A11_Attachment_1_-_GlobalNET_PWS_28-Mar-2019.docx

Performance Work Statement GlobalNET As of 13 March 2019 Contract Information

Previous Contract/Task Order Number:

POC Information

Arlington, VA 22202-5408

Address:

Table of Contents

List of Tables

1.0 DESCRIPTION OF SERVICES

1.1 General

1.1.1 Mission

DSCA’s mission is to advance U.S. national security and foreign policy interests by building the capacity of foreign security forces to respond to shared challenges. DSCA leads the broader U.S. security cooperation enterprise in its efforts to train, educate, advise, and equip foreign partners.

DSCA administers security cooperation programs that support U.S. policy interests and objectives identified by the White House, Department of Defense, and Department of State. These objectives include developing specific partner capabilities, building alliances and partnerships, and facilitating U.S. access.

DSCA integrates security cooperation activities in support of a whole-of-Government approach; provides execution guidance to DoD entities that implement security cooperation programs; exercises financial and program management for the Foreign Military Sales system and many other security cooperation programs; and educates and provides for the long-term development of the security cooperation workforce.

1.1.2 Introduction

This is a non-personal services contract to provide Defense Security Cooperation Agency (DSCA) software development, testing, and operations to support the GlobalNET collaboration efforts.

1.2 Background

The Defense Security Cooperation Agency (DSCA) leads, directs, and manages security cooperation programs and resources to support U.S. national security objectives that build and continue relationships that promote U.S. interests; build allied and partner capacities for self-defense and coalition operations; and promote peacetime and contingency access for U.S. forces. As the responsible organization for managing the Partner Outreach and Collaboration Support (POCS) program, DSCA maintains a requirement to implement a web-based outreach and collaboration platform “GlobalNET”, connecting the security cooperation community, global partners, educational, and professional communities.

1.3 Objectives

The objective of this contract is to continue to operate the current technology solution IAW DoD guidance meeting net centric and information sharing standards, and deliver new functionality within that framework. This Contract is necessary to maintain services for the GlobalNET user community (currently over 70,000 users). The outcome of this effort will be coordinated updates to the current platform, and the ability for the GlobalNET user communities to maintain connection to former participants, share information among each other, and other institutions/activities, using the web-based platform.

All task changes/orders will be incorporated via contract modification. The Government shall provide the contractor with 60 days written notice before significantly reducing the scope of the services or functions required under the contract.

1.3.1 Scope

The GlobalNET platform is an integrated stack of open source web-based applications. The platform, while ever evolving, has been in operation for over twelve years and has a mature set of user stories, requirements, management, operational processes, and procedures. The platform is used globally 24/7, to allow partners to continue to communicate, build communities of practice, and share information. System requirements, as documented throughout this PWS: GlobalNET System Specifications, are defined by the user community, prioritized and scoped by the Government Program Manager or Business Manager, discussed with the contractor prior to coding, and subsequently bundled into a release of manageable size based on mutual agreement by the Government and contractor. These are iterative and agile processes.

The current GlobalNET supported communities are:

· Africa Center for Strategic Studies (ACSS) [DC]

· Daniel K. Inouye Asia-Pacific Center for Security Studies (DKI APCSS) [HI]

· William J. Perry Center for Hemispheric Defense Studies (WJP-CHDS) [DC]

· Defense Institution Building (DIB) [CA]

· Defense Institute of International Legal Studies (DIILS) [RI]

· Defense Language Institute-English Language Center (DLI-ELC) [TX]

· DoD Civilian Leader Development (DoDCLD) [DC]

· George C. Marshall European Center for Security Studies (GCMC) [Germany]

· Ministry of Defense Advisors (MODA) [DC]

· NATO School [Germany]

· Near East South Asia Center for Strategic Studies (NESA) [DC]

· Partnership for Peace (PfP) Consortium [Germany]

· PfP Network (Atlantic Security Energy Initiative/US CENTCOM/Civil Military Emergency Preparedness) [Germany]

· School of International Graduate Studies (SIGS) [CA] Security Cooperation Collaboration Network (SCCN) [DC]

1.4 Operational Information

1.4.1 Period of Performance

The period of performance is for a base period of twelve (12) months and three (3) 12-month option periods. Total contract period of performance including the Government exercise of any options sixty (60) months. The period of performance reads as follows:

Base Year – 26 July 2019 through 25 July 2020 Option Year I – 26 July 2020 through 25 July 2021 Option Year 2 – 26 July 2021 through 25 July 2022 Option Year 3 – 26 July 2022 through 25 July 2023 Option Year 4 – 26 July 2023 through 25 July 2024

1.4.2 Place of Performance

The Contractor shall perform the required services, except as noted below, between the hours of 0800 and 1700 local time, Monday through Friday, except Federal holidays. Local time is considered Eastern Time for CONUS and local time for OCONUS positions are respective of their locations. Overtime is not authorized for these efforts. The Contractor shall ensure 24x7 systems operation for the services in support of Section 5.2 of this PWS.

1.4.2.1 Alternate Place of Performance

N/A

1.4.2.2 Other Off-Site Performance

Off-site performance is defined as any location/facility not identified in PWS (hours spent and work completed during travel is conducted and reported in accordance with travel procedures addressed in the PWS) and occurs as a result of KO or COR approval to work at an alternate location during a Government observed holiday as listed in 1.4.4 or Base Shut Downs as defined in 1.4.5. The CORs are required to monitor and certify the Contractor’s performance for any work conducted off-site; therefore the Contractor shall provide a plan to the Government for monitoring the work accomplished and hours expended by labor category that will allow the COR to validate the level of effort performed and the number of hours invoiced. The Contractor’s plan shall detail how they will (a) notify the COR in advance of their employee’s intent to work off-site, and (b) at the completion of the off-site performance, how they will validate and report the work accomplished and the hours expended by labor category.

1.4.3 Hours of Operation at the Government Facility

The Contractor shall perform the required services between the hours of 0800 and 1700 local time, Monday through Friday, except Federal holidays. Overtime is not authorized for these efforts. The Contractor shall ensure 24x7 systems operation for the services in support of Section 5.2 of this PWS.

Meetings will be required at key stakeholder sites, both domestic and international. Passports and visas, when necessary, are required; more information can be obtained from the Department of State.

Occasionally the Government will require coverage for an extended period to support emerging taskers. The workday may be extended to 2000 on these occasions. The Contractor is authorized to vary scheduling, as necessary, to cover these short notice assignments. The Contractor is not authorized separately billed premium pay for this effort.

The Project Manager shall submit a proposed staffing plan as required by the COR. When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the workforce are essential.

When the Contractor is on Government site, Contractor personnel shall not perform any end of day security checks. If Government personnel are not available in the building/location of work to oversee Contractor activities, Contractor personnel shall leave the premises. Alternate work locations must be coordinated with and approved by the COR prior to the Contractor performing work or costs incurred will not be reimbursed. The Contractor and COR shall ensure the KO is notified of COR approved alternate work locations.

1.4.4 Recognized Holidays

The Government observes the Federal Holidays listed in Table 1. Contractors will not be able to perform work at the Government facility on these dates.

Table 1 – Federal Holidays

1.4.5 Emergency Office Closures

When contractor employees are not allowed access to the worksite due to emergency closures, the Government shall not be charged for the previously scheduled work hours, unless the contractor can show work was performed, deliverables have been met and the Government received a benefit. The contracting officer shall have the option of seeking remedies that permit the contractor to (a) reschedule the time lost due to base closure or (b) work at an alternate duty location.

Non-emergency/non-essential contractors shall not report to a closed Government facility. The Contractor shall prepare all deliverables and other contract documentation utilizing contractor resources. To the extent possible, the contractor shall use best efforts to provide the same level of support as stated in the PWS. In the event the services are impacted, reduced, compromised, etc., the Contracting Officer or the contractor may request an equitable adjustment pursuant to the Changes clause of the contract.

1.4.6 Type of Contract

This is a hybrid contract utilizing Firm Fixed Price (FFP) tasks and Cost Reimbursable (CR) CLINs for Contractor Travel.

1.4.7 Contractor Identification

Each Contractor employee shall, while on duty, wear in plain view on the upper portion of his outer garment a metal or plastic identification badge to be furnished by the Contractor, containing the company name, employee name, and the section where the employee works. Contractor employees shall clearly identify themselves as “Contractors” at all times, in all communications and representations, including in the workplace, at meetings, in conversations, telecommunications, mail, electronic mail (e-mail), and faxes, whether with Government personnel, other Contractor personnel, or with the public. Contractors with access to the base Local Area Network (LAN) or with an official Government e-mail address shall include their company name in the signature block and the designation “CTR” in the global address. The Contractor shall notify the Government if the “CTR” designation is not included in the global address.

1.5 Special Qualifications

1.5.1 Personnel Management

The Contractor is responsible for providing technically qualified personnel to perform the work specified in this PWS. The contractor shall maintain the personnel, organization, and administrative control necessary to ensure that the work delivered meets the contract specifications and requirements.

The Contractor shall maintain minimal personnel turnover throughout the life of the contract and ensure continuity of services during personnel absences due to sickness, leave, and voluntary or involuntary termination from employment such that impact to the Government is minimal.

The Government reserves the right to review resumes of proposed contractor personnel prior to being assigned to support this effort. The Contractor shall submit proposed resources in batches for the Government’s review, concurrence, or non-concurrence. The Government will provide the Contractor a concurrence or non-concurrence decision within five (5) business days. Resumes submitted for employees assigned to this PWS will contain documented experience directly applicable to the functions to be performed. Prior work experiences will be specific and of sufficient variety and duration that the employee is able to effectively and efficiently perform the assigned functions.

Contractor personnel do not work for the Government; however, the Government may request removal (permanent or temporary) of personnel from performance on this contract upon discovery of fraudulent qualification documentation or when Contractor personnel behave in an unprofessional manner that would be considered unacceptable by a reasonable person.

1.5.2 Contractor Qualifications

Labor Category Standards - The Government anticipates the following mix of labor categories will be required to perform this effort at minimum and must hold an Active clearance:

1.5.2.1 Senior Information System Consultant:

Minimum of 8 years front-end support experience with Drupal Content Management System (CMS). Participation in development or deployment of at least one Drupal based CMS for DoD or NATO. GlobalNET program support experience desired. Demonstrated background knowledge in understanding web based social networking capabilities as applied to a multinational, cooperative, military and civilian communities of interest; data security administration principles, methods, and techniques; the regional and security studies community; and familiarity with strategic communications, knowledge management, and information systems. A Master’s of Science in a technology related field is required.

Serve as the operations support lead and liaison between DSCA, the stakeholders, and the GlobalNET development team as well as manage the development and execution of the GlobalNET user-training program. The Senior GlobalNET Consultant supports GlobalNET US based operations efforts and partners.

· Manage product backlog for Tier 1 tickets: prioritizes, resolves or escalates to higher Tier if required, and reports issues to the operations and development team for prioritization and resolution. Provides as a minimum ticket status (open, closed, and escalated), operational status, and site analysis monthly reports.

· Coordinate emerging stakeholder and user requirements and changes with the DSCA PM.

· Amend and revise training program, as necessary, in order to adapt to changes occurring in the GlobalNET environment.

· Assist in implementation of program guidance. Inform DSCA PM of configuration and technical issues and proposed solutions.

· Assure quality of products, services and deliverables, including participating in reviews, audits, site visits, and User Acceptance Testing (UAT).

· Maintain all necessary documentations related to assigned tasks and projects.

· Travel to stakeholder sites and special events.

· Provide training to stakeholder communities.

· Participate in developmental testing and perform operational testing.

· Update Operational Test plan for major releases, starting three months before anticipated start of testing.

1.5.2.2 Information System Consultant:

Minimum of 5 years front-end support experience with Drupal Content Management System (CMS) in a government environment preferred. GlobalNET program support experience desired. Demonstrated background knowledge in understanding web based social networking capabilities as applied to a multinational, cooperative, military and civilian community of interest. Undergraduate degree or the equivalent combination of education, technical experience or work experience.

Provide Tier 1 support services for the Washington DC based communities and the Defense Institute for International Legal Studies (DIILS) based in Newport, RI, for their courses, groups, events and public news information via the GlobalNET platform.

· Manage product backlog for Tier 1 tickets: prioritizes, resolves or escalates to higher Tier if required, and reports issues to the operations and development team for prioritization and resolution.

· Coordinate emerging stakeholder and user requirements and changes with the DSCA PM.

· Assist in implementation of program guidance. Inform DSCA PM of configuration and technical issues and proposed solutions.

· Assure quality of products, services and deliverables, including participating in reviews, audits, site visits, and User Acceptance Testing (UAT).

· Maintain all necessary documentations related to assigned tasks and projects.

· Provide training to stakeholder communities.

· Participate in developmental testing and performs operational testing.

1.5.2.3 Information System Security Officer:

Ensures that the system meets DoD and DSCA security standards and performs periodic audits of security controls; submits and updates Risk Management Framework (RMF) packages; responds and coordinates Tier 3 incidents and enters them into the contractor provided tracking tool, and ensures that all necessary parties (DSCA and ARL) are contacted and aware of progress; works and supports all requests made by the DSCA designated Information System Security Manager (ISSM); and, performs Information System Security Officer (ISSO) functions. This role will perform at Information Assurance Management (IAM) level II duties as defined in DOD 8570.01-M, Information Assurance Workforce Improvement Program. Ten years' of cyber security experience in this area is recommended.

1.5.3 Special Qualifications

The Government anticipates specialized qualifications will be required to perform this effort. The contractor shall provide personnel experienced in managing and supporting a program of the scope and complexity of the GlobalNET platform.

The following specific skills shall be provided in order to maintain, support, and enhance the application: deep knowledge and use of: Drupal CMS enhanced with Organic Groups, Features, Panels, Media, Views, and many other contributed and custom modules. This includes how to quickly implement updatable site instances through the use of contrib and database update hooks; Drush command line interface to Drupal CMS; Google GSuite Email Collaboration Platform, Ilias LMS and Solr search engine; Red Hat Enterprise Linux (RHEL/7) operating system, MariaDB, Apache, PHP, and Bash script development; Amazon Web Services (AWS) services (EC2, EBS, IAM, KMS, SES) configuration with security groups, Virtual Private Cloud (VPC), CloudWatch and CloudTrail continuous monitoring; Domain name management, SAN SSL certificates and system configuration; Common Access Card (CAC) login authentication, Shibboleth SSO and Two Factor Authentication; OpenSCAP, Advanced Intrusion Detection Environment (AIDE), fail2ban, ClamAV security/vulnerability/intrusion scanning systems; Graylog log monitoring dashboards, StatusCake, OpsGenie and other real-time security management/monitoring systems 24x7 incident response; I18n translation, EZProxy, Adobe Connect (multi-lingual), Clickatell; DAP Analytics, Google Analytics, Git, Gitlab, Jenkins, Behat, Selenium, Ansible playbooks and Docker; Desktop browser support (Internet Explorer, Chrome, Firefox, and Safari); Mobile device browser support (Safari, Chrome); JIRA, Harvest, Slack and email integrations.

Additionally, the Contractor is expected to use agile software development and a continuous integration development, code review and testing pipeline for planning, managing, and delivering software. Personnel supporting this effort are required to demonstrate working familiarity with, and depending on the specific task, in-depth knowledge of, the following platforms and skill sets in order to maintain, support, and enhance the application:

· Both working and expert knowledge of, and prior experience with the software and platforms mentioned above;

· Working knowledge of, and prior experience with web-based communications systems (i.e. chat, multi-lingual chat, video conferencing, and web mail); prior experience with ADA 508 compliance issues related to design and compliance testing; prior experience with certifications in DoD information systems security compliance including STIG certifications and FISMA/RMF;

· Expert knowledge of, and prior experience with, and certifications in agile, scrum, and kanban project management methods; prior experience with: email provision and systems; multi-platform/operating system interface support: Windows, OSX, iOS, Linux, Android, Chrome, on iOS, Android and Linux workstations, tablets, and mobile phones; multimedia development and delivery (video, audio); event management and calendaring systems; contact relationship management systems development; end-user facing help-desk management; learning management system design and development (specifically, Ilias LMS curriculum/course design and development); online collaboration strategies and tools; web- and server log analytic reporting systems, web activity and status reporting, and user engagement metrics; multilingual interface design and support; cybersecurity best practices and procedures; User Interface and User Experience analysis, testing and development; experience with development operations; automation of unit testing, BDD, visual regression, and selenium testing.

1.5.4 GlobalNET System Components and Qualifications

1.5.4.1 The Government anticipates the following components and qualifications required to perform this effort:

Applications external to the GlobalNET Drupal Application, but critical to GlobalNET functionality

Google Analytics

Analytics platform maintained by Google

Google Tag Manager

Analytics metadata platform maintained by Google

Clickatell

Email to SMS gateway maintained by clickatell.com

JIRA

Development and support ticket system, maintained by Atlassian

1.5.4.2 Certifications/Qualifications:

· IAT Level II certification(s) in accordance with (IAW) DoD 8570.01m workforce training requirements

· IAM Level I certification IAW DoD 8570.01m workforce training requirements

1.5.5 Key Personnel

Key personnel include all contractor personnel who contribute substantially and measurably to each project. Key personnel resumes submitted in response to this request must be currently employed by or accepted a contingent offer from the Contractor or Subcontractor/Team Member and not subject to contingent employment offers. The contractor shall make every reasonable effort to retain key personnel in order to ensure continuity of service within key personnel positions. Prior to substituting, removing, replacing or diverting any of the specified individuals, the Contractor shall notify the Contracting Officer 14 business days in advance and shall submit a written request and justification (including proposed substitutions) in sufficient detail to permit evaluation of the impact on this Contract. This written notification shall include the date and time the positon will be absent, anticipated replacement date, and what management corrective action will be taken to ensure mission completion. The Contract shall ensure that replacements/substitutions meet the minimum qualifications as proposed for the affected position. Position vacancies shall not exceed 21 calendar days unless approved in writing or otherwise directed in advance by the KO.

All Government provided training shall be approved and scheduled the applicable COR in advance. However, the Government may provide training to Contractor personnel only if the contract requires it or does not create a conflict or give the appearance that the Government is favoring a particular Contractor employee. No Government-provided Contractor training is authorized without KO coordination and approval.

1.6 Coordination

1.6.1 Kick-Off Meeting

The Contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation Subpart 42.5, Post Award Orientation. The contracting officer, Contracting Officers Representative (COR), and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor’s performance. At these meetings, the contracting officer will apprise the contractor of how the Government views the contractor’s performance, and the contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues.

1.6.2 Contracting Officer Representative (COR)

The (COR) will be identified by separate letter. The COR monitors all technical aspects of the contract and assists in contract administration The COR is authorized to perform the following functions: assure that the Contractor performs the technical requirements of the contract; perform inspections necessary in connection with contract performance: maintain written and oral communications with the Contractor concerning technical aspects of the contract: issue oral or written interpretations of technical requirements, monitor Contractor's performance and notifies both the Contracting Officer and Contractor of any deficiencies; coordinate availability of Government furnished property, and make arrangements for site entry of Contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the Contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the contract.

1.6.3 Contract Senior Manager (CSM)

The Contractor shall provide a contract manager who shall be responsible for the performance of the work. The name of this person and an alternate who shall act for the contractor when the manager is absent shall be designated in writing to the contracting officer. The contract manager or alternate shall have full authority to act for the contractor on all contract matters relating to daily operation of this contract. The contract manager or alternate shall be available during normal business hours as outlined above, Monday thru Friday except Federal holidays or when the Government facility is closed for administrative reasons. The Contractor shall be responsible for managing and overseeing the activities of all contractor personnel, as well as any subcontractor efforts used in performance of this effort. The contractor's management responsibilities will include all activities necessary to ensure the accomplishment of timely and effective support, performed in accordance with the requirements contained in the Performance Work Statement (PWS).

1.6.4 Decision Making:

The Contractor is not authorized to make decisions on behalf of the Government. The Contractor will make recommendations to Government personnel for the Government’s decision-making purposes. The COR or Government designee, not the Contractor, will brief DSCA leadership on the status of the contract.

1.6.5 Identification of Contractor Personnel

All contract personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. They must also ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed. Provisions of the Privacy Act may apply to some records and reports maintained by the contractor.

1.6.6 Contractor Travel

Travel outside of Washington DC Metro Area to other sites may be required for specific tasks. All travel requires government pre-approval/authorization and shall be coordinated with the Contracting Officer and COR. Any projected travel should be submitted to the Contracting Officer and COR expeditiously to allow necessary time to complete the Government approval process. Travel and per diem shall be reimbursed in accordance with the Joint Federal Travel Regulations currently in effect and IAW FAR Part 31.205-46. All travel will be conducted at the minimum cost to the Government. The Contractor shall provide a trip report detailing travelers, activities conducted, results accomplished, and expenses incurred to the Contracting Officer and COR within two (2) days of the completion of travel.

1.7 Environmental, Safety, Health and Security

1.7.1 Environmental Requirements

The Contractor shall comply with all applicable federal, state and local environmental statutes, instructions, manuals, handbooks, regulations, guidance, policy letters and rules (including all changes and amendments), and all Presidential Executive Orders in effect on the date of award. The Contractor shall comply with the highest degree of environmental protection where any disagreements exist. For OCONUS work, the Contractor shall also comply with all applicable host nation statutes and agreements. In addition, the Contractor shall comply with the following publications: The Department of Defense (DoD) Overseas Environmental Baseline Guidance Document (OEBGD) or the Final Governing Standards (FGS), if adopted for a particular location. In the event environmental laws or regulations change during the term of this contract, the Contractor is required to comply as such laws come into effect.

1.7.2 Safety and Health Requirements

The Contractor shall comply with all applicable Occupational Safety and Health Administration (OSHA) and technical orders, regulations and referenced publications. The Contractor shall comply with the highest degree of safety protection where any disagreements exist.

1.7.3 Security

The Contractor, and all Contractor personnel, shall abide by all DSCA and local rules, procedures, and standards of conduct on physical and personnel security.

The contractor is responsible for safeguarding information of a confidential or sensitive nature. Failure to safeguard any classified/proprietary information which may involve the contractor or the contractor’s personnel or to which they may have access may subject the contractor and/or the contractor’s employees to criminal liability. Provisions of the Privacy Act apply to all records and reports maintained by the contractor. In accordance with DoD 5200.2-R, “Personnel Security Program”, all DSCA contractors involved with DSCA information system design, operation, testing, maintenance, and/or monitoring must be designated at a minimum of ADP-II and a NACI shall be requested and the NACI portion favorably completed before work can be started. Completed investigations must be forwarded to DOHA for trustworthiness determination. Unfavorable trustworthiness determinations will result in the immediate removal of contractors. Properly cleared ADP-I personnel must technically review all work performed by ADP-II contractors to ensure the integrity of the system.

All contractor personnel working on this PWS shall complete web based “Identifying and Safeguarding Personally Identifiable Information” training and sign non-disclosure agreements.

All programs and materials developed at government expense during the course of this contract are the property of the government.

Any visit to DSCA by contractor personnel not physically/permanently assigned to this contract (company presidents, company security managers, contract employees, etc) require an escort by the DSCA POC they are visiting.

In order to satisfy the DoD Risk Management Framework (RMF), and to properly configure, secure, and maintain the GlobalNET platform, individuals performing security related functions will require common access cards (CAC) for select US citizens. This provides access to the Defense Information Systems Agency (DISA) information repositories and include, but are not limited to the DISA Security Readiness Review Scripts (SRRs), and the Enterprise Mission Assurance Support Service (eMass).

1.7.3.1 Physical Security

The Contractor shall safeguard all Government property and controlled forms provided for Contractor use and adhere to the Government property requirements contained in this contract. The Contractor shall ensure all Government equipment and materials are secured at the end of each day.

1.7.3.2 For Official Use Only (FOUO) and Privacy Act

The Contractor must comply with the requirements of DoD 5400.7-R, Chapter 4, DoD Freedom of Information Act (FOIA) Program, as well as The Privacy Act of 1974, as amended at 5 U.S.C. 552. These regulations set policy and procedures for the disclosure of records to the public and for marking, handling, transmitting, and safeguarding FOUO and Privacy Act information/material. The Defense Privacy, Civil Liberties, and Transparency division maintains a library of all applicable regulations.

The Contractor must not divulge any information, classified or unclassified, about DOD files, data processing activities or functions, user identifications, passwords, or any other knowledge that may be gained, to anyone who is not authorized to have access to such information. The Contractor shall observe and comply with the security provisions in effect at the DOD facility. Identification shall be worn and displayed as required.

Upon completion of this contract (i.e. - terminated for cause, retirement, etc.), the contractor personnel shall surrender all Government supplies, materials and equipment to the COR or designated Government representative. Upon the completion of the contract, all contractor personnel officially in-processed through the DSCA Security Officer, must officially out-process with the DSCA Security Officer for a de-briefing and return all access badges to the DSCA Security Officer.

DSCA retains the right to request removal of contractor personnel regardless of prior clearance or adjudication status, whose actions, while assigned to this contract, clearly conflict with the interest of the Government.

1.7.3.3 Key Control

The contractor shall establish and implement methods of making sure no keys issued to the contractor by the Government are lost or misplaced and are not used by unauthorized persons. The contractor shall not duplicate any keys issued by the Government.

The contractor shall immediately report to the Program Manager any occurrences of lost or duplicated keys.

In the event keys, other than master keys, are lost or duplicated, the contractor may be required, upon written direction of the contracting officer, to re-key or replace the affected lock or locks without cost to the Government. The Government may, however, at its option, replace the affected lock or locks or perform re-keying and deduct the cost of such from the monthly payment due the contractor. In the event a master key is lost or duplicated, all locks and keys for that system shall be replaced by the Government and the total cost deducted from the monthly payment due the contractor.

The contractor shall prohibit the use of keys, issued by the Government, by any persons other than the contractor's employees and the opening of locked areas by contractor employees to permit entrance of persons other than contractor employees engaged in performance of contract work requirements in those areas.

1.7.3.4 Lock Combinations

The contractor shall control access to all Government provided lock combinations to preclude unauthorized entry. The contractor is not authorized to record lock combinations without written approval by the Government Program Manager. Records with written combinations to authorized secure storage containers, secure storage rooms, or certified vaults, shall be marked and safeguarded at the highest classification level as the classified material maintained inside the approved containers.

1.7.3.5 Personnel Security

The following security requirements shall apply to this effort.

1.7.3.5.1 The overall classification of work associated with this PWS is at the UNCLASSIFIED level for purposes of access to unclassified DoD computer networks. The Information System Security Officer and Systems Administrator roles are required to be US Citizens. All other roles can be from DSCA partner nations.

1.7.3.5.2 Contractor personnel working in support of this contract shall have a favorably completed Access National Agency Check and Inquiries (ANACI) or National Agency Check with Local Agency and Credit Check (NACLC), resulting in final eligibility adjudicated by the Defense Industrial Security Clearance Office (DISCO) or another recognized clearance adjudication facility provided they have been claimed in the Joint Personnel Adjudication System (JPAS) as an industry contractor for the awarded company. DSCA requires a Visitor Authorization Request (VAR) to be submitted to the DSCA Security Officer signed by the Contractor Security Officer verifying the contractor personnel security credentials.

1.7.3.5.3 The Contractor will forward a Visitor Authorization Request (VAR) to the DSCA Security Mailbox for all employees prior to the beginning of each contracting period of performance and as new contractor employees are assigned to the contract.

1.7.3.5.4 Visit requests shall be processed and verified through the Joint Personnel Adjudication System (JPAS) to SMO DDAAHB6. JPAS visits for contracts are identified as “Other” or “TAD/TDY” and will include the Contract Number and ADP/IT-Access level of the contract in the Additional Information section. Contractors that do not have access to JPAS may submit visit authorizations by fax to (703) 601-0964. The Contractor may use their own format as long as all of the following information is provided on company letterhead:

* Company Name, address, telephone number, assigned CAGE code, facility security clearance

* Contract Number

* Name, Rank, Title or Position, SSN, DOB, POB, Nationality, Citizenship

* Clearance and Date

* Purpose of visit

* Date/Duration of visit

* Name of COR/Alt COR

1.7.3.5.5 DSCA Security Personnel can be contacted for Industrial or Personnel Security related issues at dsca.ncr.odam.mbx.security-ops-admin@mail.mil.

1.7.3.5.6 Contractor employees will be required to comply with all Government security regulations and requirements. Initial and periodic safety and security training and briefings will be provided by Government security personnel. Failure to comply with Government security regulations and requirements shall require the company to provide the Government with a written remediation/corrective action plan; furthermore, failure to comply with such requirements can be cause for removal and the contractor will not be able to provide service on this contract.

1.7.3.5.7 The contractor and its employees shall comply with all base traffic regulations.

1.7.3.5.8 Contractor employees are prohibited from using cellphones while driving on base in accordance with Executive Order 13513, “Federal Leadership on Reducing Text Messaging while Driving”, dated October 1, 2009.

1.7.3.5.9 Contractor employees are prohibited from possessing weapons, firearms, or ammunition, on themselves or within their contractor-owned vehicle or privately owned vehicle while on any DOD installation. This also includes DSCA Headquarters 201 12th ST, Suite 203 Arlington VA, 22202 or Official Use Only (FOUO): The contractor shall comply with DoD 5400.7-R, Chapter 4, DoD Freedom of Information Act (FOIA) Program, requirements. This regulation sets policy and procedures for the disclosure of records to the public and for marking, handling, transmitting, and safeguarding FOUO material.

1.7.3.6 Operation Security (OPSEC) Requirements

Contractor personnel shall report to an appropriate authority any information or circumstances of which they are aware may pose a threat to the security of DOD personnel, contractor personnel, resources, and classified or unclassified defense information. The contractor will attend annual OPSEC training offered by DSCA.

1.7.3.7 Cyber Security Threat Plan

In conjunction with the Defense Federal Acquisition Regulation Supplement (DFARS) Subpart 204.73, Safeguarding Unclassified Controlled Technical Information, DFARS Clause 252.204-7012, Safeguarding unclassified controlled technical information, and DoD, NIST, and other Federal mandated regulations, instructions, procedures, and laws, the contractor shall develop, submit, and implement upon approval a Cyber Threat Security Plan.

The contractor shall submit the plan 30 Calendar days after contract award to the Contracting Officer and COR for acceptance. The Contracting Officer and COR have 10 working days to provide an acceptance or feedback to the contractor. If no written acceptance is received within the 10 working days, then the contractor can consider the plan accepted. If the contractor receives feedback, the contractor has 10 working days to provide the Contracting Officer and COR, an updated plan based on the feedback received from the Government.

This plan shall be consistent with and detail the approach contained in the contractor's proposal that resulted in the award of this contract and in compliance with the requirements stated in the clause mentioned under this task. This plan shall describe the processes and procedures the contractor will follow to ensure appropriate security of IT resources that are developed, processed, or used under this contract.

This plan shall contain the following:

· Vulnerability Management: evaluating network components, security procedures, and processes for potential exploitation from attack.

· Cyber Threat Intelligence: providing policy enforcement and end-point protection against unwarranted attacks on the network.

· Analytics Monitoring: providing scalable analytics solution capable of combining potential risk indicators and developing leads.

· Mitigation and Response: providing the process on how the threat will be mitigated and responded to upon discovery.

· Lessons Learned and Action Plan: providing lessons learned and an action plan that will help all interested parties avoid repeated and similar attacks.

· Subcontractors: explaining how your subcontractors will be required to implement this requirement within their processes in support of this task.

Annually, on the anniversary date of acceptance of the plan, the contractor shall submit verification to the Contracting Officer and COR that the plan remains valid.

1.8 Special Instructions

1.8.1 Constructive Changes

All official documents and deliverables described in this PWS, and any subsequent amendments or modifications, will be submitted in writing, on the prime contractor’s letterhead.

1.8.2 Invoicing Instructions

Requests for payments must be submitted electronically via the Internet through the Wide Area Workflow – Receipt and Acceptance (WAWF-RA) system at https://wawf.eb.mil. The Contractor shall bill for services performed under this contract on a monthly basis within 60 calendar days of completion of monthly performance, by submitting a combination invoice/receiving report in WAWF in US dollars. Billings for travel shall be invoiced for the entire trip (inclusive of all costs associated with the trip) on a single invoice. Billing for a single trip shall not be broken out into various component billings spread across multiple invoices, unless otherwise approved, in writing, by the KO for extenuating circumstances.

1.8.3 Purchasing

The Contractor is not authorized to purchase any material, billable to the Government, as part of this requirement.

1.8.4 Contractor Manpower Reporting

The Contractor shall report ALL Contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract via a secure data collection site. The Contractor is required to complete all required data fields at http://www.ecmra.mil. Reporting inputs will be for the labor executed during the period of performance for each Government fiscal year (FY), which runs 1 October through 30 September. While inputs may be reported any time during the FY, all data shall be reported no later than 31 October of each calendar year. Contractors may direct questions to the CMRA help desk.

1.8.5 Contract Health Report

The contractor shall submit an annual contract health report that summarizes the major achievements and obstacles encountered during the year. The report must also include a list of all required training completed by each employee performing under this contract.

1.9 Organizational Conflict of Interest

Contractor and subcontractor personnel performing work under this contract may receive, have access to or participate in the development of proprietary or source selection information (e.g., cost or pricing information, budget information or analyses, specifications or work statements, etc.) or perform evaluation services which may create a current or subsequent Organizational Conflict of Interests (OCI) as defined in FAR Subpart 9.5. The Contractor shall notify the Contracting Officer immediately whenever it becomes aware that such access or participation may result in any actual or potential OCI and shall promptly submit a plan to the Contracting Officer to avoid or mitigate any such OCI. The Contractor’s mitigation plan will be determined to be acceptable solely at the discretion of the Contracting Officer and in the event the Contracting Officer unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the Contracting Officer may affect other remedies as he or she deems necessary, including prohibiting the Contractor from participation in subsequent contracted requirements which may be affected by the OCI.

The Contractor shall maintain an Organizational Conflict of Interest (OCI) Plan to reduce the likelihood of an actual or perceived OCI. In order to prevent OCI under this contract, guidance in this clause will apply to eliminate:

· Conflicting roles, which might bias a Contractor's judgment or objectivity

· An unfair competitive advantage to a Contractor

· The appearance of an unfair competitive advantage

· Parties recognize Contractors will play a very visible and responsible role in fulfilling the broad range of services involved in this requirement. In that capacity, Contractors may have access to information that is not available to the public, which:

· May give a Contractor an unfair competitive advantage

· Creates an appearance that a Contractor has an unfair competitive advantage even if no such advantage actually exists The technical judgment of a Contractor will often influence the systems, training, services, policy, or guidance adopted by DSCA, and a Contractor will play a key technical review role over other Contractors' work. Both the Government and all Contractors must have the utmost confidence that acquisitions are fair and that a Contractor's judgment and recommendations are objective, impartial, and independent. To avoid, neutralize, or mitigate a potential conflict of interest, the Contractor shall not, during performance of the contract, engage (as a prime contractor, subcontractor, supplier, or consultant) in any other contract that would design, develop, implement, operate, or sustain any system or deliverable that is based on a recommended solution provided under this contract.

When performing work under this contract requires or involves access to competition sensitive information, as well as possible access to proprietary technical data of other companies disclosed to the Contractor in confidence, the Contractor is required to protect such data from unauthorized use or disclosure so long as it remains proprietary (See 4a-3, Associate Contractor Agreement). The Contractor shall be cognizant of possession and/or disclosure of other Contractors' and/or Government proprietary information, including procurement sensitive information; and of restrictions on participating in development of, and then bidding on resultant requirement. For example, the Contractor may be required to perform studies that directly influence future Government requirements.