IDIQ PWS_26D7601_211024.pdf

PERFORMANCE WORK STATEMENT

Program Management Warfare

Logistics Integrated Information Solutions – Marine Corps Data Environment & Integration Logistics Data Transformation

Information Technology Services Support Base IDIQ

PART 1

GENERAL INFORMATION

1. GENERAL: This is a non-personal services contract to provide Information Technology Service Support (ITSS) to Data Environment & Integration (DE&I) portfolio in support of Logistics Data Transformation (LDT) projects. The Government shall not exercise direct supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the contractor who, in turn is responsible to the Government.

1.1. Description of Services/Introduction: The contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and services necessary to perform ITSS as defined in this Performance Work Statement (PWS) and subsequent Task Order (TO) except for those items specified as Government Furnished Property (GFP) in Part 2 of this PWS and services. The contractor shall perform to the standards set forth in this contract.

1.2. Background: The Deputy Commandant of the Marine Corps for Installations and Logistics (DC I&L) and Logistics Integrated Information Systems – Marine Corps (LI2S-MC) have a requirement to bring United States Marine Corps (USMC) Logistics Product Data (LPD) into the 21st Century with an intuitive application design that facilitates user interactions, provides high-quality data and effective business process automation. The result is the Technical Data Management (TDM) Application Development Platform which provides the technical architecture for the rapid reengineering of logistic processes using modern technology and systems design; managed using a modern software development model; and producing high-quality data through standardization while focusing on warfighter usability and information needs.

The TDM Platform technical architecture consist of Platform as a Service offerings supported by development, security, and operations (DevSecOps) pipeline tools; the performance of the Government and the contractors that support the project using a tailored SAFe agile approached.

Successful performance of this PWS and subsequent TOs will require ITSS that will maintain the necessary team staffing and provide requested developmental capacity; process improvements that lead to increased delivery velocity; reliability and availability of the application; and quality of software developed for current TDM Platform.

1.2.1. Hosting Facility: Hosting facilities will be delineated in the individual task order.

1.2.2. System Descriptions: The system descriptions will be delineated in the individual task order.

1.3. Objectives: The overarching objectives of the work contained in this PWS are to:

• Provide program management, project management, and ITSS necessary to support all tasks/sub-tasks described in this PWS.

• Provide Agile teams and services that are properly staffed and organized for tasks identified in subsequent task orders.

• Ensure software quality and availability through the implementation of best practices utilizing an Agile software development life-cycle methodologies.

• Actively contribute to the continuous process/product improvement of technology, architecture, software development, and value delivery. Focus is to improve process effectiveness and efficiency, software quality, and to evaluate, recommend, and possibly implement technology changes that increase capability relative to the cost of the improvement.

• Provide metrics that support Government reporting requirements. Categories include metrics on Agile performance (examples: burn-up, burn-down, velocity, etc.); Customer satisfaction (examples: net-promoter scores, surveys, etc.); system performance (examples: operational availability, interface status, etc.); and software quality (examples: released defects, technical debt, etc.). Metrics will used as part of the CPI process and for value assessments to support business decisions.

• Provide release management utilizing continuous integration/continuous delivery methodologies that support a “release on demand” cadence using Government provided DevSecOps tools.

Ensure configuration management tasks are performed in accordance with Government direction and guidance.

• Conduct and document, to the Government’s satisfaction, that sufficient testing, either automated or manual, has been conducted prior to each release.

• Produce, update, and maintain training materials in support capability releases.

• Provide Customer/Service Desk Support

• Provide cybersecurity support in compliant with applicable Department of Defense, Department of the Navy, and Marine Corps regulations including Risk Management Framework (RMF) tasks and cyber workforce requirements.

1.4. Scope: The contractor support services are required to:

• Provide development capacity through subsequent task orders that are organized and staffed to accomplish the requirements of the task order within the parameters of the quality assurance plan.

Development capacity is typically delivered in the form of Agile Development Teams (ADTs) consisting of application developers, database developers, business analysts, other information technology specialists, and Agile process personnel (i.e. SCRUM Masters) as required.

• Provide a release management capability to coordinate value delivery from the ADTs via Agile Release Trains (ARTs). The release management capability performs all tasks required for a successful release to include but not limited to configuration management, documentation (i.e.

release notes), training updates, etc.

• Provide engineering and IT architecture personnel to address the reliability, availability, maintenance, and cybersecurity of the underlying IT technology.

• Provide program and product management support to enable stakeholder engagements and communications in support of Government Product Owner and Project Office requirements.

Examples include producing or contributing to the development and maintenance of the product roadmap, briefing materials, demonstrations, and other various documentation requirements that support the management and execution of the project.

• Provide personnel and resources to support Agile ceremonies/events to include Product Council Meetings, Program Increment Planning, value assessment reporting.

1.5. General Information

1.5.1. Quality Control: The contractor shall develop and maintain a complete Quality Control Program (QCP) that interrelates with the Government’s Quality Assurance Surveillance Plan (QASP) and Performance Requirements Summary (PRS). The contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The contractor’s QCP is how the contractor ensures that work performed complies with the requirements of the contract. After acceptance of the QCP, the contractor must receive the Contracting Officer’s or COR’s acceptance in writing prior to implementation of any proposed change to the QCP. After initial submission and Government acceptance of the Quality Management Plan (QMP) the contractor shall provide QMP updates to the Contracting Officer’s Representative (COR) on a quarterly basis. The QMP shall include, but not be limited to, the following:

• An inspection system covering all the services stated in the PRS, to include areas to be inspected on either a scheduled or unscheduled basis and indicate the labor category(ies) of who will conduct the inspection.

• A method of identifying and correcting deficiencies in the quality of services prior to submission to the Government for acceptance. The contractor shall maintain on file all deficiencies and corrective actions and processes for resolutions.

• Quality objectives

• Key project deliverables and processes to be reviewed for satisfactory quality level.

• Quality standards

• Quality control and assurance activities, including, but not limited to, process for reporting quality control and assurance problems.

• Quality roles and responsibilities

• Quality tools

1.5.2. Quality Assurance: The Government will evaluate the contractor’s performance under this contract in accordance with the QASP and the PRS. This plan is primarily focused on what the government must do to ensure that the contractor has performed in accordance with performance standards. The PRS defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

1.5.3. On-Site Working Conditions, Holidays, and other Closures:

(a) Government facilities are smoking restricted workplaces. Due to the nature of the work, facilities, and requirements, contractor staff may only smoke outside in designated smoking areas.

(b) The Government expects the contractor will establish normal operating hours under this contract between 8:00 a.m. to 4:30 p.m. EST Monday through Friday. The contractor’s Program Manager (PM) and the Government’s COR shall consult and coordinate on any proposed alternate work schedules that may be arranged depending on the operational tempo/needs of the mission.

(c) Government personnel observe the following days as holidays. Government facilities will be closed and unavailable to contractor personnel on the following days:

New Year’s Day January 1st* Martin Luther King’s Birthday Third Monday in January President’s Day Third Monday in February Memorial Day Last Monday in May Juneteenth Independence Day June 19th *

Independence Day July 4th*

Labor Day First Monday in September

Columbus Day Second Monday in October

Veterans Day November 11th* Thanksgiving Day Fourth Thursday in November

Christmas Day December 25th* *If the date falls on a Saturday, the Government holiday is the preceding Friday. If the date falls on a Sunday, the government holiday is the following Monday.

(d) In addition to the days designated as holidays, the Government observes the following days:

• Any other day designated by Federal Statute

• Any other day designated by Executive Order

• Presidential Inauguration Day*

• Any other day designated by the President’s Proclamation

*Government personnel in the Washington, DC area are entitled to a holiday on the day a President is inaugurated (January 20 following a Presidential election). Government personnel are entitled to this holiday if they are employed in:

The District of Columbia;

Montgomery and Prince Georges Counties in Maryland;

Arlington and Fairfax Counties in Virginia; and The cities of Alexandria and Falls Church in Virginia.

When Inauguration Day is moved to January 21st because January 20th falls on Sunday, Government personnel in the Washington, DC, area who would otherwise work on Monday, January 21st, are entitled to a holiday on that day.

(e) It is understood and agreed between the Government and the contractor that observance of such days by Government personnel shall not otherwise be a reason for an additional period of performance, or entitlement of compensation except as set forth within the contract. In the event the contractor's personnel work during the holiday, they may be reimbursed by the contractor, however, no form of holiday or other premium compensation will be reimbursed either as a direct or indirect cost, other than their normal compensation for the time worked.

(f) When the federal, state, local or other Governmental entity grants excused absences to its employees, assigned contractor personnel may also be dismissed. The contractor agrees to continue to provide sufficient personnel to perform critical tasks already in operation or scheduled, and must be guided by the instructions issued by the Contracting Officer or COR.

(g) If Government personnel are unavailable due to furlough or any other reason, the contractor must contact the Contracting Officer or the COR to receive direction. It is the Government's decision as to whether the contract price/cost will be affected. Generally, the following situations apply:

(1) Contractor personnel who are able to continue contract performance (either on-site or at a site other than their normal workstation), must continue to work and the contract price shall not be reduced or increased.

(2) Contractor personnel who are not able to continue contract performance (e.g., support functions) may be asked to cease their work effort. This may result in a reduction to the contract.

(h) It is understood and agreed between the Government and the contractor that in the event contractor personnel wish to attend Government social events, such as the annual picnic, holiday parties, etc., they must coordinate their work schedules with the COR and obtain approval of their company’s supervisor prior to the event. The Government is not responsible for reimbursing any expenses to the contractor for attending any Government social event.

1.5.4. Hours of Operation: The contractor is responsible for conducting business within the locality being served (whether within the Continental United States [CONUS] or Outside the Continental United States [OCONUS]), Monday through Friday except federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. In some cases, work during a weekend may be required and directed by the COR. The contractor shall maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the

Government facility is not closed for the above reasons. When hiring personnel, the contractor shall keep in mind that the stability and continuity of the workforce are essential.

The contractors located within the CONUS shall support the Eastern time zone as required. Should OCONUS support be required within the Eastern time zone (outside of their local time zone’s daily operations), the Government will identify a timeframe that best suites all parties involved. In the event of system downtime, the contractor may be required to support operations over a weekend.

1.5.5. Place of Performance: The work performed under this contract will be performed primarily at the contractor’s facility during normal business hours (8:00 a.m. to 4:30 p.m. EST, Monday through Friday excluding Federal Holidays). Given the nature of IT development, execution of tasks may be performed remotely unless otherwise required to fulfill installation, demonstration, or interim project reviews. Work product location will be the contractor’s facility (remotely, brick and mortar) for initial configuration and development. Work product will transition to the approved Government hosting facility once all required access and controls are granted to the contract team.

1.5.6. Type of Contract: The Government will award an Indefinite Delivery, Indefinite Quantity (IDIQ) service contract, with subsequent, individual task orders. Contract line-item types on the task orders will be firm-fixed priced (FFP) and/or not-to-exceed cost reimbursable (e.g., Travel, Other Direct Costs (ODC)).

1.6. Security Requirements: Contractors accessing the Government hosting enclave are required to obtain a Common Access Card (CAC) to ensure full access and accountability in Marine Corps Information Technology Center (MCITC) spaces and on networks used in the performance of the objectives. Personnel traveling to MCITC will be required to have an approved Joint Personnel Adjudication System (JPAS) Visitor Authorization Request (VAR) on file prior to execution of travel. The information provided to the contractor will be unclassified and/or Controlled Unclassified Information (CUI). The contractor is not required or expected to have facility clearance and contractor personnel supporting this effort are not required to possess personnel clearance levels. Any contractor personnel requiring access to U.S.

Government CUI shall possess a completed background investigation (minimum of a National Agency Check with Written Inquiries (NACI)) for this Public Trust Position.

Certain contractors will be required to perform IT-I/II duties that require favorably adjudicated Tier 5/3 Level investigations. The Defense Counterintelligence and Security Agency (DCSA) will not authorize contractors to submit the necessary Tier Level investigations solely in support of IT level designation requirements without a valid classified requirement as specified in a DD-254. This effort does not warrant a DD-254, therefore the Government Contracting Activity Security Office (GCASO) is required to submit any required investigations in support of IT level designations. The Facility Security Officer (FSO) is, however, required to establish, populate, and own the Defense Information System for Security (DISS) record of every contractor processed for and/or issued a CAC or submitted for IT level duties. The contractor is required to provide a roster of prospective contractor employees performing IT Level II and/or IT Level I duties to the MARCORSYSCOM COR. This roster shall include full names, Social Security Numbers (SSN), IT Level required, e-mail address, and phone number for each contractor requiring investigations in support of IT Level designations. The COR will verify the IT Level requirements and forward the roster to the GCASO. Contractors found to be lacking required investigations will be contacted by the GCASO.

In accordance with DoDI 5200.48 “Controlled Unclassified Information (CUI),” all contractors supporting MARCORSYSCOM who receive, store, or generate CUI are required to take the DoD Mandatory CUI Training, available on the Security Awareness Hub at:

https://securityawareness.usalearning.gov/cui/index.html. Per DoDI 5200.48 and pursuant to contractual requirements, DoD contractors require initial CUI training and annual CUI refresher training. Additional MARCORSYSCOM specific CUI training and guidance can be attained by contacting the MARCORSYSCOM AC/S G-2 at 703-432-3141 / 3140 or MCSC_ACSG2_SCMO@usmc.mil.

While performing aboard NAVY/USMC sites, the contractor shall comply with the provisions of DoD Directive 5205.02E, "DoD Operations Security (OPSEC) Program," SECNAVINST 3070.2A, MARCORSYSCOMO 3070.1B, MCO 3070.2A, and the MARCORSYSCOMO P5510.2C Security Manual, at all other sites the contractor shall comply with the local command and/or program OPSEC plan.

Contractor personnel shall follow OPSEC concepts and principles in the conduct of this requirement to protect critical information, personnel, facilities, equipment, and operations from compromise. All contractors (including subcontractors) shall supplement their current security practices by requiring any personnel involved in executing this contract to complete government-sponsored and administered OPSEC training.

The FSO’s are responsible for notifying the MARCORSYSCOM AC/S G-2 Personnel Security (PERSEC) Office at 703-432-3952/3490/3374 if any contractor on this contract receives an unfavorable adjudication.

Any issued CAC of said contractor shall be revoked and retrieved immediately. Due to insider threat concerns, the FSO is also requested to notify the PERSEC Office within 24 hours of any adverse/derogatory information associated with the 13 Adjudicative Guidelines concerning any contractor performing on this contract, if they have been granted an IT designation, issued a CAC and/or a MARCORSYSCOM building badge. The FSO shall notify the Government by written notice within 24 hours of any contractor personnel added or removed from the contract that have been granted IT designations, issued a CAC and/or a MARCORSYSCOM building badge.

Contractor personnel shall physically access Government facilities and installations for purposes of site visitation, quality evaluation, and work performed within Government spaces, or meeting attendance.

Additionally, personnel clearance requirements will be identified by the COR for those personnel supporting ITSS for the LDT projects.

1.6.1. Physical Security: The contractor shall be responsible for safeguarding all Government equipment, information and property provided for contractor use. At the close of each work period, Government facilities, equipment, and materials shall be secured.

Note: All contractor persons engaged in work while on Government property shall be subject to inspection of their vehicles at any time by the Government and shall report any known or suspected security violations to the security department at that location.

1.6.1.1. Defense Biometric Identification (DBID) Card: Certain contractors may require the issuance of a DBID card to gain access to Marine Corps bases/stations. The COR will identify and approve only those contractor employees performing on this contract that require a DBID card to perform their job function aboard the base. All contractor personnel accessing Marine Corps Base Quantico (MCBQ) and Marine Corps Systems Command (MCSC) must be in compliance with access control policy identified within Marine Corps Systems Command Order (MCSCO) 5530.2A Access Control Order.

1.6.1.2. Marine Corps Base Quantico Installation Gate Access: Access onto MCBQ requires the use of an active Department of Defense Personally Identifiable Verification (PIV) credential (i.e., CAC), Military Dependent Identification Card, Military Retiree Identification Card, Transportation Worker Identification Credential) that can be scanned at all installation gates prior to being granted access onto the installation.

Contractors/vendors who require routine/reoccurring access to MCBQ and are not receiving a CAC in support of this contract effort (or do not already have an acceptable PIV), are eligible for a DBID card.

DBID cards may be obtained at no cost from the MCBQ Provost Marshall’s Office after coordination with the COR and the MCSC, AC/S G2, Physical Security Team (PHYSEC Team). To obtain a DBID card, the vendor shall submit a completed Vendor Screening Form (obtained from the COR or the PHYSEC Team) via encrypted email to mcsc_physicalsecurity@usmc.mil, faxing to 703-432-3481 (attn.: Physical Security), or a hand delivered typed hard copy to the PHYSEC Team at Building 2200. The information on the Vendor Screening Form will be used by MCBQ Provost Marshall’s Office to conduct a background check. The vendor will be notified of the results of their vendor screening background check by the PHYSEC Team and/or COR. Vendors who do not meet the eligibility standards, will not be cleared for access onto MCBQ or MCSC. Vendors who meet the eligibility standards and receive a favorable response to the background check will be required to complete the DBID registration process using a website address/link that will be provided by the PHYSEC Team or COR. Once the vendor has successfully completed the DBID registration process, a registration code will be provided. The registration code shall be printed, and hand carried by the vendor to MCBQ Provost Marshall’s Office, Bldg. 2043, between the hours of 0700 - 1500 in order to be issued the DBID card. DBID cards will be issued for a period of 3 years regardless of contract expiration. For additional questions regarding submission of the vendor screening Form or access requirements, you may contact the PHYSEC Team at mcsc_physicalsecurity@usmc.mil or by calling 703-432-3964/3909.

1.6.1.3. MCSC Facility Access: All contractor personnel accessing MCSC facilities/buildings, must maintain compliance with access control policy identified within MCSCO 5530.2A - Access Control Order.

Access into MCSC facilities requires use of a command facility access badge issued by the PHYSEC Team. Contractor personnel assigned to sit within MCSC spaces with a dedicated (by name) workspace will be considered “on-site” contractors and may be issued a green badge with the holder’s photograph.

Contractor personnel that frequently visit (three or more times a week) MCSC spaces will be considered “off-site” contractors and may be issued an orange badge with the holder’s photograph. Issuance of a MCSC facility access badge shall be initiated by the COR using the Badge Request process hosted on the MCSC Vital Information Portal for Enterprise Resources (VIPER) website. Vendors may be issued a MCSC facility badge prior to issuance of a CAC or DBID card; however, receipt of an unfavorable response will result in deactivation of any currently issued MCSC facility access badge. All other vendors supporting this contract who do not meet the “green” or “orange” badge standards shall be required to have their visit to MCSC notified in advance using the MCSC Visitor Notification System hosted on the MCSC VIPER website. Visitor notifications shall only be submitted by a MCSC sponsor with access to the MCSC VIPER website. Visitors who arrive at MCSC facilities without an approved visitor notification on file shall be turned away unless a MCSC escort with a “white”, “powder blue”, or “green” badge can be reasonably coordinated. Vendors possessing an “orange” badge are not authorized to escort visitors without an approved visitor notification on file. All “green” and “orange” badges will be programmed with unescorted access into approved MCSC facilities Monday through Friday from 0630-1700. Unescorted access outside of these times to include federal holidays, furloughs, shutdowns, etc. is restricted. For additional questions regarding MCSC facility access requirements, you may contact the PHYSEC Team at mcsc_physicalsecurity@usmc.mil or by calling 703-432-3964/3909.

1.6.2. Key Control: If applicable, the contractor shall establish and implement methods of making sure all keys/key cards issued to the contractor by the Government are not lost or misplaced and are not used by unauthorized persons. NOTE: All references to keys include key cards. No keys issued to the contractor by the Government shall be duplicated. The contractor shall develop procedures covering key control that shall be included in the QCP. Such procedures shall include turn-in of any issued keys by personnel who no longer require access to locked areas. The contractor shall immediately report any occurrences of lost or duplicate keys/key cards to the Contracting Officer.

1.6.2.1. In the event keys, other than master keys, are lost or duplicated, the contractor shall, upon direction of the Contracting Officer, re-key or replace the affected lock or locks; however, the Government, at its option, may replace the affected lock or locks or perform re-keying. When the replacement of locks or re-keying is performed by the Government, the total cost of re-keying or the replacement of the lock or locks shall be deducted from the monthly payment due the contractor. In the event a master key is lost or duplicated, all locks and keys for that system shall be replaced by the Government and the total cost deducted from the monthly payment due the contractor.

1.6.2.2. The contractor shall prohibit the use of Government issued keys/key cards by any persons other than the contractor’s employees. The contractor shall prohibit the opening of locked areas by contractor employees to permit entrance of persons other than contractor employees engaged in the performance of assigned work in those areas, or personnel authorized entrance by the Contracting Officer.

1.6.3. Lock Combinations: If applicable, the contractor shall establish and implement methods of ensuring that all lock combinations are not revealed to unauthorized persons. The contractor shall ensure that lock combinations are changed when personnel having access to the combinations no longer have a need to know such combinations. These procedures shall be included in the contractor’s QCP.

1.7. Cyber Security

1.7.1. Common Access Card (CAC) Requirement: The COR will identify and only approve those contractor employees performing on this contract that require a CAC to perform their job function. In accordance with Headquarters, USMC issued guidance relative to Homeland Security Presidential Directive – 12, all personnel must meet eligibility criteria to be issued a CAC. In order to meet the eligibility criteria, contractor employees requiring a CAC must obtain and maintain a favorably adjudicated Personnel Security Investigation (PSI). Prior to authorizing a CAC, the employee’s DISS record must indicate a completed and favorably adjudicated PSI or (at a minimum) that a PSI has been submitted and accepted (opened). The minimum acceptable investigation is a T-1 or a National Agency Check with Written Inquiries (NACI). If a contractor employee’s open investigation closes and is not favorably adjudicated, the CAC must be immediately retrieved and revoked. CACs are not issued for convenience.

FSOs are responsible for notifying the MCSC AC/S G-2 (PERSEC Office at 703-432-3490/3952 if any contractor performing on this contract receives an unfavorable adjudication after being issued a CAC. Due to insider threat concerns, the company is requested to notify the MCSC AC/S G-PERSEC Office at 703- 432-3952/3490/3374 within 24 hours of any adverse/derogatory information associated with the 13 Adjudicative Guidelines concerning any contractor performing on this contract, if they have been issued a CAC and/or a MCSC Building Badge. Each CAC is issued with a “ctr@usmc.mil” e-mail account that the individual contractor is responsible to maintain as active by logging in on a regular basis (at least twice a month), sending an e-mail and clearing any unneeded e-mails. Contractors issued a CAC are prohibited from “auto-forwarding” e-mail from their .mil e-mail account to their .com e-mail account. If the “ctr@usmc.mil” e-mail account is not kept active, G-6 will deactivate the account and the CAC will also lose its functionality. Contractor employees shall solely use their government furnished “ctr@usmc.mil” e-mail accounts for work supporting the USMC, conducted in fulfillment of this contract, and shall not use a contractor supplied or personal e-mail account to conduct official U.S. Government business. The use of a contractor or personal e-mail account for contractor business or personal use is allowed, but only when using cellular or a commercial internet service provider.

If a contractor loses their eligibility for a CAC due to an adverse adjudicative decision, they have also lost their eligibility to perform on MCSC contracts.

1.7.1.1. Marine Corps Enterprise Network (MCEN) Computer Access: Contractor personnel accessing MCSC Information Systems must maintain compliance with United States Marine Corps Enterprise Cybersecurity Manual 007 Resource Access Guide. Contractor personnel will submit a DD 2875 and a completion certificate for the CYBERC course located on MarineNet located at https://www.marinenet.usmc.mil. The CYBERC course consists of the DoD Cyber Awareness Challenge and the Department of the Navy Annual Privacy Training. Contractors will have to create a MarineNet account to complete the required training.

MCEN IT resources, if provided, are designated for controlled unclassified information and other limited authorized purposes. DOD military, civilian personnel, consultants, and contractor personnel performing duties on MCEN information systems may be assigned to one of three position sensitivity designations.

1) ADP-I (IT-1): Favorably adjudicated T-5, T5R, (formerly known as Single Scope Background Investigation (SSBI)/SSBI Periodic Reinvestigation/SSBI Phased Periodic Reinvestigation)

2) ADP-II (IT-2): Favorably adjudicated T-3, T3R, (formerly known as Access National Agency Check and Inquiries/ National Agency Check with Law and Credit/Secret Periodic Review)

3) ADP-III (IT-3): Completed T-1, (formerly known as NACI)

Privileged users must maintain the baseline Cyberspace Workforce Information Assurance Technical or Information Assurance Manager relating to the position being filled. Privileged users are defined as anyone who has privileges over a standard user account as in system administrators, developers, network administrators, code signing specialist and Service Desk technicians.

All MCEN users must read, understand, and comply with policy and guidance to protect CUI and classified national security information, and prevent unauthorized disclosures in accordance with United States Marine Corps Enterprise Cybersecurity Manual 007 Resource Access Guide and Chairman of the Joint Chief of Staff Instruction 6510.01F.

MCEN Official E-mail usage – MCEN IT resources are provided for official Government use only and other limited authorized purposes. Authorized purposes may include personal use within limitations as defined by the supervisor or the local command. Auto forwarding of e-mail from MCEN-N to commercial or private domains (e.g., Hotmail, Yahoo, Gmail, etc.) is strictly prohibited. E-mail messages requiring either message integrity or non-repudiation are digitally signed using DOD PKI. All e-mail containing CUI, an attachment, or embedded active content must be digitally signed.

MCEN users will follow specific guidelines to safeguard CUI, which includes Personally Identifiable Information (PII) and Health Insurance Portability and Accountability Act (HIPAA) information. Non-official e-mail is not authorized for and will not be used to transmit any CUI. Non-official e-mail is not authorized for CUI unless under specific situations where it is the only means for communication available to meet operational requirements. This can occur when the official MCEN provided e-mail is not available but must be approved prior to use by the Marine Corps Authorizing Official (AO).

All personnel will use DOD authorized PKI certificates to encrypt e-mail messages if they contain any of the following:

• Controlled Unclassified Information (CUI).

• Any contract sensitive information that normally would not be disclosed to anyone other than the intended recipient as this is considered CUI.

• Any privacy data, PII, or information intended for inclusion in an employee’s personal file or any information that would fall under the tenets of MSGID: DOC/5 USC 552A.

Personal or commercial e-mail accounts are not authorized to transmit unencrypted CUI.

• Any medical or health data, to include medical status or diagnosis concerning another individual.

• Any operational data regarding status, readiness, location, or deployment of forces or equipment.

1.7.1.2. Contractor Assets Connectivity to the MCEN: The contracting company will comply with MCENMSG-Unification 003-14 ENABLING CONTRACTOR ASSET CONNECTIVITY TO THE MCEN. The contractor representative will transfer the contractor owned laptops to the MCSC G-6, IT Asset Management department to have the MCEN images placed on each laptop before it is authorized to connect to the MCEN.

All contractor owned laptops must meet or exceed the USMC laptop specifications. A list of laptops authorized to be attached to the MCEN can be obtained from MCSC IT upon request.

Upon completion of the contract or at such time as the contractor reclaims the asset from the USMC, non-government owned internal\external hard drives shall become the property of the U.S. Government. Once the hard drives have been removed, the laptops\assets will be returned to the contractor. For additional questions regarding current system specifications contact the MCSC, Electronic Maintenance Facility, lead at berton.whisenant@usmc.mil.

1.7.1.3. Magnetic Hard Drive Storage Devices: This paragraph covers the requirements of classified and unclassified internal and removable magnetic and solid state hard drives that store government data. This includes, but is not limited to, storage area network (SAN) devices, servers, workstations, laptops/notebooks, printers, copiers, scanners, and Multi-Functional Devices (MFD) with internal hard drives, removable hard drives and external hard drives. Upon disposal, replacement, turn in of hard drives or completion of the contract, non-government owned internal\external hard drives shall become the property of the U.S. Government in accordance with GENADMIN Processing of Magnetic Hard Drive Storage Media for Disposal.

1.8. Special Qualifications: Obtaining and maintaining qualifications are a contractor responsibility;

contractor personnel must be qualified before being assigned to the contract. The time spent training or certifying contractor personnel shall not be charged to the Government. A copy of the contractor’s supporting qualification records will be submitted as required by the Government. Contractor personnel who do not have proper qualifications shall be denied access to DoD information systems for the purpose of performing Cyber IT/Cybersecurity functions.

1.8.1. Annual Block Training: The contractor is responsible for ensuring all employees possess and maintain current information assurance, classifications, and certification for the execution of this contract in accordance with (IAW) the Command’s Annual Block Training. This training (current as of the date of award) is required for personnel who may need a CAC or work on a Government worksite for any length of time. This training may change IAW Command Policy. The most current training required can be provided by the COR. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee, to the COR or to the Contracting Officer when necessary for access to specified technology. This training shall be completed and reported to the COR within 30 calendar days of contract assignment. From that date forward, each affected employee shall complete annual refresher training for the remaining contract duration, or until they are no longer working on the contract.

In addition, the contractor may coordinate with the COR to obtain the following accesses:

• Non-Classified Internet Protocol Routing (NIPR) DADMS Access

• NIPR MCCAST Access

• NIPR Privileged Users

• NIPR Authorized Users

1.9. Post Award Conference (PAC)/Periodic Progress Meetings: The contractor agrees to attend any PAC or periodic progress meetings convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation (FAR) Subpart 42.5. The purpose of the PAC is to: 1) Discuss characteristics of the requirement(s); 2) Identify stakeholder’s roles and responsibilities; 3) Establish a common understanding of cost, schedule, and performance expectations and schedule for work; and 4) Discuss any other item the COR or contractor may deem appropriate.

1.9.1. The contractor shall schedule a combined PAC and Project Kick-Off (PKO) meeting within thirty (30) calendar days of the contract effective date at a Government designated facility in the Quantico, VA area.

The meeting will provide an opportunity to review PWS requirements, clarify the scope of work, review terms and conditions of the contract, and discuss technical, management, security administration, travel authorization process deliverables to ensure understanding between all parties, and reporting procedures. The meeting will also provide answers to the contractor questions, establish preliminary dates for future program events, discuss any other items the COR or Contracting Officer may deem appropriate to discuss, and obtain Non-Disclosure Agreements (NDA) from, or on behalf of, the contractor employees performing on this contract. The meeting will also address administrative items, such as invoicing, communication mechanisms, access to Government systems, etc., provide Government System Authorization Access Request 2875 forms for requesting CAC issuance, and obtain the Contractor’s QCP.

As part of the PAC/PKO, the contractor shall introduce key personnel and present program implementation processes to be used under the contract, including the current personnel staffing process and status and project organizational structure. The contractor shall provide an overview of their risk management process. The contractor shall deliver a PKO Brief before the PAC/PKO meeting. The brief will include key personnel, key risks, dependencies, and mitigation for each identified risk. At a minimum, the attendees will include management contractor personnel, representatives from the Program Management Office (PMO), other relevant Government personnel, and the COR. The contractor shall provide, at a minimum, the following at the PAC/PKO meeting:

• Contractor’s Transition-In Plan and Schedule

• Program Management Plan

• Quality Management Plan

At progress meetings the Contracting Officer or COR will inform the contractor of how the Government views the contractor's performance and the contractor will apprise the Government of problems being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the Government.

1.9.2. A recap of any meeting shall be provided to the COR within seven business days after conclusion of the meeting.

1.10. Monthly Status Report (MSR): The contractor shall prepare and submit a MSR by the fifteenth business day of each month for the preceding month of performance, throughout the contract period. The purpose of this report is to provide the Government with a regular method of monitoring and measuring progress in accordance with the requirements of the contract. The MSR may include the following items IAW CDRL B001 & the discretion of the COR in conjunction with the Government technical points of contact:

a. Contract Number

b. Invoicing Period (start and end dates)

c. Amount of funds invoiced by CLIN during the invoicing period

d. Summary of work performed

e. Status of deliverables organized by associated task number

f. Planned activities for the next month

g. System problems incurred and resolution path

h. Current program risks, severity level, and mitigation plan

i. Performance metrics for the reporting period, which include the process, quality, product, and DevSecOps metrics

1.11. COR Responsibilities: The COR will be identified by separate letter. The COR monitors all technical aspects of the contract and assists in contract administration. The COR is authorized to perform the following functions: assure that the contractor performs the technical requirements of the contract; perform inspections necessary in connection with contract performance; maintain written and oral communications with the contractor concerning technical aspects of the contract; issue written interpretations of technical requirements, including Government drawings, designs, specifications; monitor contractor's performance and notify both the Contracting Officer and contractor of any deficiencies; coordinate availability of GFP;

and provide site entry for contractor personnel. A copy of the COR designation letter is sent to the contractor, which states the responsibilities and limitations of the COR, specifically regarding changes in cost or price, and estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting order.

1.12.Transition:

1.12.1. Phase In: The Contractor’s afforded phase-in time will be delineated in the individual task order.

However, phase-in will not exceed 60 days for services executed within this PWS.

1.12.2. Phase Out: The Contractor’s afforded phase-out time will be delineated in the individual task order.

However, phase-in will not exceed 60 days for services executed within this PWS.

1.13. Key Positions:

Key positions identified are designated as key based upon their criticality for their knowledge and experience needed to accomplish the mission by supporting daily operations. They shall be designated by title, and each individual performing in one of these positions must meet the qualifications as specified by the Government. The contractor is required to provide notification to the Government for the key positions ONLY and shall meet, or exceed, those outlined in this PWS. Key positions shall be determined by the tasks specified on each TO PWS and these Key Positions shall be delineated at the TO level.

1.14. Non-Key Positions:

Non-key positions shall be determined by the tasks specified on each TO PWS.

1.15. Identification of Contractor Employees: All contract personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. They must also ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed. All contract personnel while in Government facilities will obtain and wear badges in the performance of this service.

1.16. Contract Travel & Other Direct Costs (ODC): The contractor shall submit all ODC invoice(s) to the COR for review and approval before submitting in Procurement Integrated Enterprise Environment (PIEE) for the COR's purview and to avoid paid invoices via Defense Contract Audit Agency (DCAA) without proper approvals.

1.16.1. Contractor Travel: The contractor shall be required to travel within the CONUS during the performance of this contract to attend meetings, conferences, and training. The contractor may be required to travel to off-site training locations and to ship training aids to these locations in support of this PWS.

The contractor shall anticipate travel to one or more locations per quarter, including, but not limited to, National Capital Region (NCR), I Marine Expeditionary Force (MEF) (Camp Pendleton, CA), II MEF (Camp Lejeune, NC), III MEF (Marine Corps Base Hawaii and Okinawa, Japan), Marine Corps Logistics Command (Albany, GA), and MCSC (Quantico, VA).

Reimbursement of transportation, lodging, meals and incidental expenses are allowable subject to the limitations contained in FAR 31.205-46 and the limitation of funds specified in this contract. All travel requires Government approval/authorization and notification to the COR.

Travel costs are for travel requirements not already identified within this PWS. There will be no reimbursement for travel for contractor personnel unless travel is coordinated and approved by the COR in advance of the trip. All travel requests (including, but not limited to, purpose, dates, itinerary, estimated costs) must be submitted to the COR for approval and authorization no later than ten (10) business days prior to the projected travel. Upon approval, the travel costs become a not-to-exceed (NTE) amount. Any incurred costs greater than the approved NTE amount for that trip is an unallowable expense (future travel underruns will not offset exceeded travel). Upon completion of a trip, the travelers will complete and provide an expense statement to the COR. Upon approval of the submitted charges, the contractor may invoice under a travel CLIN for the costs. It is the contractor’s responsibility to include all travel costs for work, meetings, conferences, and kick-offs required by this PWS in the applicable line-item prices.

All travel within 100 miles of the NCR is included in the price of this contract. When movement of contractor personnel is required locally (i.e., Metro) costs will be borne by the contractor. The Government will reimburse the contractor for all other travel outside the 100-mile limitation that was authorized in advance by the COR or Contracting Officer, for reasonable travel related expenses.

All contractor travel shall use the most effective and efficient means to travel. Travel reimbursement shall be made on a cost reimbursable method; the Government will reimburse the contractor for actual costs associated with approved travel. All requests for contractor travel must be approved by the COR or

Contracting Officer prior to commencing. The contractor shall submit a cost estimate that includes the following:

a. Reason for Traveling

b. Temporary Duty Location

c. Number of Individuals Traveling

d. Estimates for Hotel, Air Fare, Parking, Mileage, Rental Car, and Per Diem.

The contractor shall be reimbursed for actual allowable, allocable, and reasonable travel costs incurred during performance of this effort in accordance with the FAR 31.205-46 “Travel Costs.” Requests for approval of costs in excess of maximum per diem rates in accordance with the procedures contained in FAR 31.205- 46(a)(3) must be submitted to the Contracting Officer for final approval prior to commencement of travel.

1.16.2. Other Direct Costs: This category includes travel (outlined in 1.16.1), reproduction, shipping expenses, outside services, system software, and hardware associated with training activities and visits to contractor facilities. It could also entail the renting of suitable training venues.

The contractor may be required to purchase specific direct-charge material that is needed by either the contractor or Government to support performance of the PWS requirements (and could not have been estimated or anticipated) prior to contract award (e.g., computer peripheral equipment needed by the government). Business expenses such as office supplies, utilities and expenses associated with producing a contract deliverable shall not be reimbursed as an ODC. Any and all ODCs accrued under performance of this contract shall be: a) Requested in writing prior to purchase; b) Authorized in writing by the Contracting Officer or the COR in advance of purchase; and c) Invoiced through requests for payments made under the

ODC CLIN.

Upon approval, the ODC becomes a NTE amount. Any incurred costs greater than the approved NTE amount for that ODC is an unallowable expense (that cannot be offset by future offset by future ODC underruns).

All individual ODC purchases less-than or equal to $5,000 may be approved by the COR or the Contracting Officer. All individual ODC purchases greater than $5,000 must be approved by the Contracting Officer. All

ODCs must be (cumulatively) listed…