Attachment A Draft DDMS Performance Work Statement.docx

PERFORMANCE WORK STATEMENT

DEFENSE DEBT MANAGEMENT SYSTEM (DDMS)

STANDARD FINANCIAL INFORMATION STRUCTURE (SFIS)

STANDARD LINE OF ACCOUNTING (SLOA) COMPLIANCE REQUIREMENT

1.0 BACKGROUND

The Defense Finance and Accounting Service (DFAS) provides finance and accounting services to the Military Services and other Department of Defense (DoD) activities. The Department of Defense (DoD) has directed agencies to improve financial information, improve interoperability between business systems, provide better end-to end funds traceability and linkage between budget and expenditures, comply with new Treasury requirements, and help achieve audit readiness through business process reengineering (BPR). The DoD Standard Financial Information Structure (SFIS)/ Standard Line of Accounting (SLOA) policies seek to enhance DoD system interoperability by creating standard data elements in financial, accounting and reporting systems.

Currently, each component and functional area across DoD utilizes different structures to represent the Line of Accounting (LOA). The LOA is used to identify the funding source associated with an organization’s budget and to ensure accurate accounting transactions. SFIS was established and implemented to create a common business language within the DoD. Interoperability between systems for transactional data exchanges remains a complex issue for the Enterprise because the content of a DoD LOA is non-standard; creating errors, rejections, reconciliation issues, unmatched disbursements, unsupported eliminations, and higher costs to develop and maintain disparate interfaces.

SFIS standardizes financial reporting across DoD and allows revenues and expenses to be reported by programs that align with major goals, rather than basing reporting primarily on appropriation categories. It also enables decision makers to efficiently compare programs and their associated activities and costs across the Department and provides a basis for common valuation of DoD programs, assets, and liabilities. SFIS/SLOA compliancy will reduce errors, rejections, reconciliation problems, unmatched disbursements, unsupported eliminations, and higher personnel costs due to manual processing while improving reconciliation and auditability through the standardization of this data.

2.0 OBJECTIVE

The objective is for the DDMS system to comply with SFIS/SLOA standards. In accordance with DoD objectives, compliance with the stated policies will improve financial information, improve interoperability between business systems, provide better end-to-end funds traceability, and linkage between budget and expenditures, comply with Treasury requirements and help achieve audit readiness through business process reengineering.

The general objectives are as follows:

• Configure DDMS for SFIS Compliance to the most updated version (current version of SFIS is 11.2).

• Configure Interfaces to Transmit SFIS Data Attributes – DDMS must be interoperable with all interface (trading) partners - successfully sending and receiving SFIS data and information. The SFIS Values Library Service (Under Secretary of Defense (Comptroller) > ODCFO > sfis > SFISValuesLibraryService) includes XML instances and schemas which shall be referenced when configuring interfaces.

• Develop SFIS Crosswalk Capabilities for DDMS - This is important for interoperability between SFIS configured systems and legacy (non-SFIS) systems. The interoperability between non-SFIS and SFIS configured systems will use Global Exchange (GEX) for the SFIS exchange or use an internal translator in the SFIS configured system to translate legacy data received from non-SFIS systems or translate SFIS data back to legacy when sending data to non-SFIS systems.

3.0 SCOPE

The scope of this requirement is for the contractor to analyze and implement all SFIS/SLOA standards into the DDMS system.

4.0 TASKS/REQUIREMENTS

The contractor is required to convert the DDMS interface exchange files, re-write systematic and manual debt management processes and procedures (inclusive of modifying existing DDMS application structures, i.e. database(s), application input screens, records and fields) into the initial SLOA format (and ultimately SFIS) to include the incoming validation/verification programs.

4.1 PHASE 1 – ANALYSIS

The contractor shall confirm, configure, document and verify implementation of SFIS Compliance requirements in DDMS and all associated interfaces, integrations and automated processes. The deliverables associated with this task are Meeting Minutes, Configuration Document(s), Interface Requirements Specifications (IRS) and User Guides.

The contractor shall conduct analysis of the requirement, review the system architecture/environment, and understand the As-Is and To-Be state to be achieved. When the analysis phase is complete, the contractor shall provide the following documents to the System Manager for review:

· Technical Plan to describe hardware, software, interface upgrades required

· Documents required for system audit/risk management purposes

· Crosswalk Capability Plan

· Implementation Plan

· Plan of Action and Milestones

· Quality Control Plan

The contractor shall not perform Phase 2 activities until the DFAS System Manager has provided written authorization to proceed. Please see section 9 (Inspection/Acceptance) of the PWS.

4.2 PHASE 2 – IMPLEMENTATION

The contractor shall execute its approach described in its cumulative deliverables from Phase 1. Sections 5.3 – 5.10 describe a notional process of events to occur during the SFIS/SLOA compliance execution process. In the actual performance of the contract, the contractor must execute its Implementation Plan and related execution documents.

4.3 REQUIREMENTS ANALYSIS AND FUNCTIONAL CONFIGURATION

The contractor will confirm, configure, document and verify implementation of SFIS Compliance requirements in DDMS and all associated interfaces, integrations and automated processes. The deliverables associated with this task are IPT Meeting Minutes, Configuration Document(s), Interface Requirements Specifications and User Guides.

The contractor shall provide support for all aspects of functional system requirements to the DFAS DDMS program deliverables to include that of Business Intelligence activities. Contractor shall support related applications such as DCD, DCW, TGET, SFIS Library, CEFT, DTS (support only), SDI (support only), CORAS as well as integration with the D-System suite (DDRS and DCAS). As part of FIAR projects, the contractor shall also perform research and analysis to develop functional requirements for data interfaces between D-System and non-D-System applications.

As part of supporting all aspects of the DFAS DDMS systems program initiatives, the contractor shall include conversions of the SFIS data structures in database design, system interfaces, and integration with other D-System applications (DDRS and DCAS).

The contractor will research, analyze give proof the developed functional requirements designed to carry out a migration of the DDMS applications to the Standard Financial Information Structure (SFIS). The contractor shall also record the new interfaces, modify existing interfaces, provide in writing data queries, data screens and system business functions as part of carrying out this migration.

The contractor will research, analyze and document the developed functional requirements designed to adapt/integrate the DDMS SFIS Library with the Department of Treasury and other legacy and ERP systems. This integration must also expose the SFIS data to new ERP systems or other applications for validation and compliance with SFIS business rules.

The contractor shall research, analyze and document the developed functional requirements designed to adept/integrate the functional needs for ODO and Army Departmental. Output from these related efforts support monthly and quarterly critical path financial statement reporting.

The contractor is responsible for upgrading the DDMS to SFIS version 11.2

4.4 TECHNICAL INFRASTRUCTURE SET UP

The contractor shall assist in developing the technical infrastructure for the SFIS Compliance implementation. Deliverables required are IPT Meeting Minutes and the Technical Configuration Document.

4.5 SYSTEM DEVELOPMENT

All existing interfaces, integrations, and automated processes shall be modified to support SFIS Compliance requirements. Perform code impact analysis, review the Configuration and IRS documentation, make required updates to existing DDMS interfaces and integrations that use SFIS data, and conduct unit testing. Data crosswalks shall be developed for interfaces and/or integrations with legacy systems that are not yet SFIS compliant. All interfaces shall be configurable to process inbound and outbound original non-SFIS formats and in the new SFIS format, as necessary. Determination of which format is contingent on the status of the trading partner(s).

The contractor shall apply the user interface (UI) extensions necessary to provide for consistent business process terminology between DDMS and Performance Budgeting. These extensions shall be consistent with the Configuration Guides.

The contractor shall provide documentation of developed functional descriptions to support new interfaces, modifications of existing interfaces, data queries, data screens, system business functions, use of Electronic Data Interchange conventions, and other possibly other solutions to expose the data in the library to financial system applications.

The contractor shall develop all SCRs to update the required financial reports and customer exports to comply with the most recent SFIS Version.

4.6 DATA MIGRATION

The contractor shall convert existing DDMS data to SFIS compliant data. Requirements for SFIS data migration will be identified during the Data Conversion IPT. The contractor shall develop custom migrations scripts to convert Production data from the requirements identified. Deliverables required are the Data Migration Plan and Data Reconciliation Results Memorandum.

The contractor shall support required migrations to the Standard Financial Information Structure (SFIS) and Standard Line of Accounting (SLOA) for various applications within the DDMS suite. This effort will include new interfaces, modifications of existing interfaces, data queries, data screens and system business functions and may affect DTS, SDI, CEFT, SFIS Library, DCD, DCW, and CORAS.

The contractor shall adapt the DDMS Standard Financial Information Services (SFIS) Library with new interfaces to Treasury and other external partners. DDMS shall be adapted to expose the data to new ERP systems or other applications for validation and compliance with SFIS business rules. This effort will require support for documentation of functional requirements for new interfaces, modifications of existing interfaces, and other system business functions and data interchange conventions.

4.7 TESTING

The contractor shall work with the Program Office to design, develop and execute a coordinated test strategy that meets DFAS policies and guidelines. The strategy will be included in the Test Plan along with specific testing tasks, schedules, and roles and responsibilities. The testing phases will be Regression Testing, System Integration Testing and System Acceptance Testing, and Production Validation Testing. Deliverables are Test Plan, Test Scripts and Testing Results Report.

When supporting testing activities, the contractor shall develop scenarios, scripts, acceptance criteria, setting-up test environments and using the relevant testing software.

4.8 CLOUD HOSTING

The DDMS SFIS Business Capability investment would be followed by a comprehensive Infrastructure thru Software as a Service ReArchitecture to replace COBOL with a modern object oriented programming language (ex. Java), replace IBM Operating System (OS) with an x86 OS based upon a JWCC contracted Cloud provider. The DDMS ReArchitecture package would be submitted shortly after SFIS approval to ensure reduced project timelines of maintaining COBOL and the legacy operating system. This approach would utilize still currently available Out of Service Debt knowledge IT professionals to complete the SFIS Business Capability prior to planned retirements while then migrating to an modern application thereafter. This mitigation would significantly reduce the Consequence for both the IT Systems and Staff / Resources risks ensuring DDMS continues to serve as the primary Out of Service Debt DoD application. This ReArchitecture would occur after the SFIS SLOA Project.

4.9 PRODUCTION DEPLOYMENT

The Production Deployment phase will immediately precede the system go-live. The contractor shall ensure all tasks required for the cutover are completed and that the Production environment is functional prior to go-live. This phase will begin the week before the Production environment scheduled system downtime. This phase will require 24 hour weekday and weekend support from the contractor. The deliverable is the Production Deployment Confirmation Memorandum.

4.10 TRAINING

The contractor shall provide two types of training for SFIS Compliance implementation. High-level User Testing Training will be conducted prior to the start of SIT and SAT to prepare for system testing. Deployment Training will be provided prior to the go-live date to familiarize users with new DDMS functionality and business processes. Training will include prototype demonstrations, navigation, workflow and basic system processes.

Deliverables are Training Materials and Course Evaluation Reports.

4.11 POST IMPLEMENTATION SUPPORT

The contractor will provide 60 calendar days of post-implementation support after the SFIS Compliance implementation go-live.

5.0 PERIOD OF PERFORMANCE: The Base period of performance shall be for twelve (12) months with three 12 month Option Years.

6.0 PLACE OF PERFORMANCE: The work will be performed at the DFAS Indianapolis. Work may be authorized at other locations with approval by the Contracting Officer (CO) or Contracting Officer Representative (COR). Travel may be required to CONUS locations to support DDMS customers at their place of business. CONUS sites are predominantly military bases or other Government installations.

7.0 DELIVERABLES

Others - Once at completion of Requirements Analysis

Others - Once at completion of Technical Infrastructure

Testing Results Report - Once at completion of Testing

8.0 PERFORMANCE REQUIREMENTS SUMMARY MATRIX

The contractor service requirements are summarized into performance objectives that relate directly to mission essential items. The performance threshold briefly describes the minimum acceptable levels of service required for each requirement. These thresholds are critical to mission success.

2) Testing by a DoD CIO approved/assigned testing agency

2) Testing by a DoD CIO approved/assigned testing agency

2) Testing by a DoD CIO approved/assigned testing agency

2) Testing by a DoD CIO approved/assigned testing agency

Standard Financial Information Structure (SFIS) for suite of applications.

A solution is created that meets identified functional requirements and an SCR is provided to create solution(s) accepted by Change Control Board.

Review of FD package and working group meetings and whether formal acceptance of work package has been obtained by CCB.

partners.

A solution is created that meets identified functional requirements and an SCR is provided to create solution(s) accepted by Change Control Board.

Review of FD package and working group meetings and whether formal acceptance of work package has been obtained by CCB.

update the required financial reports and customer exports to comply with SFIS Version 11.2.

The solutions and deliverables are accurate, complete, and incorporate all pertinent data.

All deliverables required no (or minor) adjustments by the Government.

Any errors/omissions identified by the Government are corrected within 10 business days.

Exceptions are due to circumstances outside of the Contractor’s control.

Deliverables provided on schedule 95% of the time.

9.0 INSPECTION AND ACCEPTANCE

· Phase 1 – Analysis

· Inspection – DDMS system office will review the approach deliverables.

· Acceptance – DDMS system office will review the approach deliverables within five (5) work days of receipt. If the DDMS system office concurs with the approach, the DDMS System Manager will provide written confirmation to the contractor/Contracting Officer/COR that the DDMS system office concurs with the approach. If the DDMS system office has concerns regarding the approach, the DDMS System Manager will provide written notice to the contractor/Contracting Officer/COR regarding the concerns and the contractor will have five (5) work days to revise the approach and respond to the DDMS System Manager.

· Phase 2 – Implementation

· Inspection – After the contractor has described that the SFIS/SLOA compliance services have been completed, the DDMS system office will inspect to determine whether the system has full compliance.

· Acceptance – When the DDMS system office has determined that the system has achieved full SFIS/SLOA compliance, the DDMS System Manager will provide formal written notification to the contractor/Contracting Officer/COR of that determination.

10.0 PAYMENT

Phase 1 – Analysis Once the contractor has received written confirmation from the DDMS System Manager regarding the approach, the contractor may submit an invoice regarding the Phase 0001 activities.

Phase 2 – Implementation Once the contractor has received written confirmation from the DDMS System Manager regarding the implementation, the contractor may submit an invoice regarding the Phase 0002 activities.

11.0 ADDITIONAL INFORMATION:

11.1 Interaction with Contractor Personnel: The COR shall forward questions or concerns directly to the prime contractor official representative who is directly responsible for managing its own employees/subcontractor personnel.

The prime contractor official representative shall coordinate a training schedule with the COR that does not cause undue delays to Task Order (T.O.) performance.

The prime contractor official representative (including subcontractor’s personnel, when applicable) shall provide the COR, within 30 days after T.O. award/exercise of an option, a written report identifying:

(1) Contractor employees required to take the training

(2) Contractor employees who completed the training

(3) Contractor employees who are delinquent

Contractor personnel shall direct their questions or concerns to their contractor management chain and/or company representative.

11.2 Recognized Holidays:

Juneteenth Independence Day

11.3 Hours of Operation: The contractor shall conduct business between the hours of 6:00AM and 6:00PM, Monday thru Friday except the Federal holidays listed in 11.2 or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. The contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for any of the above reasons.

11.4 Extended/Emergency Hours: When mission needs dictate, at the request of or upon coordination with the COR, Contracting Officer Technical Representative (COTR), the contractor staff shall be available outside facility duty hours (i.e. will work nights and weekends) to support the types of work described within the PWS.

11.5 Remote Location: The contractor may be authorized to work from a remote location when it’s advantageous to the DFAS mission. This must be coordinated and approved by the COR and CO. NOTE: Work involving classified information will not take place at the contractor facility.

11.6 Post Award Conference/Periodic Progress Meetings: The contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation Subpart 42.5. The COR, and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor's performance. At these meetings the CO will apprise the contractor of how the Government views the contractor's performance and the contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the Government.

11.7 Knowledge Transfer Plan:

Whenever there is a transition in support personnel, the current contractor shall be required to transition specific systems knowledge to the replacing labor resources. This transition period will be no longer than 90 days from the end of the current period of performance. Actual transition time will be determined by DFAS. Typically, the time will be less than sixty (60) days.

During the transition, it is expected that the contractor shall be onsite and shall work cooperatively with the replacement resources to transfer knowledge.

11.8 Contracting Officer Representative (COR):

The COR is the primary point of contact for the contractor. The COR shall interface with DFAS Information and Technology (IT) Point Of Contact (POC) as well as the appropriate DFAS Site Force Protection Office POC to maintain internal monthly system updating to DoD compliance. To identify Site Force Protection Officers at each DFAS location consult the Agency Force Protection ePortal Page.

https://eportal.dfas.mil/portal/server.pt/community/force_protection/656

Follow the link titled “Site Specific Force Protection/Security Services” in the Additional Points of Contact section near the top right side of the Web page.

The COR is responsible for monitoring all technical aspects of the award and assisting in contract administration. COR duties include:

· Ensure contractor performs the technical requirements of the award.

· Perform inspections necessary in connection with contract performance.

· Maintain written and oral communications with the contractor concerning technical aspects of the award.

· Monitor contractor’s performance and notifies both the CO and contractor of any deficiencies.

· Coordinate availability of Government furnished property and site entry of contractor personnel.

A letter of designation issued to the COR, a copy of which is sent to the contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting order.

11.9 Type of Contract: The award will be a Labor Hour contract type.

11.10 Identification of Contractor Employees: All contract personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. They must also ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed. Contract personnel will be issued Government Common Access Cards (CACs) identifying them as a contractor after favorable security adjudication. Contractor employees must wear CAC’s while in the facility.

11.11 Travel Policy: The Government will reimburse the contractor for allowable travel cost incurred by the contractor in performance of the contract in accordance with FAR 31.205-46. Overhead, profit and Other Direct Costs are not an allowable travel cost for this requirement. The contractor will only be reimbursed for allowable direct labor costs.

Travel must be approved by the COR prior to any travel being made. When travel is required, the contractor is responsible for making all needed arrangements for their personnel. Actual travel costs will be reimbursed IAW FAR 31.205-46.

The contractor shall provide a trip report five (5) days after each trip associated with a travel approval. The contractor shall maintain a summary of all approved travel, to include at a minimum, the name of the traveler, location of travel, duration of trip, total cost of trip. The contractor shall confirm travel requests in writing and shall provide the COR with names of travelers, expected duration of travel, travel locations, cost estimates and labor effort associated with the travel prior to travel period. No travel is expected outside the continental United States (OCONUS).

Travel, subsistence, and associated labor charges for travel time are authorized for travel beyond a 50-mile radius of the local office, whenever a task assignment requires work to be accomplished at a temporary alternate work site. No travel, subsistence, or associated labor charges for travel time shall be charged for work performed within a 50-mile radius of the Contractor’s local office, normal work site, or temporary work site unless approved in advance by the COR. Under no circumstances will costs be reimbursed for travel performed for personal convenience and daily travel to and from the normal work site, to include parking expenses. A CLIN will be used for contractor travel reimbursement.

11.12 Data Rights: This requirement is covered by the data rights clauses included in the Task Order. In the event Data or Application Code is required that was developed exclusively at private expense of the contractor DFARS Clause 252.227-7015 is applicable. In the event Data or Application Code is developed during performance of this requirement using government funds DFARS Clauses 252.227-7013, 252.227-7016, 252.227-7017, 252-227-7030, and 252-227-7037 is applicable.

11.13 Organizational Conflict of Interest: Contractor and subcontractor personnel performing work under this Task Order may receive, have access to or participate in the development of proprietary or source selection information (e.g., cost or pricing information, budget information or analyses, specifications or work statements, etc.) or perform evaluation services which may create a current or subsequent Organizational Conflict of Interests (OCI) as defined in FAR Subpart 9.5. The contractor shall notify the CO immediately whenever it becomes aware that such access or participation may result in any actual or potential OCI and shall promptly submit a plan to the CO to avoid or mitigate any such OCI. The contractor’s mitigation plan will be determined to be acceptable solely at the discretion of the CO and in the event the CO unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the CO may affect other remedies as he or she deems necessary, including prohibiting the contractor from participation in subsequent contracted requirements which may be affected by the OCI.

11.14 Weekly Status Reports: The prime contractor official representative shall submit a weekly status update to the COR, no later than the 10th day of the following month, identifying the initial and annual SPIRIT training status of all contractor personnel. This report can be integrated with the regularly scheduled weekly Status Reports and made available to the COR as a deliverable item on the contract.

11.15 Section 508 Compliance:

· Requirements for accessibility based on Section #508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d) are determined NOT to be relevant for the following program need: “NAF Configuration Management Server Migration.”

· Requirements for accessibility based on Section #508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d) do not apply based on the claim of the following exception founded in Federal Acquisition Regulation (FAR) 39.204:

· Section 508 back office exception based on CFR D1194.3 (f) “Products located in spaces frequented only by service personnel for maintenance, repair, or occasional monitoring of equipment are not required to comply with this part.” Justification for this claim is documented by the following: “NAF server and host applications reside on server hardware located in a controlled access data center. End-users have no direct access to NAF server hardware in DFAS data centers.”

11.16 Alternate Worksite Authorization:

The Contractor may be authorized to work at an alternate worksite under the subject task order, on a case by case basis, only with prior authorization from either the COR or CO. Each alternate worksite effort will be for a definitive period of time as agreed upon by both parties.

11.17 Telework – Request, Monitoring Plan and Other Requirements:

The Defense Finance and Accounting Service (DFAS) requires contractors to maintain adequate internal control over all labor timekeeping activity. Specific to telework, controls associated with telecommuting are expected to be documented and considered acceptable for government contract costing. All costs as well as the controls are subject to U.S. government audit. If the contractor does not have telecommuting written policies and procedures, or if such procedures are not considered adequate, a telework request may be denied. The written policies and procedures for a telework program should be concerned with two key areas.

Regarding the above, items recommended to be addressed are:

1. Has proper advance approval by appropriate management officials been provided for the employee(s)?

2. How is evaluation of the participating employee’s performance in completing assigned tasks addressed? Is there a standard of onsite performance that must be maintained to be eligible?

3. Is written documentation of the specific tasks to be performed, along with expected completion dates, part of the program/plan?

4. Is there a requirement that employees attend periodic meetings at the work site to allow the employee and supervisor to discuss work progress, be assign new tasks and to evaluate work performed?

5. Is there a requirement that employee’s work a mutually agreeable set of core hours to allow management to have access to the employee at designated times?

The contractor should provide within any request for teleworking the following details:

1. Positions for telework

2. Location of telework

3. Justification, which should include benefits achieved in support of this contract and cost reduction resulting from telework

4. Repercussion of not receiving telework approval

5. Financial benefits to the Government for allowance of telework

6. A plan for monitoring telework

Note: The government may not consider allowing telework for every contract. The government may deem having employees working at home to not be practical, efficient or effective if the work:

Regarding timekeeping, telecommuting employees should be required to submit time cards (either hard copy or electronic) in accordance with the company-wide timekeeping system guidance, and processes. Copies of the time cards should be kept at the company facility and are subject to Government audit. If an auditor finds inadequacies during an audit, the contractor may be cited for a labor accounting system deficiency and telework authorization may be rescinded.

12.0 GOVERNMENT FURNISHED PROPERTY:

Government Furnished Property, Equipment, or Information (GFP, GFE, and GFI): All facilities and services (i.e. computer products-PCs, printers, telephones, software and Government provided developmental platforms) will be furnished by DFAS for use within the DFAS Center. The DFAS site location will furnish office space, desks, chairs, and supplies for Contractor personnel working on this task order. The office space, supplies and equipment will be of the type ordinarily found at the DFAS site. The furnishings will be of the type used by personnel at in the DFAS site.

All computer software required to complete the tasks will be made available to the Contractor. Desktop Management Initiative (DMI) is the DFAS Standard for software/hardware. All computers connected at DFAS sites must be configured under DMI. Vendor’s employees will be provided standard issue DMI laptop. For Contractor personnel working at alternate locations agreed upon by DFAS and the Contractor, logon ID’s will be provided to access to the required platforms. The Contractor shall provide the access network connection via the Pulse Secure for any personnel not working at the physical DFAS site.

Government Furnished Property is subject to the following clauses which have been included in this RFQ by full text.

The awardee of this contract must have an acceptable Property Management System, per DFARS 252.245-7003 and 52.245-1(f) in place in order to be able to receive GFP. The Contractor will provide sufficient information as part of their offer in order for the CO to determine the Contractor’s Property Management System is acceptable. Reporting requirements are defined in the provisions/clauses above.

GFP on this contract will be in the form of DFAS formatted laptop in which the contractor will need to remove the laptop from a Government Controlled Facility in order to perform the tasks that are required on the contract at an alternate location.

Receipt and return of GFP will be created and tracked through the GFP Tool.

13.0 SECURITY REQUIREMENTS.

Personnel Security Investigation (PSI) Requirements. Contractor personnel working on this contract will require a favorably adjudicated Tier 3, or equivalent Noncritical Sensitive (formerly IT-II) level or higher investigation. No access to classified information is required. IAW standard DFAS Personnel Security policy, ALL incoming contractors, regardless of whether they possess a favorably adjudicated Noncritical Sensitive (formerly IT-II) or higher investigation, must submit a Declaration for Federal Employment (OF-306), and a new set of fingerprints* to the COR, who will submit these forms with a Contractor Request for Investigation (CRI) (DFAS Form 9035) to DFAS Personnel Security. DFAS Personnel Security will review all submitted documentation to validate whether contractor personnel meet personnel security requirements to perform work on the contract or if a new background investigation is required.

*New fingerprints are not required if any of the following apply:

1. The person has been fingerprinted for the Office of Personnel Management (OPM) within the past 30 days;

2. The person is currently undergoing a background investigation, or reinvestigation, by OPM or any other Federal agency;

3. The person has a background investigation currently being adjudicated by the Department of Defense Consolidated Adjudications Facility (DoD-CAF) or another CAF;

4. The person has been favorably adjudicated within the past 30 days by the DoD CAF or a CAF from any other Federal agency; or

5. The person is coming directly from another DOD agency, with no break in service. This includes any of the military branches as well as the U.S. Coast Guard; however, service members in an inactive reserve status are not included.

6. The Personnel Security Office otherwise determines that no new fingerprints are required.

Security Requirements. Contractor personnel shall follow the security and training requirements in DFAS 2000.1-I, “Force Protection Mission,” DoDM 5200.01, Volumes 1-3, “DoD Information Security Program,” DoDI, 5200.48, “Controlled Unclassified Information,” DFAS 5200.1-I, “Information Security Program,” DFAS 5200.8-I, “Physical Security Program,” and DFAS 5200.10-I, “Counter Insider Threat Program.” Contractor personnel shall follow all host security requirements in accordance with Part 117 of Title 32, Code of Federal Regulations; paragraph 117.16. The contractor shall immediately report any occurrences of violation of stated regulations to the Contracting Officer (CO), Contracting Officer Representative (COR) and the Personnel Security Office.

DFAS Personnel Security Incident Reporting Requirements, the National Industrial Security Program and Due Process as it Relates to DFAS Contractor Personnel. The National Industrial Security Program (NISP) is a partnership between the federal government and private industry to safeguard classified information and Controlled Unclassified Information (CUI).

Executive Order 12829, as amended, “National Industrial Security Program, “further amended by Section# 6 of E.O. 13691, was established to achieve cost savings and to ensure that industry safeguards the classified information with which it is entrusted while performing work on contracts, programs, bids, or research and development efforts while working for United States Government.

It is important to note that personnel employed as contractors for DFAS are not covered under the National Industrial Security Program (NISP) and are exempt from the provisions of 5 C.F.R. 731. This means that DFAS contractor personnel involved in an incident that potentially violates one or more of the National Security Adjudicative Guidelines found at https://www.dni.gov/files/NCSC/documents/Regulations/SEAD-4-Adjudicative-Guidelines-U.pdf , are not entitled to Due Process rights normally afforded to federal civilian employees and those personnel covered under NISP; more specifically, Personnel Security may suspend or revoke their access to DFAS IT systems, sensitive information and/or DFAS facilities.

Incident Reporting Requirements.

Whenever a DFAS contractor displays conduct, or is involved in any incident, which is in violation of any of the thirteen National Security Adjudicative Guidelines*, a report shall be made immediately following the incident, or as soon as practicable thereafter, to their DFAS civilian supervisor and the supervisor, if there is one, of the area to which they are assigned, the COR, and in all cases, the Personnel Security Office. Reporting to Personnel Security may be made by phone to (317) 212-7888, by email to dfas.indianapolis-in.zh.mbx.dfas-inhrsecurity@mail.mil, or, in the case of personnel physically located at DFAS Indianapolis Center, in person to the Personnel Security Office located on the third floor center hallway at Column 320T.

All incidents will be investigated by Personnel Security and, depending on the date of the subject’s most recent investigation, may need to have an updated background investigation initiated. Those that do not require a new investigation will have all relevant information regarding the incident forwarded to the Department of Defense, Consolidated Adjudications Facility (DoD-CAF) for review and re-adjudication.

*The thirteen National Security Adjudicative Guidelines are:

Some Examples of Incidents That Require Reporting to Personnel Security:

a. An arrest for any criminal offense, not including minor traffic violations, by any law enforcement agency. This does include the traffic offenses of Driving Under the Influence of Alcohol or Drugs, and Reckless Driving;

b. Violation of any court order;

c. Delinquencies on any debt for 180 days or longer;

d. Federal, State or Local tax issues or delinquencies;*

e. Delinquencies on any Federal debt;*

f. Child Support delinquencies;

g. Filing for Chapter 7 or Chapter 13 bankruptcy in any Federal Bankruptcy Court;

h. Civil judgements;

i. Having a close personal friendship with a Foreign National (person from a foreign country) with regularly occurring contact;

j. Being approached by a person know to be, or suspected to be, working as an agent of a foreign government or terrorist organization, or any other person, who seeks any information about DFAS, the Department of Defense, or the U.S. Government, especially if the person offers money or something of value to the contractor employee; and

k. Ownership of property or financial accounts in a foreign country.

It should be noted that persons delinquent on Federal debt of any kind may not obtain or maintain favorable personnel security adjudication be considered for a contractor position with DFAS unless they can provide documentary proof that a payment plan has been established with the government agency to whom the debt is owed, and that regularly recurring payments are being made. Contractor personnel who cannot obtain and maintain a favorable personnel security adjudication may not have access to the government data, facility, and equipment required under the contract.

NOTE: This list does not cover every potential incident or offense; any incident in which a contractor is involved and a question exists as to whether it should be reported, should report the incident to Personnel Security, who will then determine if further action is warranted. Failure to report an incident is, in and of itself, an incident involving personal conduct, and may, in some cases, be more serious than the original incident.

Foreign Travel by DFAS Contractor Personnel:

Official and Unofficial (Personal) Travel: Official U.S. Government Business: persons employed as contractor employees with DFAS, to include those with Noncritical Sensitive (formerly IT-II) access, Critical Sensitive (formerly IT-I) access, access to critical program information (related to Research, Development, Test, and Evaluation), sensitive compartmented information, and/or special access program information, in accordance with DoD Directive 5240.06, are required to complete a DFAS Form 9133, Notification of OCONUS Travel, not less than fourteen (14) calendar days prior to the scheduled travel. One copy shall be sent the DFAS Personnel Security group box at dfas.indianapolis-in.zh.mbx.dfas-inhrsecurity@mail.mil and one copy shall be turned into the Site Security/Force Protection Office of the DFAS site where they are stationed.

Upon receipt of the completed Form 9133, the Site Security/Force Protection Office will contact the contractor employee and schedule a Foreign Travel briefing. Immediately prior to travel, contractor employees will check with the State Department at https://travel.state.gov/content/travel/en/traveladvisories/traveladvisories.html.html for any travel advisories for the country or region being traveled to and take the appropriate steps to ensure their safety for any location covered by a travel advisory or warning.

Security Education and Training: Contractor personnel shall receive initial, continuous and refresher security education training in accordance with DFAS 2000.1-I, DoDM 5200.01, Volume 3, “DoD Information Security Program – Protection of Classified Information,” DoDI 5200.48, and DFAS 5200.1-I. Contractor personnel shall also complete all required contractor training requirements identified in this Statement of Work/Performance Work Statement.

Access To, Accountability For, and Safeguarding of Controlled Unclassified Information (CUI): The DFAS manager of the requiring office will determine what CUI contractor personnel are given access to. CUI may not be disclosed to contractor personnel unless required for contract performance. Contractor personnel shall safeguard CUI in accordance with DoDI 5200.48 and DFAS 5200.1-I. The sponsoring DFAS activity will provide storage capability for all CUI required for contract performance.

Installation Entry and Common Access Card (CAC) Requirements.

The Contractor shall comply with established security procedures for entering government installations and facilities. Contractor employees shall be required to obtain and wear identification (ID) badges that will permit access into the facility.

All contractors who require unescorted access to DFAS facilities will be required to obtain a DoD CAC. Contractor shall work with the assigned DFAS Contracting Officer Representative (COR)/Trusted Agent (TA) to obtain a CAC using the Trusted Associate Sponsorship System (TASS). Under no circumstances will a CAC be issued to any person unless that person has been cleared by the DFAS Personnel Security Office to work on the contract.

All CACs and badges issued to Contractor personnel are Government property and must be returned to the assigned DFAS COR/TA upon departure from the program or at the conclusion of the contract, whichever comes first. Contractors whose CAC is lost or stolen must report the loss as soon as possible to the assigned DFAS COR/TA and present documentation that the CAC is missing and describing the circumstances under which the loss occurred. The assigned DFAS COR/TA will follow agency CAC procedures in order to issue a new CAC.

The CAC contains personally identifiable information (PII) and must be treated as a controlled item. Contractors’ must not share their CACs and passwords with any other staff members. The assigned DFAS COR/TA will report any violation or suspected violation to the Contracting Officer and DFAS Trusted Agent Security Manager (TASM). Any violators will be temporarily or permanently removed from the project. If a Contractor has a CAC issued from a previous engagement with another agency that CAC must be returned to that agency before issuance of a new CAC.

Training:

DoD Mandatory Contractor Personnel Requirements: The contractor shall direct that its employees performing under this contract complete the annual mandatory training in accordance with the DoD mandate identified for each training module.

Contractor personnel working at a DFAS site who require a Common Access Card (CAC), or contractor personnel working remote via VPN, need to complete the following training modules within 30 days after receipt of CAC, (note for Cyber Awareness Challenge Module 003, completion of this module is required prior to requesting a new DFAS network or VPN account), as a precondition for continued attendance and/or network access.

In addition, these modules shall be completed annually to retain accessibility. Noncompliance will negatively impact contract performance and lead to the loss of CAC and/or network access for contractor personnel.

Continuity of Operations and Crisis Management Organization: Contractor personnel will take the training through the DFAS Portal upon receipt of Network access.

Cyber Awareness Challenge: Completion of this module is required prior to requesting a new DFAS network…