Attachment_1_-_PWS_for_IDIQ.pdf

SOLICITATION: HTC711-14-R-D003

ATTACHMENT 1

PERFORMANCE WORK STATEMENT (PWS) FOR LOGISTICS AUTOMATIC

IDENTIFICATION TECHNOLOGY (AIT) AND IN-TRANSIT VISIBILITY (ITV)

15 October 2013

TABLE OF CONTENTS

SECTION I: OVERVIEW

1.0 OBJECTIVE

2.0 SCOPE

3.0 BACKGROUND

SECTION II: SPECIFIC TASKS (TASK AREA LIST)

4.0 GENERAL REQUIREMENTS

4.1 Task Area 1 - Contract Program Management Support

4.2 Task Area 2 - AIT/ITV Project Management Support

4.3 Task Area 3 - Functional Support

4.4 Task Area 4 - Technical Support

4.5 Task Area 5 - Evaluation and Planning

4.6 Task Area 6 - Analysis and Metrics

4.7 Task Area 7 - Other AIT/ITV Related Tasks

SECTION III: ADMINISTRATIVE DATA

5.0 DELIVERABLE SCHEDULE

6.0 INSPECTION AND ACCEPTANCE

7.0 SERVICE DELIVERY SUMMARY (SDS)

8.0 PLACE AND PERIOD OF PERFORMANCE

9.0 SECURITY

10.0 GOVERNMENT FURNISHED EQUIPMENT (GFE)

11.0 OTHER PERTINENT INFORMATION OR SPECIAL CONSIDERATIONS

12.0 TRAVEL

13.0 GLOSSARY OF TERMS

PERFORMANCE WORK STATEMENT (PWS) FOR

LOGISTICS AUTOMATIC IDENTIFICATION TECHNOLOGY (AIT) AND

IN-TRANSIT VISIBILITY (ITV)

SECTION I: OVERVIEW

1.0 OBJECTIVE

1.1 This Performance Work Statement (PWS) defines the general tasks to be performed under the USTRANSCOM Indefinite Delivery, Indefinite Quantity (IDIQ) contract known as Logistics AIT and ITV.

1.2 The objective of this contract is to provide AIT and ITV subject matter expertise and functional analysts, in addition to other labor categories, to USTRANSCOM and Department of Defense (DOD) AIT/ITV stakeholders (Office of Secretary of Defense, Joint Staff, Combatant Commands, Military Services, Defense Agencies, and other Departmental organizations) for their AIT/ITV-related projects and implementations.

1.3 The prime contractor under this effort shall be knowledgeable of DOD transportation and distribution processes, AIT/ITV policy and procedures, standards, and possess technical knowledge of AIT/ITV to ensure interoperability with automated systems in DOD, commercial industry, and coalition partners.

2.0 SCOPE

2.1 This USTRANSCOM IDIQ contract shall serve as a vehicle to provide broad AIT/ITV technical support and analytical tools to support and improve policy development, management and administration, standards, guidance, implementation, strategic planning and technical direction to sustain and improve the overall distribution process.

2.2 To ensure a common understanding of AIT and ITV, the DOD definitions for both acronyms are provided below. These definitions will be used to determine if the task order requirement is within scope of the IDIQ contract.

2.2.1 AIT: A suite of tools for facilitating total asset visibility (TAV) source data capture and transfer. AIT includes a variety of devices, such as bar codes, magnetic strips, optical memory cards, and radio frequency tags for marking or “tagging” individual items, multi-packs, equipment, air pallets, or containers, along with the hardware and software required to create the devices, read the information on them, and integrate that information with other logistic information. AIT integration with logistic information systems is key to the DOD’s TAV efforts.

2.2.2 ITV: Is the ability to track the identity, status, and location of DOD units, and non-unit cargo (excluding bulk petroleum, oils, and lubricants) and passengers; patients; and personal property from consignor or origin to consignee or destination across the range of military operations.

2.3 This USTRANSCOM IDIQ contract shall be used to complement the Government’s technical expertise in accomplishing its mission. Outputs may take the form of information, advice, opinions, alternatives, analyses, evaluations, recommendations, training and services to complement the Government’s expertise. The majority of the work performed under this contract will support USTRANSCOM requirements with the remaining work effort supporting other DOD organizations described in the 1.0 Objectives section. The nature of the work will sometimes demand the contractor be capable of quick response to deadlines. Specific tasks included are identified in Section II of the PWS.

3.0 BACKGROUND

3.1 USTRANSCOM was designated by Under Secretary of Defense for Acquisition, Technology and Logistics ((USD)-AT&L) as the DOD lead proponent for RFID and related AIT implementation for the DOD Supply Chain on 26 September 2006. DOD organizations are tasked to take full advantage of the inherent life-cycle asset management efficiencies that can be realized through RFID and other related AIT, including USTRANSCOM as the Distribution Process Owner (DPO). Part of USTRANSCOM’s DPO role is to execute an AIT implementation strategy and develop a centralized approach for use of technologies that enhance asset visibility.

3.2 As the Department lead functional proponent for RFID and related AIT implementation in the DOD supply chain, specifically active and passive RFID, satellite tracking technology, and linear and two-dimensional bar codes, USTRANSCOM, in collaboration with national partners, is responsible for developing a concept of operations for RFID and related AIT, and implement each technology within the appropriate supply chain segments across the Joint Deployment and Distribution Enterprise. In conjunction with the (USD)-AT&L, USTRANSCOM champions funding for RFID and synchronizes RFID implementation across the Department. In addition, USTRANSCOM is responsible for incorporating RFID and related AIT into the DPO architecture and oversee data quality and performance, using a Portfolio Management methodology.

3.3 On 17 August 2011, SECDEF designated USTRANSCOM as DOD lead proponent for ITV.

In addition to USTRANSCOM's role as lead proponent for AIT, this designation will contribute to a comprehensive and integrated approach for achieving ITV from point of origin to point of delivery. In coordination with the Joint Staff, Services, and Defense Agencies, this designation will also ensure policies, business processes, procedures, systems, data elements, and technologies are synchronized for effective ITV throughout the deployment/redeployment and distribution/retrograde pipeline.

3.4 The IDIQ contract will allow USTRANSCOM and AIT/ITV stakeholders to obtain contractor support to meet Departmental and their organizational requirements. This could include work that maintains and implements AIT/ITV in business processes across the DOD supply chain including ensuring policies, business processes, procedures, systems, data elements, and technologies are synchronized.

SECTION II: SPECIFIC TASKS (TASK AREA LIST)

4.0 GENERAL REQUIREMENTS

The contractor shall provide AIT/ITV subject matter experts and functional analysts, and other labor categories, to USTRANSCOM and other DOD organizations for their AIT/ITV-related projects and implementations supporting focused logistics, asset or shipment visibility, integration within the DOD Supply Chain, and those tasks that address automatic data capture policies and standards, assessing AIT technology, conducting analysis, examining future trends, and recommending Department policies providing the warfighter the best possible integrated solution. Work will be performed under individual Task Orders (TO). Work performed will be within the scope of the seven (7) task areas listed below.

1. Contract Program Management Support

2. AIT/ITV Project Management Support

3. Functional Support

4. Technical Support

5. Evaluation and Planning

6. Analysis and Metrics

7. Other AIT/ITV Related Tasks

Major categories of task area support are identified by a bolded and underlined paragraph title.

4.1 Task Area 1 - Contract Program Management Support

4.1.1 The contractor shall provide contract program management support that consists of activities relating to the administration and management of this PWS. The contractor shall provide a centralized program management capability. This function shall encompass administrative, clerical, documentation, and related functions that provide general support for the program. The contractor shall assign a Program Manager, who will be the primary point of contact (POC) for the acceptance of the tasks and all services performed under this PWS.

4.1.2 The contractor shall provide support by preparing documents such as Task Order Management Plan (TOMP), Monthly Status Report (MSR), and In Progress Reviews (IPR) in addition to briefings, point papers, trip reports and meeting minutes related to status of the performance of this PWS.

4.1.3 The contractor shall report ALL direct contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract for the United States Transportation Command (USTRANSCOM) via a secure data collection site. The contractor is required to completely fill in all required data fields using the following web address: http://www.ecmra.mil/.

4.1.3.1. Reporting inputs will be for the labor executed during the period of performance during each Government fiscal year (FY), which runs October 1 through September 30.

While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year, beginning with 2013. Contractors may direct questions to the help desk at help desk at: http://www.ecmra.mil/

The eCMRA site associated with this contract is Air Force.

The Command of the Requiring Activity is AFELM USTRANSCOM.

The Unit Identification Code (UIC) for this requirement is FF9XK0.

The Federal Service Code for this contract is R408.

4.2 Task Area 2 - AIT/ITV Project Management Support

4.2.1 The contractor shall provide program management and technical support services for an AIT/ITV project. The contractor shall assist the government in the planning, execution, installation, organization, development, implementation, configuration, integration, interoperability, life-cycle support, status, interim authority to operate, acquisition, budget, security certification and accreditation documentation.

4.2.2 The contractor may be required to purchase equipment or provide maintenance for a specific project on a reimbursable basis.

4.2.3 The contractor shall support government personnel in the effective transition and support of AIT/ITV planning and deployment of solutions at government installations. This shall include the install, repair, maintenance, and upgrade of existing AIT-enabled hardware and software solutions, and site visits for solution inspection, planning, design, site survey, installation of infrastructure to support solutions to include network/telecom/ wireless/electrical, training, and problem resolution.

4.2.4 The contractor shall support the formulation and monitoring of program budget and schedule of activities, and provide recommendations to ensure integrated contribution to overall effort.

4.2.5 The contractor shall coordinate with the various DOD organizations to ensure focus on and contribution to program goals, and to align work efforts with program milestone schedules and evolving design concepts and priorities.

4.3 Task Area 3 - Functional Support

4.3.1 The contractor shall provide AIT/ITV functional expertise and support for daily operations by executing system data queries, evaluating data results, reporting data results, and providing recommendations across the full spectrum of planning and execution processes during peace, contingency and wartime operations. The contractor shall focus on solving distribution challenges and enable better resource allocation decisions while improving delivery of forces and sustainment to desired points of effect.

4.3.2 As an AIT/ITV functional, the contractor will participate in experimentation, wargaming, and command supported exercises. This includes documenting lessons learned and working AIT/ITV-related lessons learned issues to completion.

4.3.3 The contractor shall assist in the integration of Unique Identification (UID) and serialized asset management.

4.4 Task Area 4 - Technical Support

4.4.1 The contractor shall contribute technical engineering services and participate as technical advisor with respect to AIT/ITV including RFID technology. Efforts include conducting engineering reviews and technical evaluation of AIT/RFID acquisition contract change proposals (CCPs) and coordinating contract change proposals with configuration management actions, identifying AIT and RFID articles requiring Hazards of Electromagnetic Radiation to Ordnance (HERO) safety evaluation, the planning phase of testing and evaluation AIT devices in controlled and operational conditions to determine utility in DOD operations, examining wireless security issues with respect to AIT and RFID relevant to National Institute of Standards and Technology (NIST) testing and Federal Information Processing Standards (FIPS) 140-11-2 Standards. This requirement also includes initiating and coordinating planning efforts to have products safety evaluated for use around people, equipment, and ordnance.

4.4.2 The contractor shall maintain familiarity with DOD UID policy, passive RFID Electronic Product Code (EPC) standards promulgated by EPC Global Inc., Common Criteria Certification guidelines promulgated by the National Security Agency (NSA), DOD wireless policy, and Federal Information Processing Standards.

4.4.3 The contractor shall assist in the creation, refinement, and resolution of logistics AIT/ITV standardization issues including supporting international, national, and industry standards.

Contractor shall attend standard meetings at various DOD levels, NATO, coalition partners, and with commercial industry.

4.4.4 The contractor shall participate in sponsored International Standards Organization (ISO) Working Integrated Product Team (WIPT) chartered with developing the ISO Migration Plan and identifying mitigating impacts of the migration approach from the current National Committee for Information Technology Standards (NCITS) and Joint Defense Total Asset Visibility (JDTAV) standards to ISO 18000-7 and MH10 standards. The contractor shall attend and participate in other technical forums, seminars, symposiums, and conferences as directed.

4.4.5 The contractor shall perform all functions necessary to assure that logistics AIT/ITV standards at all levels are maintained in concert with the DOD leadership vision and guidance.

The contractor shall coordinate and assist with AIS integration to assure AIT/ITV standards are applied in new AIS developments.

4.4.6 The contractor shall maintain cognizance of emerging commercial and scientific development of next generation AIT/ITV technical solutions. This includes providing expert technical advice and assistance to organizations responsible for planning and implementation of IT systems including evaluating improvements to enhance ITV and asset visibility.

4.4.7 The contractor shall provide technical advice and support in obtaining frequency clearances.

4.4.8 The contractor shall provide assistance in the procurement of AIT and IT hardware, software, and services.

4.4.9 The contractor shall assist the government in the evaluation of solicited and unsolicited logistical proposals. Evaluation will focus on if the proposed work/solution is unique and worthwhile, addresses a significant problem or issue, and has sufficient merit to warrant further consideration.

4.4.10 The contractor shall provide expert technical advice and assistance to managers responsible for planning and implementation of AIT/ITV or asset visibility programs. Work effort includes the following activities as required: recommend requirements collection strategies, methodologies, schedules, and activities; analysis; and provide technical advice related to data, security, and system engineering.

4.5 Task Area 5 - Evaluation and Planning

4.5.1 The contractor shall assist in the development or revision, coordination, and publication of logistics AIT/ITV policies. The contractor shall provide assistance to implement AIT/ITV. This includes providing inputs and recommending changes to Concept of Operations CONOPS, implementation plans, strategic plans and other written documentation.

4.5.2 The contractor shall maintain liaison with the necessary organizations for early planning for logistics AIT/ITV support. The Contractor shall assist in the identification of logistical requirements in projects and implementations approved by the government.

4.5.3 The contractor shall provide planning and evaluation support to implement AIT/ITV.

4.5.4 The contractor shall determine, facilitate, and coordinate the expansion of the use of AIT media across the DOD supply chain including the identification of emerging AIT technologies and evaluation of potential utilization. Contractor will identify DOD assets and business process opportunities that would benefit from certified AIT use. This includes assisting in the development of DOD policy for the use of AIT and its use from the factory to the foxhole/last tactical mile.

4.6 Task Area 6 - Analysis and Metrics

4.6.1 Data Analysis. The contractor shall retrieve and evaluate raw data downloads and identify trends, data errors, and data integrity issues. Prepare, update, or review data reports. Facilitate analysis and assessment of global and regional distribution using standard enterprise metrics and applicable commercial leading practices for qualitative and quantitative measurement. Apply tools and other analysis techniques in performing detailed analyses. Provide system, process and policy metrics; and, provide system, process, and policy shortfall identification.

4.6.2 Metrics. The contractor shall develop a variety of quantitative metrics that are related to AIT/ITV, providing an accurate measurement of service to specific customers. The contractor shall facilitate the construction of a balanced metrics and measures program. The contractor shall prepare, update, or review metrics reports and provide/present comprehensive analysis of execution/operational performance metrics to support recommended process and system improvements and identify business process improvements/recommended courses of action (COAs), system changes and process workarounds to achieve and improve data quality, ITV, asset visibility, and end-to-end (E2E) processes.

4.7 Task Area 7 - Other AIT/ITV Related Tasks

4.7.1 The contractor shall work assigned taskers relating to AIT/ITV including preparing papers, briefings, articles, and other documents as directed. This includes providing memoranda of meetings and trip reports.

4.7.2 The contractor shall prepare technical content for program management weekly, monthly, quarterly, and annual progress reports.

4.7.3 The contractor shall plan and coordinate meetings with senior personnel located at various headquarters and with OSD, Joint Staff, Service, and other stakeholders for the dissemination and exchange of AIT/ITV information.

4.7.4 The contractor shall plan, coordinate, and provide staffing for booths and displays at selected conferences and symposiums.

4.7.5 The contractor shall prepare AIT/ITV articles for DOD or commercial publications and provide, create, or revise documents for posting to a government website.

SECTION III: ADMINISTRATIVE DATA

5.0 DELIVERABLE SCHEDULE

Deliverables will be indicated on each task order.

6.0 INSPECTION AND ACCEPTANCE

Unless specified under individual task orders, final inspection and acceptance of all work performed, reports, and other deliverables will be performed at the place of delivery. The Government will review and accept or reject the deliverables within 15 workdays. The contractor shall make revisions or corrections to the deliverables as identified by the Government within 10 workdays of receipt of the requested revisions.

7.0 SERVICE DELIVERY SUMMARY (SDS)

7.1 Quality Assurance. The Government will evaluate performance of the services listed in the SDS to determine if they meet the performance thresholds. When the proper level of performance is not met, the Contracting Officer (CO) will issue a written Corrective Action Request (CAR). A Contracting Officer’s Representative (COR) will be assigned and point of contact information included in each individual task order. The COR will follow the methods of surveillance specified in the Government’s Quality Assurance Surveillance Plan (QASP).

Government personnel will record all surveillance observations. When an observation indicates defective performance, the COR will require the contract or Task Order (TO) manager or representative to initial the observation. The initialing of the observation does not necessarily constitute concurrence with the observation, only acknowledgment that they have been made aware of the defective performance.

7.2 Performance Deficiency Notification. The Government will employ three types of notification: First Notice, Second Notice, and a Corrective Action Request (CAR).

7.2.1 First Notification. First notification is used for minor tasks that can be re-performed. It will state “First Notice.”

7.2.2 Second Notification. Second notification is used when first notice fails. It will state “Second Notice.”

7.2.3 Corrective Action Request. This request is issued when previous notifications failed to result in corrective actions or for failure of an SDS item.

7.3 Performance Deficiency Resolution. Contractor shall take immediate action to correct all Government reported deficiencies, and to prevent recurrence of the deficiency.

7.4 Service Delivery Summary Table. A SDS will be tailored and specified for individual task order requirements, similar to the surveillance methods and thresholds described below.

PERFORMANCE

OBJECTIVE

SURVELLANCE METHOD

PERFORMANCE MEASURE

Develop and submit all required deliverables

Periodic inspection as specified by TO by COR or TO monitor

Contractor submits deliverables on time, in the format specified, and with the content directed by or mutually agreed to between the contractor and the government IAW each individual task order (TO) 98% of the time.

Maintain a stable workforce

Periodic inspection as specified by TO by COR or TO monitor

The contractor effectively retains personnel performing on the TO to reduce and minimize the need for the government to expend time/money/effort to retrain and re-orient new contractor personnel.

The contractor's turnover rate is less than 5% (total number of personnel assigned to TOs/number of personnel replaced or moved without government direction).

Successfully meet TO requirements

Validated customer complaint to COR or TO monitor

Contractor receives less than two (2) formal customer complaints/corrective action requests for the period of performance for each TO. The contractor successfully resolves customer complaints within 10 days of receipt, 100% of the time.

Successfully meet all security requirements

Periodic inspection as specified by TO by COR or TO monitor

Contractor must meet and maintain all security requirements 100% of the time.

8.0 PLACE AND PERIOD OF PERFORMANCE

8.1 The primary place of performance may take place either at the contractor’s location, in Government facilities, or as mutually agreed between the contractor and the Government. Place of performance will be stipulated in each individual task order.

8.2 This contract will be a base year with two (2) one year option periods. Period of performance will be stipulated in each individual task order. The base period is 17 March 2014 through 16 March 2015. Option periods are:

Option Year 1: 17 March 2015 through 16 March 2016;

Option Year 2: 17 March 2016 through 16 March 2017

9.0 SECURITY

Security items may be further defined in each task order. It is expected that 10% of the work for this IDIQ contract will be performed at the TOP SECRET level; majority of the work will be performed at the SECRET level.

9.1 General Security Information. Access to classified information at the TOP SECRET level is required. The contractor shall not divulge any financial, planning, programming, or budgeting information without the express consent of the Government as outlined in Operational Security (OPSEC) and Information Security regulations. The contractor shall comply with all appropriate provisions of applicable security regulations. Specific security requirements are identified in the DD Form 254, DOD Contract Security Classification Specification. A completed/signed DD Form 254 is attached to the task order.

9.2 Citizenship Requirements for Clearance. The contractor employees performing services under this contract shall be citizens of the United States of America. No dual citizens will be authorized interim or final security clearance determinations. U.S. Citizens who have foreign government (expired or active) passports will not be able to hold interim or final security clearances within DOD. These contractors who maintain or have in their possession a passport issued by a foreign country are considered dual-citizens. The contractor, subcontractor(s), and/or partner(s) shall possess the capability to articulate well, speak and write fluently in the English Language, and comprehend the English Language. Overall, all contractor personnel shall possess the appropriate personnel security investigation for the position occupied.

9.3 Security Clearance Requirements. All positions on this contract require a minimum of a SECRET clearance as granted by the Defense Industrial Security Clearance Office (DISCO).

Selected personnel may require access to TOP SECRET information and will require TOP SECRET eligibility granted by DISCO. Interim clearances granted by DISCO without favorable fingerprint checks completed are not accepted. The fingerprint checks must be favorable and must be completed before an interim clearance is accepted.

9.4 Facilities Clearance Level. The contractor must have a valid FCL at the TOP SECRET level. Interim FCLs are acceptable provided they are not expired. FCL procedures and security guidelines for adjudicative requirements are outlined in DOD 5220.22-M. FCLs and Interim FCLs must be awarded by the applicable Defense Security Service (DSS) field office.

9.5 Clearance Requirements and Position Sensitivity. Contractor personnel with IA administrative privileges and/or who will monitor DOD IT systems or software as designated by DOD 8500.1/5200.2-R may be rated at the various levels listed below. The stipulation of the numbers and what IT/Automated Data Processing (ADP) levels the contractors will have is approved by the COR or the CO before the start of the task order. The contractor shall not divulge any financial, planning, programming, or budgeting information without the express consent of the Government as outlined in Operational Security (OPSEC) and Information Security regulations or be held liable for punitive damages incurred as a result of release of such information. The contractor shall comply with all appropriate provisions of applicable security regulations while assigned to this task order for DOD and USTRANSCOM. The following guidance will be followed when determining background investigation and clearance levels for this task order depending on requirements:

POSITION LEVEL: Information Technology (IT)-I / Automated Data Processing (ADP)-I or Critical Sensitive Positions (TOP SECRET): IT/ADP-I and Critical Sensitive Positions are those positions that: require access to Top Secret information; development or approval of plans, policies, or programs that affect the overall operations of the DOD or of a DOD component; development or approval or war plans, plans or particulars of future major or special operations of war, or critical and extremely important items of war; investigative and certain investigative support duties, the issuance of personnel security clearances or access authorizations, or the making of personnel security determinations; fiduciary, public contact, or other duties demanding the highest degree of public trust; duties falling under Special Access programs; directly responsible for the planning, direction, and implementation of a computer security program; major responsibility for the direction, planning and design of a computer system, including the hardware and software; or can access a system during the operation or maintenance in such a way, and with a relatively high risk for causing grave damage, or realize a significant personal gain; and any other position so designated by the head of the component or designee.

BACKGROUND INVESTIGATION REQUIREMENTS: (IT-I/ADP-I or Critical Sensitive) Requirements for TOP SECRET: Positions designated by the Government as Critical Sensitive/ADP-I/IT-I rating require a Single Scope Background Investigation (SSBI) (or acceptable periodic reinvestigation) favorably adjudicated (a favorable adjudication grants eligibility at the TOP SECRET level as prescribed by DOD 5200.2-R). The IT-I/ADP-I requirements mandate the contractor have a minimum Facilities Clearance Level (FCL) at the TOP SECRET level due to investigation submissions as directed in DOD 5220.22-M, DOD

5200.01 and the Joint Personnel Adjudications System (JPAS).

POSITION LEVEL: Information Technology (IT)-II / Automated Data Processing (ADP)- II /Or Non-Critical Sensitive Positions (SECRET): IT/ADP-II and Non-Critical Sensitive Positions are those positions that: have access to Secret or Confidential information; Security police/provost marshal-type duties involving the enforcement of law and security duties involving the protection and safeguarding of DOD personnel and property; category II automated data processing positions; duties involving education and orientation of DOD personnel; duties involving the design, operation, or maintenance of intrusion detection systems deployed to safeguard DOD personnel and property; responsible for the direction, planning, design, operation, or maintenance of a computer system, and whose work is technically reviewed by a higher authority of the ADP-I category to ensure the integrity of the system; and any other position so designated by the head of the Component or designee.

BACKGROUND INVESTIGATION REQUIREMENTS:

(IT-II/ADP-II/Non-Critical Sensitive) Requirements for SECRET: Positions designated by the Government at the Non-Critical Sensitive/ADP-II/IT-II rating require a National Agency Check with Local Credit (NACLC) (or acceptable periodic reinvestigation) favorably adjudicated (a favorable adjudication grants eligibility at the SECRET level as prescribed by DOD 5200.2-R). The IT-II/ADP-II requirement mandates the contractor have a minimum FCL at the SECRET (or higher) level due to investigation submissions as directed in DOD 5220.22- M, DOD 5200.01 and JPAS.

POSITION LEVEL: Information Technology (IT)-III / Automated Data Processing (ADP)-III /Or Non-Sensitive Positions (Position of Trust Determination) (No Classified Access) All other positions involved in computer activities and Common Access Card. No clearance is granted for classified access and only a Position of Trust (PoT) is awarded and posted in JPAS.

BACKGROUND INVESTIGATION REQUIREMENTS:

(IT-III/ADP-III/Non-Sensitive) Requirements for Position of Trust Determinations (No Classified Access): Positions designated by the Government at the Non-Sensitive/ADP-III/IT-III rating require a National Agency Check with Inquiries (NACI) (or acceptable investigation/reinvestigation) favorably adjudicated (a favorable adjudication issues a Position of Trust determination as prescribed by DOD 5200.2-R and DOD DTM 08-003 (Dated Dec 08).

Favorable NACI or equivalent investigation results must be posted in JPAS before a CAC or NIPRNET access will be granted. To obtain interim CAC/ NIPRNET access, NACI investigations will be opened with fingerprint, name and criminal records checks returned favorably before the credentials (CAC and NIPRNET) are issued. NACI submissions will be completed on the Standard Form (SF) 85 and submitted with fingerprint cards (FD 258) to USTRANSCOM Force Protection, Security Services Center (SSC) for processing. No classified access will be granted based on the NACI investigation.

NOTE: The above requirements for IT-III/ADP-III/Non-Sensitive Positions are for access to unclassified systems only. Contractors who require access to classified systems or areas must have interim or final adjudication of background investigations at the Critical or Non-Critical Sensitive levels.

USTRANSCOM will only process NACI/Position of Trust investigations and will not complete any personnel security investigations for classified access. It is incumbent upon the contractor to have the appropriate investigations completed upon start of the task order. Personnel who do not have the proper investigation will be denied the ability and access to USTRANSCOM facilities until investigations have been favorably adjudicated.

9.6 Personnel Clearance Validation. Upon contract award, the contactor shall submit the names of contractor personnel to the USTRANSCOM Force Protection Division Security Services Center (SSC) for vetting through the Joint Personnel Adjudication System (JPAS) to ensure investigative and clearance requirements have been satisfied. This will be completed before the COR/Trusted Agent (TA) creates and approves a Common Access Card (CAC) in the DOD Trusted Associate Sponsorship System (TASS) for each employee.

9.7 Common Access Card Issuance Procedures. Upon notification by the SSC that contractor personnel meet the required investigative and clearance levels, the Trusted Agent can approve the CAC application and a CAC can be issued. CACs may be approved for a period not to exceed three years.

9.8 Scott Air Force Base/USTRANSCOM Physical Access. Upon receipt of the CAC, permanently assigned contractor personnel located at USTRANSCOM at Scott AFB (SAFB), IL, may obtain the AF 1199 (Restricted Area Badge) if the employee meets the requirements set forth in the SAFB Instruction 31-101. Only personnel assigned physically on SAFB at least four

(4) days a week will be issued the AF 1199. The Government will provide unrestricted access to facilities, consistent with security clearance and need to know, necessary for the on-site personnel to perform their work in accordance with the contract. Contractor personnel assigned on-site at USTRANSCOM will display the Restricted Area badge at all times while in Government facilities. Badges will not be displayed when outside facilities. Visits to SAFB by contractor personnel who do not possess the CAC will be facilitated by the COR/CO sponsoring the employee through the online base access system.

9.9 Visits to USTRANSCOM/SDDC Buildings. Any visit(s) by contractor personnel not permanently assigned to this contract (i.e., company presidents, company security managers, contractor personnel not permanently assigned at SAFB, etc.) will require an electronic visit request be submitted using the Joint Personnel Adjudication System (JPAS). JPAS visits can be forwarded to the Security Management Office (SMO) code: USTC - SDDC. Permanently assigned contractor employees on SAFB will require a visit request for the current period of performance posted in JPAS to SMO: USTC - SDDC. The visit request will annotate the contract number in the POC block of the visit request and the name of the COR/CO in the phone number block.

9.10 Information Assurance Training. Contract employees physically assigned to USTRANSCOM at SAFB shall attend/complete security training as prescribed by DOD and USTRANSCOM instructions. At a minimum this includes: Employee Initial Security Training, Annual Security Awareness Training, Operations Security (OPSEC), DOD Antiterrorism Level 1 Training, Personally Identifiable Information (PII) Training and any Security Stand Down Day Training scheduled by the Commander USTRANSCOM. Contract employees assigned elsewhere shall attend security training established by their respective government security offices and/or installations.

9.11 Additional Security Conditions. Upon completion of this contract, the contractor’s personnel shall surrender all Government supplies, materials and equipment to the COR. All contractor personnel assigned to this contract who possess CAC cards shall return those cards to the COR at SAFB for turn-in to the USTRANSCOM SSC. Any assigned contractor personnel who possess a security badge shall turn in those badges to the SSC in person during out-processing. Contractor personnel shall out-process on the last day of the contract or upon termination or reassignment from duties under this contract.

9.12 Security Debriefing. Contractor personnel physically working at USTRANSCOM at SAFB, IL, shall complete a security debriefing statement (SF 312) upon completion of the contract.

9.13 Contractor activity. If the Government notifies the contractor that the employment or the continued employment of any contractor personnel is prejudicial to the interests or endangers the security of the United States of America, that employee shall be removed and barred from the worksite. This includes security deviations/incidents and credible derogatory information on contractor personnel during the course of the contract’s period of performance. The contractor shall make any changes necessary in the appointment(s).

9.14 NATO Information Access. No contractor employee will access NATO information without first being indoctrinated on NATO and having that access recorded in JPAS. Any NATO information accessed will be only on SIPRNet. Senders of NATO information will ensure the receiving network is accredited and the receiving point is a Sub-Registry or authorized Control Point. No NATO information will be stored with US classified information. Access to NATO information will be based on need-to- know, appropriate access level, and training.

NATO information will not be disseminated to unauthorized users. NATO information will be printed only on authorized copiers and printers. All printed NATO classified information must be strictly controlled and tracked in a NATO registry. Contact the USTRANSCOM Sub- Registry for additional control measures.

Security Regulation Guidance: Department of Defense (DOD):

2000.16 (DOD Antiterrorism (AT) Standards) 5200.01, Volumes 1-4 (DOD Information Security Program) 5200.2-R (DOD Personnel Security Program) 5200.08-R (DOD Physical Security Program) 5220.22-M (National Industrial Security Program)

8500.1 (Information Assurance (IA))

2000.12 (DOD Antiterrorism (AT) Program)

8500.2 (Information Assurance (IA) Implementation) DOD regulations found at: http://www.dtic.mil/whs/directives/corres/pub1.html

Scott Air Force Base:

SAFB Instruction 31-101 (Installation Security Instruction)

Forms:

DD 254, DOD, Contract Security Classification Specification

DOD forms found at:

http://www.dtic.mil/whs/directives/corres/pub1.html

USTRANSCOM Force Protection (Industrial Security) Points of Contact:

Patrick Collins or Steven Strait 508 Scott Drive Security Services Center (SSC) Scott AFB IL 62225 Commercial: 618-220-6550/6531 (respectively) Email at Patrick.Collins@ustranscom.mil or Steven.Strait@ustranscom.mil

9.15 Security. Handling of Non-Public Information. In performance of this contract, the contractor may have access to sensitive, non-public information. The contractor agrees (a) to use and protect such information from unauthorized disclosure IAW Directive-Type Memorandum (DTM) 08-027 - Security of Unclassified DOD Information on Non-DOD Information Systems, 31 July 2009; (b) to use and disclose such information only for the purpose of performing this contract and to not use or disclose such information for any personal or commercial purpose; (c) to obtain permission of the Government Program Manager before disclosing/discussing such information with a third party; (d) to return and/or electronically purge, upon Government request, any non-public, sensitive information no longer required for contractor performance;

and (e) to advise the CO and/or COR of any unauthorized release of such information. Upon request, the contractor shall have its employees assigned to this contract execute a non-disclosure agreement for delivery to the Government. The Government will require contractor personnel to sign a non-disclosure statement to protect non-public information of other contractors and/or the Government.

9.16 Requirements for Contractor Provision of Security Plan, Information Assurance Controls.

The contractor shall establish an Information Assurance Program to implement and sustain appropriate Information Assurance management, operational, and technical controls and processes required to safeguard DOD non-public information resident on or transiting the contractor's unclassified information systems from unauthorized access and disclosure.

Protection measures applied must be commensurate with the risks (i.e. consequences and their probability) of loss, misuse, unauthorized access, or modification of information. The contractor shall submit for Government approval an overarching security plan that describes their strategy for implementation of Information Assurance and Industrial Security requirements throughout the life of the contract. The security plan shall address the security controls described in National Institute of Standards & Technology (NIST) Special Publication 800-53 (current version), Recommended Security Controls for Federal Information Systems and Organizations (http://csrc.mist.gov/publications/PubsSPs.html), and should be tailored in scope and depth appropriate to the effort and the specific unclassified DOD information.

9.17 Periodic Government Inspections. The contractor shall authorize Government inspections and reviews to assure compliance with DOD Information Assurance requirements throughout the contract performance period. The contractor shall be responsible for taking corrective action based upon the impact and severity of identified weaknesses.

9.18 Remote Access. Contractor Furnished Equipment (CFE) employed for remote access to a Government network must meet equivalent Government Furnished Equipment (GFE) Information Assurance computing requirements. The contractor shall ensure that all CFE (hardware and software) employed to access these environments meet the following minimum Government Information Assurance requirements and provide periodic certification of compliance as a pre-requisite to being granted network access.

(a) Use of personal systems is prohibited;

(b) Operating systems and applications must be configured for compliance with the DISA Gold Disk and applicable Security Technical Implementation Guides (STIGs);

(c) DOD approved anti-virus and anti-spyware software must be installed and signatures must be configured to automatically update on a daily basis;

(d) DOD approved personal firewall must be utilized and configured to permit traffic by exception only, dropping all other traffic. If the personal firewall provides intrusion detection or prevention, the signatures or rules must be updated at the same intervals as the anti-virus software.

(e) Computers must be Information Assurance Vulnerability Management (IAVM) compliant;

(f) Computers must be scanned with the DOD version of E-eye Retina vulnerability scanner (or current approved DOD scanner solution) at a minimum of every 30 days. All vulnerabilities must be remediated and reported to the cognizant Information Assurance Manager;

(g) Contractor employees must possess a current Government issued Common Access Card (CAC) and install Government certified CAC readers; and

(h) Verification of compliance with these requirements must be provided to an appointed government representative on a monthly basis.

9.19 Detect, Analyze, Respond; Reporting Requirements. The contractor shall report to the USTRANSCOM Technical Information Analysis Center (TIAC) and USTRANSCOM designated Government personnel within 4 hours of discovery of any suspected cyber intrusion events that affect DOD information resident on or transiting the contractor's unclassified information systems. Initial report shall be provided even if some details are not yet available, with follow-on detailed reporting within 24 hours. Reportable cyber intrusion events include the following:

(a) A cyber intrusion event appearing to be an advanced persistent threat;

(b) A cyber intrusion event involving data exfiltration or manipulation or other loss of any DOD information resident on or transiting the contractor's, or its subcontractors', unclassified information systems;

(c) Intrusion activities that allow unauthorized access to an unclassified information system on which DOD information is resident or transiting.

Definition of advanced persistent threat: An extremely proficient, patient, determined, and capable adversary, including two or more of such adversaries working together.

9.20 Incident Report Content. The incident report shall include, at a minimum, the following information:

(a) Applicable dates (date of suspected compromise and date of discovery);

(b) Threat methodology (all known resources used such as Internet Protocol (IP) addresses, domain names, copies malware, etc.);

(c) An account of what actions the threat(s) may have taken on the victim system/network and what information may have been accessed;

(d) A description of the roles and functions of the threat-accessed system;

(e) An initial list of potentially impacted Government programs and each program’s classification;

(f) What information may have been exfiltrated that may impact Government programs.

(g) A list of all employees and subcontracted employees who work or have worked with the victim system/network;

(h) A point of contact to coordinate damage assessment activities.

9.21 Incident Report Submission. The contractor will submit unclassified network cyber incident reports to the USTRANSCOM Technical Information Analysis (TIAC) and USTRANSCOM designated Government personnel via encrypted email or another mutually agreed upon secure communications method. Copies of malware require special handling and pre-coordination must be accomplished prior to submission.

9.22 Incident Response Coordination. In the event of a known or potential intrusion, the contractor agrees to allow follow-on actions by the Government to further characterize and evaluate the suspect activity. The contractor acknowledges that damage assessments may be necessary to ascertain intruder methodology and identify systems compromised as a result of the intrusion. Company acknowledges that in certain cases a complete forensic analysis may be necessary to ascertain intruder methodology and identify systems compromised as a result of the intrusion. Once an intrusion is identified, the company agrees to take all reasonable and appropriate steps to preserve any and all evidence, information, data, logs, electronic files and similar type information reference NIST Special Publication 800-61: Computer Security Incident Handling Guide, (current version) related to the intrusion for subsequent forensic analysis so that an accurate and complete damage assessment can be accomplished by the Government. The contractor is not required to maintain an organic forensic capability, but must ensure data is preserved until forensic analysis can be performed by the Government (e.g. removing an affected system, while still powered on, from the network meets the intent of this requirement). Any follow-on actions shall be coordinated with the contractor via the Contracting Officer’s Representative (COR).

9.23 Law Enforcement/Counterintelligence. In the event of a known or potential intrusion, the contractor shall consent to responding counterintelligence or law enforcement investigative agency requests to apply forensic analysis tools to contractor information systems affected by the intrusion, including monitoring tools, imaging tools, and any other techniques that the agency seeks to apply to effectively analyze the intrusion. The contractor shall allow the responding counterintelligence and/or law enforcement investigative agency to image affected systems, including systems containing proprietary information. Nothing in this contract shall limit the ability to conduct law enforcement or counterintelligence activities, or other activities in the interest of the Government.

9.24 Information Sharing. The Government may use and disclose reported information (e.g., information regarding threats, vulnerabilities, incidents, or best practices) that does not include attribution information at its discretion to assist entities in protecting information or information systems (e.g. threat information products, threat assessment reports); provided that such use or disclosure is otherwise authorized in accordance with applicable statutes, regulations, and policies.

9.25 Confidentiality and Non-Attribution Statement. The Government shall take reasonable steps, by controlled access and need-to-know procedures, to protect against public release of attribution information of the contractor. The Government may use and disclose reported information that includes attribution information only on a need-to-know basis to authorized persons for cyber security and related purposes (e.g., in support of forensic analysis, incident response, compromise or damage assessments, law enforcement, counter intelligence, threat reporting, and trend analysis). The Government may disclose attribution information to support contractors that are supporting the Government's cyber security and related activities if the support contractor is subject to legal confidentiality requirements that prevent any further use or disclosure of the attribution information. The Government agrees to consider available exemptions of the Freedom of Information Act to protect against disclosure of attribution information of the contractor to unauthorized persons.