ID09210005 Draft PWS.pdf

ID09210005 – RFI, Attachment

DRAFT PWS 1

SECTION C – DESCRIPTION, SPECIFICATIONS, PERFORMANCE WORK STATEMENT

C.1 PERFORMANCE WORK STATEMENT (PWS):

Personnel and Security Research Center (PERSEREC) Research, Development, and Communication Support For Personnel Security, Suitability, and

Credentialing (SSC), Reliability, Counter-Insider Threat, and other Risk Management Programs Performance Work Statement (PWS)

C.2 INTRODUCTION:

The Defense Human Resources Activity (DHRA), Office of People Analytics (OPA) requires support for a research and development program. This line of effort is dedicated to improving the effectiveness, efficiency, and fairness of Federal- and DoD-level security, suitability, and credentialing (SSC), reliability, counter-insider threat, and other risk management programs.

Program activities include use of social and behavioral science (SBS) methods to (1) conduct operational research and development efforts; (2) develop innovative systems, tools, trainings, and job aids for policymakers, practitioners, and the workforce at large; and (3) generate and communicate action-oriented research findings for stakeholders and project sponsors.

C.3 BACKGROUND:

C.3.1 OPA is part of the Defense Human Resources Activity (DHRA), a Department of Defense (DoD) Field Activity. OPA supports decision making by the Office of the Under Secretary of Defense for Personnel and Readiness (OUSD[P&R]), the Office of the Under Secretary of Defense for Intelligence and Security (OUSD [I&S]), and other Federal government organizations both within and outside the DoD enterprise.

C.3.2 Research focusing on security, suitability, and credentialing (SSC) programs has been a cornerstone of Personnel and Readiness’s (P&R’s) mission for many years. More recently, workplace violence and insider threat-related issues have risen to the forefront. As threats to national security, technology, and the workforce more broadly continue to evolve, it is as important as ever to ensure policy makers and other leadership personnel have empirically-based knowledge, metrics, and tools to support their decision-making needs.

C.4 SCOPE:

C.4.1 The contractor shall provide all personnel and management oversight necessary to perform the research, development, and communication services detailed within this PWS and subsequent task orders.

C.5 REQUIREMENTS:

The Contractor shall:

C.5.1 Security, Suitability, and Credentialing (SSC) and Reliability Programs

C.5.1.1 PERSEREC has been conducting SBS research in support of Federal- and DoD-level SSC and reliability programs since 1986. PERSEREC focuses its efforts on solving some of the most difficult challenges facing DoD and other Federal agencies to include operational research efforts aimed at modernizing personnel vetting under Trusted Workforce 2.0.

DRAFT PWS 2

C.5.1.2 Below we list several SSC and reliability program research areas to demonstrate our diverse portfolio:

a) Background Investigation Process Improvement (e.g., program evaluation)

b) Adjudication Process Improvement (e.g., adjudication quality review)

c) Social Media and Publicly Accessible Electronic Information (PAEI) Vetting

d) Vetting for Special Populations (e.g., Legal Permanent Residents [LPRs])

e) Continuous Vetting (CV) and Automated Record Checks (ARCs)

f) Reporting Behaviors of Concern

g) eAdjudication (i.e., automated clean case adjudication processing system)

h) Mental Health Vetting

i) Human Reliability Program Evaluation (e.g., under DoE)

C.5.1.3 PERSEREC’s applied research, development, and communication activities—as depicted across the previously-listed broad pillars of programmatic study—are directed to achieve the following:

a) Programs that are efficient and cost-effective (e.g., automated programs) that deliver fair, equitable, and timely decisions regarding employment status and eligibility to access classified information.

b) Programs that encourage use of risk management principles, and maximize use of information technology and databases to expedite investigative and adjudicative processes.

c) Programs that reduce labor-intensive tasks and lessen the workload of both applicants and government personnel (e.g., promoting reciprocal investigation and adjudication processes across Federal agencies).

d) Programs that enforce the selection of a trusted population of military, civilian, and industrial employees who are fully aware of their security responsibilities and potential threats (e.g., foreign intelligence threats) that could impact their lives, work, or combat mission.

e) Programs that promote a resilient and ready military, civilian, and industrial workforce.

C.5.1.4 The contractor shall provide support across these pillars and affiliated programmatic goals to advance PERSEREC’s mission and to further contributions to the SSC and reliability program community.

C.5.1.5 PERSEREC is responsible for establishing and executing SBS research priorities intended to improve the efficiency, effectiveness, and fairness of SSC and reliability programs. In support of these goals, the contractor shall provide subject matter expertise across the following R&D domains:

a) Qualitative research design, methods, and analytic techniques to include participant observation, interviews, focus groups, user experience tests, questionnaires, and discourse analysis.

b) Quantitative research design, methods, and analytic techniques to include descriptive statistics, inferential statistics, data mining, and machine learning.

c) Policy and regulation review to include coverage at the Federal- and DoD-level.

d) Operational initiatives to build trainings, tools, videos, websites, web-based and mobile applications, and databases informed by research and made viable for use in the SSC and reliability program community.

DRAFT PWS 3

C.5.2 Counter-Insider Threat Programs

C.5.2.1 PERSEREC created The Threat Lab in 2018 to fulfill the DoD Counter-Insider Threat Program Director’s vision to incorporate SBS into the mission space. Since then, The Threat Lab has scaled rapidly to meet the growing research, professionalization, and communication needs of both DoD and the National Insider Threat Task Force (NITTF). PERSEREC requires support across these three pillars to continue The Threat Lab’s strategic growth and expand its contributions to the global counter-insider threat community.

C.5.2.2 The Threat Lab is responsible for establishing and executing SBS research priorities, the results of which are meant to advance stakeholders’ efforts to prevent, detect, and mitigate both intentional and unintentional insider threat incidents. In support of these goals, the contractor shall demonstrate expertise in both quantitative and qualitative research design, execution, analysis, and presentation. Qualitative methods and analysis techniques include participant observation, interviews, focus groups, user experience questionnaires, and discourse analysis. Quantitative methods and analysis techniques include descriptive statistics, inferential statistics, data mining, and machine learning.

C.5.2.2.1 To effectively support The Threat Lab’s research pillar, the contractor shall demonstrate subject matter expertise in National- and DoD-level insider threat policies, authorities, and processes, to include knowledge of how and why executive agencies’ policies, authorities, and processes differ. Moreover, the contractor shall demonstrate expertise in policy analysis as a method to understand how and why relevant policies (e.g., workplace violence, insider threat, information security, etc) have evolved since Executive Order 13587 was signed. The contractor shall be expected to articulate its policy expertise both in written reports and oral presentations, to include, for example, conference briefings, sponsor meetings, and webinars.

C.5.2.2.2 The Threat Lab relies on a multidisciplinary approach to understand, conceptualize, and explain how unintentional, negligent, and malicious insider threat events occur. Therefore, the contractor shall demonstrate subject matter expertise in foundational theories of human behavior at the micro-, meso-, and macro-levels across a number of disciplines including, but not limited to, psychology, sociology, criminology, communications, economics, public health, user experience/design, and business.

C.5.2.3 The contractor shall demonstrate expertise in the creative design and delivery of counter-insider threat professionalization materials to include: 1) skill-based and task-based training materials across a variety of platforms (e.g., virtual, in-person); 2) the full life cycle of a certification program, including the accreditation process and a robust professional development unit management system; and 3) tradecraft materials that enable counter-insider threat analysts and behavioral threat assessors to test, apply, and expand their knowledge. The Threat Lab is committed to accommodating stakeholders’ varied learning styles, and so the contractor shall demonstrate expertise in creating materials that encompass visual, physical, aural, verbal, logical, social, and solitary learning styles. The contractor also shall demonstrate expertise in graduate-level curriculum design and delivery for both in-person synchronous learning and online asynchronous and synchronous learning.

C.5.2.4 The Threat Lab is responsible for sharing its work product with stakeholders around the world and requires expertise in strategic communications and marketing. The contractor shall demonstrate a successful record of identifying and executing a strategic

DRAFT PWS 4

communication/ marketing plan that has contributed to a government sector organization’s/program’s growth, brand, and reputation.

C.5.3 Workplace Risk Management and Mitigation

C.5.3.1 PERSEREC has been conducting SBS research, program evaluation, policy analysis, outreach, and training in support of DoD violence prevention, intervention, and postvention programs since 2014. PERSEREC efforts in this area include removing barriers to help seeking;

identifying interpersonal, situational and organizational risk factors; and identifying risk management strategies and empirically-based best practices. PERSEREC has also developed tools and interventions to improve individual outreach and support to reduce risks of violence, self-harm, and acts or threats of aggression in both physical and virtual workplace environments.

PERSEREC requires support to achieve enterprise-level and Component goals within this line of effort.

C.5.3.2 PERSEREC is responsible for identifying and executing DoD and Component-level research priorities to advance stakeholders’ efforts to detect, prevent, and manage workplace/ work-related violence, suicide, and self-harm. In support of these goals, the contractor shall demonstrate expertise in both quantitative and qualitative research design, methods, and analysis.

Qualitative methods and analysis techniques include participant observation, interviews, focus groups, user experience tests, questionnaires, program evaluation, policy analysis, and discourse analysis. Quantitative methods and analysis techniques include descriptive statistics, inferential statistics, data mining, natural language processing, and machine learning.

C.5.3.3 The contractor shall demonstrate subject matter expertise in National- and DoD-level workplace and school violence, harassment, sexual assault, and suicide prevention and management policies, authorities, and processes, to include knowledge of how and why executive agencies’ policies, authorities, and processes differ. Moreover, the contractor shall demonstrate expertise in policy analysis as a method to understand how and why relevant policies have been modified. The contractor shall be expected to articulate its policy expertise both in written reports and oral presentations, to include briefings, sponsor meetings, and webinars.

C.5.3.4 The contractor shall demonstrate subject matter expertise in foundational theories of violent behavior at the micro-, meso-, and macro-levels across a number of disciplines including, but not limited to, psychology, clinical psychology, sociology, criminology, communications, education, economics, public health, user experience/design, and business.

C.5.3.5 The contractor shall demonstrate expertise in the creative design and delivery of workplace risk management and mitigation training and outreach materials including but not limited to the development and delivery of videos, toolkits, webinars, podcasts, interactive presentations, posters, web-based and mobile applications, facilitated and computer-based learning modules.

C.5.4 Data Discovery, Collection, Analysis, Management and Presentation

C.5.4.1 Data Discovery and Evaluation

C.5.4.1.1 The contractor shall examine existing and emerging data sources, including PAEI, automated electronic databases, and non-automated information sources, and assess their value for

DRAFT PWS 5

(a) SSC and reliability programs; (b) counter-insider threat programs; and (c) workplace risk management and mitigation.

C.5.4.1.2 Specific requirements include: (a) evaluating new electronic records sources as well as other automated and non-automated sources of information; (b) developing, testing, and refining business rules and algorithms for identifying personnel security, safety, or suitability risk using electronic records and other information sources; (c) identifying sources of PAEI with the potential to reduce cost and improve the quality and efficiency of SSC background investigations, continuous evaluation, continuous vetting, counterintelligence, and efforts to mitigate threats to national security; (d) evaluating tools for authenticating PAEI and other information to ensure it pertains to personnel under investigation; (e) identifying contextual information that decision-makers need to evaluate PAEI and other data sources; and (f) identifying legal and privacy policies that govern the use of PAEI and other electronic and non-automated data sources in security and personnel management; (g) improving human-based reporting of security, insider threat, and other workplace-related concerns; (h) developing metrics and prototype mechanisms for monitoring quality, efficiency, effectiveness, and fairness of programs related to SSC, reliability, counter-insider threat, and workplace risk management and mitigation; (i) estimating cost/benefit impacts of Courses of Action (COAs); and (j) developing and assessing new methods of collecting information regarding personal, organizational, behavioral/non-behavioral, and community factors to improve risk-based personnel management.

C.5.4.2 Data Collection, Transformation and Management

C.5.4.2.1 The contractor shall provide support in all aspects of survey research, including (a) developing research questions and hypotheses; (b) sampling; (c) data collection technologies; (d) survey design, construction, administration, and support; (e) SME interview and focus group planning, administration, and analysis; (f) development of coding schemes; (g) data validation and quality assurance; and (h) operational issues.

C.5.4.2.2 The contractor shall provide programming and other information system technical support to (a) extract, transform, load, and merge data; (b) create automated routines for data processing; (c) perform data quality control for identity resolution, data deduplication, missing data, and data integrity; (d) create automated routines for data standardization and categorization;

(e) create, test, modify, and maintain relational databases and data entry applications used for automated and manual data collection; (f) perform manual data coding and transformation, where not automatable; (g) conduct data quality assurance on manually coded data; (h) perform troubleshooting of software and hardware systems; and (i) create procedural documentation, including user’s guides, software installation procedures, and other such documents.

C.5.4.3 Data Analysis, Predictive Modeling, and Advanced Analytics

C.5.4.3.1 The contractor shall analyze data from SSC, reliability, counter-insider threat, and other workplace management programs to generate descriptive analysis, develop predictive models, and support decision-makers and researchers in those programs with actionable information.

C.5.4.3.2 Specific requirements include conducting analyses using (a) basic descriptive statistics; (b) statistical correlation; (c) significance testing; (d) predictive modeling including standard forms of regression; (e) experimental design; (f) classification; (g) machine learning; and

(h) text analysis and language processing.

DRAFT PWS 6

C.5.4.4 Research and Analysis Results Presentation

C.5.4.4.1 The contractor shall demonstrate expertise presenting results in written and oral form.

C.5.4.4.2 Specific requirements include (a) writing standard research reports; (b) authoring briefing slides; (c) delivering oral briefings; (d) displaying quantitative results in a wide variety of data visualizations; (e) displaying qualitative data in a variety of graphical formats, including flowcharts; (f) providing technical reviews and technical and grammar editing; and (g) generating user manuals, data dictionaries, and other documentation.

C.5.4.5 Technology Expertise

C.5.4.5.1 The contractor shall have expertise in the following technologies:

SPSS

R/R-Studio Python Microsoft Office suite Microsoft Access MS Project Visual Basic SQL, Relational databases Oracle database administration

NVIVO

C.5.4.5.2 Expertise with the following technologies would be beneficial:

QLIK

DataBricks DataRobot

C.6 DELIVERABLES:

Deliverables: In addition to the following deliverables, each task order will identify additional required deliverable for each order awarded.

Deliverable PWS Reference Delivery Date

Monthly Status Report F.7 Third Business Day of Each Month

Trip Reports F.7 If required by Task Individual Task Order – Refer to Task Order Instruction

C.7 CONTRACTOR MANPOWER REPORTING

DRAFT PWS 7

The contractor shall report ALL contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract for the DHRA/OPA via a secure data collection site. The contractor is required to completely fill in all required data fields using the following web address: http://www.ecmra.mil/. Reporting inputs will be for the labor executed during the period of performance during each Government fiscal year (FY), which runs October 1 through September 30.

While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year. Contractors may direct questions to the help desk at help desk at:

http://www.ecmra.mil

C.8 SECURITY:

C.8.1 Perform offsite work with government approved systems that meet DOD Instruction

8500.01 Cybersecurity and DOD Instruction 8510.01 Risk Management Framework (RMF) requirements. Systems must have and maintain and Authority to Operate (ATO) or if acceptable to the government, an ATO with Conditions.

C.8.2 Contractor and all Contractor personnel with access to or responsibility for nonpublic Government data under this contract shall comply with DoD Directive 8500.1 Information Assurance (IA), DoD Instruction 8502.2 Information Assurance (IA) Implementation, DoD Directive 5400.11 DoD Privacy Program, DoD 6025.18-R DoD Health Information Privacy Regulation, DoD 5200.2-R Personnel Security Program, and Homeland Security Presidential Directive (HSPD) 12.

C.8.3 Contractor shall establish appropriate administrative, technical, and physical safeguards to protect any and all nonpublic Government data to ensure the confidentiality, integrity, and availability of government data.

C.8.4 Contractor systems and information networks that receive, transmit, store or process nonpublic government data must be accredited according to DoD 8510.01 RMF and DoDI 8500.01 Cyber-security. All systems subject to RMF must present evidence of Assessment and Accreditation (A&A) testing in the form of an ATO and Plan of Action and Milestones (POA&M). Evidence of FISMA compliance must be presented in the form of a POA&M. The Contractor will be responsible for the cost of Cybersecurity A&A and FISMA testing required for any Contractor owned and operated network, facility, and/or application processing DoD information.

C.8.5 The Contractor shall ensure all media containing sensitive information (e.g., hard drives, removable disk drives, CDs, DVDs) considered for disposal will be destroyed. Prior to destruction, media will be sanitized (i.e., all prudent and necessary measures shall be taken to ensure data cannot be retrieved through known conventional or unconventional means.) USB Flash drive use is prohibited by DoD.

C.8.6 To the extent that the work under this contract requires the Contractor to have access to DoD sensitive information the Contractor shall after receipt thereof, treat such information as confidential and safeguard such information from unauthorized use and disclosure. The Contractor agrees not to appropriate such information for its own use or to disclose such information to third parties unless specifically authorized by the Government in writing.

C.8.7 The Contractor shall allow access only to those employees who need the sensitive information to perform services under this contract and agrees that sensitive information shall be used solely for the purpose of performing services under this contract. The Contractor shall ensure that its http://www.ecmra.mil/ http://www.ecmra.mil/

DRAFT PWS 8

employees will not discuss, divulge, or disclose any such sensitive information to any person or entity except those persons within the Contractor’s organization directly concerned with the performance of the contract.

C.8.8 Contractor shall administer a monitoring process to ensure compliance with DoD Privacy Programs. Any discrepancies or issues should be discussed immediately with the Contracting Officer Representative (COR) and corrective actions will be implemented immediately.

C.8.9 The Contractor shall report immediately to the DMDC Cybersecurity/Privacy Office and secondly to the COR discovery of any Privacy breach. Protected PII is an individual’s first name or first initial and last name in combination with any one or more of the following data elements including, but not limited to: social security number; biometrics; date and place of birth; mother’s maiden name;

criminal, medical and financial records; educational transcripts, etc.

C.8.10 Contractor personnel with access to DMDC systems or data must comply with HSPD-12 Personal Identity Verification (PIV) issuance requirements, known as the Common Access Card (CAC) for DMDC and must be CAC or PIV ready prior to beginning work on this contract:

(a) All Contractor personnel must obtain/maintain a favorable FBI National Criminal History Check (fingerprint check).

(b) Two forms of identity proofed identification (I-9 document).

(c) Be citizens of the United States.

(d) Submit a Standard Form (SF) 86 National Security Questionnaire through e-QIP that is favorably accepted by the Office of Personnel Management (OPM) for those:

i. Who do NOT have an active security clearance

ii. Will be obtaining a position of trust through DMDC or

iii. Have NOT been favorably adjudicated within the last 24 months.

(e) Background investigation has been scheduled by OPM.

(f) Maintain favorable FBI National Criminal History checks and ensure completion and successful adjudication as required for Federal employment.

(g) Obtaining CAC or PIV ready status is the responsibility of the contractor. It is the responsibility of the contractor to notify DMDC when this is complete.

C.8.10.1 Obtain/maintain a favorable FBI National Criminal History Check (fingerprint check).

C.8.10.2 Two forms of identity proofed identification (I-9 document).

C.8.10.3 Be citizens of the United States.

C.8.10.4 Submit a Standard Form (SF) 86 National Security Questionnaire through e-QIP that is favorably accepted by the Office of Personnel Management (OPM) for those:

Who do NOT have an active security clearance Will be obtaining a position of trust through DMDC or Have NOT been favorably adjudicated within the last 24 months.

C.8.10.5 Background investigation has been scheduled by OPM.

C.8.10.6 Maintain favorable FBI National Criminal History checks and ensure completion and successful adjudication as required for Federal employment.

DRAFT PWS 9

C.8.10.7 Obtaining CAC or PIV ready status is the responsibility of the contractor. It is the responsibility of the contractor to notify DMDC when this is complete.

C.8.11 If at any time, any Contractor person requiring a CAC is unable to obtain/maintain an adjudicated NACLAC, the Contractor shall immediately notify the DMDC Information Systems Security Group (DISSG) remove such person from work under this contract.

C.8.12 The Contractor shall report immediately to the DMDC CIO/Privacy Office and secondly to the COR discovery of any Privacy breach.

C.8.13 Personnel in section 4.1 shall be required to have and maintain an IT-1 clearance on day of award, all others shall have IT-2 unless otherwise defined in the individual task order. Facility clearance shall be submitted to the COR within 3 days of contract award.

C.8.14 All Contractor personnel with access to DMDC systems or data must comply with DODI 5200.2-R. All persons on this contract will be designated as either an IT-1 or IT-2 as determined by the Government per position responsibilities.

C.8.14.1 Prior to beginning work on this contract, the contractor will complete all required DMDC personnel security requirements as specified by the Human Resource and Facilities Division.

(a) Submit a Standard Form (SF) 86 National Security Questionnaire through e-QIP that is favorably accepted by the Office of Personnel Management (OPM) for all employees under this contract requesting a position of trust.

(b) It is the responsibility on the contractor to ensure their employees and sub-contractors, if applicable, comply with DMDC personnel security requirements.

C.8.15 Security Clearance Requirements

C.8.15.1 All Contractor personnel requiring access to classified information will need to obtain the appropriate security clearance prior to beginning work on this contract.

C.8.15.2 DMDC is not responsible for processing contractor personnel for national security clearance

(SECRET, TOP SECRET, TOP SECRET/SCI).

(a) The contractor must comply with required DMDC personnel security requirements as specified by the Cybersecurity Branch.

(b) Interim Clearances will be reviewed upon notification to DMDC Information Security Branch.

(c) It is the responsibility of the contractor FSO to notify DMDC immediately if there is a change in clearance eligibility.

(d) If at any time, any Contractor FSO is unable to obtain/maintain an adjudicated Personnel

Security Investigation (PSI), the Contractor shall immediately notify the DMDC Cybersecurity Branch and remove such person from work under this contract.

C.8.16 LAN Access Requirements:

C.8.16.1 It is the responsibility of the contractor to comply with account access requirements as specified by the DMDC Cybersecurity Branch. At minimum:

(a) Completed DMDC personnel security requirements.

DRAFT PWS 10

(b) Complete DD 2875 Form(s) for all access required.

(c) Submit proof of completion for Personally Identifiable Information (PII) Training.

(d) Submit proof of completion Information Assurance/Cyber Awareness Challenge

Training.

(e) Adhere to and sign the DMDC Information Systems User Agreement(s).

C.8.16.2 Final approval for all IA tasks under this contract belongs to the Chief Information Office (CIO), Cybersecurity Branch. The contractor is expected to obtain this final approval from Cybersecurity. All IA-related design, decisions, including cryptography, authentication, access control, data transfer and storage, Need-to-Know (NTK), or other IA technologies, must be coordinated with and approved by Cybersecurity.

(a) Work performed on this contract must be done using government provided email. Personal or company email shall not be used to perform government work.

(b) Work performed on this contract must be done using government furnished equipment.

Personal or company equipment shall not be used to perform (including store or transmit) government work.

C.9. QUALITY CONTROL PLAN (QCP):

The contractor shall implement and maintain a QCP to ensure work performed conforms to the scope of work and meets the requirements under this PWS. The QCP shall, at a minimum, provide a method for performing inspections; identifying, correcting, and preventing problems/defective service; addressing customer complaints and improving the quality of services over the life of the contract.

C.10 QUALITY ASSURANCE:

C.10.1. The Government reserves the right to perform inspections and surveillance to evaluate the Contractor’s compliance to the contract terms and performance of the requirements in the PWS. The Government will make every effort to ensure that the surveillance methods described below are conducted in an objective, fair, and consistent manner. The Government will utilize a Quality Assurance Surveillance Plan (QASP) that will be issued with each respective task order to monitor and evaluate contractor performance.

C.10.1.1. Periodic Surveillance. This action occurs when the COR or other Government official observes a deficiency. Examples include evidence from accidents, incidents, or delays. Regardless of where in the line-of-duty the COR observes contractual procedures not being followed, he/she has an obligation to document and report the deficiency to the Contracting Officer.

C.10.1.2. Customer Complaint Surveillance. This action is instituted when the COR receives a complaint from a stakeholder regarding contractor service. The COR will obtain the complaint in writing and then conduct an investigation to determine its validity. If the complaint is deemed valid, the COR will immediately notify the contracting Officer for action. The COR will notify both the Contract Manager and the complainant of the Government’s response to their complaint.

C.10.2. Contract Discrepancy Report (CDR). In the event of unsatisfactory contractor performance, the COR or CO will issue a CDR that will explain the circumstances and findings concerning the incomplete or unsatisfactory service. The contractor shall acknowledge receipt of the CDR and respond in writing as to how he/she shall correct the unacceptable performance and avoid a recurrence. The Government will review the contractor’s corrective action response to determine acceptability and will

DRAFT PWS 11

use any completed CDR as part of an overall evaluation of Contractor performance when determining present or future contractual actions.

C.10.3. The table associated with each task order will identify the Critical Performance Elements and the respective Performance Standards and Acceptable Quality Levels (AQLs) which the Government will use to determine contractor performance.

C.11 APPLICABLE DOCUMENTS:

DOCUMENT WEB LINK

DoDI 8500.2, Information Assurance (IA)

Implementation http://www.dtic.mil/whs/directives/corres/pdf/850002p.pdf

DOD Instruction 8500.01 Cybersecurity http://dtic.mil/whs/directives/corres/pdf/850001_2014.pdf

DOD Instruction 8510.01 Risk Management

Framework (RMF) http://www.dtic.mil/whs/directives/corres/pdf/851001_2014.pdf.

DoD Directive 8500.1 Information Assurance

(IA)

www.dtic.mil/whs/directives/corres/pdf/850001p.pdf

DoD Instruction 8502.2 Information Assurance (IA) Implementation www.dtic.mil/whs/directives/corres/pdf/850001p.pdf

DoD Directive 5400.11 DoD Privacy Program www.dtic.mil/whs/directives/corres/pdf/540011p.pdf

DoD 6025.18-R DoD Health Information Privacy Regulation www.dtic.mil/whs/directives/corres/pdf/602518r.pdf

DoD 5200.2-R Personnel Security Program www.dtic.mil/whs/directives/corres/pdf/520002r.pdf

Homeland Security Presidential Directive

(HSPD) 12

http://www.dhs.gov/homeland-security-presidential-directive-12

C.12 GENERAL INFORMATION:

This contractor shall provide on and off -site services for the research and evaluation of the Research for Personnel Security, Suitability and Reliability Systems for the Defense Manpower Data Center (DMDC). All work shall be performed in accordance with this Performance Work Statement (PWS).

C.13 REPORTS:

C.13.1 The contractor shall be responsible for the quality of deliverables for the delivery orders.

All reports except monthly reports shall be prepared in accordance with PERSEREC report guidelines as specified in each task order. The contractor shall be responsible for all reports complying with the http://www.dtic.mil/whs/directives/corres/pdf/850002p.pdf http://www.dtic.mil/whs/directives/corres/pdf/851001_2014.pdf

DRAFT PWS 12

Guidelines as well as all other requirements of this contract. All reports, as well as other documents such as manuals and briefings, shall be carefully edited to ensure that the highest standards of written communication, typing, reproduction, etc. are attained. Reports shall be delivered by the contractor ready for printing with completed Report Documentation Page (SF 298), Tables of Contents, and Executive Summaries, etc., as required by the specific delivery order. Unless stated otherwise in a specific delivery order, any technical report, final technical report, user manual, or other document that is in need of copy editing when submitted to DMDC will be returned to the contractor as unacceptable.

C.13.2 The contractor shall deliver one copy of each report or document on diskette in Word for Windows (or as specified on the delivery order) software format from which the manuscript was printed and which is free of all extraneous codes such as paragraph marks at the end of every line in a paragraph. The contractor shall also deliver one camera-ready copy of all figures, tables, or other art work used in the final document, and one copy of the negative and/or computer file as appropriate for each graphic image. DMDC as part of Office of the Under Secretary of Defense for Personnel and Readiness (OUSD (P&R)) is standardizing on the Microsoft Office Suite in the Windows environment and requires compatible file formats in all deliverables.

(a) Weekly and monthly status reports may be submitted by electronic mail. Other deliverables, with delivery order Contracting Officer approval, may be submitted by electronic mail that preserves all file characteristics and formatting.

(b) Unless stated otherwise in the specific Task order the Government will be allowed fifteen

(15) working days for each review of a draft or final dataset or technical document and to notify the contractor of acceptability. In the event that the Government exceeds the amount of time set forth in the delivery order for review, approval, and/or recommending changes in the draft, the contractor shall be allowed one (1) additional day, at no additional cost to the Government, for each day of such delay for delivery of the final report in final form, providing that in the event the Government causes such delay, the contractor shall request an extension in writing from the Contracting Officer.

(c) Once agreed upon, the contractor shall strictly adhere to the schedule and all task dates.

Monthly progress reports for each delivery order shall summarize the support tasks performed under that delivery order and shall describe all problems encountered or anticipated; the status of the tasks, milestones achieved or missed, and anticipated activities for the next reporting period. It shall reflect the current fiscal status of the delivery order.

The contractor shall send each progress report to the designated COR as required by the contract to the addresses designated by the COR.

C.14 RELEASE OF REPORTS:

The contractor shall not publish nor distribute instruments, data, or findings from this contract research without prior review and approval of DMDC. All papers, reports, professional or lay publications, and presentations at meetings and conventions must be sent to the COR for review and approval. The contractor should be aware that review by DMDC normally takes four (4) weeks.

C.15 DISCLAIMER STATEMENT:

All reports resulting from this study shall cite DMDC support (including contract and delivery order number) and shall include the following disclaimers, “The views, opinions, and/or findings contained in this report (paper) are those of the author(s) and should not be construed as an official DMDC position, DRAFT PWS 13 policy or decision unless so designated by other official documentation.” The contractor shall ensure that all subcontractors are aware of and agree to the provisions of this paragraph.

C.16 AUTHORSHIP:

Publication credit for DMDC technical publications is assigned proportionately to in-house and contracted personnel who have contributed to the product. Proper acknowledgment of DMDC sponsorship and responsibility shall be included. Generally, authorship credit shall be restricted to the three persons making the largest creative contribution to the total effort, from the formulation of the problem to the final technical report.

C.17 DISSEMINATION OF INFORMATION:

There shall be no dissemination of publication, except within and between the contractor and any subcontractors, of information developed under this contract or contained in the reports to be furnished pursuant to this contract without prior written approval from the Contracting Officer.

C.18 ROYALTY-FREE LICENSE:

In consideration of the sum to be paid to the contractor under this contract, the contractor hereby agrees and does grant, convey, and reserves to the United States of America a nonexclusive, irrevocable, worldwide, royalty-free license in all written material, published, printed, presented or used in connection with the contract, in which the contractor presently holds a copyright or in the future shall obtain a copyright therein or in which he has the right to issue royalty-free licenses thereto.

C.19 GOVERNMENT FURNISHED EQUIPMENT FOR ON-SITE PERSONNEL:

Defense Manpower Data Center (DMDC) will provide standard desktop computers with appropriate application software and access to computer networks to perform the tasks identified in this Statement of Work. DMDC will also provide office space, phone lines, office furniture and related office equipment which will include consumable supplies for personnel working directly on this contract.

C.20 CONTRACTOR – GOVERNMENT MEETINGS:

Technical or other meetings between the Contractor and the Government may be needed during the duration of the contract to facilitate understanding of the contract requirements or to resolve contractual issues. All Contractor costs associated with attendance at these meetings shall be incidental to the contract and not separately billed.

C.21 SMALL BUSINESS SUBCONTRACTING:

It is the U.S. General Services Administration (GSA) goal to assist the Defense Manpower Data Center (DMDC) in meeting or exceeding the statutory goals for small businesses. With this said, GSA is interested in pursuing small business subcontracting under this contract. Contractors are encouraged to achieve small business subcontracting goals to the maximum extent possible. For your information, the FY 2015 Defense Manpower Data Center (DMDC) small business subcontracting goals are listed below:

Small Business 43%

DRAFT PWS 14

Small Disadvantaged Business 5%

Woman-Owned Small Business 5%

HUBZone Small Business 3%

Service-Disabled Veteran-Owned Small Business

3%

For this contract, the Contractor shall establish, maintain, and adhere to a Small Business Subcontracting Plan that commits the maximum practicable opportunity for small businesses within the contract. The plan shall be accordance with FAR Part 19, with specific attention paid to FAR 19.7 and FAR 52.219.9, alternate II. This includes, but is not limited to:

(a) Estimating the value and percentage goals of the services to be subcontracted to small businesses.

(b) Incorporating small businesses into the core team of companies.

(c) Stipulating the plans for mentoring emerging and small businesses during their services.