IDIQ Contract PWS as of 18 Mar 26 v3.docx

PERFORMANCE WORK STATEMENT (PWS)

Part 1

General Information

1. GENERAL: This is a non-personnel services contract to provide Information Technology (IT) Services. The Government will not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the IDIQ Contractor who, in turn is responsible to the Government.

1.1 Description of Services/Introduction: The Contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform installation/repair of inside/outside plant copper cable and fiber optic cable at various locations within Fort Gordon, Gillem Enclave, Forrest Park, Peachtree City, and all other areas serviced by the Fort Gordon - Stand Alone Network Enterprise Center (FG-SANEC), to include abatement (asbestos) as defined in this Performance Work Statement. The Contractor shall perform to the standards in this contract as defined in this Performance Work Statement, except for those items specified as government furnished property and services.

1.2 Background: Fort Gordon has ongoing cabling support for Fort Gordon, Georgia and other areas serviced by FG-SANEC.

1.3 Objectives: Provide high quality installation of fiber optic and copper projects.

1.4 Scope: Installation of Outside Plant (OSP) cabling to include concrete encasement, aerial cabling, inside plant wiring, Cat 6 or Higher, plenum rated cabling and floor boxes. Troubleshooting OSP and Inside Plant installation and provide copies of test results to the government point of contact (COR) for acceptance once the project is completed. The Contractor shall perform abatement in work areas if required.

1.5 Period of Performance: The period of performance shall be for one (1) Base Year of 12 months and four (4) 12-months option years. The Period of Performance reads as follows:

Base Year: 20 August 2026 – 19 August 2027 Option Year 1: 20 August 2027 – 19 August 2028 Option Year 2: 20 August 2028 – 19 August 2029 Option Year 3: 20 August 2029 – 19 August 2030 Option Year 4: 20 August 2030 – 19 August 2031

1.6 General Requirements

1.6.1 Quality Control and Quality Assurance.

1.6.1.1 Contract Quality Requirements. Contract requirements/terms contained in the PWS include those that articulate service and deliverable requirements, and any PWS quality requirements, such as Quality Management Plan, Quality Control Plan (QCP), and so forth. Quality Control (QC) is the responsibility of the Contractor. The Contractor is responsible for the control of its quality to ensure delivery of quality services to the Government in accordance with (IAW) the terms and conditions and the applicable inspection clauses.

1.6.2 Quality Control. The Contractor shall develop, implement, and maintain an effective Quality Control System that includes a written QCP. The QCP shall implement standardized procedures/methodology for monitoring and documenting contract performance to ensure all contract requirements are met.

1.6.2.1 An optimal QCP shall identify potential problem areas and evolve over the life of the contract. The Contractor’s QCP shall contain a systematic approach to monitor operations to ensure acceptable services are provided to the Government.

1.6.2.2 The QCP, as a minimum, shall address continuous process improvement; procedures for scheduling, conducting, and documenting inspection; discrepancy identification and correction; corrective action procedures, to include procedures for addressing Government-discovered nonconformances; procedures for root cause analysis to identify the root cause and root cause corrective action to prevent recurrence of discrepancies; procedures for trend analysis; and procedures for collecting and addressing customer feedback/complaints.

1.6.2.3 The Contractor, upon request, shall provide to the Government its QC documentation.

1.6.2.4 The Contractor shall provide the Government with an electronic copy of its comprehensive QCP in Microsoft Word format or Portable Document Format (PDF) within 30 calendar days after award date to the Contracting Officer and Contracting Officer’s Representative (COR) for approval. After acceptance of the QCP, the Contractor shall receive the Contracting Officer’s acceptance in writing of any proposed change to its QCP.

1.6.3 Quality Assurance.

1.6.3.1 The Government will evaluate the Contractor’s performance under this contract IAW the Quality Assurance Surveillance Plan (QASP). This plan is a Government-only document primarily focused on what the Government must do to assure that the Contractor has performed IAW the requirements of the contract. The Government has the right to conduct inspections and performance evaluation at any time. If any aspect of the performance is not in conformance with the requirements of this contract, the Government has the right to issue to the Contractor a Nonconformance Report (NCR).

1.6.3.2 Corrective Action. At any time it is determined by the Contracting Officer that the quality control system, personnel, instructions, controls, tests, or records are not providing results that conform to contract requirements, the Contractor shall take action to correct the deficiency. If an NCR is issued, the Contractor shall develop a Corrective Action Plan (CAP) that identifies the root cause, Corrective Action (CA) for the root cause, CA for the specific nonconformance, CA to the root cause to prevent recurrence, and a timeline for completion.

1.6.3.2.1 Nonconformance Report.

1.6.3.2.1.1 An NCR is a letter to a Contractor that identifies nonconformance of contract requirement or identifies business system deficiencies and requests Contractor corrective action with the purpose to both correct the immediate nonconformance/deficiency, and to prevent recurrence. Nothing in the NCR changes any terms or conditions of the contract or waives any rights the Government has under the contract or in law.

1.6.3.2.1.2 An NCR is neither a contract action nor a contract remedy, but it can be a precursor to one (though not required). It is also not a punitive action (though multiple uncorrected problems or ineffective corrective action could lead to contract remedies). It is a tool and process used to document failure(s) to meet contract/task order requirements and to work with Contractors to resolve performance issues, with the goal to prevent the need for contractual remedy. It is also a tool to provide the Contractor an opportunity to correct or replace nonconforming work when it can be accomplished within the delivery schedule.

1.6.3.2.1.3 The three types of nonconformance, as defined in FAR 46.101, are Level 1 (Minor), Level 2 (Major), and Level 3 (Critical).

1.6.3.2.1.4 NCRs are a part of the performance records, but, at the discretion of the assessing official, may be included in the Contractor Performance Assessment Reporting System (CPARS).

1.6.4 Corrective Action Plan Requirements. The Contractor shall provide a CAP in response to an NCR within 10 business days of receipt or as instructed in the NCR. The CAP shall include:

1.6.4.1 Actions planned or taken to correct the specific nonconformance.

1.6.4.2 Root cause analysis of the nonconformance.

1.6.4.3 Corrective action planned or taken to eliminate the root cause(s) and prevent recurrence of the nonconformance, to include addressing people, process, and/or tools as necessary.

1.6.4.4 Determination of whether other processes/products/services/work are affected by the root cause(s), including product/service/work already delivered to the Government.

1.6.4.5 Corrective action milestones and target date(s) for implementation.

1.6.5 Recognized Holidays:

1.6.6 Hours of Operation. The contractor is responsible for conducting business, between the hours of 0600 and 1700 Monday thru Friday except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. For other than firm fixed price contracts, the contractor will not be reimbursed when the government facility is closed for the above reasons. The Contractor must always maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons. When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the workforce are essential.

1.6.7 Place of Work and Work Hours. The work to be performed under this contract will be performed at Fort Gordon, Gillem Enclave, Forrest Park, GA, Peachtree City, GA and all other areas serviced by the FG-SANEC. ACCESS TO CLASSIFIED INFORMATION IS LIMITED TO GOVERNMENT WORK LOCATIONS. NO CLASSIFIED INFORMATION SHALL BE DISCUSSED, PROCESSED, OR STORED IN THE CONTRACTOR’S FACILITY. The Government requires support from 0700 – 1700, Monday through Friday, excluding Federal holidays. The Contractor shall ensure appropriate coverage from 0700 to 1700. The workday shall start between 0600 and 0800, and end between 1500 and 1700 depending on company policy for lunch periods. A regularly scheduled lunch break must be taken. The KO must approve, in advance, any deviation from the standard schedule, including any additional duty hours and all overtime supporting this requirement.

1.6.8 Type of Contract: The government will award an Indefinite-Delivery Indefinite-Quantity (IDIQ) contract.

1.6.6 Security Requirements: This requirement does not require access to classified and controlled or sensitive information and facilities. IDIQ Contractor personnel shall comply with all applicable security and safety regulations, guidance, and procedures, including local, referenced in this PWS and in effect at the work sites.

1.6.6.1 Access and General Protection Security Policy and Procedures: IDIQ Contractor and all associated IDIQ sub-Contractor employees shall provide all information required for background checks to meet installation access requirements to be accomplished by the installation Provost Marshal Office (PMO), Director of Emergency Services (DES), or Security Office. IDIQ Contractor workforce shall comply with all personal identity verification requirements of FAR clause 52.204-9, Personal Identity Verification of Contractor Personnel. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in IDIQ Contractor security matters or processes.

1.6.6.2 Physical Security: The IDIQ Contractor shall have the IDIQ contractors sign in/out keys to the core nodes from the COR. If/when they require access to manholes, the COR signs in/out the keys from the Voice Branch and issues to the contractors only during the performance of the contract. This will ensure the Plans and Voice Branches maintain control of keys signed out regarding IDIQ contract work.

1.6.6.3 Threat Awareness and Reporting Program (TARP) Training. All cleared contractor personnel assigned to this contract shall complete initial and annual TARP training. Completion of training shall be reported to the COR. Detailed requirements on TARP are stated in the DD Form 254.

1.6.6.4 Key Control: The IDIQ Contractor shall establish and implement methods of making sure all keys/key cards issued to the IDIQ Contractor by the Government are not lost or misplaced and are not used by unauthorized persons. NOTE: All references to keys include key cards. No keys issued to the IDIQ Contractor by the Government shall be duplicated. The IDIQ Contractor shall develop procedures covering key control that shall be included in the Quality Control Plan. Such procedures shall include turn-in of any issued keys by personnel who no longer require access to locked areas. The IDIQ Contractor shall immediately report any occurrences of lost or duplicate keys/key cards to the Contracting Officer. The IDIQ Contractor shall be solely responsible for the costs of all replacement locks and keys, issued to their Company employees and sub-Contractors.

1.6.6.4.1 In the event keys, other than master keys, are lost or duplicated by the contractor, the Government, at its option, will replace the affected lock(s) or perform re-keying. The cost for the replacement lock(s) or re-keying shall be paid for by the IDIQ Contractor. In the event a master key is lost or duplicated, all locks and keys for that system shall be replaced by the Government. The cost for replacement lock(s) and keys shall be paid for by the IDIQ Contractor.

1.6.6.4.2 The IDIQ Contractor shall not use Government Issued Keys for any purpose other than in support of task orders issued based on this contract. The IDIQ Contractor shall prohibit the use of Government issued keys/key cards by any persons other than the IDIQ Contractor’s employees. The IDIQ Contractor shall prohibit the opening of locked areas by IDIQ Contractor employees to permit entrance of persons other than IDIQ Contractor employees engaged in the performance of assigned work in those areas, or personnel authorized entrance by the Government.

1.6.6.5 Lock Combinations: The IDIQ Contractor shall establish and implement methods of ensuring that all lock combinations are not revealed to unauthorized persons. New lock combinations will be given to the COR upon completion of each TASKORD. The COR will validate that locks with new combinations are operable.

1.6.6.6 Contractors shall contact the COR to request access to core nodes, manholes and all other communications facilities managed by FG-SANEC.

1.6.7 Special Qualifications:

1.6.7.1 Training: All Contractor personnel shall be trained and have the required certification to provide the support as defined in this PWS. The Government will only provide one-time training to the existing contractor personnel for new technology not previously identified that can be directly correlated to the tasks within the PWS. If trained Contractor personnel are replaced, the Contractor shall be responsible for training the replacement employees at the Contractor’s expense before they begin work on this contract.

1.6.7.2 Program Manager: Shall be Building Industry Consulting Service International (BICSI) Registered Communications Distribution Designer (RCDD) for design and installation and certified to approve projects.

1.6.7.3 Installers: Shall be BICSI registered Cabling Installers or have documentation supporting a minimum of three (3) years’ experience installing inside and outside plant cabling.

1.6.8 Post Award Conference/Periodic Progress Meetings: The IDIQ Contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation Subpart 42.5. The contracting officer, Contracting Officers Representative (COR), and other Government personnel, as appropriate, may meet periodically with the IDIQ Contractor to review the IDIQ Contractor's performance. At these meetings, the Contracting Officer (KO) will apprise the IDIQ Contractor of how the government views the IDIQ Contractor's performance. The IDIQ Contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve any outstanding issues. These meetings shall be at no additional cost to the government.

1.6.9 Contracting Officer Representative (COR): The KO will provide a COR Designation Letter for this Contract upon award. The IDIQ Contractor shall acknowledge the COR Designation Letter in writing and return to the KO within five (5) business days of receipt.

1.6.10 Supervision of IDIQ Contractor Employees: The Government will not exercise any supervision or control over IDIQ Contractor or sub-Contractor employees while performing work under the contract. Such employees shall be accountable solely to the IDIQ Contractor, not the Government. The IDIQ Contractor, in turn, shall be accountable to the Government for IDIQ Contractor or sub-Contractor employees.

1.6.11 IDIQ Contractor Personnel: The IDIQ Contractor shall provide a workforce possessing the skills, knowledge, and training to perform satisfactorily the requirements of services in this PWS. The IDIQ Contractor employees shall have the ability to communicate proficiently in the English language. Personnel performing work under this PWS shall remain employees of the IDIQ Contractor and shall not be considered employees of the Government. If the IDIQ Contractor becomes aware that personnel are not performing requirements of this contract IAW the terms, the IDIQ Contractor shall maintain personnel provisions to correct the deficiencies, up to and to include removing such personnel. The IDIQ Contractor shall be responsible for the immediate removal of employees for misconduct or other causes prejudicial to the maintenance of health, welfare, morale or security to the work locations and personnel at those locations. The IDIQ Contractor shall be aware of the Installation Commander’s responsibility for the general security and well-being of personnel, and shall ensure that personnel removal provisions support the Installation Commander in this regard. The Government has an inherent right under law, practice and regulation, to control access to its facilities, property, and data, including those that are the subject of this contract. Access privileges will be tailored to individual IDIQ Contractor personnel responsibilities. The Government will be the final authority in determining access privileges. Under the authority of 18 U. S. C. Chapter 67, the Government’s exercise of its right to grant and revoke access by particular individual(s) to its facilities will not constitute a breach or change to this contract, regardless of whether said individual(s) are employed by the IDIQ Contractor, and regardless of whether said individuals are thereby precluded from performing work under this PWS. It is the IDIQ Contractor’s responsibility to propose the correct labor types, mix, and hours in the proposal and during performance to meet the requirements of the performance work statement.

1.6.12 Key Personnel: The IDIQ Contractor shall provide a contract manager who shall be responsible for the performance of the work. The name of this person and an alternate who shall act for the IDIQ Contractor when the manager is absent shall be designated in writing to the contracting officer. The contract manager or alternate shall have full authority to act for the IDIQ Contractor on all contract matters relating to daily operation of this contract. The contract manager or alternate shall be available between 0700 to 1700 hours, Monday thru Friday except Federal holidays or when the government facility is closed for administrative reasons.

1.6.13 IDIQ Contractor Identification Requirements:

1.6.13.1 In accordance with FAR 37.114(c), all contractor personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious are required to identify themselves as such to avoid being mistaken for Government officials. Contractors performing work at Government workplaces shall provide their employees with an easily readable identification (ID) badge indicating the employee’s name, the contractor’s name, the functional area of assignment, and a recent color photograph of the employee. Contractors shall require their employees to wear the Contractor ID badges visibly along with the Government issued CAC card and/or special access badges when performing work at Government workplaces. Contractor personnel shall also ensure that all e-mails, documents, or reports they produce are suitably marked as Contractor products and/or that Contractor participation is appropriately disclosed. All signature blocks on e-mails shall indicate that the sender is a Contractor employee and include the Contractor's company name.

1.6.13.2 Contractor personnel who are retired military shall not use their retired military rank/titles while working in an official role as a Government contractor on this contract.

1.6.14. Common Access Card (CAC):

1.6.14.1. Before CAC issuance, the Contractor employee requires, at a minimum, a favorably adjudicated Tier 1 (T1) (formerly NACI) or an equivalent or higher investigation in accordance with Army Directive 2014-05. The Contractor employee will be issued a CAC only if duties involve one of the following: (1) Both physical access to a DoD facility and access, via logon, to DoD networks on-site or remotely; (2) Remote access, via logon, to a DoD network using DoD-approved remote access procedures; or (3) Physical access to multiple DoD facilities or multiple non-DoD federally controlled facilities on behalf of the DoD on a recurring basis for a period of 6 months or more. At the discretion of the sponsoring activity, an initial CAC may be issued based on a favorable review of the Federal Bureau of Investigation (FBI) fingerprint check and a successfully scheduled T1 investigation at the Army’s investigative provider.

1.6.14.2. The Government will provide special access badges as necessary. The Prime Contractor Facility Security Officer (FSO) shall ensure that all Contractor personnel acquire and maintain CACs. The approving Government Mission Partner Affiliation Sponsor (MPAS) will create the CAC application for the Contractor employee in the online portal called Mission Partner Identity, Credential and Access Management (MP ICAM), https://mpartnerspnrweb.dmdc.osd.mil/mpartnerspnrweb/app/. Contractor eligibility remains in force during employment under the contract for those employees who have a valid and recurring requirement for access to Government facilities or automation systems (reference DD Form 254 for additional security requirements) to perform those duties stipulated in the contract. The Contractor shall use a valid CAC to access the Government domain. The Contractor shall immediately return the CACs to the COR when the Contractor employee’s employment is terminated or upon expiration of the contract. The CACs expire when Contractor employee’s eligibility terminates or three years from the issuance date, whichever occurs first. The Contractor is responsible for all CACs and shall report all lost or stolen CACs to the COR immediately.

1.6.15 Travel.

1.6.15.1 The Contractor shall provide support at CONUS locations. The support outside Fort Gordon, GA and Gillem Enclave, GA, areas will be designated as TDY. The Contractor shall obtain all necessary travel documents to execute travel as required, including but not limited to U.S. Government-issued passports to support OCONUS travel requirements. The Contractor shall ensure all Contractor employees comply with all guidance, instructions, and general orders applicable to U.S. Armed Forces and DoD civilians and issued by the Theater Commander or his/her representative. This shall include any and all guidance and instructions issued based on the need to ensure mission accomplishment, force protection, and safety. The Government will reimburse the Contractor, in accordance with the Joint Travel Regulation (JTR) and FAR part 31.205-46, for all approved travel incurred during the performance of this task order. The COR will approve all travel requirements before travel begins.

1.6.15.2 The COR will issue travel subtasks via email to the Contractor that include destination, dates, duration of stay, purpose, and estimated cost. Travel requests for deployment will specify additional travel conditions. The Contractor shall not proceed without this notification and adequate contract/task order funding.

1.6.16 Other Direct Costs: This category includes travel (outlined in 1.6.15), reproduction, and shipping expenses associated with training activities and visits to IDIQ Contractor facilities. It could also entail the renting of suitable training venues.

1.6.17 Data Rights: The Government has unlimited rights to all documents/material produced under this contract. All documents and materials, to include the source codes of any software, produced under this contract shall be Government owned and are the property of the Government with all rights and privileges of ownership/copyright belonging exclusively to the Government. These documents and materials may not be used or sold by the IDIQ Contractor without written permission from the Contracting Officer. All materials supplied to the Government shall be the sole property of the Government and may not be used for any other purpose. This right does not abrogate any other Government rights.

1.6.18 Access to Protected Information. Protected information means all non-public information, including, but not limited to, trade secrets or proprietary information of other Contractors, Government source selection information, Privacy Act or personally identifiable information (PII), or any other information with distribution limited by the Government. If, during the performance of this requirement, Contractor personnel obtain access by any means to protected information, they shall not disclose, publish, divulge, release, or make known, in any manner or to any extent, the information except as necessary to carry out duties under this contract. Protected information shall be given only to persons specifically granted access to this sensitive information and may not be further divulged without specific prior written approval from an authorized U.S. Government individual. Further, contractor employees may use any non-public information for official/authorized Government purposes, and they shall not use the information for their personal gain, the gain of their employer, or the gain of anyone else. The Contractor shall notify the Contracting Officer of any potential organizational conflicts of interest created by any such access; however, a nondisclosure agreement will not overcome an Organizational Conflict of Interest (OCI) as defined in FAR Subpart 9.5. Moreover, the Trade Secrets Act prohibits releasing proprietary information without the owner’s consent. Accordingly, all Government Contractors are required to mark their proprietary information, and any time the Contractor is given inadvertent access to such marked information, the Contractor shall inform the Contracting Officer of the access.

1.6.19 Phase-In. The Contractor shall conduct phase-in procedures beginning 90 calendar days prior to the performance date specified in Section F of the contract. The phase-in shall require coordination with the incumbent Contractor for acceptance of the program. The Contractor shall perform a joint inventory of GFP listed in TE2 with the incumbent Contractor and the designated Government Contracting Officer’s Representative (COR), Government Property Administrator (PA), or Property Book Officer (PBO). All discrepancies and problems shall be noted and submitted to the Government PA for resolution.

1.6.20 Phase-Out. The services under this contract are considered vital to the Government and must be continued without interruption upon contract expiration. Therefore, the Contractor shall provide phase-out services IAW FAR 52.237-3.

1.7.0 Protection Requirements

1.7.1 Army Cybersecurity Mandatory Requirement

1.7.1.1 Cyber Awareness Training. The Contractor shall ensure that all Contractor employees and subcontractor employees as a condition of access to Government information systems (IS) and networks to perform contract/task order duties shall successfully complete the annual Cyber Awareness training as specified in AR 25-2, DA Pam 25-2-6, and as specified by the Government requiring activity. The Contractor employees and subcontractor employees shall complete the training at the start of work performance on this contract/task order and annually thereafter for the duration of this contract/task order. Cyber Awareness Training is available at https://cs.signal.army.mil.

1.7.1.2 Army Information Technology (IT) User Agreement. The Contractor shall ensure that all Contractor employees and subcontractor employees sign an Army IT User Agreement (UA) following completion of the Cyber Awareness training at the start of work performance on this contract/task order and annually thereafter for the duration of this contract/task order. The Army IT UA is available at https://cs.signal.army.mil.

1.7.2 Technology Overview

1.7.2.1 Army Training and Certification Tracking System (ATCTS). The Army has officially decommissioned the Army Training and Certification Tracking System (ATCTS) effective 01 May 2025 to better meet the current operational needs of the Army. ATCTS had two (2) major functions: (1) Network Access Management and (2) DoD Cyber Workforce Qualifications Management. The primary major function of ATCTS has migrated to the Account Validation System (AVS). The secondary major function of ATCTS will migrate to Cyberspace Workforce Reporting System (CWRS) in future implementation. The ATCTS Sunsetting Hub is accessible via https://armyeitaas.sharepoint-mil.us/teams/ATCTSSunsetting.

1.7.2.2 Army Account Validation System (AVS). AVS is a new Army system for validating user accounts and network access requests. AVS has replaced the PDF versions of the DD Form 2875 or System Authorization Access Request (SAAR) and DA Form 7789 or Privileged Access Agreement (PAA). The Government training materials and documentation supporting AVS are available via the AESMP portal at https://www.aesmp.army.mil/csm.

1.7.2.2.1 AVS Process. The Contractor shall ensure that all Contractor employees and subcontractor employees performing work under this contract/task order who require new or renewed access to the Department of Defense Information Network (DoDIN) systems and networks, shall request access through the Army Enterprise Service Management Platform (AESMP) portal https://www.aesmp.army.mil/csm by initiating a new web-based DD Form 2875 (SAARs), DA Form 7789 (PAAs), or both, if required, then typing “NSAR” and clicking on the “New System Access Request” link. This portal will guide the requestor through the AVS New System Access Request (NSAR) process for validation and authorization approval for access to requested networks and/or systems. For the interim, some systems/ applications/ organizations request not currently incorporated into AESMP may require paper or PDF versions of DD Form 2875/DA Form 7789 to gain authorization and access.

1.7.2.3 Cyberspace Workforce Reporting System (CWRS). CWRS is the Cyberspace Workforce Reporting System, the long-term solution for workforce management, compliance tracking, and reporting. CWRS will potentially integrate with AVS in future implementation phases. During this interim period, Contractor employees and subcontractor employees shall be prepared to provide certifications, appointment letter, and other documents upon request to their KO/COR, Information System Security Managers (ISSMs), or Information System Security Officers (ISSOs). The Contractor employees and subcontractor employees shall send these certifications via email, OneDrive, or Teams. This manual process shall continue until AVS fully integrates with a Workforce Management, Training, and Credentialing Tracking System.

1.7.3 Army Cyberspace Workforce

1.7.3.1 Cyberspace Workforce Policy. Defense Federal Acquisition Regulation Supplement (DFARS) Subpart 239.71 (Security and Privacy for Computer Systems) applies to this contract/task order. This contract/task order is subject to the mandates of DoDD 8140.01, and supplementary issuance, which establishes the qualification requirement for Contractor employees and subcontractor employees performing any cyberspace work roles in accordance with (IAW) DoDD 8000.01, DoDI 1336.05, Volume 4 of DoDI 1444.02, and Volume 1 of DoD Manual 7730.54. Until an update of the DFARS authorizes DoD 8140 implementation for contractor personnel, the requirements set forth in DoDI 8140.02 and DoDM 8140.03 do not apply to all Contractor employees and subcontractor employees performing work pursuant to this contract/task order. The DoDM 8140.03 requirements only apply to contractors working in coded positions.

1.7.3.2 DoD Cyberspace Workforce Framework (DCWF). The DCWF framework organizes cybersecurity into categories of several specialty areas. Each specialty area consists of multiple work roles. The Contractor shall ensure all Contractor employees or subcontractor employees supporting cyberspace services/functions under this contract/task order acquaint with the DCWF work role listed at https://public.cyber.mil/wid/dcwf/work-roles-2/.

1.7.3.3 Qualification Requirements. The DoD Cyber Workforce Qualification and Management Program (hereafter referred to as Qualification Program) IAW DoD 8140 consists of foundational qualifications, residential qualifications, and continuous professional development (CPD). These requirements are based on the availability of training courses that meet the residential and sustainment standards, see Table 1.

Table 1. Foundational, Residential, and CPD Requirements.

1.7.3.4 Foundational Qualification Requirement. The Contractor shall ensure that as a condition of employment to perform the functions on this contract/task order, all Contractor employees and subcontractor employees performing cyberspace functions shall agree to hold the appropriate foundational qualification requirement at their work performance start date and shall maintain the foundational qualification requirement until contract/task order expiration date, until officially relieved or released from appointment, or upon transfer, termination, reassignment, retirement, or contract end.

1.7.3.5 Residential Qualification Requirements. Contractor employees and subcontractor employees shall meet the residential qualification requirements to perform capabilities within the functional resident or supporting environment. Contractor employees and subcontractor employees shall be certified or qualified at the levels required of the positions for the work to be accomplished. Contractor employees and subcontractor employees performing functions in multiple functional categories or specialties shall obtain certificates or qualifications to the functions performed in each category and specialty. Contractor employees and subcontractor employees supporting cyberspace work roles shall have their residential qualification documented for inspection program and readiness reporting. Contractors who do not have proper and current qualifications/certifications shall be denied access to DoD IS for the purpose of performing cyberspace services/functions.

1.7.3.6 Continuous Professional Development. The Contractor shall ensure that all Contractor employees and subcontractor employees’ training, certifications, certification maintenance, continuing education, and sustainment training remain active and are renewed at the end of the training and certification cycle. Contractor employees and subcontractor employees shall be prepared to provide copies of their certification and other appropriate training certifications for functional categories to the COR for continuous compliance monitoring and reporting. The COR shall verify the Contractor employees’ AVS profile and certification(s) at least annually.

1.7.3.7 Contractor and COR Accountability. The COR shall interact with both AVS and AESMP/NSAR to attest and approve Authorizations and Access requests. The Contractor and COR shall continue to validate Contractor employees and subcontractor employees who need access to the requested networks and systems. The Contractor and COR shall ensure that Contractor employees and subcontractor employees have the appropriate training, qualifications, and credentials. The Contractor and COR shall maintain a list of Contractor employees and subcontractor employees’ functional responsibilities by category (technical or management) and platform level (computing environment, network environment, or enclave). The work required should be identified by functional category and proficiency level for primary and additional functional categories as applicable. The Contractor and COR shall maintain a list of training, certification, certification maintenance, continuing education or sustainment training required for the cyberspace functional responsibilities under this contract.

1.7.4 Network and Data Access Protection

1.7.4.1 Network Access and Security Requirements. Table 2 below provides a summary of each functional category required for this contract/task order aligned with the proficiency level, supporting workforce elements, network account type, security clearance, and security investigation required to access the level of network or system to perform work functions on this contract/task order. Details regarding the Workforce Elements are located at https://cyber.mil/wid/dcwf/workforce-elements/. The Contractor shall ensure that Contractor employees and subcontractor employees supporting any workforce elements are assigned to the position in writing. The cyber workforce appointment letters will become automated in future implementation of AVS. Table 2 is tailored to the specific needs and requirements that apply to this contract.

Table 2. Network Access and Security Requirements.

Functional Category

Advanced

Advanced

Advanced

Advanced

1.7.4.2 Telework or Remote Access. The KO/COR may authorize, with limitations, telework or remote access technologies such as Government approved virtual desktop environment such as virtual desktop or virtual mobile devices such as Hypori to perform work from external locations in support of this contract/task order. Should telework or remote work be authorized under this contract/task order, the Contractor personnel shall complete the telework training via https://www.opm.gov/telework/, sign DD Form 2946 (Department of Defense Telework Agreement), and provide a copy of the training certificate and signed agreement to the COR. Contractor personnel shall agree with the Army Bring Your Own Device (BYOD) Acceptable User Agreement as conditions for using any virtual environments, devices, or applications. The Contractor shall not install on or connect any mobile or removable devices or tools on any Government systems or networks without the COR and ISSM authorizations or specific guidance.

1.7.4.2.1 Virtual Private Network (VPN). Per DA Pam 25-1-1, the only authorized access from DoD-owned computers, systems, and networks to the Internet is via the NIPRNET. If the KO approves teleworking or remote work, the Contractor shall use only GFP to access the VPN in the event telework or remote work is authorized and GFP was not previously provided on the contract/task order. The VPN allows remote DoD computers to meet this requirement by providing a secure tunnel to the NIPRNET. Contractor employees and subcontractor employees using DoD-owned computers shall always use VPN to access the DoDIN or NIPRNET when using commercial Internet Service Providers. The Government prohibits unauthorized split-tunneling of VPN connections. The Authorizing Official (AO) or GO/SES level may authorize split-tunneling only with a documented and signed risk assessment.

1.7.4.2.2 Army Enterprise Azure Virtual Desktop (AVD). AVD is a Windows 11 Government virtual machine that uses Army 365 credentials for an optimized, complete single sign-on (SSO) experience. AVD is accessible via an AVD web client without software install or system modification. The Windows App (previously named Remote Desktop client) (MacOS/Windows) supports CAC login and S/MIME encryption. The Contractor shall create an AVD profile at https://aka.ms/goarmyavd.

1.7.4.2.3 Hypori BYOD. Contractors shall use the Hypori, an Android Virtual Machine (VM) which uses MobileConnect and EAMS-A for authentication and is accessed from mobile phone using the Hypori Halo and Mobile Connect applications. Installation of their credentials happens during the onboarding process and allows access to Army 365 apps, NIPR websites, and use encryption. The Contractor shall sign for Hypori at https://aka.ms/rcwpenrollment.

1.7.4.2.4 Army Information Hub Landing Zone. The Army Information Hub Landing Zone via AESMP includes information and technologies for using smartphones and other personal devices to perform work in support of this contract. The Landing Zone is located at https://armyeitaas.sharepoint-mil.us/.

1.7.4.2.5 Contractor or Employee-owned Information Systems (EOIS). The Contractor shall not install or connect non-Government-owned or privately-owned systems, devices, or tools to Government systems or networks under this contract/task order without the COR coordinating and obtaining proper authorization from the appropriate ISSM or ISSO, ensuring that all software has been authorized under the Risk Management Framework (RMF) Assess Only process. If approved, EOIS or Contractor-owned systems, devices, or tools shall meet all security requirements for Government-owned hardware and software when managing, storing, or processing DoD or Army information, or conducting official communications or business IAW the current version of NIST SP 800-171, and their local Network Enterprise Center (NEC) requirements and policies. This contract/task order prohibits Contractor employees and subcontractor employees from connecting remotely to DoD and Army systems or network using privately owned IT to conduct privileged access functions, IAW AR 25-2, paragraph 4-25c.

1.7.4.2.6 Prohibited EOIS. The Contractor shall not use prohibited EOIS to perform contract/task order requirements. These non-Government-owned computing systems or devices include such items as removable media, such as external hard drives; optical media, such as compact disk (CD)/digital video disk (DVD), flash media, such as memory cards, universal serial bus (USB) flash drives, thumb drives, and solid-state drives; and non-approved multifunction mobile devices.

1.7.4.2.7 Protection of Sensitive and Unclassified Data. The Contractor shall ensure any sensitive information, including items such as Personally Identifiable Information (PII), Controlled Unclassified Information (CUI), proprietary information, and Law Enforcement Sensitive information residing on portable electronic devices (PEDs) or other external media, is protected IAW current Government IS guidelines and requirements. The Contractor shall use authorized, approved, and prescribed solutions that comply with current in transit and at rest processes and tools. The PEDs include items such as laptops, netbooks, notebooks, personal digital assistants (PDA), tablet computers, and mobile devices. External media include CDs, DVDs, USB drives (also referred to as flash or thumb drives), and other portable digital storage devices.

1.7.4.3 Incidental Property. The Government will provide property incidentals to the place of performance, when the contract requires contractor personnel to be located on a Government site or installation or when teleworking is allowable by the Contracting Officer (KO) in the case of emergency/pandemic situations and the Government considers laptops that are provided with VPN capability as incidental property, and when the property used by the contractor within the location remains accountable to the Government. Items considered to be incidental to the place of performance include normal office type property, for example, office space, desks, chairs, telephones, computers, printers, paper, plotters, and computer peripherals. It does not include any equipment, special test equipment, special tooling, material or real property.

1.7.4.3.1 Virtual Private Network (VPN). The Contractor shall use only Government Property to access the Virtual Private Network (VPN). Per DA Pam 25-1-1, the only authorized access from DOD-owned computers, systems, and networks to the Internet is via the NIPRNET. The VPN allows remote DOD computers to meet this requirement by providing a secure tunnel to the NIPRNET. The VPN must be used at all times that the DOD-owned computer is accessing the Internet when using commercial Internet Service Providers. Split-tunneling of VPN connections is prohibited.

1.7.4.3.2 No Contractor or Employee-Owned Information Systems (EOIS) are allowed connection or access via the VPN. The NIPRNET is Sensitive Information. AR 25-2, paragraph 4-25c, prohibits the use of EOIS for sensitive information. Non-Army Government agencies will require evaluation on case-by-case bases. Non-DOD hosts will be treated as un-trusted hosts.

1.7.5 Antiterrorism (AT)

1.7.5.1 AT Level I Awareness Training. All Contractor employees, including subcontractor employees, requiring access to Army installations, facilities, and controlled access areas, shall complete AT Level I awareness training within thirty (30) calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable, and annually thereafter. The Contractor shall submit certificates of completion for each affected Contractor employees and subcontractor employees to the COR or to the KO, if a COR is not assigned, within thirty (30) calendar days after completion of training by all Contractor employees and subcontractor employees. AT Level I awareness training is available at the following website: https://jko.jten.mil..

1.7.5.2 Outside Continental United States (OCONUS) Travel. If this contract requires OCONUS travel, Contractor employees shall obtain KO or COR approval prior to such travel. The Contractor employees shall contact the Government requiring activity Antiterrorism Office to receive a specific theater AT/threat briefing prior to departing on OCONUS temporary duty travel.

1.7.5.3 iWATCH. The Contractor and all associated subcontractors shall brief all Contractor employees and subcontractor employees on the local iWATCH program (training standards provided by the requiring activity Antiterrorism Office). This locally developed training shall be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the COR and the requiring activity’s security office. This training shall be completed within thirty (30) calendar days of the contract/task order start date and within thirty (30) calendar days of new employees’ commencing performance, with the results reported to the COR no later than (NLT) thirty (30) calendar days after the contract/task order start date. The Contractor shall maintain all iWATCH training records and shall provide copies to the COR upon request.

1.7.5.4 Emergencies and Force Protection Conditions. During declared emergencies and/or elevated Force Protection Conditions (FPCONs) Charlie or Delta, Contractor performance under this contract/task order shall be determined by the KO. All Contractor employees providing services under this contract/task order are required to report for duty as scheduled and remain on duty during declared emergencies and/or elevated FPCON levels unless otherwise directed by the KO. The Contractor shall keep the COR apprised of the whereabouts of all Contractor employees and subcontractor employees when in a temporary duty (TDY) location.

1.7.5.5 Operations Security (OPSEC). The Contractor is not required to develop an OPSEC Plan. However, the Contractor shall comply with DoD Directive 5205.02E, AR 530-1, and the requiring activity’s OPSEC program. Per AR 530-1, the Contractor employees shall complete Level I OPSEC Awareness training. New Contractor employees and subcontractor employees shall be trained within 30 calendar days of their reporting for duty and annually thereafter. The Contractor shall maintain all OPSEC training records and shall provide copies to the COR upon request.

1.8 Service Contract Reporting: The requirement for contract manpower reporting shall be in accordance with Defense Acquisition Regulation Supplement (DFARS) 252.204-7023 (Reporting Requirements for Contracted Services).

1.8.1 The Contractor shall report ALL Contractor labor hours (including Subcontractor labor hours) required for performance of services provided under this task order via a secure data collection site. The Contractor is required to fill in all required data fields completely using the following web address: http://www.sam.gov.

1.8.2 Reporting inputs will be for the labor executed during the period of performance during each Government fiscal year (FY), October 1 through September 30. While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year.