ENTERPRISE_CYBERSECURITY_SUPPORT_(ECSS)_DRAFT_PWS.pdf

FOR OFFICIAL USE ONLY – THIS DOCUMENT IS PROCUREMENT SENSITIVE

See FAR 3.104

FOR OFFICIAL USE ONLY – THIS DOCUMENT IS PROCUREMENT SENSITIVE

PERFORMANCE WORK STATEMENT (PWS)

US Army Intelligence and Security Command (INSCOM)

ENTERPRISE CYBERSECURITY SUPPORT (ECSS)

1. Non-Personal Services.

This is a non-personal services contract to provide Cybersecurity (CS) support for the U.S.

Army Intelligence and Security Command (INSCOM), located at Ft. Belvoir, VA, INSCOM facilities in the Continental United States (CONUS), Major Subordinate Commands (MSCs), and sites Outside the Continental United States (OCONUS). The Government will not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn, is responsible to the Government.

1.1 Background.

INSCOM, a Direct Reporting Unit (DRU) to Headquarters (HQ), Department of the Army, G-2, conducts intelligence, security and information operations for military commanders and national decision makers. INSCOM executes mission command of operational intelligence and security forces; conducts and synchronizes worldwide multi-discipline and all-source intelligence and security operations; delivers linguist support and intelligence-related advanced skills training, acquisition support, logistics, communications, and other specialized capabilities in support of Army, Joint, and Coalition Commands and the U.S.

Intelligence Community (IC). Headquartered at Fort Belvoir, VA, INSCOM is a global command with MSCs that tailor their support to the specific needs of different theaters.

The command synchronizes the intelligence operations of all INSCOM elements to ensure multi-discipline intelligence support to theater/component war fighters, the IC and other national agencies. INSCOM has a variety of smaller units with over 17,000 personnel dispersed over 180 locations worldwide. INSCOM and its MSCs provide the enabling layer to connect the Army and its tactical formations to defense and national intelligence agencies via tactical networks. The ability to provide mission critical intelligence is dependent on the successful use of its Information Technology (IT) networks worldwide.

1.2 Objectives.

The Contractor shall provide all personnel and non-personal services necessary to perform CS support as defined in this Performance Work Statement (PWS) except for items specified as government furnished property and services. The Contractor shall perform to the standards in this contract.

1.3 Scope.

This service contract objective is to acquire technical services to enhance INSCOM’s Cybersecurity (CS) Program and provide Risk Management Framework (RMF) support and Security Control Assessor – Representative (SCA-R) support to INSCOM. The Contractor

FOR OFFICIAL USE ONLY – THIS DOCUMENT IS PROCUREMENT SENSITIVE

See FAR 3.104 shall provide CS support to HQ INSCOM, and INSCOM facilities CONUS and OCONUS, and MSCs. The Contractor shall provide all personnel, management, supervision, and other items and services necessary to perform technical services for CS support to INSCOM HQ/MSCs.

Specific tasks include, but are not limited to:

• Risk Management Framework (ICD 503) Support

• Cybersecurity Policy, Planning, Compliance, and Program Management Support

• IA Vulnerability Management (IAVM)

• Incident Response Support

• Federal Information Security Management Act (FISMA) Implementation Support

• IT Contingency Plan/Disaster Recovery Support

• Cybersecurity Administrative Support

• Dedicated Security Control Assessor – Representative (SCA-R) support

• Information Assurance Support

• IS/IT Security Operations

• Computer Network Defense (CND) Support

• INSCOM TROJAN Specific Support Services

• US Army G2 Cybersecurity Support Services

1.4 Period of Performance.

The Period of Performance shall be one (1) 12 month base year period and four (4) twelve 12 month option periods (no option period will exceed one (1) year).

1.5 Type of Contract.

The Government anticipates award of a TBD type contract.

1.6 Recognized Holidays.

The government will be closed on the following holidays:

New Year’s Day Labor Day Martin Luther King Jr.’s Birthday Columbus Day Presidents Day Veterans Day Memorial Day Thanksgiving Day Independence Day Christmas Day

When a holiday falls on a non-workday, Saturday or Sunday, the holiday is typically observed on Monday (of the holiday falls on Sunday) or Friday (if the holiday falls on Saturday). Unless otherwise specified, the Contractor shall observe the Federal holidays as set forth above. On the rare occasion, such as a President's death, that the Government declares a Federal Holiday, Contractors should recognize it as with other Federal Holidays.

In those instances, only mission critical personnel will be required to work. On a President's Inauguration Day, Contractors that work within the Military District of Washington (MDW), which is a 50 mile radius shall also recognize it as a Federal Holiday.

FOR OFFICIAL USE ONLY – THIS DOCUMENT IS PROCUREMENT SENSITIVE

See FAR 3.104

1.7 Hours of Operations.

The Contractor services provided at each site shall be based on a Principal Performance Period (PPP) as indicated in Table 1, except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closing, or similar Government directed facility closings. At some sites, the Contractor may be required to provide coverage on alternate PPP schedules such as 8x7, 16x5, 16x7, 24x5, or 24x7 (hours x days). Contractor personnel shall be required to be on-site to support the user at the established times of operation at each location. Unless otherwise directed by the Contracting Officer (CO) or Contracting Officer’s Representative (COR), the Contractor shall support the same hours each day of the week. Contractor personnel will be required to take, at a minimum, a thirty (30) minute lunch, which cannot be at the beginning or end of a work day and may be subject to recall outside the PPP. Contractor personnel may be subject to recall outside the PPP. For information purposes, normal Government duty hours are 8 am to 5 pm EST unless otherwise stated. Unless the contractor is performing scheduled shift type work, the organizations Core Hours at HQ INSCOM are 0900 – 1500. Core Hours are those hours in which non-shift work are to be included in the normal work day. The Contractor shall at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed.

Table 1. Unit Hours of Operation/PPP (Local Time)

Unit Location Duty Hours

(assumes 30 min. lunch)

Days Per Week

Ground Intelligence Support Activity (GISA) – Belvoir &

HQ INSCOM

Ft. Belvoir, VA Alexandria, VA (Metro Park)

0600 – 1830 (12 hours)

5 (Monday – Friday)

GISA – Bragg Ft. Bragg, NC 0600 – 1830 (12 hours)

5 (Monday – Friday)

GISA Bragg Detachment Ft.

Gordon (GDFG), GA

– Includes the following sites: 782nd MI BN, 116th MI BDE (206th/224th)

Ft. Gordon, GA 0600 – 1830 (12 hours)

5 (Monday – Friday)

GISA – Europe & 66th MI

Darmstadt/Wiesbaden, GE

0600 – 2030 (14 hours)

5 (Monday – Friday)

GISA – Pacific & 500th MI

Ft. Shafter, Hawaii 0600 – 2030 (14 hours)

5 (Monday – Friday)

1st IO Ft. Belvoir, VA 0600 – 1830 (12 hours)

5 (Monday – Friday)

FOR OFFICIAL USE ONLY – THIS DOCUMENT IS PROCUREMENT SENSITIVE

See FAR 3.104

902nd MI Ft. Meade, MD 0600 – 1830 (12 hours)

5 (Monday – Friday)

780th MI Ft. Meade, MD 0600 – 1830 (12 hours)

5 (Monday – Friday)

470th MI Ft. Sam Houston, TX 0600 – 1830 (12 hours)

5 (Monday – Friday)

501st MI Camp Humphreys, Pyongtek, Korea

0800 – 1630 (8 hours)

5 (Monday – Friday)

204th MI Ft. Bliss, TX 0800 – 1630 (8 hours)

5 (Monday – Friday)

441st MI Camp Zama, Japan As Needed Fly support from GISA-Pacific and/or 501st

513th MI Ft. Gordon, GA 0800 – 1630 (8 hours)

5 (Monday – Friday)

207th MI Vincenza, Italy As Needed Fly support from GISA-Europe

Army Field Support Center (AFSC)

Ft. Meade, MD 0800 – 1630 (8 hours)

5 (Monday – Friday)

Army Operation Group (AOG)

Ft. Meade, MD 0800 – 1630 (8 hours)

5 (Monday – Friday)

Foundry Camp Bullis, TX 0800 – 1630 (8 hours)

5 (Monday – Friday)

National Guard Bureau (NGB)

Ft. Leavenworth, KS 0800 – 1630 (8 hours)

5 (Monday – Friday)

National Ground Intelligence Center

(NGIC)

Charlottesville, VA 0800 – 1630 (8 hours)

5 (Monday – Friday)

Personnel Security Investigation Center of Excellence PSI CoE) (902nd MI GP)

Ft. Meade, MD 0600 – 1830 (12 hours)

5 (Monday – Friday)

1.8 Leave of Absences.

The Contractor, COR/Alternate Contracting Officer Representative (ACOR) will ensure minimal disruption to the mission. If a Contractor employee requires a continuous period of sick or annual leave greater than 30 days, the Contractor shall, if requested by Contracting Officer (CO), COR or /ACOR, provide a temporary replacement possessing the same skills, clearance, and knowledge at no additional cost to the government.

1.9 Surge.

In addition to the performance requirements of this PWS, the Government shall require surge support during the base and option periods. Surge support option modifications will provide increased support for the defined task areas of the PWS. Surge support is defined as IT support required to support increased mission requirements, emergencies, natural

FOR OFFICIAL USE ONLY – THIS DOCUMENT IS PROCUREMENT SENSITIVE

See FAR 3.104 disasters, terrorist threats or events, elevation of threat-levels or unscheduled / short notice exercises, unit activations, contingency operations or deployments. Surge support may require movement of or additional Contractor support, Contractor travel or movement / shipment / installation of task order supported equipment. The Contracting Officer will provide written notice to the contractor prior to any exercise of the Surge Option.

1.9.1 Surge Notification & Response

Notification of surge support requirements from the CO shall include locations, durations, specific services required, suggested number of personnel, and any other surge unique information with no less than 30 days advanced notice whenever practical. Surge capability will be defined in a separate Contract Line Item Number (CLIN). Surge expenditure shall not exceed 30% of the total contract amount.

The contractor shall provide the Government a proposal for surge support within 36 hours from the time of notification. The contractor will ensure that their proposed solution does not delay the execution of mission or cause mission failure. Surge support will be provided at the same labor rates proposed and found fair and reasonable at time of task order award for the applicable period of performance.

The Contractor shall provide a surge plan within 30 days after contract award.

1.10 Extended Work Hours/Overtime.

This contract may require the use of extended work hours to support Quick Reaction Capabilities (QRC) deployments, contingency operations, hostilities, war, national emergencies, critical mission systems repairs, or other unusual, critical operations.

Requests for extended work weeks must be approved by the COR prior to execution of additional hours. Without approval, Contractor's invoice for those hours worked may be reduced or rejected by the Government. Extended work hours are defined as that time exceeding the normal hours of operation. Support may include overtime and surge support in support of exercises, operations, or unpredictable events at the location determined by the event.

1.11 Rest and Relaxation (R&R).

Contractors providing support within the CENTCOM Area of Responsibility (AOR) will be considered deployed. Contractors that will be in a deployed location for 12 consecutive months are authorized one Government funded R&R leave period not to exceed 18 consecutive days after six (6) months of support in the AOR. Unless the Government requires a change in the Contractor’s location, Contractors that take an R&R leave period and depart the deployed location prior to the end of a 12 month period will reimburse the Government for the costs authorized. Contractors are authorized an additional R&R period after five (5) months of the start date of an additional 12 month period. The Contractor site lead for support in the AOR shall provide the TTM or Government representative and COR the initial projected R&R and leave schedule for all Contractors providing support in the AOR and is due to the TTM, Government representative and COR within three (3) months of the start date of the contract, and quarterly thereafter. The R&R and leave schedule shall include the Contractors plan for continued support during Contractor’s R&R and leave in order to ensure that contract R&R and leave do not negatively impact mission requirements.

FOR OFFICIAL USE ONLY – THIS DOCUMENT IS PROCUREMENT SENSITIVE

See FAR 3.104

1.12 Place of Performance.

Service will be performed at HQ INSCOM on Fort Belvoir, VA, to include all INSCOM MSC locations worldwide, INSCOM IC Partner facilities, in all theater locations, and tenant organizations at Fort Belvoir. Performance locations are worldwide and are represented in Table 2 of this PWS.

Table 2: Unit Central/Remote Locations Unit Central Site/Remote Locations

HQ, INSCOM/GISA

Belvoir

Central Site: Ft. Belvoir, VA; Alexandria, VA (Metro Park)

AOG Central Site: Ft. George G. Meade, MD Remote Site: Stuttgart, DE

902nd MI GP Central Site: Ft. George G. Meade, MD Remote Site: Aberdeen Proving Ground, MD; Redstone Arsenal, AL; Ft. Leavenworth, KS; Ft. Sam Houston, TX, Pearl Harbor, HI; Stuttgart, DE

PSI CoE (902nd MI GP) Central Site: Aberdeen Proving Ground, MD 470th MI BDE Central Site: Ft. Sam Houston, TX 204th MI BN Central Site: Ft. Bliss, TX 780th MI BDE Central Site: Ft. George G. Meade, MD GISA Bragg Detachment Ft Gordon

Central Site: Ft. Gordon, GA Remote Site: 782nd MI BN , GDFG-Data Center, Cyber Protection BDE (CPB) and Cyber Center of Excellence

(CCOE)

513th MI BDE Central Site: Ft. Gordon, GA 1st IO Central Site: Ft. Belvoir, VA 116th MI BDE Central Site: Ft. Gordon, GA

Remote Site: 224th MI (Hunter Airfield, Savannah, GA), 206th and 15th MI, Fort Hood, TX; JSTARS Warren Robbins, GA

IDTF/Foundry Central Site: Camp Bullis, TX and Ft. Stewart, GA Remote Site: Ft. Drum, NY; Ft. Lewis, WA; Ft. Campbell, KY; Ft. Bliss, TX; Ft. Carson, CO; Ft. Bragg, NC; Schofield Barracks, HI and Ft. Riley, KS

AFSC Central Site: Colombia, MD GISA Bragg Central Site: Ft. Bragg, NC and GISA Bragg Site 15

Remote Site: III Corps, Ft. Hood, TX; FORSCOM HQs at Ft.

Bragg, NC; Ft. Gordon, GA; Army South, Ft. Sam Houston, TX; MIRC at Camp Bullis; TX; Army North, Ft. Sam Houston, TX

GISA Europe Central Site: Wiesbaden, DE Remote Site: 66th MI Brigade in Wiesbaden and Darmstadt, DE; 207th MI Brigade, Vicenza, Italy; European foundry Platform in Grafenwoehr, DE

GISA Pacific Central Site: Ft. Shafter, HI Remote Site: Ft. Richardson, AK; Camp Zama, Japan; 8th

FOR OFFICIAL USE ONLY – THIS DOCUMENT IS PROCUREMENT SENSITIVE

See FAR 3.104

Army USAG Yongsan, Korea; Camp Humphreys, Korea NGB Central Site: Ft. Leavenworth, KS NGIC Central Site: Charlottesville, VA

Remote Site: Aberdeen Proving Ground, MD; Army GEOINT Battalion (AGB), Ft. Belvoir, VA

501st MI BDE Central Site: Camp Humphreys, Pyongteak, RK Remote Site: Camp Carroll, Deagu; Camp Humphreys, Korea

1.12.1 Alternate Duty Sites.

In the case of either Government-wide or installation closure, Contractor personnel whose place of duty is the installation or facility affected are not authorized to perform at an alternate duty site unless the CO approves the type of work and the alternate location in writing.

1.13 Key Personnel.

The follow personnel are considered key personnel by the government:

a. Program Manager (PM),

b. G-2 SCA Lead (located in INSCOM HQ)

c. Site Lead and any other positions the CO and/or COR deem as key personnel

Table 3. Key Position Requirements

Key Position Description Qualifications

Program Manager

(PM)

• Accountable for all aspects of contract execution and manages the hands-on, day-to-day execution of related operational activities

• Responsible for program/project management operations and resourcing of all task order requirements, including staffing, GFE accountability, and tasking responses

• Responsible for meeting all technical, financial, and contractual requirements

• Ensures that management processes and business systems facilitate meeting performance requirements

• Primary Point-of-Contact

• Is authorized to act on all matters relating to the daily operation of the task order

Minimum Education: Master’s degree in business related field required.

Minimum Experience: 10 years of project management experience, including 8 years of supervisory experience leading teams of at least 40 people.

Desired Skills: Project Management Professional Certification (PMP). Possess communication skills to effectively interface with military officials, managers, and subordinates.

Security Clearance: TS/SCI *For degree exceptions see TBD Labor Category Experience and Degree Requirements.

FOR OFFICIAL USE ONLY – THIS DOCUMENT IS PROCUREMENT SENSITIVE

See FAR 3.104

Key Position Description Qualifications

US Army

G-2 SCA

Lead (located in

INSCOM

HQ)

• Accountable for all aspects of requirements and manages the hands-on, day-to-day issues related to operational activities

• Responsible for operations including security, maintenance and accountability

• Responsible for meeting all technical requirements

• Ensures that processes and network systems facilitate meeting performance requirements

• Point-of-Contact for issues

• Is authorized to act on site-specific matters relating to the daily operation of the task order.

Acts as a “First-Level Supervisor” for site-employees

Minimum Education: Minimum of Bachelor’s degree in technology related field required.

Minimum Experience: 8 years of experience in Cybersecurity field and DoD IAT Level III Certification.

Additionally, candidate must have at least three years of experience managing teams of at least 10 people.

Desired Skills: Has the communication skills to effectively interface with military officials, managers, and subordinates.

Security Clearance: TS/SCI *For degree exceptions see TBD Labor Category Experience and Degree Requirements.

Site Lead

(INSCOM

HQ, GISA-

Belvoir, GISA-

Bragg)

• Accountable for all aspects of requirements and manages the hands-on, day-to-day issues related to operational activities

• Responsible for operations including security, maintenance and accountability

• Responsible for meeting all technical requirements

• Ensures that processes and network systems facilitate meeting performance requirements

• Point-of-Contact for issues

• Is authorized to act on site-specific matters relating to the daily operation of the task order.

Acts as a “First-Level Supervisor” for site-employees

Minimum Education: Minimum of Bachelor’s degree in technology related field required.

Minimum Experience: 8 years of experience in Cybersecurity field and DoD IAT Level III Certification.

Additionally, candidate must have at least three years of experience managing teams of at least 10 people.

Desired Skills: DoD IAT Level III Certification and communication skills to effectively interface with military officials, managers, and subordinates.

Security Clearance: TS/SCI *For degree exceptions see TBD Labor Category Experience and Degree Requirements.

1.13.1 Replacement of Key Personnel.

During the first 180 days of performance, the Contractor shall make no substitutions of key

FOR OFFICIAL USE ONLY – THIS DOCUMENT IS PROCUREMENT SENSITIVE

See FAR 3.104 personnel unless the substitution is necessitated by illness, death, or termination of employment. Prior to directing any of the proposed key personnel to other programs or functional areas, the Contractor shall submit justification to substitute key personnel at least 30 calendar days prior to the substitution. Justification shall be in sufficient detail, to include the replacement’s resume, to permit evaluation of the impact of the proposed change on the program and its schedule. The Contractor shall not substitute or change the Key Personnel without prior written consent of the CO. The Contractor shall demonstrate to the satisfaction of the CO that the qualifications of the prospective personnel are equal to or greater than the qualifications of the personnel being replaced.

1.13.2 Personnel Replacement.

In the event the Contractor’s personnel performance is unsatisfactory to the Government, the CO reserves the right to request and receive satisfactory replacement. If the Government calls into question the qualifications of a contractor employee, the burden is on the contractor to prove that the employee in question has the required education/experience.

The contractor will backfill vacancies NLT the 11th working day temporarily and permanently within 30 days.

1.13.3 Mission Essential Personnel.

This requirements supports an Excepted Activity, as such, those responsible for ensuring Cybersecurity capabilities that the Government considers basic and necessary for the accomplishment of the organizations mission are considered mission essential and will remain operational during installation or Government closure.

1.14 Government and Contractor Notification.

The Contractor personnel will be required to perform services OCONUS. The government reserves the right to modify the contract to incorporate undated versions of applicable clauses for purposes of equitable adjustments to the contract price that result from such deployments. Any such modifications will be issued by the CO.

1.14.1 Deployment Checklist.

The Contractor shall use the DFARS PGI deployment checklist which can be found at:

http://www.acq.osd.mil/dpap/dars/pgi/pgi_htm/PGI225_3.htm

1.14.2 OCONUS Deployment / Compliance Requirements.

Prior to reporting for processing/travel to an OCONUS location, Contractor personnel will be required to obtain a Letter of Authorization (LOA) approved by the CO. The Contractor shall comply with and ensure that its personnel authorized to accompany U.S. Armed Forces deployed outside the United States are familiar with and comply with all applicable U.S., host country, and third country national laws; provisions of the law of war, as well as any other applicable treaties and international agreements; U.S. regulations, directives, instructions, policies, and procedures; and other directives, and instructions issued by the Combatant Commander, including those relating to force protection, security, health, safety, or relations and interaction with local nationals.

The following information shall be included in the text of the LOA: reports shall reference the task number directing the travel and the corresponding LOA number. Travel to be performed is necessary in the public service. Cost for travel performed under this LOA will http://www.acq.osd.mil/dpap/dars/pgi/pgi_htm/PGI225_3.htm

FOR OFFICIAL USE ONLY – THIS DOCUMENT IS PROCUREMENT SENSITIVE

See FAR 3.104 be reimbursed to the Contractor under the terms and conditions of the contract. Individual is authorized to travel on commercial or military aircraft or other conveyance under the contract as required for mission accomplishment. This LOA shall not be construed as authorization for the Contractor to exceed the ceiling on travel funds set forth in the contract. When traveling, you are authorized to carry hand-receipted Government equipment. When traveling, use of Government facilities and services; i.e., club facilities and post office are authorized under the contract and will be in accordance with the appropriate local commander under the provisions of AR 700-32, Logistic Support of United States Non-governmental, Non-military Agencies and Individuals in Oversea Military Commands. LOAs will not include logistical support for individuals traveling within the Continental U.S.

1.14.3 Technical Expert Status Accreditation in Germany.

Contractor employees hired for positions in Germany as Technical Experts must be accredited by host nation authorities’ Technical Expert Status Accreditation (TESA) in accordance with procedures established in Article 73 of the Supplementary Agreement (SA) to the North American Treaty Organization (NATO) Status of Forces Agreement (SOFA), managed by the Department of Defense Contractor Personnel Office, Clay Kaserne, Wiesbaden, Germany. The contractor shall use and adhere to the guidance found at http://www.eur.army.mil/Portals/19/Contractor/SAOGermany.pdf?ver=2018-05-18- 071244-070. The contractor is responsible for creating position descriptions for submittal to the DoD Contractor Personnel (DOCPER), Germany, for all positions that require TESA accreditation. The contractor may hire technically qualified personnel who are unable to meet the TESA standards due to Ordinarily Resident status. These contractors are not eligible for Individual Logistics Support.

1.14.4 Technical Representative Accreditation in Italy.

Contractor employees hired for positions in Italy as Technical Representatives must be accredited by host nation authorities in accordance with procedures established in the Tri- Component Directive for Italy on Personal Property, Rationed Goods, Motor Vehicles and Drivers’ Licenses, Civilian Component and Technical Representative Status, dated 20 February 2004, managed by the Department of Defense Contractor Personnel Office, Clay Kaserne, Wiesbaden, Germany. The contractor shall use and adhere to the guidance found at http://www.eur.army.mil/Portals/19/Contractor/SAOItaly.pdf?ver=2018-05-18-071244-

647. The contractor is responsible for creating position descriptions for submittal to DOCPER, Germany, for all positions that require Technical Representative Accreditation.

1.14.5 SOFA Compliance.

The contractor shall adhere to all relevant provisions of the applicable Status of Forces Agreements (SOFA).

1.14.5.1 SOFA Compliance for work performed in Korea.

a. U.S.-Korea bilateral agreements govern the status of contractors and employees, criminal jurisdiction, and taxation;

b. USFK and component policy, as well as U.S.-Korea bilateral agreements, govern logistics support and base privileges of contractor employees;

c. The Commander, USFK, is primarily responsible for interpreting the SOFA and local laws applicable to U.S. Forces in Korea and for requirements in support of http://www.eur.army.mil/Portals/19/Contractor/SAOGermany.pdf?ver=2018-05-18-071244-070 http://www.eur.army.mil/Portals/19/Contractor/SAOGermany.pdf?ver=2018-05-18-071244-070 http://www.eur.army.mil/Portals/19/Contractor/SAOItaly.pdf?ver=2018-05-18-071244-647 http://www.eur.army.mil/Portals/19/Contractor/SAOItaly.pdf?ver=2018-05-18-071244-647

FOR OFFICIAL USE ONLY – THIS DOCUMENT IS PROCUREMENT SENSITIVE

See FAR 3.104

USFK; and

d. The contractor shall adhere to and comply with available logistics support and the

U.S.-Korea SOFA agreements. Review of the SOFA information can be found at the USFK website at http://www.usfk.mil/ under “About”, or at http://www.usfk.mil/About/SOFA/. Contact information for the Commander is also available at http://www.usfk.mil/Leadership/; and

e. Additional applicable directives and regulations are available at http://www.usfk.mil/, click on the drop down menu named “About”.

1.14.5.2 SOFA Compliance for work performed in Japan.

a. U.S.-Japan bilateral agreements govern the status of contractors and employees, criminal jurisdiction, and taxation;

b. USFJ and component policy, as well as U.S.-Japan bilateral agreements, govern logistic support and base privileges of contractor employees;

c. The Commander, USFJ, is primarily responsible for interpreting the Status of

Forces Agreement (SOFA) and local laws applicable to U.S. Forces in Japan and for requirements in support of USFJ; and

d. The contractor shall adhere to and comply with available logistics support and the U.S.-Japan SOFA agreements. Review of the SOFA information on Contractor Performance in Japan can be found at the USFJ website, http://www.usfj.mil.

1.14.6 Synchronized Pre-Deployment and Operation Tracker (SPOT).

Prior to reporting for processing/travel into the CENTCOM Area of Responsibility (AOR) contractor personnel are required to obtain a Letter of Authorization (LOA) approved by the Contracting Officer. The contractor will be responsible for inputting the contractor information into the DoD system Synchronized Personnel and Operational Tracker (SPOT) in order to obtain an LOA. The COR, as the Government Authority, will be responsible for review and acceptance of the contractor record in SPOT so that the CO can approve the LOA generated by SPOT. The contractor shall provide timely responses to the COR or Contracting Officer for any information needed to effect timely deployment.

1.14.7 Contractor Law Compliance Program.

The Contractor shall institute and implement an effective program to prevent violations of the law of war by its employees and sub-Contractors and provide the CO and COR with a quarterly update of compliance.

1.14.8 Government Provided Support for Deployed Contractor Personnel.

Support that may be authorized or required when Contractor personnel are deployed with or otherwise provide support in a theater of operations to U.S. military forces deployed outside the U.S. may include, but are not limited to:

Deployment in-processing centers Training UNCLASSIFIED//FOR OFFICIAL USE ONLY See FAR 2.101 and

3.104 Transportation to operation area Transportation within operation area Physical security Force protection Organizational clothing and individual equipment http://www.usfk.mil/ http://www.usfk.mil/About/SOFA/ http://www.usfk.mil/Leadership/ http://www.usfk.mil/ http://www.usfj.mil/

FOR OFFICIAL USE ONLY – THIS DOCUMENT IS PROCUREMENT SENSITIVE

See FAR 3.104

Emergency medical care Mess operations Quarters Postal service Phone service Emergency notification Laundry and Religious services

1.14.9 Deceased / Missing Personnel.

When Contractor personnel become deceased or are missing while on a duty assignment in the performance of work, the COR and the CO shall be notified by telephone and/or priority message within 24 hours of the Contractor’s regional manager’s learning of the employee’s change in status.

1.14.9.1 CONUS.

The Contractor shall be responsible for arranging mortuary services and for payment of all costs associated with the care, disposition, and transportation of the employee’s remains.

1.14.9.2 OCONUS.

Contractors are eligible for the care and disposition of the remains in accordance with AR 638-40, Care and Disposition of Remains. The Contractor shall pay all costs associated with the care and disposition of the remains. The Government shall provide, on a reimbursable basis and at the request of the Contractor, suitable transportation for the remains from the place of death to the port of entry within the continental U.S.

Deployment Medical Requirements

1.14.9.3 Pre-deployment Medical Evaluation.

All personnel deploying to an AOR through a CONUS Replacement Center (CRC) shall be medically and psychologically fit for deployment and for performance of their contracted duties. (See DOD Instruction 3020.41, Contractor Personnel Authorized to Accompany the U.S. Army Forces, E3.1). The Contractor shall ensure the completion of all medical and dental requirements prior to arrival at the deployment CRC. Minimum medical and dental standards are identified at DODI 3020.41, 4.8.1 and include dental records, DNA analysis and immunizations. Individuals who are deemed not medically qualified at the CRC or during the deployment process or require extensive preventative dental care will not be authorized to deploy. Conditions that usually preclude granting of medical clearances are identified at DODI 3020.41, E3.10

1.14.9.4 Medications and Eyewear.

The Contractor shall ensure that Contractor Personnel deployed to an AOR through a CRC who are taking medications for chronic medical conditions, have sufficient quantities of their medication to last for the duration of their assignment in the AOR. The Contractor shall also ensure that Contract Personnel deployed to an AOR through a CRC who wear eye glasses, deploy with not less than two pairs of replacement eye glasses.

1.14.9.5 Medical Screening and Evaluation of Other Contract Personnel.

The Contractor shall ensure that medical screening and evaluation is performed for all Contractor Personnel that are hired in the AOR, or that are not deployed to the AOR

FOR OFFICIAL USE ONLY – THIS DOCUMENT IS PROCUREMENT SENSITIVE

See FAR 3.104 through a CONUS CRC, in order to preclude the assignment of personnel who are unable to perform their assigned responsibilities, or who could potentially cause infection of U.S.

military forces or other Contractor Personnel. The medical screening and evaluation shall be performed, at a minimum, for the following:

a. Testing and detection of communicable diseases and other diseases known to be prevalent in the local region where recruited and where assigned

b. Current, up-to-date record of vaccinations and immunizations, as appropriate for the areas where assigned

c. Active tuberculosis

d. Hepatitis

e. Human Immunodeficiency Virus (HIV), subject to applicable law and host nation requirements

f. Tests, as appropriate, for current usage of narcotics and illegal drugs, consistent with applicable law and host nation requirements

1.14.9.6 Contractor Personnel Medical Screening Records.

The Contractor shall maintain a record of individual Contractor Personnel medical screening and evaluation, which shall be provided to the COR, upon request. NOTE: local physicians in some AORs, where contingency operations are being performed, may not be reliable sources for screening, evaluation and medical records due to locally rampant corruption. In the event that any medical record is determined to be false or fraudulent, the CO may direct that the Contractor Personnel be removed pursuant to DFARS 252.225- 7040(g) without prejudice to other Government rights, including the Termination for Default clause.

1.14.10 Individual Equipment.

When required by the Mission or Theater Commander, the Government will provide to the Contractor all military unique individual equipment. When the situation warrants, the Government will provide the Contractor personnel with Mission Oriented Protective Posture (MOPP) equipment and clothing. The Contractor employees are authorized to participate with local military personnel in all Nuclear, Biological, and Chemical (NBC) training when mission requirements dictate. Upon receipt of individual equipment, the Contractor shall assume full responsibility and accountability for these items.

1.14.10.1 Deployment Weapon Requirements.

Contractor personnel may NOT possess privately owned firearms/weapons in the AOR, unless authorization is obtained pursuant to DFARS 252.225-7040. Authorization for Contractor personnel to carry a Government-furnished weapon for self-defense in the Area of Operations (AO) is at the discretion of the Theater Commander and will be annotated on the Contractor’s Synchronized Pre-deployment and Operational Tracker (SPOT) orders.

1.14.10.2 Government Furnished Weapons.

Acceptance of Government furnished weapons by Contractor employees is at the discretion of the Contractor and contract employee. When accepted, the contract employee shall be responsible for using the weapon in accordance with the applicable rules governing the use of force. Upon receipt of any Government issued weapon or ammunition, the Contractor shall assume full responsibility and accountability for these items. The Contractor and contract employee must understand that they may incur civil

FOR OFFICIAL USE ONLY – THIS DOCUMENT IS PROCUREMENT SENSITIVE

See FAR 3.104 and criminal liability, both under host nation law or U.S criminal and civil law, for the improper or illegal use of a weapon. The Theater Commander issuing weapons to contract employees is responsible for all training and familiarization commensurate with training provided DOD civilian employees.

1.15 Quality Control

1.15.1 Quality Control Plan (QCP).

The Contractor is responsible for the management and quality control actions necessary to meet the quality standards set forth in the contract. The contractor shall provide oversight and management of subcontractor task order efforts. The Contractor is responsible for the submission of a QCP to be used as a guide and to rigorously document the implementation of the required management, quality assurance, and quality control actions to achieve the specified results.

The Contractor shall develop and maintain an effective quality control program to ensure services are performed in accordance with this PWS. The Contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services.

The Contractor’s QCP is the means by which the Contractor assures that the work complies with the requirements of the contract. The Quality Control Plan shall be delivered within the contractor’s technical proposal at proposal submission. Thereafter, any contractor change to the QCP shall be submitted within 5 working days to the Contracting Officer (CO) and Contracting Officer’s Representative (COR) for review and acceptance. The Government may find the QCP "unacceptable" whenever the Contractor’s procedures do not accomplish quality control objective(s). The Contractor shall be notified to revise the QCP within 5 working days from receipt of notice that QCP is found "unacceptable.” After review and acceptance of a revised quality control plan, the Contractor shall receive written notice from the Contracting Officer.

1.15.2 Quality Assurance.

The government shall evaluate the Contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan is primarily focused on what the Government must do to ensure that the Contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the tool / report, etc. that will be utilized to measure performance.

1.16 Security Requirements.

Contractor personnel must have and maintain a TOP SECRET/SCI clearance with Special Background Investigation (SBI) on day one of contract commencement, be able to attain SI, TK, G, and HCS access. Personnel must sign a Non-Disclosure Statement. A current Counterintelligence Scope Polygraph may be required at the Governments direction at any time. Personnel must perform within the security limitations of AR 381-10 (U.S. Army Intelligence Activities), USSID 1800 (Legal Compliance and Minimization Procedures), and other appropriate security regulations according to their intelligence disciplines. This effort requires access to classified Government information at U.S. Government facilities only. Additional requirements are contained in the DD Form 254, “Contract Security Classification Specifications.”

FOR OFFICIAL USE ONLY – THIS DOCUMENT IS PROCUREMENT SENSITIVE

See FAR 3.104

1.17 Additional Security Requirements.

Additional security requirements may be added at the contract level. The Government reserves the right to direct any Contractor employee to be removed from performance, directly or indirectly, whenever there is probable cause to believe, on the basis of all facts available, that such action is warranted in the interest of national security. This action shall be made whether or not the cause is deemed of sufficient severity to warrant action to terminate the Contractor’s or individual’s security clearance. The Government also reserves the right to remove any Contractor for the purpose of conducting any investigation of alleged misconduct that may, in the opinion of the CO, jeopardize the security of the project. Loss or suspension of required facility security clearance as set forth on the DD 254 would result in the Contractor’s inability to perform in accordance with the terms and conditions of this contract. If this applies, the Contractor will be subject to termination under the appropriate termination clause herein.

1.18 DOD Directive 8570 Information Assurance Workforce Improvement Program Compliance

All Contractor support personnel requiring access to information technology (IT) systems will have the appropriate security clearance and will be granted access according to their security clearance, need-to-know, and their position/category. All Contractor employees assigned to this contract are required to obtain a Common Access Card (CAC) in order to retrieve Government provided internet/intranet information. Additional position category and investigation guidance is available in DOD 5200.2-R (DOD Personnel Security Program). As referenced in AR 25-2 (Section 5 Personnel Security), personnel requiring access to information systems processing classified information to fulfill their duties will possess the required favorable security investigation, security clearance, formal access approval (DOD Directive 8570 (Information Assurance Workforce Improvement Program) and need-to-know.

1.18.1 Special Qualifications

Contractor personnel supporting this effort must have minimum certifications in accordance with DoD Directive 8570.01-M, Information Assurance Training, Certification, and Workforce Management, and the DoD 8570.01-M Information Assurance Workforce Improvement Program IA Certifications spreadsheet for elevated privileges (IAT level 2 or 3). (Also see INSCOM G6/GISA Cyber Workforce Management Policy under Table 6:

Applicable Publications. Will be provided to vendor upon award). All qualified personnel shall be able to read, write, speak, and understand English. The contractor shall be responsible to the Government for acts and omissions of its employees and for any subcontractor(s) and its employees.

1.18.1.1 DoD Cybersecurity and Computer Network Defense (CND)-Analysis Certification

Contractor employees must satisfy the requirements of DoDI 8140.01 Cyberspace Workforce Management (requirements listed in 8570.01) and AR 25-2 Information Assurance. At a minimum, the CND-Analyst senior level employees shall be Information Assurance Technical Level II (IAT-II) and Computer Network Defense – Analyst (CND-A) certified. The CND-Analyst intermediate level employees shall, at a minimum, be Information Assurance Technical Level I (IAT-I) and CND-A certified.

FOR OFFICIAL USE ONLY – THIS DOCUMENT IS PROCUREMENT SENSITIVE

See FAR 3.104

Table 4: DoD 8570.01-M Requirements

DoD 8570.01-M Requirements

Positions Requiring

Certification Position Categories

No Special Training or Certification Requirements

General users who do not possess privileged user access permissions.

Administrative positions such as desk officers, staff action officers, help desk, asset managers and other positions without permission to change software or hardware configurations.

IAT Level I Certifications for a Computing Environment

Personnel with privileged user access or system administrator permissions to local workstations including laptops not networked.

Administrative positions such as desk officers, staff action officers, help desk, asset managers, hardware configuration, software configuration, etc. with privileged user access permissions to individual computers.

IAT Level II Certifications for a Network and Advanced Computing Environment

Personnel with privileged user access or system administrator permission to multiple workstations, servers, routers, switches, domain controllers, etc.

System administrators, network administrators, help desk support, hardware maintainers, software maintainers, configuration managers, programmers, web and portal administrators with privileged user access permissions to networked equipment.

IAT Level III Certifications an Enclave, Computing Environment and Advanced Network Environment

Personnel with privileged user access or system administrator permission to multiple workstations, servers, routers, switches, domain controllers, etc.

System administrators and network administrators who provide boundary defense, incident detection and response, wide area network (WAN), and key management. This level is required for a very limited number of personnel who serve in the HQ INSCOM data center and maintain the MI Forest.

FOR OFFICIAL USE ONLY – THIS DOCUMENT IS PROCUREMENT SENSITIVE

See FAR 3.104

DoD 8570.01-M Requirements

Positions Requiring

Certification Position Categories

IA Management (IAM) Level I

Personnel are responsible for the implementation and operation of a DoD IS or system DoD Component within their CE.

Incumbents ensure that IA related IS are functional and secure within the Computer Environment (CE).

IA Management (IAM) Level II

Personnel are responsible for the IA program of an IS within the NE. Incumbents in these positions perform a variety of security related tasks, including the development and implementation of system information security standards and procedures. They ensure that IS are functional and secure within the Network Environment (NE).

IA Management (IAM) Level III

Personnel are responsible for ensuring that all enclave IS are functional and secure. They determine the enclaves’ long term IA systems needs and acquisition requirements to accomplish operational objectives. They also develop and implement information security standards and procedures through the DoD Assessment and Authorize process.

IA Workforce System Architecture and Engineering (IASAE) Specialty Level I

Personnel responsible for the design, development, implementation, and/or integration of a DoD IA architecture, system, or system component for use within their CE.

Incumbents ensure that IA related IS is functional and secure within the CE.

IA Workforce System Architecture and Engineering (IASAE) Specialty Level II

Personnel responsible for the design, development, implementation, and/or integration of a DoD IA architecture, system, or system component for use within the NE.

CSSP Analyst

CSSP Analyst personnel use data collected from a variety of CSSP tools (including intrusion detection system alerts, firewall and network traffic logs, and host system logs) to analyze events that occur with their environment.

CSSP Infrastructure Support

CSSP Support personnel test, implement, deploy, maintain, and administer the infrastructure systems which are required to effectively manage the CSSP-SP network and resources. This may include, but is not limited to routers, firewalls, intrusion detection/prevention systems, and other CSSP tools as deployed

FOR OFFICIAL USE ONLY – THIS DOCUMENT IS PROCUREMENT SENSITIVE

See FAR 3.104

DoD 8570.01-M Requirements

Positions Requiring

Certification Position Categories within the NE or enclave.

CSSP Incident Responder

CSSP-IR personnel investigate and analyze all response activities related to cyber incidents within the NE or Enclave.

These tasks include, but are not limited to: creating and maintaining incident tracking information; planning, coordinating, and directing recovery activities; and incident analysis tasks, including examining all available information and supporting evidence or artifacts related to an incident or event.

CSSP Auditor

CSSP-AU personnel perform assessments of systems and networks within the NE or enclave and identify where those systems/networks deviate from acceptable configurations, enclave policy, or local policy. CSSP-AUs achieve this through passive evaluations (compliance audits) and active evaluations (penetration tests and/or vulnerability assessments).

CSSP Manager

CSSP-SPMs oversee the CSSP-SP operations within their organization. CSSP-SPMs are responsible for producing guidance for their NE or enclave, assisting with risk assessments and risk management for organizations within their NE or enclave, and are responsible for managing the technical classifications within their organization.

1.19 Physical Security Requirements.

This effort requires access to classified Government information at U.S. Government facilities. Physical, personnel, information and operational security measures are part of the security specifications as outlined in the DD Form 254, and the Contractor shall comply in accordance with DIAM 50-5 and other government security regulations, manuals and directives. The Government reserves the right to direct any Contractor employee to be removed for substandard performance, directly or indirectly, whenever there is probable cause to believe, that such action is warranted in the interest of national security. The Contractor employees and vehicles are subject to checks before entering or exiting any INSCOM site/facility. The Contractor shall coordinate clearance issues for personnel supporting this contract with Contractor Support Element (CSE) and INSCOM System Security Officer (SSO). The Contractor is responsible for safeguarding all Government equipment, information and property provided for Contractor use. At the close of each work period, Government facilities, equipment, and materials shall be secured. The

FOR OFFICIAL USE ONLY – THIS DOCUMENT IS PROCUREMENT SENSITIVE

See FAR 3.104 following personal items are prohibited inside classified INSCOM workspaces at all times:

cell phones / Blackberries, portable USB memory drives, other portable USB devices, external hard drives, cameras, MP3 players, music CD, headphones, scanning devices, digital flash cards / disks, personal laptop computers, camera / USB watches, all GPS enables devices, and any wireless transmitters.

1.19.1 Key Control.

The Contractor shall establish and implement methods of making sure all keys / key cards issued to the Contractor by the Government are not lost or misplaced and are not used by unauthorized persons. NOTE: All references to keys include key cards. No keys issued to the Contractor by the Government shall be duplicated. The Contractor shall develop procedures covering key control that shall be included in the QCP. Such procedures shall include turn-in of any issued keys by personnel who no longer require access to locked areas.