HSTS03-09-R-SEC070 Adjudicator-FINAL.pdf

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 29

1. REQUISITION NO.

2109209SEC070

2. CONTRACT NO.

3. AWARD/EFFECTIVE DATE

See Block 31c

4. ORDER NO.

5. SOLICITATION NO.

HSTS03-09-R-SEC070

6. SOLICITATION ISSUE

DATE

08/12/2009

7. FOR SOLICITATION

INFORMATION CALL

a. NAME

Ali Etedali

b. TELEPHONE NO. (No collect calls)

571-227-2516

8. OFFER DUE DATE/LOCAL

TIME

9:00 a.m.EST

08/26/2009

9. ISSUED BY

CODE

10. THIS ACQUISITION IS 11. DELIVERY FOR FOB 12. DISCOUNT TERMS

U.S. DEPARTMENT OF HOMELAND SECURITY

TRANSPORTATION SECURITY ADMINISTRATION

701 SOUTH 12

TH

STREET (WEST TOWER)

UNRESTRICTED

SET ASIDE: 100% FOR

SMALL BUSINESS

DESTINATION UNLESS

BLOCK IS MARKED

SEE SCHEDULE

NA

ARLINGTON, VA 22202

SMALL DISADV.

BUSINESS

13a. THIS CONTRACT IS A RATED ORDER

UNDER DPAS (15 CFR 700)

POC: Ali Etedali

PHONE: 571-227-2516FAX: 571-227-2913

8(A) 13b. RATING mailto:EMAIL: Ali.Etedali@DHS.GOV SIC 561611 SIZE STD: $12.5 m 14. METHOD OF SOLICITATION

RFQ IFB RFP

15. DELIVER TO CODE

16. ADMINISTERED BY CODE

See Attachment Same as Block 9

17a. CONTRACTOR/ CODE

OFFEROR

FACILITY

CODE 18a. PAYMENT WILL BE MADE BY CODE

United States Coast Guard Finance Center TSA Commercial Invoices P.O. Box 4111 Chesapeake, VA 23327-411 FIN-SMB-TSAINVOICES@uscg.mil

(757) 523-6940 / Customer Service Number

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS

IN OFFER

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS

BLOCK BELOW IS CHECKED SEE ADDENDUM

19.

ITEM NO.

20.

SCHEDULE OF SUPPLIES/SERVICES

21.

QUANTITY

22.

UNIT

23.

UNIT PRICE

24.

AMOUNT

See Attachments

(Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA

26. TOTAL AWARD AMOUNT (For Govt. Use Only)

27. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN 1 COPY TO ISSUING OFFICE.

CONTRACTOR AGREES TO FURNISH AND DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED HEREIN.

28. AWARD OF CONTRACT: REFERENCE OFFER DATED

_________________. YOUR OFFER ON SOLICITATION (BLOCK

5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE SET

FORTH HEREIN, IS ACCEPTED AS TO ITEMS:

29a. SIGNATURE OF OFFEROR/CONTRACTOR 30a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

29b. NAME AND TITLE OF SIGNER (TYPE OR PRINT)

30c. DATE SIGNED

30b. NAME OF CONTRACTING OFFICER (TYPE OR

PRINT)

Carl J. DeBernard, Jr.

CONTRACTING OFFICER

30c. DATE SIGNED

31a. QUANTITY IN COLUMN 21 HAS BEEN

ACCEPTED, AND CONFORMS TO THE

32. SHIP NUMBER

33. VOUCHER NUMBER

34. AMOUNT

VERIFIED

CORRECT FOR

RECEIVED INSPECTED CONTRACT, EXCEPT AS NOTED PARTIAL

FINAL

35. PAYMENT 36. CHECK NUMBER

31b. SIGNATURE OF AUTHORIZED GOVT REPRESENTATIVE 31c. DATE COMPLETE PARTIAL

FINAL

37. S/R ACCOUNT NO.

38. S/R VOUCHER NO.

39. PAID BY

41a. RECEIVED BY (Print)

40a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

40b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 40c. DATE 41b. RECEIVED AT (Location) mailto:

mailto:FIN-SMB-TSAINVOICES@uscg.mil

RFP HSTS03-09-R-SEC070

SECTION B – SUPPLIES/SERVICES & PRICE/COSTS

B.1 SCHEDULE OF SUPPLIES OR SERVICES AND PRICES/COSTS

The contractor shall provide all management, supervision, labor, and materials necessary to perform the Personnel Suitability & Security Adjudication Program services. Program support shall be provided as is appropriate with the proper CLIN.

CLIN ITEM/DESCRIPTION UNIT UNIT

PRICE

Evaluation Quantity Only *

TOTAL

EVALUATED

PRICE

Base Period (12 Months) Sept.

14, 2009 through Sept. 13, 2010

0001 Pre-Hire Adjudication Cases

Per Case

10,000**

0002 SSBI/SSBI-PR

Adjudication Cases

400**

0003 All Other Adjudication Cases (MBIs, NACIs, ANACIs, et al.)

5,000**

0004 Security Analysts Labor Hour

28,800

(15 FTE)

0005 OPTION Security Analysts

Labor

19,200

(10FTE)

1st Option Period (12 Months) Sept. 14, 2010 through Sept. 13, 1001 Pre-Hire Adjudication

7,000

1002 SSBI/SSBI-PR

1003 Adjudication Cases (MBIs, NACIs, ANACIs, et al.)

2,500

1004 Security Analysts Labor

(15FTE)

1005 OPTION Security Analysts

2nd Option Period (12 Months) Sept. 14, 2011 through Sept. 15, 2001 Pre-Hire Adjudication

Per Case

7,000

2002 SSBI/SSBI-PR

2003 Adjudication Cases (MBIs, NACIs, ANACIs, et al.)

2,500

2004 Security Analysts Labor

(15 FTE)

2005 OPTION Security Analysts

* The Evaluation Quantities in the table above shall be used for evaluation purposes only. Any resultant contract shall have a maximum of 39,700 cases for the entire period of performance to include all options if exercised*

** The 5,000 backlogged cases that are required to be completed in the base year of the contract are a mix of the the Pre-Hire, SSBI/SSBI-PR and MBIs. The Evaluation Quantities represented are not inclusive of the 5,000 backlogged cases.**

B.2 Contract Pricing

B.2.1 Firm-Fixed Unit Price Rates

Pricing is in accordance with the pricing set forth in Section B.1, Schedule of Supplies or Services and Prices. The unit prices are firm-fixed price. The rates for Adjudication of Case must contain the complete burdened cost (including all labor/materials etc).

B.2.2 Initial Staffing

Fifteen (15) Security Analysts are required at contract award with an additional ten (10) being required at a date to be determined by the TSA Personnel Security Division.

(end)

SECTION C – DESCRIPTION/WORK SPECIFICATION

PERSONNEL SUITABILITY & SECURITY ADJUDICATION SUPPORT

SECTION C. 1.

OVERVIEW

The Transportation Security Administration (TSA) is responsible for protecting the nation‘s transportation systems to ensure freedom of movement of people and commerce. This responsibility includes adjudicating investigations of individuals who have access to, or duties involving, transportation systems that are vulnerable to terrorist attacks. To support this endeavor, TSA adjudicates for both suitability and security investigations of all TSA federal applicants and contractor employees. These investigations ensure that individuals who work for or have access to TSA meet TSA‘s suitability and security standards.

SECTION C. 2. INFORMATION

Contract requirements and contractor performance are subject to evaluation and monitoring for performance and compliance to stated requirements.

SECTION C. 3. PURPOSE

A. SERVICE AND OUTCOME NEEDED

TSA requires assistance in implementing their personnel suitability and security investigation program by performing assigned tasks within the process. The personnel suitability and investigation program is a process for assuring that the employment and continued employment of all TSA persons in the Federal service and contracted personnel are subject to pre-investigative review and referral for suitability adjudication.

B. SCOPE

1. The Department of Homeland Security, Transportation Security Administration, is delegated by law, rules and regulations to establish and carry out a program for investigating and adjudicating the suitability of applicants for, and appointees to, the TSA and contractor employees who are proposed to work on a TSA contract. The Personnel Security Division (PERSEC Division) within the Chief Security Office, TSA, adjudicates for both suitability and security investigations of all TSA federal applicants and contractor employees in order to identify and avoid hiring individuals who may pose a threat to the transportation system or are not suitable for employment to positions of the public‘s trust.

2. PERSEC Division requires contracted support for its personnel suitability and security investigation program. The contractor shall accurately assist the TSA in the adjudicating process of approximately 10,000 MBI‘s approximately 24,000 or more Pre-hire reviews, approximately 700 SSBI/SSBI-PR and must be responsive to manage expedited requests, and reduce the current backlog of approximately 5,000 cases within 12 months after contract award or the start of the base period of performance. The case load is not to exceed 39,700 cases

3. The TSA personnel suitability program is managed and implemented in accordance with all the referenced laws, regulations and OPM guidelines identified in paragraph C.5., Applicable References.

SECTION C. 4. TECHNICAL REQUIREMENTS/TASKS/OUTCOMES

A. REQUIREMENTS/TASKS

1. The contractor is required, in accordance with law, OPM rules, and regulations (paragraph C.5., Applicable References), to establish and carry out specific tasks for investigating and adjudicating the suitability of applicants for, and appointees to, the TSA and contractor employees who are proposed to work on a TSA contract. The contractor shall perform adjudication processes as set forth within this Statement of Work (SOW) for all background investigations. The contractor shall process for PERSEC Division applicant pre-hire EOD suitability cases and final suitability and security cases for all current and prospective employees of the TSA and its contractors.

2. The results of contractor work performed will be documented in written reports and provided to the PERSEC Division. The contractor reports will include accurate research, information and a recommendation of individual suitability, unsuitability or suitability referral with supporting data and rationale in enough detail that the PERSEC Division can make the correct suitability decision.

B. MANAGEMENT OF CONTRACTOR’S WORKFORCE

1. A case is complete at the time it is referred to the Federal Team Lead with an eligible/ineligible suitability or favorable/unfavorable security clearance recommendation. The recommendation shall be made in accordance with published suitability and/or security standards, all issues having been accurately identified, addressed and mitigated (where appropriate) and the adjudicative summary and recommendation having been written in a clear, organized, concise and objective matter.

2. Contractor‘s management will be structured to allow effective and efficient implementation of personnel suitability determinations, investigations and workflow of requested products/services.

Contractor‘s organizational structure must be adaptable to TSA PERSEC business operations or mirror TSA business operations in order to effectively and transparently manage required workflow.

3. Contractor‘s management shall be responsible for, but not limited to reconciliation of the contractor staff‘s weekly timesheets and complete cases; the contractor shall submit the timesheets and the completed cases documentation with monthly invoice to the COTR for purposes of supporting acceptable contract performance and entitlement to payment.

4. The contractor‘s Managing Adjudicator shall be the contractor‘s most senior project manager and/or supervisor responsible for all administrative, performance, and/or personnel issues that can jeopardize acceptable performance on the Contract and must be qualified to perform adjudications if needed.

C. CONTRACTOR’S STAFFING REQUIREMENTS

1. Contractor‘s ability to obtain sufficient and qualified staff can impact successful contract performance.

Obtaining and maintaining qualified personnel in a timely manner is critical to successful accomplishment of this contract.

2. Contractor will hire and manage qualified adjudicators and security analysts to perform tasks relating to personnel suitability and security investigations as required by the TSA in accordance with contractor recruitment and retention policies and plans. Contractor will hire and staff adequate personnel to process the case/volume workload as required and specified in Section B.

3. The contractor shall ensure that each contract employee meets the following criteria:

a. Contract employees must be US Citizens. Permanent Residents are not authorized to work on this contract. In accordance with DHS MD 11055, ―Suitability Screening Requirements for Contractors‖, paragraph 4.E.1, Only US Citizens can access TSA‘s Information Technology (IT)

Systems or documents containing Sensitive Security Information (SSI). Contract employees must undergo an EOD suitability determination. Contract employees must be eligible or have been the subject of a favorably adjudicated SSBI within the last five years

i. The following BI security paperwork must be completed by the contract employee and submitted prior to employment under this contract.

Standard Form (SF) 85P/SF 86.

TSA Form 2811, Fair Credit Reporting Act Authorization

TSA Form 2812, Authorization of Release of Information

4. The contractor will use qualified adjudicators to perform the following tasks in accordance with the referenced laws, rules, regulations, policies and procedures:

a. The Contractor‘s Adjudicators shall review and evaluate reports of investigation which may include, but not limited to the following:

National Agency Checks with Inquiries (NACIs), Access National Agency Checks with Inquiries (ANACIs), Limited Background Investigations (LBIs), Minimum Background Investigation (MBIs), Single Scope Background Investigations (SSBIs); and

Other investigative documentation such as personnel security forms, criminal investigations and records, and financial information for pre-employment applications.

b. The Adjudicators shall prepare adjudicative analytical summaries recommending courses of action and providing fact-based rationale with supporting documents and justification (legal, policy, financial, and security policies) for the recommended course(s) of action.

c. The Adjudicators shall manage and prepare for TSA PERSEC Federal Team Leads and/or Program Managers‘ signature all outgoing requests for additional information and Letters of Interrogatory (LOIs) from applicants, employees and other sources as necessary to resolve issues.

d. The Adjudicators shall manage caseload with appropriate follow-up based on timelines mandated by PERSEC Federal Team Leads and/or Program Managers.

e. Adjudicators shall be responsible for performing other tasks that align with processing, maintaining and supporting the personnel suitability and security investigation process.

f. The Adjudicators shall review appeals and reconsideration requests and prepare a summary of recommended findings. Unless otherwise specified, as a minimum, each adjudicator will prepare a file that includes the subject‘s BI, all relevant documents, and the summary. The summary shall include a brief history (e.g., the action taken and basis for the action, and the subject‘s reason or basis for appealing or requesting a reconsideration of the action), any relevant laws, regulations or policies, and recommendation (e.g., to grant or deny the appeal or request). Each case must be reviewed by Federal Team Lead or Program Manager to ensure data is correctly entered into the database.

g. Adjudicators may be required to prepare for and testify at official court hearings or respond to official inquiries.

5. The contractor will use qualified security analysts to perform the following tasks in accordance with the referenced laws, rules, regulations, policies and procedures:

a. Security Analysts under this contract shall perform a wide variety of administrative tasks associated with personnel security investigations to include, but not limited to, reviewing SF-85Ps and/or SF-86s (questionnaires for public trust and national security positions) and other BI documentation, collecting and arranging BI documentation but not limited to analysis of data prior to entering into the personnel security data base.

b. Security Analysts shall contact applicants or TSA federal and/or contractor employees to assist with corrective action concerning completion/submission of documents.

c. Security Analysts shall assist TSA employees with e-QIP submissions, perform applicable entries in PERSEC‘s database, review re-hire applications; process Congressional inquiries, and perform other clerical and/or general administrative tasks as required.

d. Security Analysts shall track documents to ensure accurate processing, review OPM PIPS documents, access OPM Portal for form review processing, and run management reports from data as requested.

e. Security Analysts shall mail documents and perform basic customer service administrative functions, answer telephones, access Unit‘s e-mail/e-fax accounts. They shall be responsible for customer service, interaction with internal and external customers, using the data as the tool and review hardcopy documents for accuracy and correctness.

f. Security Analysts shall be responsible for conducting research, which includes identifying files, records, or forms that will be needed by PERSEC staff; identifying and flagging missing information in forms or records; identifying and resolving problems involving files, forms, records, database and other resources; preparing and proof-reading correspondence; and identifying and attaching or enclosing correspondence.

g. Security Analysts shall be responsible for performing other tasks that align with processing, maintaining and supporting the personnel suitability and security investigation process.

h. Security Analysts shall be responsible for performing tasks in the Scanning and Data Entry Unit which includes quality checks of scanned data, data entry, and processing of all new paperwork.

i. Security Analysts may perform other administrative and/or clerical tasks as determined by TSA.

Security Analysts may be required to prepare for and testify at official court hearings or respond to official inquiries.

6. The following general qualifications are mandatory for all staffing:

a. All persons must be efficient in entering data and maintaining records in the order specified (e.g.

alphabetical, chronological, or numerical).

b. All persons must be U.S. Citizens.

c. 100% of contract employees must be able to professionally communicate and read/write English without difficulty.

d. All contract employees assigned to work with the Transportation Security Administration under this contract will be required to undergo the EOD suitability determination process prior to beginning work and must receive a favorable adjudication to work at TSA.

7. The following specific qualifications are mandatory and are the minimum acceptable staffing requirements for each position:

The Contractor shall provide a Managing Adjudicator possessing the following minimum mandatory requirements unless otherwise stated:

a. This position requires no less than two (2) years managing and supervising Adjudicators and Security Analysts incorporating the various BI categories; and

b. Must have no less than two (2) years, senior-level adjudication (suitability & security) experience which includes, but not limited to, NACI, ANACI, MBI, LBI, and SSBI. The Managing Adjudicator‘s adjudication experience must be within the last year. Experience as an investigator may not be substituted nor combined for adjudication experience.

c. Must have successfully completed and received a certificate, which must be provided as an attachment to Technical Proposal, in Management of the Personnel Security Program Course, Basic Suitability Adjudication Course and the Advanced Suitability Course. Courses and/or certificates must be from an accredited institution and/or training organization recognized by the Federal Government. Courses and/or Certification will not be paid (i.e., an unallowable expense) for by TSA, and shall not be acquired post-contract award.

d. Knowledge and implementation of regulations and professional standards for adjudicating BI‘s to include, but not limited to, Adjudicative Guidelines as set forth by the White House Memorandum for William Leonard, Subject: Adjudicative Guidelines, dated December 29, 2005 which includes the revised Adjudicative Guidelines for Determining Eligibility for Access to Classified information;

Executive Order 12968; 5CFR 731.202(b) (Suitability Factors); and 5CFR 737.202(c) (Additional Considerations).

e. Knowledge of procedures for maintaining BI‘s, correspondence, reports, and databases in accordance with the Privacy Act.

8. The Contractor shall provide Adjudicators who possess the following minimum mandatory requirement unless otherwise stated:

a. This position requires no less than two (2) years experience in adjudicating suitability and security BI‘s. Experience as an investigator may not be substituted nor combined for adjudication experience. Resumes and certificates must be provided with completed forms during EOD suitability determination.

b. Must have successfully completed and received certificates (certificates must be provided at EOD suitability vetting) in Basic Suitability Adjudication Course and the Advanced Suitability Adjudication Course. Courses and/or certificates must be from an accredited institution and/or training organization recognized by the Federal Government. Courses and/or Certification will not be paid for by TSA.

c. Knowledge and implementation of regulations and professional standards for adjudicating and BI‘s to include, but not limited to, Adjudicative Guidelines as set forth by the White House Memorandum for William Leonard, Subject: Adjudicative Guidelines, dated December 29, 2005 which includes the revised Adjudicative Guidelines for Determining Eligibility for Access to Classified information; Executive Order 12968; 5CFR 731.202(b) (Suitability Factors); and 5CFR 737.202(c) (Additional Considerations).

9. The Contractor shall provide Security Analysts who possess the following minimum mandatory requirement unless otherwise stated:

a. This position requires no less than one (1) year experience providing customer service in a federal government security office environment. Resume must be provided at EOD suitability vetting.

b. Must also possess 1.5 years experience reviewing security clearance forms, using Microsoft Word, updating databases, conducting telephonic inquires and preparing correspondence to obtain information needed to process security forms or adjudicate cases, verifying entries in databases.

c. Six (6) months of experience with e-QIP.

d. Must be able to work with little supervision.

D. STAFFING LEVELS AND REQUIREMENTS

1. Staffing - The contractor shall schedule their staff to provide support for the tasks performed within the scope of this contract. For contractor awareness and coordination with Government staff TSA core hours are 0900 through 1500 Monday through Friday.

2. PERSEC is organized in units. Currently there are five units that must be independently supported by adjudicators and security analysts. They are as follows:

a. Central/East/West (is one unit)

b. Internal Review (is one unit)

c. Pre-hire (is one unit)

d. Contractors (is one unit)

e. HQS (is one unit)

f. All other units require only Security Analysts support.

E. DELIVERABLES

The following deliverables shall be provided to the COTR under this contract:

1. The Program Management Plan shall describe the Contractor‘s organization, program planning and scheduling tools and techniques, program tracking and control methods and resource management. The plan shall conform to those instructions in Data Item Description (DID) PMP 0001 and Contract Requirement Data List (CDRL) A001.

2. The contractor shall ensure the quality, timeliness, and efficiency of the work performed on this contract. The contractor shall clearly describe its proposed Quality Control plan. At a minimum, the contractor‘s Quality Control Plan shall include:

a. Methods for maintaining an accurate electronic log of the cases reviewed by the Managing Adjudicator for quality control purposes and the quality of the cases reviewed;

b. Ensuring that all personnel possess the required certifications as stated within the SOW;

c. Methods for monitoring, conformance of the work provided to the outlined requirements.

d. Methods for verifying that invoices are correct and are for tasks that have not been previously invoiced.

e. Methods for documenting case file review findings, areas for improvement and corrective actions.

f. Methods for managing and measuring satisfactory performance of security analysts

g. Prepared in accordance with DID PM0002 and CDRL A002.

3. The contractor‘s Managing Adjudicator shall perform the first quality review of each contract Adjudicator‘s work beginning the second (2nd week from the date the contract performance period began.

The contractor‘s Managing Adjudicator shall submit a report of his/her case file review findings to the Adjudicator‘s Federal Team Lead and to the COTR.

Reference Report Due Date Report goes to:

C.4.E.1 Program Management Plan 5 day after contract performance period begins.

Monthly, thereafter. Not later than 5 th day of next month.

Federal Team Lead and COTR with a Letter to the Contracting Office

C.4.E.2 – E.7

Quality Review (Adjudicators)

2nd week after contract performance period begins

Federal Team Lead and COTR with a Letter to the Contracting Office

C.4.E.2. Quality Review (Security Analysts) th week after contract performance period begins Federal Team Lead and COTR with a Letter to the Contracting Office

C.4.E.4 Review of Completed Work (Adjudicators)

1 completed closed case per Adjudicator per week

Federal Team Lead and COTR with a Letter to the Contracting Office

C.4.E.9 Contract Review & Performance Checklist (Monthly)

Monthly - Not later than 5 th day of next month. Invoices will not be approved and processed unless Monthly Performance Report covering the invoiced period is included as an attachment.

COTR with a Letter to the Contracting Office

C.4.E.8. Strength Report First report due after the first work day upon award of the contract. Afterwards it is due only upon changes to the labor pool.

COTR with a Letter to the Contracting Office

4. The Managing Adjudicator shall review no less than one (1) completed closed case per contract Adjudicator per week; all case file reviews will be provided to the Federal Team Leads.

5. The case file review shall consist of, but not limited to, looking at the entire case file to include the following:

a. all BI data,

b. all correspondence with the subject of the investigation and/or other sources, and

c. the Adjudicator‘s summary.

6. The contractor‘s quality review shall focus on whether the initial determination was in accordance with TSA‘s suitability and/or security standards (see paragraph C.5., Applicable References) such as Letters of Interrogatory, whether all issues were accurately identified, addressed and mitigated (where appropriate), and whether the adjudicative summary and recommendation are written in a clear, organized, concise, and objective manner without errors (e.g., typographical, grammatical, or logic.)

7. The contractor‘s performance will be measured and documented in accordance with the PERSEC/COTR contract monitoring plan.

8. The Managing Adjudicator shall provide, after the first work day upon award of the contract, a strength report (i.e., meaning the number of contractor employees working on the contract) consisting of, at a minimum, the section the employee is working in (e.g. Customer Service, Western Region, etc);

the position of the employee (E.G. Adjudicator, Security Analyst); the number of vacancies per section.

After the first work day, the report only has to be submitted if there are changes to the contractor‘s staff.

The report shall be submitted to the COTR and updated as needed.

9. Contract Review and Performance Checklist will be submitted monthly with the invoice. Each PERSEC project lead that receives contractor support will also review the checklist and provide feedback/comments/ concerns relating to the Contractor‘s monthly performance. The contractor will be informed of all COTR/PERSEC feedback on performance through a report or at a meeting.

F. PERFORMANCE PERIOD

The period of performance on this contract is as follows:

Base Period: September 14, 2009 through September 13, 2010 Option 1 Period: September 14, 2010 through September 13, 2011 Option 2 Period: September 14, 2011 through September 13, 2012

G. LOCATION OF PERFORMANCE

1. All work provided in the performance of this contract shall be at the contractors‘ facility and within a fifty (50) mile radius of the TSA HQ located at 601 S. 12

, Street, Arlington, Virginia 20598

2. The contractor‘s location must comply with TSA IT and Physical Security standards and regulations and must be approved within 30 days of contract award. IT Security standards are located in Section C.11 of the Statement of Work.

3. The contractors‘ facility shall have at a minimum three (3) workspaces available for Federal staff.

H. TRAVEL REQUIREMENTS

TSA does not anticipate any travel or other direct costs associated with this solicitation. No travel of any kind will be authorized absent a funded travel CLIN. Under no circumstances will local travel (50-miles radius) be reimbursed.

I. SPECIAL REQUIREMENTS

Transition Out: Upon contract completion or termination, the Contractor shall assist with the transition to a new contactor within thirty (30) days of contract completion or termination date.

J. PERFORMANCE REQUIREMENTS

TSA reserves the right to have contractor personnel removed from the contract for not meeting required performance goals for each specific unit; provided such failure to meet required performance goals has been documented by the COTR in writing.

A. Eastern, Western, Central & HQ Regions.

I. SSBI‘s/SSBI-PR‘s, completed an average of five (5) cases per work day per

Adjudicator.

II. All other background investigations completed an average of seven (7) cases per work day per Adjudicator.

III. The Managing Adjudicator must provide written justification to the Federal Team lead and COTR as to why he/she could not meet the requirement.

B. Pre-Hire Team and Contractor Unit.

IV. Completed an average of 20 cases per work day per Adjudicator.

The Managing Adjudicator must provide written justification to the Federal Team lead and COTR as to why he/she could not meet the requirement.

SOW

REQUIREMENT

PERFORMANCE REQUIREMENT PERFORMANCE

STANDARD

SURVEILLANCE

METHOD

C.4.E.4. Adjudicator Performance Requirements met.

Pass/Fail Observation and/or Audit

C.4.E.2. Quality Control plan successfully implemented as stated in the approved QC plan.

Pass/Fail Observation and/or Audit

C.4.A.2. Personnel Suitability & Security Investigation packages/files/reports & recommendations, information, analysis, summary support provided to TSA personnel to make accurate decisions without delay of TSA‘s schedule.

98% Successful as determined monthly.

Exceeds Performance: 100% Successful

Random Sampling

C.4.E.6. Acceptable Quality Reviews of Personnel (Adjudicators & Security Analysts) that may include ongoing or closed effective Corrective Actions.

Pass/Fail Monthly Review

SECTION C. 5. – APPLICABLE REFERENCES

Procedures and standards for adjudicating personnel suitability to include, but not limited to:

a. 5 C.F.R., Part 731 – Personnel Suitability

b. 5 C.F.R., Part 732 – Personnel Security

c. 10 C.F.R., Part 710.8 – Criteria

d. TSA Management Directive No. 2800.71

e. Title 49 U.S.C. Section 44936 – Employment Investigations & Restrictions

f. DHS MD 11050.2 – Personnel Security & Suitability Program

g. TSA Legal Guidance on Criminal History Records Checks

h. White House Memorandum for William Leonard, dated December 29, 2005, Subject:

Adjudicative Guidelines

i. TSA HRM No. 300-13 – Interim Guidance on Diploma Mills

j. DCI Directive No. 6/4 – Personnel Security Standards and Procedures Governing Eligibility for

Access to SCI

k. EO #12968 – Access to Classified Information

SECTION C. 6. REQUIREMENTS FOR HANDLING SENSITIVE AND PRIVATE INFORMATION

A. The contractor shall comply with the Privacy Act of 1974 (the Act) and the agency rules and regulations issued under the Act in the scanning, design, development, or operation of any system of records on individuals to accomplish an agency function when the contract specifically identifies:

The systems of records; and, The design, development, or operation work that the contractor is to perform.

B. Include the Privacy Act notification in every solicitation and resulting subcontract and in every subcontract awarded without a solicitation, when the work statement in the proposed subcontract requires the redesign, development, or operation of a system of records on individuals that is subject of the Act.

C. The data processed within TSA offices is considered proprietary and/or sensitive and therefore cannot be used to solicit or benefit other work by the contractor. All personnel assigned to perform work associated with the contract shall be required to sign a non-disclosure statement or sensitive information agreement and are subject to the security requirements of TSA.

D. All records, databases and other resources received, created, used, and maintained by the contractor for this effort shall be protected as sensitive data, in accordance with Government laws, as well as, all acquisition regulations followed by TSA and shall be returned and provided to the TSA upon completion of the contract. Additionally, the contractor shall not destroy or distribute property without the express written authority and oversight of TSA. The contractor shall not retain any photographs, records, or other data created, scanned or otherwise used for this contract after the contract ends. All property, data, and Government furnished information will be returned to TSA at the end of contract performance.

SECTION C. 7. DELIVERY OF CASES TO CONTRACTOR

Upon award of the contract and after a determination has been made that the contractors‘ facility meets both the Physical Security Division requirements as well as the required IT Security requirements the Transportation Security Administration will begin delivery of the cases to the contractor via Government courier. Case will be delivered by Government courier on an as needed basis. A schedule for delivery of the cases will be given to the contractor after award.

SECTION C. 8. PROFESSIONAL RULES OF CONDUCT

A. The Contractor understands that its employees‘ conduct during the execution of this contract directly impacts the proper and effective accomplishment of the Contractor‘s official duties and responsibilities.

The Contractor shall ensure that its employees perform their duties in a professional and business-like manner throughout the workday. The Contractor shall ensure that its employees conduct themselves professionally and in accordance with the Contractor‘s directive and/or other applicable guidance while assigned to execute its contractual obligations (e.g. while attending meetings). The Contractor shall ensure that its employees in direct contact with the public (i.e., prospective employees of the TSA and/or its contractors, and members of the PERSEC Division) understand that contractor employees bear a heavy responsibility as their conduct and appearance have a significant impact on the public's trust in the Federal Service and the TSA.

B. The Contractor shall ensure that all of its employees while on-duty, conduct themselves in a manner that does not reflect adversely on the PERSEC Division or negatively impact its ability to discharge its mission, cause embarrassment to the agency, or cause the public and/or TSA to question the PERSEC Division‘s reliability, judgment or trustworthiness. The Contractor shall institute its policy/directive that addresses employee professional rules of conduct and the consequences of failure to fully comply with the provisions may result in the CO demanding corrective action and consideration

C. The Contractor shall address the PERSEC COTR and CO its policy/management directive that addresses professional rules of conduct similar in scope as the TSA‘s MD 1100.73-5, and the Standards of Ethical Conduct for Employees of the Executive Branch (5 C.F.R. Part 2635) (the “Standards”) and related conflict-of-interest statutes (18 U.S.C. §§ 201-209) and regulations. All employees that the Contractor proposes to work on this contract shall represent with their signature that they are informed of the Contractor‘s Professional Rules of Conduct or at the minimum this SOW provision and promise to abide by its intent.

SECTION C. 9. PHYSICAL SECURITY REQUIREMENTS FOR CONTRACTOR FACILITY

The minimum physical security requirements as specified by TSA Chief Security Officer (CSO), Office of Security for access accountability of personnel into the contractors‘ facility include but are not limited to:

- Employee identification- access control badges

- Visitor Management control

- High security locks where required

- Security cameras on egress/exit perimeter door(s)

- Access to LAN room controlled with multi-factor authentication

SECTION C. 10. GOVERNMENT FURNISHED EQUIPMENT

For the performance of this contract the TSA will provide computer desktops as well as VPN Client access. Contractor is required to provide all other equipment and supplies to perform the tasks identified under this contract.

SECTION C. 11. IT SECURITY REQUIREMENTS

Controls

The Contractor shall comply with Department of Homeland Security (DHS) and Transportation Security Administration (TSA) technical, management and operational security controls to ensure that the Government's security requirements are met. These controls are described in DHS MD 4300A and TSA MD 1400 series security policy documents and are based on the NIST 800-53 standards. The Authority is the Federal Information Security Management Act (FISMA) of 2002, Title III of the E-Government Act of 2002 (Pub.L. 107-347, 116 Stat. 2899).

The Contractor shall include this prospective clause in all subcontracts at any tier where the subcontractor may have access to ―sensitive information‖ as defined in this prospective clause

General Security Responsibilities for Contract Performance

The Contractor shall ensure that its employees follow all policies and procedures governing physical, environmental, and information security described in the various TSA regulations pertaining thereto, good business practices, and the specifications, directives, and manuals for conducting work to generate the products as required by this contract. Personnel will be responsible for the physical security of their area and any government furnished equipment (GFE) issued to them under the provisions of the contract.

http://en.wikipedia.org/wiki/E-Government_Act_of_2002 http://en.wikipedia.org/wiki/E-Government_Act_of_2002 http://www.gpo.gov/fdsys/pkg/PLAW-107publ347/content-detail.html http://en.wikipedia.org/wiki/United_States_Statutes_at_Large

All Contractor employees shall receive IT Security Awareness Training within 60 days of assignment to the contract. Refresher training must be completed annually thereafter. The education and training will meet standards established by the National Institute of Standards and Technology (NIST) and set forth in DHS and TSA security policy. Evidence of training provided to personnel will be available upon request of the DHS IT Security Training Office, or during DHS/TSA onsite validation visits performed on a periodic basis.

All Contractor employees that have access to the TSA network (users, managers, and operators of the TSA network) must sign TSA Form 1403, ―Computer Access Agreement.‖

Non-Disclosure Agreement (NDA)

All TSA contractors and consultants shall execute a DHS Form 11000-6, Sensitive But Unclassified Information Non-Disclosure Agreement (NDA) upon initial assignment to TSA or prior to accessing any TSA data types.

All individuals who access SSI and/or mission-critical information must sign a NDA valid for a period two years after their termination of service with TSA.

Exit Interview

Individuals terminating voluntarily from the TSA or a TSA-contractor organization must have an exit interview, a portion of which clearly identifies their post-employment responsibilities to the TSA.

Individuals terminating involuntarily (for cause) from the TSA or a TSA-contractor organization should have an exit interview, a portion of which clearly identifies their post-employment responsibilities to the

TSA

Records of exit interviews will be signed and maintained by the contractor as part of the individual employment record for a period of two years.

Notification of Personnel Changes

The Contractor shall notify the Contracting Officer's Technical Representative and the Contracting Officer via phone, or electronic transmission, no later than one work day after any permissible personnel changes occur. Written confirmation is required for phone notification. This includes, but is not limited to, name changes, resignations, terminations, and reassignments (i.e., to another contract).

The Contractor shall notify the TSA, via phone, or electronic transmission, of any change in access requirements for its employees no later than one day after any personnel changes occur. This includes name changes, resignations, terminations, and transfers to other Contractors. The Contractor shall provide the following information to TSA: full name, social security number, effective date, and reason for change. Written confirmation is required for phone notification.

Security Policy The Contractor shall ensure that its employees follow all policies and procedures governing physical, environmental, and information security described in the various TSA regulations pertaining thereto, good business practices, and the specifications, directives, and manuals for conducting work to generate the products as required by this contract. Personnel will be responsible for the physical security of their area and government furnished equipment (GFE) issued to them under the provisions of the contract.

The Contractor solution shall follow all TSA and DHS policies, procedures, guidelines, and standards including but not limited to:

· DHS MD 4300A Sensitive Systems Handbook

· TSA IT Security Policy

· DHS IT Security Architecture Guidance Volumes 1, 2 and 3

· DHS/TSA System Development Lifecycle (SDLC)

Contracting Officer‘s Technical Representative (COTR) and IT Security shall conduct reviews to ensure that the security requirements in the contract are implemented

Certification and Accreditation

Certification and Accreditation (C&A) in accordance with NIST SP 800-37 is a requirement for IT systems processing, transmitting and/or storing TSA data, including general support systems (e.g., standard TSA desktop, general network infrastructure, electronic mail, etc.), major applications and pilot systems (if connected to the operational network or processing, storing, or transmitting government data). A written authority to operate (ATO) granted by the Designated Accrediting Authority (DAA) is required prior to processing, transmitting and/or storing operational data or connecting to any TSA network. A Security Accreditation Package is required to be submitted upon award of the contract including a signed Authority To Operate Letter by the DAA.

The contractor shall support Certification and Accreditation efforts required by the FISMA of 2002. This includes remediation of vulnerabilities found in scans, audits and assessments, providing time for interviews, providing documentation, and providing configuration settings of applications and databases to assessors.

At the conclusion of each Certification and Accreditation, the system‘s Security Accreditation Package will contain the following security documentation: a Risk Assessment Report, a Security Accreditation Report, a System Security Plan (SSP), a Contingency Plan, a Contingency Plan Test Results document, FIPS 199 Security Categorization, a Privacy Impact Assessment, and E-Authentication worksheet, an Authority To Operate Letter, and a Plan of Action and Milestones. The Security Accreditation Package will be stored in the Trusted Agent FISMA Tool.

Configuration Management

Hardware or software configuration changes shall be in accordance with TSA‘s Configuration Management policy. The TSA Chief Information Security Officer (CISO)/ IT Security must be informed of and involved in all configuration changes to the TSA IT environment including systems, software, infrastructure architecture, infrastructure assets, and end user assets. The TSA IT SECURITY will approve any request for change prior to any development activity occurring for that change and will define the security requirements for the requested change.

The Contractor shall ensure all sites impacted by patching are compliant within 14 days of change approval and release.

The Contractor shall be responsible for the acquisition of commercial-off-the-shelf ( COTS) Information Assurance (IA) and IA-enabled IT products (to be used on systems entering, processing, storing, displaying, or transmitting ―sensitive information‖) to ensure that they will be limited to those products that have been evaluated and validated, as appropriate, in accordance with one of the following:

The International Common Criteria for Information Security Technology Evaluation Mutual Recognition Agreement.

The National Security Agency (NSA)/National Institute of Standards and Technology (NIST) National Information Assurance Partnership (NIAP) Evaluation and Validation Program.

The NIST FIPS validation program.

The Contractor shall adhere to DHS Security Architecture Guidance Volume 1: Network and System Infrastructure Design for Internet Protocol Version 6 (IPv6) requirements and IPV6 transition planning.

The Contractor shall establish processes and procedures for continuous monitoring of Contractor systems that contain TSA data by ensuring all such devices are monitored by, and report to, the TSA Security Operations Center (SOC).

The Contractor shall allow the security audit of contractor systems, networks, and applications that contain TSA data by installing the Enterprise Vulnerability Management System (EVMS) agent(s) provided by IT SECURITY on all devices

Audits

The Contractor shall comply with requests to be audited and provide timely responses within 3 business days to requests for data, information, and analysis from the Office of Inspector General (OIG), General Accounting Office (GAO), TSA IT SECURITY and management, as directed by the Contracting Officer.

The Contractor shall provide support during the IT SECURITY audit activities and efforts. These audit activities may include, but are not limited to the following: requests for system access for penetration testing, vulnerability scanning, incident response and forensic review.

Security Program Plan The Contractor shall provide, implement, and maintain a Security Program Plan (SPP) based on the templates provided by TSA IT Security as part of the required security compliance documentation. This plan shall describe the processes and procedures that will be followed to ensure appropriate security of IT resources that are developed, processed, or used under this contract. The security controls contained in the plan shall meet the requirements listed in the TSA, Security Policy Handbook -- Chapter 3, Section 21, Information Security Documentation and the DHS Sensitive Systems Policy and Handbook 4300A (current version).

The SPP shall be submitted within 30 days after contract award. The SPP shall be considered a living document; it will be reviewed and updated semi-annually to address new processes, procedures, technical or federally mandated security controls and other contract changes that affect the security of IT resources under contract. It shall be consistent with and further detail the approach contained in the offeror‘s proposal or quote that resulted in the award of the contract and be in compliance with the requirements stated in the security clause(s) in the contract.

Data Security The Contractor shall be responsible for the security of: i) all data that is generated by the contractor on behalf of the TSA, ii) TSA data transmitted by the contractor, and iii) TSA data otherwise stored or processed by the contractor, regardless of who owns or controls the underlying systems while that data is under the contractor‘s control. All TSA data, including but not limited to PII, sensitive security information (SSI), and sensitive but unclassified (SBU), critical infrastructure information (CII), shall be protected according to DHS and TSA security policies and mandates.

SSI and PII data shall be encrypted during storage and transmission. The following methods are acceptable for encrypting sensitive information:

1. Products Advanced Encryption Standard (AES) algorithms that have been validated under FIPS 140-2.

2. National Security Agency (NSA) Type 2 or Type 1 encryption.

3. Public Key Infrastructure (PKI) (see paragraph 5.5.2.1 of the Department of Homeland Security (DHS) IT Security Program Handbook (DHS Management Directive (MD) 4300A) for Sensitive Systems).

The contractor shall comply with the all data disposition requirements stated in the TSA Information Security Policy Handbook Chapter 3as well as TSA MD 3700.4 Handling Sensitive Personally Identifiable Information.

Interconnectivity and Remote Access

Unless otherwise directed by TSA, any storage of data must be contained within the resources allocated by the Contractor to support TSA and may not be on systems that are shared with other commercial or government clients.

The Contractor remote access connection to TSA networks shall be considered a privilege arrangement for both Contractor and the Government to conduct sanctioned TSA business. Therefore, remote access rights must be expressly granted, in writing, by the TSA IT SECURITY.

The Contractor remote access connection to TSA networks may be terminated for unauthorized use, at the sole discretion of TSA.

Communication Protocols. Communication protocols shall comply with the TSA Technical Standards

The contractor:

a) Shall not use the following unencrypted network protocols:

1) File Transfer Protocol (FTP); and

2) Telnet.

b) Shall use Secure Shell, Secure Sockets Layering, or Transport Layer Security in lieu of unencrypted network protocols; and

Shall use SSL, SSH, and TLS versions compliant with the most current version of FIPS 197 for algorithms and FIPS 140 for cryptographic modules

Expiration of Contract At the expiration of the contract, the contractor shall return all TSA information and IT resources provided to the contractor during the contract, and provide a certification that all assets containing or used to process TSA information have been sanitized or destroyed in accordance with TSA IT Security Policy Handbook.