HHM402-24-Q-0001_Amendment_01 (U).pdf

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods:

(a) By completing items 8 and 15, and returning or (c) By separate letter or electronic communication which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by letter or electronic communication, provided each letter or electronic communication makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

E. IMPORTANT: Contractor is not is required to sign this document and return copies to the issuing office.

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT 1. CONTRACT ID CODE

2. AMENDMENT/MODIFICATION NUMBER 3. EFFECTIVE DATE 4. REQUISITION/PURCHASE REQUISITION NUMBER 5. PROJECT NUMBER (If applicable)

7. ADMINISTERED BY (If other than Item 6) CODE

STANDARD FORM 30 (REV. 11/2016)

Prescribed by GSA FAR (48 CFR) 53.243

FACILITY CODE

9A. AMENDMENT OF SOLICITATION NUMBER

9B. DATED (SEE ITEM 11)

10A. MODIFICATION OF CONTRACT/ORDER NUMBER

10B. DATED (SEE ITEM 13)

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers is extended. is not extended.

12. ACCOUNTING AND APPROPRIATION DATA (If required) copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS. IT MODIFIES THE CONTRACT/ORDER NUMBER AS DESCRIBED IN ITEM 14.

CHECK ONE A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT ORDER NUMBER

IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation data, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15C. DATE SIGNED

15A. NAME AND TITLE OF SIGNER (Type or print)

16C. DATE SIGNED

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

PAGE OF PAGES

6. ISSUED BY CODE

8. NAME AND ADDRESS OF CONTRACTOR (Number, street, county, State and ZIP Code) (X)

CODE

15B. CONTRACTOR/OFFEROR

(Signature of person authorized to sign)

16B. UNITED STATES OF AMERICA

(Signature of Contracting Officer)

Previous edition unusable

UNCLASSIFIED

Attachment Page

UNCLASSIFIED

PAGE 2 OF 163 HHM402-24-Q-0001/

The purpose of this modification is to perform the below.

1. The following clauses are the only clauses that have been removed from the solicitation, see item

#2 for the other clause information:

a. 52.211-17,

b. 52.211-8,

c. 52.211-9, 52.211-9 ALT I, 52.211-9 ALT II, 52.211-9 ALT III,

d. 52.211-16,

e. 52.215-14, 52.215-14 I,

f. 52.215-15,

g. 52.215-19,

h. 52.215-20,

i. 52.215-21, 52.215-21 III,

j. 52.216-10,

k. 52.222-2,

l. 52.222-4,

m. 52.222-7,

n. 52.222-20,

o. 52.223-3,

p. 52.223-6,

q. 52.223-10,

r. 52.228-3,

s. 52.230-2,

t. 52.230-3,

u. 52.230-4,

v. 52.230-6,

w. 52.246-2,

x. 52.246-4,

y. 52.246-6,

z. 52.246-7,

aa. 52.246-9, and

bb. 52.246-15,

2. The clauses highlighted in yellow are mandatory for DIA and cannot be deleted from the solicitation.

3. Provide an update to Schedule B.

4. Provide an update to the ITO (see Section M).

5. Provide Attachment 6 Bidder’s Library documents in SAM.gov.

6. Provide an Attachment 5 - NDA.

7. Change the NAICS code from 334290 to 541512.

8. Updated the Statements of Work in Section C:

Attachment Page

UNCLASSIFIED

PAGE 3 OF 163 HHM402-24-Q-0001/

a. Add the overarching SOW

b. Add Minimum Guarantee TO 01 SOW

c. TO 02 SOW

9. Correct the functional requirements document (FRD) to the most current version.

10. Correct the Pricing Sheets for the Base IDIQ and TO02.

11. Q&As are incorporated by reference and will be uploaded to SAM.gov.

SCHEDULE Continued

ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

0001 Minimum Guarantee

This CLIN is to provide the minimum guarantee through the issuing of Task Order 0001 and funding will support OHR OEM SOW Task 2.3.1, Contract Project Management and Common Tasks. This task order will be issued as a FFP TO. In addition, the minimum guarantee for this effort is $2,500.00.

Period of Performance: 12/11/2023 to 12/10/2028

0.00 EA

0002 Licensing Cost up to 30,000 users.

0003 Labor

0004 Hosting

0005 ODCs - Non-Travel

0006 ODCs - Travel

0007 Materials

0008 Data Deliverables

0009 OPT: Unpriced Option JWICS Licensing up to 30,000 users.

Period of Performance: 12/11/2023 to 12/10/2028

0.00 EA

OPT

1002 Licensing Cost for up to 30,000 users.

Period of Performance: 12/11/2028 to 12/10/2029

1003 Labor CLIN

1004 Hosting

1005 ODC - Non-Travel

PAGE 4 OF 163 HHM402-24-Q-0001/

1006 ODC - Travel

1007 Materials

1008 Data Deliverables

OPT

1009 OPT: Unpriced Option JWICS Licensing up to 30,000 users.

Period of Performance: 12/11/2028 to 12/10/2029

0.00 EA

2002 Licensing Cost for up to 30,000 users.

Period of Performance: 12/11/2029 to 12/10/2030

2003 Labor

2004 Hosting

2005 ODC - Non-Travel

2006 ODC - Travel

2007 Materials

2008 Data Deliverables

OPT

2009 OPT: Unpriced Option JWICS Licensing up to 30,000 users.

PAGE 5 OF 163 HHM402-24-Q-0001/

3002 Licensing Cost for up to 30,000 users.

Period of Performance: 12/11/2030 to 12/10/2031

3003 Labor

3004 Hosting CLIN

3005 ODCs - Non-Travel

3006 ODCs - Travel

3007 Materials

3008 Data Deliverables

OPT

3009 OPT: Unpriced Option JWICS Licensing up to 30,000 users.

Period of Performance: 12/11/2030 to 12/10/2031

0.00 EA

OPT

4002 Licensing Cost for up to 30,000 users.

One year option period. Order CLINs shall be FFP orders for any licenses procured.

Period of Performance: 12/11/2031 to 12/10/2032

0.00 EA

4003 Labor

Period of Performance: 12/11/2031 to 12/10/2032

4004 Hosting

4005 ODCs - Non-Travel

PAGE 6 OF 163 HHM402-24-Q-0001/

ITEM NO. SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

4006 ODCs - Travel

4007 Materials

4008 Data Deliverables

OPT

4009 OPT: Unpriced Option JWICS Licensing up to 30,000 users.

Period of Performance: 12/11/2031 to 12/10/2032

0.00 EA

OPT

5002 Licensing Cost for up to 30,000 users.

One year option period. Order CLINs shall be FFP orders for any licenses procured.

Period of Performance: 12/11/2032 to 05/11/2033

0.00 EA

5003 Labor

Period of Performance: 12/11/2032 to 05/11/2033

5004 Hosting

5005 OCDs - Non-Travel

5006 OCDs - Travel

5007 Materials

5008 Data Deliverables

OPT

5009 OPT: Unpriced Option JWICS Licensing up to 30,000 users

PAGE 7 OF 163 HHM402-24-Q-0001/

Table of Contents

SECTION C DESCRIPTION/SPECIFICATIONS/WORK STATEMENT

C.1 C.1 IDIQ SOW

C.2 C.1.1 TO 01 - SOW

C.3 C.1.2 TO 02 - SOW

SECTION E INSPECTION AND ACCEPTANCE

E.1 52.244-6SUBCONTRACTS FOR COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES (SEP 2023)

E.2 52.246-2 INSPECTION OF SUPPLIES--FIXED-PRICE (AUG 1996)

E.3 52.246-4 INSPECTION OF SERVICES--FIXED-PRICE (AUG 1996)

E.4 52.246-6INSPECTION--TIME-AND-MATERIAL AND LABOR-HOUR (MAY 2001)

E.5 52.246-7 INSPECTION OF RESEARCH AND DEVELOPMENT--FIXED-PRICE (AUG 1996)

E.6 52.246-9 INSPECTION OF RESEARCH AND DEVELOPMENT (SHORT FORM) (APR 1984)

E.7 52.246-15 CERTIFICATE OF CONFORMANCE (APR 1984)

SECTION F DELIVERIES OR PERFORMANCE

F.1 52.211-17 DELIVERY OF EXCESS QUANTITIES (SEP 1989)

F.2 52.211-8 TIME OF DELIVERY (JUN 1997)

F.3 52.211-9 DESIRED AND REQUIRED TIME OF DELIVERY (JUN 1997)

F.4 52.211-9 I DESIRED AND REQUIRED TIME OF DELIVERY (JUN 1997)--ALTERNATE I (APR 1984)

F.5 52.211-9 II DESIRED AND REQUIRED TIME OF DELIVERY (JUN 1997)--ALTERNATE II (APR 1984)

F.6 52.211-9 III DESIRED AND REQUIRED TIME OF DELIVERY (JUN 1997)--ALTERNATE III (APR 1984)

F.7 52.211-16 VARIATION IN QUANTITY (APR 1984)

SECTION I CONTRACT CLAUSES

I.1 52.204-23PROHIBITION ON CONTRACTING FOR HARDWARE, SOFTWARE, AND SERVICES DEVELOPED OR PROVIDED BY

KASPERSKY LAB AND OTHER COVERED ENTITIES (NOV 2021)

I.2 52.204-25PROHIBITION ON CONTRACTING FOR CERTAIN TELECOMMUNICATIONS AND VIDEO SURVEILLANCE SERVICES

OR EQUIPMENT (NOV 2021)

I.3 52.204-27PROHIBITION ON A BYTEDANCE COVERED APPLICATION (JUNE 2023)

I.4 52.215-14INTEGRITY OF UNIT PRICES (NOV 2021)

I.5 52.215-14 IINTEGRITY OF UNIT PRICES (JUN 2020)--ALTERNATE I (OCT 1997)

I.6 52.215-15 PENSION ADJUSTMENTS AND ASSET REVERSIONS (OCT 2010)

I.7 52.215-19 NOTIFICATION OF OWNERSHIP CHANGES (OCT 1997)

I.8 52.215-20REQUIREMENTS FOR CERTIFIED COST OR PRICING DATA AND DATA OTHER THAN CERTIFIED COST OR

PRICING DATA (NOV 2021)

I.9 52.215-21REQUIREMENTS FOR CERTIFIED COST OR PRICING DATA AND DATA OTHER THAN CERTIFIED COST OR

PRICING DATA--MODIFICATIONS (NOV 2021)

I.10 52.215-21 III (c)REQUIREMENTS FOR CERTIFIED COST OR PRICING DATA AND DATA OTHER THAN CERTIFIED COST

OR PRICING DATA--MODIFICATIONS (NOV 2021)--ALTERNATE III (OCT 1997)

I.11 52.215-21 III (d)REQUIREMENTS FOR CERTIFIED COST OR PRICING DATA AND DATA OTHER THAN CERTIFIED COST

OR PRICING DATA--MODIFICATIONS (NOV 2021)--ALTERNATE III (OCT 1997)

I.12 52.215-22 LIMITATIONS ON PASS-THROUGH CHARGES -- IDENTIFICATION OF SUBCONTRACT EFFORT (OCT 2009).49

I.13 52.215-23 ILIMITATIONS ON PASS-THROUGH CHARGES (JUN 2020) ALTERNATE I (OCT 2010)

I.14 52.222-2 PAYMENT FOR OVERTIME PREMIUMS (JUL 1990)

I.15 52.222-4 CONTRACT WORK HOURS AND SAFETY STANDARDS --OVERTIME COMPENSATION (MAY 2018)

I.16 52.222-7 WITHHOLDING OF FUNDS (MAY 2014)

I.17 52.222-20CONTRACTS FOR MATERIALS, SUPPLIES, ARTICLES, AND EQUIPMENT (JUN 2020)

I.18 52.223-3HAZARDOUS MATERIAL IDENTIFICATION AND MATERIAL SAFETY DATA (FEB 2021)

I.19 52.223-6 DRUG-FREE WORKPLACE (MAY 2001)

PAGE 8 OF 163 HHM402-24-Q-0001/

Table of Contents

I.20 52.223-10 WASTE REDUCTION PROGRAM (MAY 2011)

I.21 52.230-2COST ACCOUNTING STANDARDS (JUN 2020)

I.22 52.230-3DISCLOSURE AND CONSISTENCY OF COST ACCOUNTING PRACTICES (JUN 2020)

I.23 52.230-4DISCLOSURE AND CONSISTENCY OF COST ACCOUNTING PRACTICES--FOREIGN CONCERNS (JUN 2020)... 50

I.24 52.230-6 ADMINISTRATION OF COST ACCOUNTING STANDARDS (JUN 2010)

I.25 52.244-2SUBCONTRACTS (JUN 2020)

I.26 252.204-7000 DISCLOSURE OF INFORMATION (OCT 2016)

I.27 252.204-7018PROHIBITION ON THE ACQUISITION OF COVERED DEFENSE TELECOMMUNICATIONS EQUIPMENT OR

SERVICES (JAN 2023)

I.28 252.232-7003 ELECTRONIC SUBMISSION OF PAYMENT REQUESTS AND RECEIVING REPORTS (DEC 2018)

I.29 252.239-7017NOTICE OF SUPPLY CHAIN RISK (DEC 2022)

I.30 252.239-7018SUPPLY CHAIN RISK (DEC 2022)

I.31 252.246-7007CONTRACTOR COUNTERFEIT ELECTRONIC PART DETECTION AND AVOIDANCE SYSTEM (JAN 2023)... 50

I.32 252.246-7008SOURCES OF ELECTRONIC PARTS (JAN 2023)

I.33 5552.203-9002DIA CONTRACTOR WHISTLEBLOWER PROTECTION (APRIL 2019)

I.34 5552.209-9008UTILIZATION OF SUPPORT CONTRACTORS BY THE GOVERNMENT (FEB 2009)

I.35 5552.211-9006SHIPPING AND MARKING DELIVERABLES (SEP 2018)

I.36 52.228-3 WORKERS` COMPENSATION INSURANCE (DEFENSE BASE ACT) (APR 1984)

SECTION J LIST OF ATTACHMENTS

J.1 Exhibit A - CDRLS

J.2 Attachment 2 - OHR OEM IDIQ PRICING

J.3 Attachment 2.1 - TO 02 Pricing Sheet

J.4 Attachment 3 - FRD

J.5 Attachment 5 - NDA

J.6 Attachment 6 - Bidder's Library

J.7 Attachment 8 - RIM Spreadsheet

SECTION K REPRESENTATIONS, CERTIFICATIONS AND OTHER STATEMENTS OF OFFERORS

K.1 52.204-24REPRESENTATION REGARDING CERTAIN TELECOMMUNICATIONS AND VIDEO SURVEILLANCE SERVICES OR

EQUIPMENT (NOV 2021)

SECTION L INSTRUCTIONS, CONDITIONS, AND NOTICES TO OFFERORS

L.1 52.233-2 SERVICE OF PROTEST (SEP 2006)

L.2 Guidance for Sections L & M

SECTION M EVALUATION FACTORS FOR AWARD

M.1 Instructions To Offerors

PAGE 9 OF 163 HHM402-24-Q-0001/

SECTION C

DESCRIPTION/SPECIFICATIONS/WORK STATEMENT

C.1 C.1 IDIQ SOW

UNCLASSIFIED

PAGE 10 OF 163 HHM402-24-Q-0001/

UNCLASSIFIED

UNCLASSIFIED

Solicitation HHM402-24-Q-0001 Page 1 of 22

HCMS OEM IDIQ SOW

(U) Defense Intelligence Agency (DIA)

(U) Human Capital Management System (HCMS)

(U) Original Equipment Manufacturer (OEM)

(U) Indefinite Delivery/Indefinite Quantity (IDIQ)

(U) Statement of Work (SOW)

(U) 19 September 2023

PAGE 11 OF 163 HHM402-24-Q-0001/

UNCLASSIFIED

UNCLASSIFIED

Solicitation HHM402-24-Q-0001 Page 2 of 22

HCMS SOW

1. (U) INTRODUCTION

2. (U) SCOPE

3. (U) DELIVERABLES

4. (U) ORDERING PERIOD

5. (U) PLACES OF PERFORMANCE

6. (U) SECURITY

7. (U) GOVERNMENT PROPERTY (GP)

8. (U) TRAVEL

9. (U) TASK ORDER PROCESSING

10. (U) PERSONNEL

11. (U) TRAINING

12. (U) CONSTRAINTS

13. (U) OTHER CONSIDERATIONS

14. (U) Data Rights

15. (U) GOVERNMENT POINTS OF CONTACT (POC)

16. (U) APPENDIX A: ACRONYMS & ABBREVIATIONS

17. (U) APPENDIX B: Common data deliverables

PAGE 12 OF 163 HHM402-24-Q-0001/

UNCLASSIFIED

UNCLASSIFIED

Solicitation HHM402-24-Q-0001 Page 3 of 22

HCMS SOW

1. (U) INTRODUCTION

1.1. (U) The Defense Intelligence Agency (DIA) looks to transform how Human Resources information technology services are provided to support human capital and workforce development to the Agency population. The Human Capital Management System (HCMS) effort is an initiative by DIA to obtain a modernized Human Capital Management (HCM) solution. HCM is defined as a set of practices related to people resource management. HCM focuses on core human capital functions with the intent to transform current HR business and workforce by utilizing industry best practices to effectively support DIA personnel with a modern management and technology system.

DIA requires assistance with the design, configuration, implementation, migration, integration, security, and operations for applications related to human resources. HCMS is intended to modify, replace or integrate with DIA systems to create an ecosystem of employee support and business management technologies.

PAGE 13 OF 163 HHM402-24-Q-0001/

UNCLASSIFIED

UNCLASSIFIED

Solicitation HHM402-24-Q-0001 Page 4 of 22

HCMS SOW

PAGE 14 OF 163 HHM402-24-Q-0001/

UNCLASSIFIED

UNCLASSIFIED

Solicitation HHM402-24-Q-0001 Page 5 of 22

HCMS SOW

2. (U) SCOPE

2.1. (U) The contractor shall be able to perform TOs governed by the technical and management scope outlined below. Contractors shall be able to perform all tasks below, where work will be performed as specified in individual TOs. When possible, performance work statements (PWS) will be used to define the required outcomes of TOs. Additionally, SOW will be issued for government-prescribed requirements.

Finally, when only top-level objectives are known, a statement of objectives (SOO) will be issued for government-prescribed requirements.

2.2. (U) TECHNICAL SCOPE

2.2.1. (U) The IDIQ contract requires the contractor to deliver and sustain an HCM system environment and application services to include, but not limited to, human resources and workforce development business functional areas defined in the Functional Requirements Document (FRD):

2.2.1.1. (U) Human Capital (HC) Strategy, Policy and Operation Plan

2.2.1.2. (U) Talent Acquisition

2.2.1.3. (U) Talent Development

2.2.1.4. (U) Employee Performance Management

2.2.1.5. (U) Compensation and Benefits

2.2.1.6. (U) Separation and Retirement

2.2.1.7. (U) Employee Engagement and Relations

2.2.1.8. (U) Workplace Analytics and Employee Records

2.2.1.9. (U) Employee, Supervisor, and Staff Management Self Service

2.2.2. (U) The contractor shall deliver an Impact Level 5 Authorization within the

DIA NIPRNet authorization boundary and Top Secret/Sensitive Compartmented Information (TS/SCI) network. The government will serve as a sponsor and will assist both the contractor and the selected Systems Integrator (SI) partner with these activities.

2.2.3. (U) The contractor shall deliver an HCM environment capable of operating in concert with DIA infrastructure, security, and network policies to include, but not limited to:

2.2.3.1. (U) Software/Application production, support, maintenance

2.2.3.2. (U) Systems management

2.2.3.3. (U) Data storage and management

2.2.3.4. (U) Data backup and recovery

2.2.3.5. (U) Application management

2.2.3.6. (U) Release management, upgrades, and patches

2.2.3.7. (U) Application configuration

2.2.3.8. (U) Incident management and reporting

2.2.3.9. (U) Systems integration

2.2.3.10. (U) Systems engineering

2.2.3.11. (U) Information system engineering

PAGE 15 OF 163 HHM402-24-Q-0001/

UNCLASSIFIED

UNCLASSIFIED

Solicitation HHM402-24-Q-0001 Page 6 of 22

HCMS SOW

2.2.3.12. (U) Vulnerability Management

2.2.4. (U) The contractor shall work with the government to map existing DIA workflows and standard operating procedures to out of the box system functionality. The contractor shall take government-provided documentation and map to system functionality, as well as, conduct functional exchanges with the government to document system functionality and solutions for “to be” workflows.

2.2.5. (U) The contractor has up to a five-year period to deliver a software solution that is supportive of multiple domain operations, including unclassified, Impact Level 5 (IL5) Authorization within the DIA NIPRNet boundary and Top Secret/Sensitive Compartmented Information (TS//SCI) networks. The government will serve as a sponsor and will assist both the contractor and the selected Systems Integrator (SI) partner with these activities. All software and infrastructure, on both the unclassified and TS//SCI networks, will be authorized for use according to DIA cyber security policies and procedures, further outlined in the Bidders Library. These solutions may be single-tenant or multi-tenant SaaS, or on-prem software.

2.2.5.1. (U) The Agency requires an HCM environment be capable of storing

Controlled Unclassified Information (CUI), Personally Identifiable Information (PII), and Protected Health Information (PHI) Tailored in accordance with DoD and IC Control Sets, Impact Level 5 Authorization) within the DIA NIPRNet authorization boundary.

2.2.5.2. (U) Unclassified: The Agency requires an unclassified external recruitment solution that secures data according to PII and PHI, as appropriate. This may be accomplished fully through an unclassified instance of the HCM solution, or partially via the HCM and interfaces with additional unclassified systems, such as USAjobs.com.

2.2.5.3. (U) TS//SCI: On the classified networks, there is an elevated level of security to ensure the protection of Agency data and systems that is interwoven in the design of the infrastructure and deployment of systems. To meet these requirements, the solution will adhere to all legal requirements, policies and guidance to meet Agency Cyber and security standards for deploying software or hosting services onto the TS//SCI domains. The HCM environment must align with Intelligence Community Directive 503 (ICD-503) security requirements as well as applying all applicable Intelligence Community Standards (ICS). The Agency requires the HCM environment to be capable of storing and handling Personally Identifiable Information, and Protected Health Information, and limited classified personnel information including meeting Intelligence Overlay B requirements.

PAGE 16 OF 163 HHM402-24-Q-0001/

UNCLASSIFIED

UNCLASSIFIED

Solicitation HHM402-24-Q-0001 Page 7 of 22

HCMS SOW

2.2.6. (U) The HCM environment shall provide secure data flows, primarily of recruitment information, to and from the various networks in accordance with DIA cross domain capabilities and policies. The primary data will be transferred from unclassified to TS//SCI. A limited amount of unclassified data will be transferred from TS//SCI to the unclassified network

2.3. (U) MANAGEMENT SCOPE

2.3.1. (U) The contractor shall identify a (1) program manager and (1) contract manager as IDIQ-level “key personnel.”

2.3.1.1. (U) The contractor program manager(s) shall oversee all project managers that execute TOs to ensure that requirements are satisfied as defined, on schedule, and within established costs. The program manager(s) shall participate in the contract kick-off meeting and present the Project Management Plan (PMP)1. Preferred qualifications for the program manager include 10 years’ experience working in HR and IT; and an advanced management certification, such as DAWIA level three in Program Management or a Program Management Professional certification; Contractor program managers should be accessible via phone and email at facilities determined by individual task orders, but most likely contractor sites.

2.3.1.2. (U) The contract manager(s) shall have full authority to act for the contractor on all contract matters relating to daily operation of the contract and all TOs. The contract manager(s) shall be available between 0800 and 1700, Monday through Friday (eastern time zone, US), except Federal holidays or when the government facility is closed for administrative reasons. In accordance with the instruction set forth in contract Section I, the contract manager(s) shall submit a bi-annual subcontracting report.

2.3.1.3. (U) Each TO issued under this contract will identify the contract project management tasks that are applicable to the TO. The TO project manager (PM), or the designated technical lead performing project management functions on the TO, shall be the single point of contact between the government contracting officer (CO) and the contracting officer’s representative (COR) for all active TOs. The project manager shall be responsible for ensuring that all TOs are satisfied as defined, on schedule, and within established costs. Project management tasking may include, but is not limited to, the following:

1 The PMP is the principal document that presents the contractor’s organization, roles, responsibilities, and processes used throughout the project life cycle. The PMP shall convey systematic policies and procedures the contractor shall utilize for each TO, thereby eliminating the need for duplicative sections in response to individual TOPRs. Rather, a contractor’s TOPR response will reference fundamentals of the HCMS PMP, specifying any (U) planned PMP deviations or additional program actions necessary to meet unique TO requirements (e.g., scheduling, financial management, operational security (OPSEC) management, quality control, risk management).

PAGE 17 OF 163 HHM402-24-Q-0001/

UNCLASSIFIED

UNCLASSIFIED

Solicitation HHM402-24-Q-0001 Page 8 of 22

HCMS SOW

2.3.1.3.1. (U) Participate in individual TO kick-off meetings that will generally occur within five (5) days of TO award;

2.3.1.3.2. (U) Provide a work breakdown structure (WBS) clearly defining all associated costs, resources, schedules, and anticipated travel requirements per task and a roll-up of the total project cost;

2.3.1.3.3. (U) Provide a comprehensive project schedule detailing the timelines for WBS task accomplishment, meetings, test events, delivery dates, milestones and the overall project schedule during the contract’s period of performance;

2.3.1.3.4. (U) Provide support in the planning and execution of special projects including composing summary analysis reports and advising government on feasibility, risk, budget, and schedules;

2.3.1.3.5. (U) Serve as the single point of contact for TO project management and technical assistance, providing supervision of contractor activities for both prime and subcontractor staff;

2.3.1.3.6. (U) Provide technical support to arrange, host, and attend technical meetings and conferences in support of TO work;

2.3.1.3.7. (U) Make recommendations and implement actions for more effective contract oversight/management;

2.3.1.3.8. (U) Develop weekly and monthly briefings which summarize contract status and issues as defined in the TO;

2.3.1.3.9. (U) Prepare and present in-progress reviews (IPRs), weekly status briefings and quarterly Program Management Reviews (PMRs), the topics of which will be identified by the TO CORs;

2.3.1.3.10. (U) Provide oversight of operational security (OPSEC) followed on TO.

2.3.1.3.11. (U) Provide key milestone documents such as System Requirement Document (SRDs) as specified in the TOs.

2.3.1.3.12. (U) Provide system documentation, such as network diagrams, manuals, and procedures as specified in the TOs.

2.3.2. REMOVED

3. (U) DELIVERABLES

3.1. (U) All materials created on TOs issued under this contract, together with requested accompanying documentation (e.g., program manuals, engineering drawings, baseline document change pages, testing plans and procedures, and transition plans) are project deliverables in accordance with DFARS 252.227-7015. Commercial data sets shall be provided as deliverables under each TO as specified. Finished products resulting from onsite and/or offsite contractor support shall be delivered in accordance with each TO. If proprietary data or procedures are contained in any document, each paragraph, image, table, and figure will be marked as proprietary.

PAGE 18 OF 163 HHM402-24-Q-0001/

UNCLASSIFIED

UNCLASSIFIED

Solicitation HHM402-24-Q-0001 Page 9 of 22

HCMS SOW

Marking a document proprietary in its entirety is NOT AUTHORIZED. Any technical data, process/procedures, repair procedures, preventative maintenance procedures, fault isolation procedures, training documentation, presentations, instructions, or descriptions of data (in any format) shall be non-proprietary.

Government data rights shall extend to the common source database, transformation style sheets, and other tools or products used to author or display technical data.

Exceptions to this will be addressed at the TO level.

3.2. (U) Data Deliverables. All data deliverables will be specified in each TO. All deliverables shall be provided as identified in the appropriate Data Item Description (DID) or “remarks” section of the DD 1423 (i.e., block 16) unless otherwise stipulated in the TO. Appendix B is a table of common DIDs; the table is not exhaustive, and individual TOs may include some of these or others. When the common CDRLs are referenced in the individual TOs the descriptions are supplied in Appendix B of this document.

3.3. (U) Hardware Deliverables. Delivery locations for hardware shall be identified in each TO and may require CONUS or OCONUS destinations. The contractor shall utilize the DD form 250 for the purposes of material inspection by an authorized government official (e.g., COR). When applicable, the DD250 may also be used to indicate acceptance of the hardware deliverable. Copies of all signed DD250s shall be provided to the CO/CS for material tracking purposes.

3.4. (U) Software Deliverables. The contractor shall deliver all executable program, source code, supporting library files, related software documentation, and noncommercial technical data in accordance with DFARS 252.227-7014 and/or commercial technical data in accordance with DFARS 252.227-7015. This includes load modules, conversion programs and any data changes involved in the project. The contractor shall provide deliverables on a DVD or other method approved in writing in the TO.

3.5. (U) Source Code developmental deliveries shall be defined as including the documentation, development, testing, and delivery of new source code, reused or modified reused code, maintenance of source code, and the delivery of products created during all activities necessary to implement the design of a non-commercial software product. Changes/clarifications/modifications to this paragraph will be addressed at the individual TO level. If the individual TO has no specific requirements for this area, this SOW paragraph 4.3.1 will take precedence. See Appendix B “Contract Data Requirements List (CDRL)”.

PAGE 19 OF 163 HHM402-24-Q-0001/

UNCLASSIFIED

UNCLASSIFIED

Solicitation HHM402-24-Q-0001 Page 10 of 22

HCMS SOW

4. (U) SOFTWARE FUNCTIONALITY DEFINITIONS

4.1. (U) Out of the Box Functionality is any functionality that can be used as-is from templates, built-in workflows, and/or best practices provided directly by the vendor.

DIA’s definition of Out of the Box Functionality does not include functionality that can be configured to meet the functional requirements.

4.2. (U) Configuration is defined as any functionality that can be created using built-in workflow tools from the software vendor but does not start from an as-is capability or template. To be considered configurable, functionality must be forward-compatible with future releases.

4.3. (U) Customization is defined as any functionality that is developed outside of the OEM software to meet the requirement, or changes to the underlying OEM code. Offerors shall only include components and/or modules of software that is not customized and is commercially available.

5. (U) ORDERING PERIOD

5.1. (U) The ordering period shall consist of one, five (5)-year base ordering period (e.g. date of award – month 60) and five (5) one-year option periods that may be exercised by the contracting officer (CO).

6. (U) PLACES OF PERFORMANCE

6.1. (U) The place(s) of performance will be identified in each TO. For planning purposes, primary places of performance will include contractor and government facilities in the CONUS. Periodic travel within and outside the local commuting area may be required.

Performance at various CONUS and OCONUS locations, including deployments to provide technical support, will be indicated at the TO level.

6.2. (U) For contractor personnel working onsite, the government will provide full access to government-owned and operated facilities, including workspace and computer access, as well as other government-owned resources as appropriate. The government will also facilitate full access to other locations, if necessary, where the contractor may be required to work in support of individual TOs. The government shall provide the contractor copies of the standard operating procedures (SOPs) & protocols for on-site work, as well as any required internal or external interface agreements.

6.3. (U) The normal working hours on government sites are from approximately 0800 to

1700, Monday through Friday (eastern time zone, U.S.). However, as events dictate, the contractor shall be available to provide support beyond traditional work hours, including evenings, nights, and weekends, in accordance with mission needs and prevailing operational manpower requirements. It is the Government's expectation that the Contractor Program Manager will be available in near real time by phone and/or email but from the contractor's facility during the Government's standard operating hours.

PAGE 20 OF 163 HHM402-24-Q-0001/

UNCLASSIFIED

UNCLASSIFIED

Solicitation HHM402-24-Q-0001 Page 11 of 22

HCMS SOW

6.4. (U) Government-Furnished Spaces: If a TO requires performance at government secure facilities, common use utilities and office equipment, desk space, telephones, computers, and other items necessary to maintain an office environment will be provided. The government will also facilitate access to any government-owned facilities or other locations where the contractor may be required to work in support of the SOW.

Contractor use of government computers and networks shall be governed by the requirements of the computer user agreement required of all persons accessing government systems. Utilizing government computers for any purposes other than direct support of the HCMS IDIQ is expressly prohibited without advance written approval of the COR.

7. (U) SECURITY

7.1. (U) A DD-254 is not anticipated to be required at this time for the HCMS OEM IDIQ; however, if the it is determined that one will be required in the future then the Government will work with the contractor to establish and incorporate the document into the contract. If one should be required, the contractor shall comply with the contract DD Form 254, and with all personnel, physical, and computer security policies and procedures of the government. Appropriate clearances, storage of classified materials, and processing of classified data are required, in coordination with the Government, before initiating any classified effort in support of this project.

7.2. (U) Competition for and participation in this program is limited to U.S. only firms, except when specifically approved in advance for foreign firms. Any approved foreign-owned, controlled or influenced (FOCI) company awarded a contract shall require a national interest determination (NID) from the Agency owning its security access (e.g., SCI-ODNI, COMSEC-NSA, TS-DIA) prior to performing on the HRIS OEM SW program.

7.3. (U) DIA Access Badges: As necessary to perform work directly in support of this contract, CORs may sponsor contractor facility badges (i.e., “green” badges) through DIA Security. Contractors are expressly prohibited from accessing DIA facilities for the purposes of marketing, strategic business development, or any other objectives without the advance written authorization of the COR. Failure to comply with these restrictions may result in the suspension and/or revocation of badges as determined by the COR.

7.4. (U) Non-Disclosure: All contractor employees performing on HCMS shall execute appropriate non-disclosure agreements, prior to receiving any proprietary or competition-sensitive information. The contractor shall furnish copies of these written agreements to the COR. Furthermore, in accordance with FAR 9.505-4(b), prior to accessing proprietary information of other companies, the contractor must agree with the other companies to protect their information from unauthorized use or disclosure for as long as it remains proprietary and refrain from using the information for any purpose other than that for which it was furnished. The contractor shall furnish copies of these agreements to the CO.

7.5. (U) All data, products, techniques, applications, activity, concepts, plans, programs and publications related to this program are subject to the rules for classification as stipulated in Executive Order 13526.

PAGE 21 OF 163 HHM402-24-Q-0001/

UNCLASSIFIED

UNCLASSIFIED

Solicitation HHM402-24-Q-0001 Page 12 of 22

HCMS SOW

7.6. (U) Any new data, products, techniques, applications, activity, concepts, plans, programs, and publications developed during this effort are subject to Original Classification Authority review, the program classification guide and Executive Order 13526.

7.7. (U) Any proposed public release of information relating to this program (classified & unclassified) must be submitted to the CO and COR for forwarding to the appropriate Public Affairs Office and Office of Primary Responsibility (OPR) for approval.

7.8. (U) Any proposed foreign release of information relating to this program (classified and unclassified) must be submitted to the CO, the appropriate Foreign Disclosure Office, and the OPR for approval.

7.9. (U) Multiple classification guides may apply to TOs issued under the HCMS IDIQ.

At a minimum, the government will provide access to the appropriate program security classification guide at the TO level.

7.10. (U) Marketing: Unclassified information generated under or about this contract will be restricted in its dissemination to government personnel directly involved in the contract and to those organizations approved by the COR or the CO. The contractor shall not include the existence of this contract in marketing literature or in capabilities briefings. Release in open literature or exhibition of such information is strictly prohibited without written permission of the CO.

8. (U) GOVERNMENT PROPERTY (GP)

8.1. (U) Government Property includes property owned or leased by the government.

Government property includes Government Furnished Property (GFP) and Contractor Acquired Property (CAP), both of which may be applicable under this contract. The contractor’s use, management, reporting, redistributing, and disposing of GP shall comply with the terms and conditions set forth in the FAR and DFARS Clauses, DoDI 5000.64, DIAI 4000.001, requirements specified under each TO, and instructions provided in Section 16 of the DD 1423 and/or directed by the CO.

8.2. (U) Upon disposition request from contractor and/or direction (instruction) from the government CO, all GP shall be shipped to the designated government location for reutilization or disposition using a DD form 1149 or other acceptable documentation approved by the CO.

8.3. (U) The government will provide full access to GFP as identified in each TO.

Movement of GP being returned, transferred or transported to or/from any location shall be documented on a DD Form 1149. The contractor shall provide GP reports and perform physical inventories to include jointly held property inventories as required under each TO CDRL and in accordance with the applicable instructions provided in Section 16 of the DD 1423. Accountability of GFP will include a unique item identifier (UII).

8.4. (U) The contractor shall purchase equipment and material as identified in each TO.

Government may require procurement of commercial/non-developmental hardware, software and services with very little to no lead-time. Therefore, the contractor shall have a procurement system in place that allows for purchase orders to be placed within ten (10) days after receipt of requirement. Movement of CAP being returned, transferred or transported to or from any location shall utilize a DD Form 1149.

PAGE 22 OF 163 HHM402-24-Q-0001/

UNCLASSIFIED

UNCLASSIFIED

Solicitation HHM402-24-Q-0001 Page 13 of 22

HCMS SOW

8.5. (U) Some materials and services purchased under this contract will be highly specialized and can only be obtained through one source; therefore, the contractor may be instructed to purchase from government-directed sources. If so, such direction shall be made in writing by the CO.

8.6. (U) The Contractor shall establish and maintain procedures necessary to assess its property management system effectiveness and shall perform periodic internal reviews, surveillances, self-assessments, or audits. Significant findings or results of such reviews and audits pertaining to Government property shall be made available to the contracting office (future Property Administrator). The government shall conduct Property Management System Assessments (PMSA) of the contractor’s property management policies, procedures, practices, and systems. The government shall accomplish standard or limited PMSA as frequently as conditions warrant.

9. (U) TRAVEL

9.1. (U) Domestic and overseas travel may be required to support HCMS TOs, including system deployment and set-up, operational support activities, test and evaluation activities, rapid prototyping, and associated training/maintenance. All travel and associated expenses must be pre-approved in writing by the TO COR prior to the contractor incurring any travel expense. Travel may be reimbursed by the government in accordance FAR Subpart 31.205-46. The contractor shall submit trip reports for all travel performed on the contract.

10. (U) TASK ORDER PROCESSING

10.1. (U) Individual TOs will define specific task requirements in the form of SOOs, PWSs, or SOWs. The SOO, PWS or SOW will include some or all of the following information: desired capability, technical data associated with the specific task;

appropriate milestone/schedule dates; required travel; a list of required data deliverables; and a list of hardware/software deliverables, as applicable. The process will start with the government issuance of TOPRs. The government will perform technical evaluations of proposals that are submitted in response to TOPRs. For non-urgent requirements, the standard TOPR response period will be thirty (30) days.

Urgent requirements are subject to shorter response periods, and contractors shall be able to support responding to TOPRs in less than 21 days.

10.1.1. (U) The government will make every effort to give the contractor advance notice of requirements, but the requirements for which this contract will be used could address emergent requirements with little or no advance notice.

Contractors shall be able to fulfill full development efforts in less than 24 months.

10.1.2. (U) The contractor is advised that it is not possible to determine the precise types or amounts of products or services that will be ordered during the term of the HCMS IDIQ contract. The contractor shall be obligated to perform within the minimum and maximum order limitations set forth in the Order Limitations clause of Section I.

PAGE 23 OF 163 HHM402-24-Q-0001/

UNCLASSIFIED

UNCLASSIFIED

Solicitation HHM402-24-Q-0001 Page 14 of 22

HCMS SOW

11. (U) PERSONNEL

11.1. (U) Each TO may designate one or more contractors as “key personnel.” Key personnel are considered vital to the successful performance of the IDIQ and each TO; therefore, key personnel substitutions shall not normally be permitted unless such substitutions are necessitated by an individual's sudden illness, death, termination of employment, changed work requirements, or substandard employee performance. All proposed substitutions of key personnel shall be submitted, in writing, at least sixty

(60) days prior to the substitution in accordance with the HCMS IDIQ Section H:

Special Contract Requirements. In these cases, (U) the contractor shall promptly notify the CO and COR. Each request shall provide a detailed explanation of the circumstances necessitating the proposed substitution.

12. (U) TRAINING

12.1. (U) It is expected that contractor employees will be fully trained and capable of performing any services required under this contract. Consequently, it is the responsibility of the contractor to ensure its employees are appropriately trained to perform their duties. However, TOs may provide for government-furnished training to contractor employees in the event the government determines such training is indispensable to their adequate performance of a DIA contract and can only be provided by the government.

13. (U) CONSTRAINTS

13.1. (U) No TOs issued under this contract shall constitute personal services contracts as defined by FAR 37.104. No contractor services shall be provided for tasks inherently governmental in nature. At no time shall contractors represent themselves as acting on behalf of/or speaking for the U.S. Government. All contract personnel attending meetings, answering government telephones, and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression that they are government officials.

Contractors must also ensure that all documents or reports produced are suitably marked as contractor products or that contractor participation is appropriately disclosed.

14. (U) OTHER CONSIDERATIONS

14.1. (U) The considerations listed in this section will be tailored in scope within individual

TOs, to potentially involve exclusion from a TO. However, all contractors awarded under this contract shall have the capabilities and expertise required to perform the functions required as outlined below.

14.2. (U) FACILITIES

14.2.1. (U) For the unclassified (U) fabric, the contractor shall adhere to all facility/space/security requirements inherent to the required DOD Impact Level Authorization.

14.2.2. (U) The contractor and all approved subcontractors will be vetted against Foreign Ownership and Control Interests.

PAGE 24 OF 163 HHM402-24-Q-0001/

UNCLASSIFIED

UNCLASSIFIED

Solicitation HHM402-24-Q-0001 Page 15 of 22

HCMS SOW

14.2.3. (U) The contractor shall ensure that all unclassified portions of the HCM effort are located in a U.S. facility with enhanced security protections and must meet all FedRAMP requirements for Physical Security & Environmental and Personnel as per FedRAMP Moderate + CUI/PII/PHI Specific Tailored Control Set, and Impact Level Authorization in accordance with DCSA and National Industrial Security Program Operating Manual (NISPOM) requirements.

14.3. (U) IT SECURITY

14.3.1. (U) The contractor shall consider the following IT constraints, policies, or procedures when performing tasks in this contract:

14.3.1.1. (U) DIA RMF processes

14.3.1.2. (U) POA&M maintenance

14.3.1.3. (U) ICD 503

14.3.1.4. (U) NIST 800 standards for data protections

14.3.1.5. (U) DIA CIO Cyber & Security guidelines/policies/procedures

14.4. (U) 508 COMPLIANCE

14.5. (U) The contractor shall provide a solution that ensures that all systems, hardware, software, software engineering, and information technology associated with this effort is made in a manner that is accessible for people with disabilities as directed in the DIA Policy and Section 508 of the Rehabilitation Act of 1973 as amended in 1998 (Section 508). Specifically, all Information and Communications Technology (ICT) associated with this contract, should use the Web Content Accessibility Guidelines (WCAG) 2.1 to comply with Section 508 or use alternative designs or technologies which result in substantially equivalent or greater access to and use of the product for people with disabilities. Furthermore, provide a solution that pursues human centered design and usability guidelines to ensure that all services associated with this contract are accessible by as many users as possible and as a means to drive modernization, innovation, and enhance mission support.

14.6. (U) SUPPLY CHAIN RISK MANAGEMENT (SCRM)

14.7. (U) The contractor shall provide a solution that adheres to Agency SCRM standards, policies, and directives (supplied in the Bidders Library) regarding allowable equipment; alignment with Agency risk management and procurement requirements; and the recapitalization and upgrade of hardware.

14.8. (U) The contractor shall provide and maintain a Supply Chain Risk Management

(SCRM) plan including, at a minimum, the acquisition of intellectual property, information technology and integration of new code baselines for approval by the Agency. To achieve this, the contractor shall:

PAGE 25 OF 163 HHM402-24-Q-0001/

UNCLASSIFIED

UNCLASSIFIED

Solicitation HHM402-24-Q-0001 Page 16 of 22

HCMS SOW

14.9. (U) Provide completed SCRM questionnaires for all planned use of third-party vendor services, acquisition (receive SCRM certificate prior to the purchase) of third-party vendor companies, and use of subcontractors (down to the third level of sub-contracts) and again when adding new services to the HCM environment in order to allow the Agency to make an informed risk management decision.

14.10. (U) Develop and maintain an SCRM repository containing SCRM questionnaire results and any further research conducted by the Collaborative Supply Portal (CSP) to vet companies and their associated software code. SCRM repository records shall be updated whenever a procurement is planned, in order to collect the most current information required for assessment. The contractor shall provide an API to the Agency for near real-time data ingest from the CSP repository to a consolidated Agency repository for use in assessing risk to determine whether to approve a procurement and/or order removal of currently implemented hardware or software.

14.11.14.10. (U) Ensure the SCRM adheres to Agency standards, policies, and directives regarding allowable equipment; alignment with Agency risk management and procurement requirements; and the recapitalization and upgrade of hardware.

14.12.14.11. (U) Ensure that there is parity with publicly available secure hosting for generational recapitalization and upgrading of all contractor-furnished hardware, while complying with all supply chain risk management requirements and policies.

14.13.14.12. (U) Ensure the plan captures how the contractor will establish, maintain, and operate an adequately staffed HCM Integrated Supply Chain Program dedicated to directly support the Agency’s staff security representatives to include, but not limited to, Information Security Owner (ISO), Facility Security Officer (FSO), Mission Security Officer (MSO), and Contractor Special Security Officer (CSSO).The contractor shall develop and implement a SCRM plan that may include the control elements of SA-12 of NIST SP 800-53 and counterfeit parts of any type.

15. (U) DATA RIGHTS

15.1. (U) See attachments to the contract.

15.2. (U) Commercial computer software or commercial computer software documentation is acquired by the Government under the licenses customarily provided to the public unless such licenses are inconsistent with Federal procurement law.

15.3. (U) The Government obtains rights in non-commercial software and technical data developed and delivered under this contract IAW DFARS 227.7203-4 License Rights and 227.7203-5 Government rights. IAW DFARS 227.7103-3(b) and 227.7203- 3(a) the Government has included the provision at 252.227-7017 Identification and Assertion of Use, Release, or Disclosure Restrictions, in this solicitation and offerors are directed to that provision for requirements that must be completed in responding to this solicitation.

PAGE 26 OF 163 HHM402-24-Q-0001/

UNCLASSIFIED

UNCLASSIFIED

Solicitation HHM402-24-Q-0001 Page 17 of 22

HCMS SOW

16. (U) GOVERNMENT POINTS OF CONTACT (POC)

16.1. (U) The contract POCs are defined below and are named in the contract schedule.

Reference each individual TOs for the applicable CO, CS, COR, ACOR, or TPOC.

16.2. (U) Contracting Officer (CO). The only formally designated person authorized to award (sign) and change (modify) contracts on behalf of the U.S. Government.

16.3. (U) Contracting Specialist (CS). The CS is the only person authorized by the

CO to administer contracts in support of the CO and on behalf of the Government.

16.4. (U) Contracting Officer Representative (COR) & Alternate Contracting

Officer Representative (ACOR). The COR/ ACOR are the only individuals designated in writing by the CO to act as the Contracting Officer's authorized representative to monitor specific aspects of the contract per their letters of appointment for the contract.

The COR/ACOR act as the primary points of contact between the CO and the contractor.

Neither the COR nor an ACOR may change any terms or conditions of the contract, or alter the contract in any way, either directly or by implication. COR/ACOR responsibilities and limitations are established by the contracting officer in the letters of appointment.

16.5.