waste, fraud, abuse or public health or safety threats); the Intelligence Identities Protection Act of 1982 (50 USC 3121 et seq.) (governing disclosures that could expose confidential Government agents); and the statutes which protect against disclosure that may compromise the national security, including Sections 641, 793, 794, 798, and 952 of Title 18, United States Code, and Section 4(b) of the Subversive Activities Act of 1950 (50 USC 783(b)).

My execution of this Agreement shall not nullify or affect in any manner any other Confidentiality or Non-Disclosure Agreement, including any Standard Form 312 or 4414, which I have executed or may execute with the United States Government or any of its departments or agencies.

I have carefully read this Agreement and understand my obligations under it.

Signature of Contractor Employee Date

_1535455022.xls Sheet1

Columns O through V must also be completed when an IUID tag is required.

Manufacturer Name Manufactuer Part/Model Number Description Covered by OEM Warranty (type and duration) HW Unique Item Identifier (See DFARS 252.211-7003) HW Serial Number/Key Code Software License Included (Duration) Software Serial Number/Key Code Contract Number Delivery Order Number (if applicable) Funding Document Number Contract Line Item No. (CLIN) SubCLIN (SLIN) Customer Organization Delivery Address UNIT OF ISSUE UNIT PRICE IUID Type Issuing Agency Code Enterprise Identifier Lot or Batch Number Type Designation Special Tooling or Special Test Equip

Note: Columns O through V must also be completed when an IUID tag is required.

&F

Sheet2

Sheet3