IS3 PWS 2026-09-10.docx

CUI//PROCURE

PERFORMANCE WORK STATEMENT (PWS)

INDUSTRIAL SECURITY AND CYBERSECURITY SUPPORT SERVICES

DEFENSE COUNTERINTELLIGENCE AND SECURITY AGENCY (DCSA)

PART 1

GENERAL INFORMATION

1. General This is a non-personal services contract to provide Industrial Security and Cybersecurity Support Services to the Defense Counterintelligence and Security Agency (DCSA). The Government shall not exercise direct supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn, is responsible to the Government.

1.1. Description of Services/Introduction

The Contractor must provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and services necessary to perform program, analytical, administrative, and technical support services as defined in this Performance Work Statement (PWS), except for those items specified as Government furnished property (GFP) and services. The Contractor must perform to the standards in this contract.

1.2. Background

The Defense Counterintelligence and Security Agency is undergoing a multi-year transformation that includes a significant expansion of predecessor Agencies’ authorities and responsibilities. Mission accretion and associated growth in personnel and resources requires deliberate coordination and planning to achieve effective outcomes while simultaneously establishing and integrating new activities, initiatives, and projects. DCSA consists of nearly 13,000 Government and Contractor personnel operating throughout the United States and overseas supporting stakeholders across the Federal Government. DCSA requires comprehensive support for its Industrial Security, Cybersecurity, and Counterintelligence missions. This includes a wide range of analytical, administrative, technical, and strategic support services to effectively oversee and support the National Industrial Security Program (NISP) and associated cleared industry partners.

1.3. Objectives

The basic service objectives of this contract are:

· To acquire analytical, technical, and strategic support for DCSA’s industrial security, special programs, and cybersecurity missions.

· To enable data-driven decision-making, proactive risk management, and continuous process improvements across the NISP enterprise.

· To ensure the security and integrity of classified and controlled unclassified information (CUI) held by cleared industry.

1.4. Scope

The Contractor must provide support services across six primary task areas:

1. International and Special Programs (ISP) Support

2. Cyber Operations Division / Cyber Mission Center (CMC) Support

3. NISP Mission Performance (NMP) Support

4. Industrial Security Technologies and Strategy (ISTS) Support

5. National Access Elsewhere Security Oversight Center (NAESOC) Support

6. Industrial Security Support Research (ISSR) Support (Field Operations) The Contractor must provide support on this contract which is proficient insecurity and counterintelligence and be able to implement Executive Orders, Department of Defense (DoD) regulations, and directives that govern NISP implementation.

The Contractor must accomplish the specific outcomes, analyses, reports, and operational functions detailed in Part 5 of this PWS, ensuring compliance with federal directives, safeguarding CUI/classified information, and utilizing analytical tools to identify risks and recommend process optimizations (including potential applications of Artificial Intelligence).

Artificial Intelligence (AI) or automated tools may be implemented within this contract, after contract award, to streamline processes and reduce the contract price. Any implementation of AI or automated tools within this contract must be accomplished via bilateral modification to the contract. Developing new AI or automated tools or modifying existing AI or automated tools is not within the scope of this PWS. The Contractor must continually survey the technical landscape to determine if any viable AI or automated tools become available. If the Contractor identifies a potentially viable AI or automated tool, the Contractor must submit documentation to the Contracting Officer (KO) and COR regarding the AI or automated tool. Viable AI or automated tools must meet all Information Technology (IT) and cybersecurity requirements of the DoW. If the Government approves the use of the AI or automated tool within DCSA systems, the process for completing a bilateral modification to implement the AI or automated tool within this contract may begin.

1.5. Period of Performance

The period of performance (PoP) shall be for a twelve (12-month) base period, four (12-month) option periods, and an optional six-month extension in accordance with Federal Acquisition Regulation (FAR) clause 52.217-8, Option to Extend Services. The anticipated PoP is as follows:

Base Period: 4/01/2027 – 3/31/2028 Option Period 1: 4/01/2028 – 3/31/2029 Option Period 2: 4/01/2029 – 3/31/2030 Option Period 3: 4/01/2031 – 3/31/2031 Option Period 4: 4/01/2031 – 3/31/2032 Optional Extension (FAR 52.217-8): 4/01/2032 – 9/30/2032

(Note: Final Period of Performance dates will be reflected in the final Contract Award Document.)

1.6. General Information

1.6.3. On-Site Working Conditions, Holidays, and other Closures

1.6.3.1. DCSA facilities are smoking-restricted workplaces. Contractor staff may only smoke outside in designated smoking areas.

1.6.3.2. Normal operating hours under this contract shall be established between 6:00 a.m. and 6:00 p.m. Eastern Time (ET), Monday through Friday, with consideration for flexible start times coordinated with the COR. The Contractor must ensure continued performance and uninterrupted support during each workday so that operations are not interrupted. The Contractor’s Program Manager (PM) must consult and coordinate with the COR to ensure contractual deliverables are accomplished within the time and quality standards of this PWS.

1.6.3.3. Government personnel observe the following Federal holidays. Government facilities will be closed and unavailable to Contractor personnel (except as otherwise authorized in writing by the KO or COR):

· New Year’s Day (January 1st*)

· Martin Luther King’s Birthday (Third Monday in January)

· President’s Day (Third Monday in February)

· Memorial Day (Last Monday in May)

· Juneteenth National Independence Day (June 19th*)

· Independence Day (July 4th*)

· Labor Day (First Monday in September)

· Columbus Day (Second Monday in October)

· Veterans Day (November 11th*)

· Thanksgiving Day (Fourth Thursday in November)

· Christmas Day (December 25th*) *If the date falls on a Saturday, the Government holiday is observed on the preceding Friday. If the date falls on a Sunday, the Government holiday is observed on the following Monday.

1.6.3.4. In addition to the days designated as holidays, the Government observes the following days:

· Any other day designated by Federal Statute

· Any other day designated by Executive Order

· Presidential Inauguration Day

· Any other day designated by the President’s Proclamation

1.6.3.5. Contractor personnel are not authorized to perform work on-site during the holidays and observances listed above The Government will not compensate the contractor for authorizing contractor personnel to perform work during the holidays and observances listed above.

1.6.3.6. Inclement Weather and Administrative Closures: In the event of inclement weather or other events where the occupied Government facility is closed or dismissed early, Contractor personnel stationed at the impacted Government facility are authorized to work from an alternate work location (telework) until the facility is reopened.

1.6.3.7. Alternate Work Location Parameters: Performance from an alternate work location must be from an approved, secure location (such as the Contractor's corporate facility or the employee's residence within the local commuting area) where Controlled Unclassified Information (CUI) and classified data can be strictly safeguarded and cannot be accessed by unauthorized persons. Alternate work locations are permitted at other DCSA locations only if space is available and pre-coordinated with the COR. The Contractor must ensure contractual deliverables are accomplished within the PWS time and quality standards. The Contractor may be required to account for the physical location of personnel upon request by the COR. Alternate work locations are authorized at no additional cost to the Government.

1.6.3.8. DCSA Social Events: Contractor personnel may attend DCSA social events (e.g., annual picnics, holiday gatherings) provided the Contractor's PM obtains COR approval prior to the event. The PM must coordinate to ensure continued performance and uninterrupted support so that operations and deliverables are not impacted. The Government is not responsible for reimbursing any expenses to the Contractor for attending social events.

1.6.3.9. Unscheduled System Outages (Excusable Delays): If critical systems (such as NISS, DISS, NI2, ACCESS, SIPR, NIPR, or JWICS) become unavailable beyond scheduled maintenance windows for four or more consecutive hours per event, these events shall be treated as excusable delays. The Contractor PM shall notify the COR in writing within one (1) business day. The COR will extend the due dates of impacted deliverables on a day-for-day basis. Delays resulting from these circumstances are not considered the contractor’s fault for the purposes of QASP/PRS or CPARS evaluations.

1.6.4. Hours of Operation

The Contractor is responsible for conducting business between the hours of 6:00 a.m. and 6:00 p.m. ET, Monday through Friday, except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government-directed facility closings. The contractor must ensure continued performance and uninterrupted support during each workday so that operations on this contract are not interrupted, The Contractor’s Key Personnel must consult and coordinate with the Government’s COR to ensure contractual deliverables are accomplished within the time and quality standards of this PWS.

1.6.5. Place of Performance

The work to be performed under this contract will be performed at the following locations:

Government Facility (Quantico): Russell-Knox Building, 27130 Telegraph Road, Quantico, VA 22134 Government Facility (Hanover): National Access Elsewhere Security Oversight Center (NAESOC), 7556 Teague Road, Suite 580, Hanover, MD 21076 Field Office Facility / Remote Telework: As authorized for Task Area 6 (Industrial Security Support Research) upon approval of the Task Manager and COR.

Note on Cubicle Space Availability:

Quantico, VA: Ten cubicle spaces are available but this is subject to change based on operational mission needs. Contractor personnel may have to perform at an alternate work location while alternating days onsite.

Hanover, MD: Cubicle space is available but subject to change based on operational mission needs.Contractor personnel may have to perform at an alternate work location while alternating days onsite. .

1.6.6. Type of Contract

The Government will award a Firm-Fixed-Price (FFP) contract.

1.6.7. Security Requirements

he Contractor shall possess and maintain a TOP SECRET facility clearance granted by the Defense Counterintelligence and Security Agency (DCSA). The Contractor's employees, performing work in support of this contract must be US Persons and require TOP SECRET security clearance/eligibility with SCI eligibility determination based on a favorably adjudicated T5 or T5R with SCI eligibility; be within investigation scope and/or currently enrolled in Continuous Evaluation (CE) / Continuous Vetting (CV) prior to contract performance and throughout the life of the contract to include all potential option years identified in this PWS.

• The DD 254 shall be completed within the Defense Counterintelligence and Security Agency National Industrial Security System Increment 2 (NI2), which superseded NCCS) (https://niss.dcsa.mil/) at contract award. The DD 254 will be housed within the NI2 through the life of the contract. The Contractor shall be required to be registered within NI2 at time of award to gain access to the DD 254. It is incumbent upon the Contractor to ensure that the necessary security paperwork is submitted in sufficient time to enable each individual to be cleared prior to beginning work on this contract. In the event that the NI2 is superseded by another System Of Record, the same requirements apply. The DCSA KO will maintain the DD254 in the Official DCSA Contracts Records. The Contractor is required to maintain a copy in their records and to ensure distribution to their Cognizant Security Office. Subcontracting on this effort requires approval of the DCSA Contracting Officer (KO) or DCSA Agreements Officer (AO). If approved, contractor shall provide copies of all Subcontract DD254s to the GCA and Contracting Officer. For accesses which require prior written authorization from the GCA, Contracting Officer (KO), the contractor shall submit a DRAFT SUBCONTRACT DD254 to the GCA and Contracting Officer for review and concurrence with coordination of the DCSA Industrial Security Program Manager.

Contractor personnel performing or assigned under this contract must be U.S. persons. Security Classification Guide requests should be presented to the Government Sponsor, if required, subsequent to contract award. All classified information received or generated under this contract is the property of the U. S. Government. The U. S. Government shall provide disposition instructions. No release of classified information or controlled unclassified information under this contract is authorized. All requirements for control and accounting of original documentation and copies apply. All applicable provisions of the NISPOM and its supplements and 32 CFR, part 117 apply. Any classified information shall be transmitted IAW DOD Manual 5200.01, Volumes 1-3. DOD Information Security Program Regulations. The contractor shall adhere to 32 CFR Part 117.18 (NISPOM), which applies to non-DoD IT systems.

• Within 10 days of contract award, prime contractor shall submit a Visit Authorization Request (VAR) to DCSA Security Office to validate that all management, supervisory, and other personnel assigned to this contract meet the clearance requirements. Failure to provide security eligibility information shall delay and/or deny the individual access to DCSA, and DoD facilities and information. It is the responsibility of the Prime Contractor to maintain either an owning or servicing relationship in DISS with all personnel supporting this contract, this includes Prime contractor personnel, subcontractor personnel, and any consultants. All Visit Authorization Requests (VARs) submitted to the host government locations must be sent via the Defense Industrial System for Security (DISS) and *must* come from the Prime Contractor's SMO in DISS. For visits to DCSA, Collateral and SCI Visit Authorization Requests should be sent to SMO DCSAHQSEC.

In accordance with Security Executive Agent Directive (SEAD) 3 all covered individuals who have been granted eligibility or hold a sensitive position shall report as required in this directive to DCSA and must be favorably adjudicated, by Adjudication and Vetting Services (AVS) formerly known as DoD CAS.

• Contractor is not authorized to subcontract on this effort without an approved subcontracting plan with written GCA/COR authorization.

• All Common Access Cards (CACs), building access badges, and parking passes must be returned immediately at the end of the period of performance date.

• The Contractor shall comply with (1) Security Agreement (DD Form 441/DD Form 441-1), including the National Industrial Security Program Operating Manual (NISPOM), DoD 5220.22-M and any revisions and (2) 32 CFR, Part 117.Provisions of the Privacy Act apply to all records and reports maintained by the contractors.

•All programs and materials developed at government expense during the performance period of this contract are the property of the US Government.

Prior to granting an employee access to classified information and/or materials, the contractor shall brief employees with regard to their obligation to comply with the NISPOM, to include any changes and/or amendments, and 32 CFR, Part 117. The contractor’s employees shall be debriefed when access to the material is no longer needed or is terminated. A list of all employees who have had access to classified information during the period of this contract shall be maintained by the contractor company and be available for Defense Counterintelligence and Security Agency inspection.

•Access to General Protection/Security Policies and Procedures. All contractor employees, including subcontractor employees stationed or assigned on a US Government facility shall comply with applicable installation, facility access procedures and local security policies (provided by the US Government security personnel). The contractor workforce shall comply with all personal identification verification requirements as directed by DCSA and/or local policy. In addition to the changes otherwise authorized by the changes clause in this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the US Government may require changes in the contractor security processes or procedures.

Contractors requiring access to US Government Information Technology (IT) systems must adhere to all US Government requirements. All contractor employees and any associated subcontractor employees shall annually complete the DoD Information Assurance Training and sign an Acceptable Use Policy (AUP). The training certificate and AUP must be provided to the designated personnel at US Government facilities before issuance of network access and annually thereafter.

• Contactor employees shall abide by US Government Security Regulations and Security Standard Operating Procedures when working on-site at US Government facilities/installations and shall annually attend Government mandatory training including Operational Security, Security Awareness, Subversion and Espionage, Ethics and Prevention of Sexual Harassment, and any/all other training as directed by the US Government.

• Common Access Cards (CACs) are authorized for contractor employees that work on-site at DCSA Government facility. CACs are the property of the US Government and shall be giving to the Contractor Facility Security Officer upon termination of employment with the company, expiration of the CAC, replacement of a CAC, or upon contract completion. The FSO shall immediately return the CACs to the DCSA Government Contracting Officer or Contracting Officer Representative. The loss of a CAC shall be reported on the first business day following the discovery of the lost CAC to your chain of command and to the issuing agency. Unauthorized possession of a CAC can be prosecuted criminally under section 701, title 18, United States Code. Photocopying of US Government Identification (CAC) is a violation of Title 18, US Code Part 1, Chapter 33, Section 01 and punishable by both fine and imprisonment. Although the asking for military/government identification is totally permissible by commercial establishments, there is a prohibition on duplication of government identification. A state issued driver license or other form of photo identification should be provided to be photocopied if an establishment insists on a photocopy of the traveler’s identification. Contractor is required to ensure that all employees are aware of this law.

• Contractor personnel shall utilize US Government or official company e-mail for transmitting official US Government business. Official US Government business shall NOT be transmitted via personal, private, and/or commercial e-mail accounts, i.e., YAHOO, HOTMAIL, GMAIL, JUNO, AOL, COMCAST, KNOLOGY, VERIZON, etc.

⦁ Contractor is prohibited from using reference to this contract, classification, clearances, accesses (collateral and/or SCI), even by unclassified acronyms, in advertisements, websites, capabilities fliers, promotional efforts, or recruitment of employees.

1.6.7.2. Physical Security: The Contractor must safeguard all Government equipment, information, and property provided for Contractor use. At the close of each work period, Government facilities, equipment, and materials shall be secured in accordance with DoWI 5220.22-M (NISPOM), DoWI 5200.48 (CUI), and 32 CFR Part 117.

1.6.7.3. Key Control: The Contractor must establish and implement methods to ensure all keys/key cards issued by the Government are not lost, misplaced, or used by unauthorized persons. No keys shall be duplicated. The Contractor must include key control procedures in their QCP, including turn-in procedures for departing personnel. Lost keys must be reported immediately to COR.

1.6.7.3.1. If non-master keys are lost, the Government may replace or re-key the affected locks. The total cost of replacement/re-keying shall be deducted from the Contractor’s invoice for the next monthly payment. If a master key is lost, all locks in the affected system will be replaced by the Government at the Contractor's expense, with costs deducted from the next monthly invoice.

1.6.7.3.2. Key cards/keys shall not be used by anyone other than the Contractor's authorized employees, nor shall Contractor employees grant unauthorized persons entry into locked areas.

1.6.7.4. Visit Authorization Requests (VARs): Within ten (10) business days of contract award, the prime Contractor shall submit a VAR via the Defense Information System for Security (DISS) to SMO: DCSAHQSEC to validate security clearances. The prime Contractor must maintain an owning or servicing relationship in DISS for all personnel (including subcontractors) supporting this contract.

1.6.7.5. Common Access Cards (CACs): CACs are Government property and must be returned to the COR immediately upon employee termination, expiration of the CAC, or contract completion. Photocopying a CAC is a violation of Title 18, U.S.C. Section 701 and is strictly prohibited.

1.6.7.6. Information Technology Systems: Contractor personnel using Government IT systems must annually complete DoD Cyber Awareness Challenge training and sign an Acceptable Use Policy (AUP). Official Government business must be conducted solely via Government-issued email accounts; the use of commercial or personal email accounts is strictly prohibited.

1.6.8. Special Qualifications & Required Training

The Contractor is responsible for ensuring all employees possess and maintain the special qualifications and certifications required for their respective roles as outlined in Part 5 and Section 1.6.11.

1.6.8.1. Non-Disclosure Agreement: All contractor personnel will be required to sign a Non-Disclosure Agreement (NDA). Contractors shall be responsible for processing their employees for the required clearance in accordance with DoD 5220.22M, the National Industrial Security Program Operating Manual (NISPOM) and ensuring that no employee is assigned to work at a Government facility without the appropriate clearance and shall be eligible for and, subsequently be issued, a Department of Defense (DoD) Contractor Common Access Card (CAC) / Personal Identity Verification (PIV) card prior to working any DoD contracts.

1.6.8.2. Mandatory Training:

In accordance with the 32 CFR NISPOM Part 117.12 Security Training and Briefings; Contractor personnel performing under this contract shall complete Initial Security Training prior to be granted access to classified information. Training shall be completed and reported to the COR within 30 calendar days of award and Refresher training every 12 months for duration of the contract. The Contractor shall submit certificates of completion to the COR for each affected Contractor employee and Subcontractor employee.

* Course code in parenthesis as assigned in DCSA’s learning management system, Security Training Education and Professionalization Portal (STEPP)

1.6.9. Key Personnel

The following positions are designated as Key Personnel:

· Program Manager (PM)

· National Access Elsewhere Security Oversight Center (NAESOC) Team Lead The minimum qualifications and roles for these Key Personnel are detailed below:

Program Manager (PM): Responsible for overall contract performance, resource allocation, and daily operations. Must serve as the primary interface with the KO and COR.

Qualifications: Bachelor’s Degree (or higher) in Program/Project Management, Business, Finance, IT, or Logistics; current Project Management Professional (PMP) certification; minimum of 10 years of experience in program management; and minimum of 10 years of experience interacting with senior-level officials.

NAESOC Team Lead: Responsible for the performance of work at the NAESOC, coordinating with the PM, NAESOC Mission Director and Government Team Leads.

Qualifications: 3-5 years of experience with security-related systems (NISS, DISS); 3-5 years of experience in risk mitigation methodology/strategies; 3-5 years of experience identifying risk to industrial security under the NISPOM; 3-5 years of experience in data analytics, trend reporting, and metrics gathering; and demonstrated experience facilitating the design/implementation of Artificial Intelligence applications.

1.6.9.1. Key Personnel Administration

Key Personnel must be staffed at all times.

1.6.9.1.1. If any Key Personnel position is unstaffed or vacant for more than fifteen (15) consecutive business days, there will be a reduction to the Contractors’ invoice or invoices. The decrement period will be from the 16th unstaffed business day until the day it is staffed. The decrement amount will be calculated by multiplying the fully loaded labor rate (which includes profit rate, G&A Rate, Fringe Benefit Rate, Labor Overhead Rate, Direct Labor Rate, etc) by the number of hours the key personnel position was not staffed.

1.6.9.1.2. The Contractor must submit a proposed replacement for an unstaffed key personnel position. The proposed replacement must be submitted to the COR via email. The proposed replacement must meet the qualifications of the key personnel position as stated in section 1.6.11 of this PWS. The proposed replacement must contain the resume of the personnel the Contractor proposes to fulfill the key personnel position. The COR has 3 business days to notify the Contractor of approval or denial of the Contractor’s proposed replacement.

1.6.9.1.3 If a key personnel position is staffed but the personnel is absent for a period of 3 to 14 consecutive business days, the Contractor must provide a substitute to fulfill the absent key personnel duties. The substitute must meet the qualifications of the key personnel position as stated in section 1.6.13.5 of this PWS. The Contractor must provide the COR written notice, which includes the designated substitute, at least 3 business days before the expected absence. A substitute is not authorized to cover the duties of a key personnel position longer than 11 consecutive business days. A key personnel position is not authorized to have a substitute more than twice in any 60-day calendar period.

1.6.10. Identification of Contractor Employees

All contract personnel attending meetings, answering Government telephones, and working in situations where their Contractor status is not obvious are required to identify themselves as such to avoid creating the impression that they are Government officials. The Contractor must ensure that all documents, spreadsheets, presentations, and reports produced are clearly marked as Contractor products. Contractor personnel working on-site shall obtain, wear, and display Government-issued identification badges at all times.

1.6.11. Contractor Travel

The Contractor may be required to travel within the Continental United States (CONUS) to attend meetings, conferences, or training in support of this PWS.

1.6.11.1. Local Travel: All travel within a 100-mile radius of the Contractor personnel’s assigned work office (Quantico, VA; Hanover, MD; or authorized remote work site) is considered local travel and is fully included in the fixed price of this contract. Local travel costs (e.g., Metro, local mileage) shall be borne entirely by the Contractor.

1.6.11.2. Non-Local Travel: Reimbursement of allowable transportation, lodging, meals, and incidental expenses for travel outside the 100-mile radius will be executed on a cost-reimbursable basis against a dedicated Travel CLIN, subject to the limitations of FAR 31.205-46 and the Joint Travel Regulation (JTR).

1.6.11.3. Travel Approvals: All non-local travel requires written pre-authorization from the COR. The Contractor must submit a detailed travel cost estimate to the COR at least five (5) business days prior to travel, containing:

· Detailed justification and relation to PWS tasks

· Destination and duration

· Number of personnel traveling

· Breakdown of lodging, airfare, rental car, mileage, and per diem estimates.

1.6.11.4. Reporting: The Contractor must submit a comprehensive Trip Travel Report to the COR within five (5) business days following the completion of travel.

1.6.12. Organizational Conflict of Interest (OCI)

Contractor and subcontractor personnel performing work under this contract may have access to proprietary, sensitive, or source selection information (e.g., cost/pricing data, budget analyses, specifications, draft PWS documents) which may create an Organizational Conflict of Interest (OCI) as defined in FAR Subpart 9.5.

1.6.12.1. The Contractor must notify the KO and COR immediately upon identifying an actual or potential OCI and submit an OCI Mitigation Plan within three (3) business days. Acceptance of the mitigation plan is at the sole discretion of the KO.

1.6.12.2. Three-Year Hardware/Services Restriction: The Contractor agrees that during the performance of this contract and for a period of three (3) years after its completion, the Contractor, its affiliates, subcontractors, or successors shall not furnish to the United States Government, as a prime or subcontractor, any system, component, or services which were the subject of the strategic analysis or technology specifications developed under this contract. This exclusion does not apply to re-competitions for the same support services.

1.6.13. Phase-In / Phase-Out Periods (Transition)

To ensure continuity of services and prevent decreases in mission productivity, The Contractor must execute structured 60-day transition periods.

1.6.13.1. Transition-In Period: The transition-in period shall encompass the first sixty (60) calendar days of the Base Period. The Contractor must achieve full operational capability with zero degradation to mission services by the end of this period. The Contractor must:

· Conduct a Start of Work Meeting (SOWM) virtually or in person, within 10 business days of contract award.

· An agenda must be submitted to the KO and COR at least three (3) business days before the SOWM.

· A detailed Phase-In Plan must be submitted at the SOWM

· The Phase-In Plan shall provide a detailed description of full assumption of duties by contractor employees, including all phase-in activities required under this contract

· A Contractor Point of Contact and Organization Chart must be submitted to the KO and COR at the SOWM

· Meeting minutes must be recorded and provided electronically to the COR within five (5) business days after the SOWM.

· Onboard 100% of Key Personnel within seven (7) calendar days of contract start.

· Obtain all necessary security and access credentials for employees to work at the provided Government facility(ies) (i.e., contractor badges/Common Access Cards (CACs)). For Government issued credentials, The Contractor must submit all initial forms and supporting documentation no later than 20 days after contract award. For any follow-on requests for information needed in support of processing the request for Government issued credentials, The Contractor must respond to all Government requests within 48 hours.

· Achieve the following staffing milestones: 25% of staff within 15 days; 50% within 30 days; 75% within 45 days; and 100% within 60 days.

· Complete all Government-provided network and systems training within forty-five (45) calendar days of award.

1.6.13.2. Transition-Out Period: The transition-out period shall run for thirty (30) calendar days immediately prior to the end of the contract's final period of performance. The Contractor must submit a Phase-Out Plan ninety (90) days prior to contract completion. The Contractor must fully cooperate with the successor contractor and Government personnel, conduct hands-on system and tool training, and transfer work control without disrupting day-to-day operations. The Phase-Out Plan must:

· Detail disposition actions and provide accountabilities for all furnishings, equipment, and documentation, and outline the contractor’s approach to fulfill the phase-out requirements of this contract.

· Explain how the contractor will relinquish accountability of GFP during the phase-out period.

· Specify a training program or approach and a date for transferring responsibilities as described in the plan. This plan shall be subject to Government approval.

· Include delivery of the required information to integrate analysis, resource management, office specific task and deliverables.

· Provide the details of how the outgoing contractor will transition all data, and documentation so a successor can re-create all products to continue the same level of quality and service.

· Include all deliverables associated with this PWS as well as any relevant lessons learned, Standard Operating Procedures (SOP) or materials that would be required to recreate any of the deliverables and/or operate and maintain the system.

PART 2

DEFINITIONS AND ACRONYMS

2.1. Definitions

Artificial Intelligence (AI): Machine-based systems capable of demonstrating behaviors and analytical outputs linked to human intelligence, such as reasoning, trend identification, and pattern recognition.

Contractor: A supplier or vendor awarded a contract to provide specific supplies or services to the Government. The term used in this contract refers to the prime contractor.

Contracting Officer (KO): A person with the authority to enter into, administer, and/or terminate contracts and make related determinations on behalf of the Government. Note: The only individual who can legally bind the Government.

Contracting Officer’s Representative (COR): An employee of the U.S. Government appointed in writing by the KO to administer the technical aspects of the contract and provide technical direction within the scope of the contract. The COR provides technical direction but is NOT authorized to change any of the terms, conditions, pricing, or period of performance of the contract.

Defective Service: A service output or deliverable that does not meet the performance standard associated with the Performance Work Statement.

Deliverable: Anything that can be physically or electronically delivered, including reports, plans, analysis products, data inputs, and meeting minutes.

Key Personnel: Contractor personnel evaluated during the source selection process whose continuous presence and expertise are deemed essential for successful contract execution.

Physical Security: Actions and physical barriers that prevent the loss, unauthorized access, or damage of Government property and facilities.

Quality Assurance (QA): The Government's procedures, inspections, and monitoring to verify that services performed by the Contractor meet acceptable standards.

Quality Assurance Surveillance Plan (QASP): An organized, written document specifying the surveillance methodologies and frequency the Government will use to monitor Contractor performance.

Quality Control (QC): All measures taken by the Contractor to ensure that the quality of services and deliverables meets contract requirements.

Subcontractor: An entity that enters into a contract with the prime Contractor. The Government does not have privity of contract with subcontractors.

Work Day: The number of hours per day the Contractor provides services in accordance with the contract.

Work Week: Monday through Friday, unless specified otherwise.

2.2. Acronyms

AA&E: Arms, Ammunition, and Explosives AAR: After Action Report ACAGE: Agency Use Code/Block AI: Artificial Intelligence AQL: Acceptable Quality Level ATF: Bureau of Alcohol, Tobacco, Firearms and Explosives AUP: Acceptable Use Policy CAC: Common Access Card CAP: Contractor Acquired Property CE: Continuous Evaluation CFR: Code of Federal Regulations CI: Counterintelligence CIAR: Counterintelligence Awareness and Reporting CMC: Cyber Mission Center CONUS: Continental United States COR: Contracting Officer’s Representative CUI: Controlled Unclassified Information DCSA: Defense Counterintelligence and Security Agency DISS: Defense Information System for Security DoW: Department of War FCL: Facility Clearance Level FFP: Firm-Fixed-Price FOCI: Foreign Ownership, Control, or Influence FSO: Facility Security Officer GFE: Government Furnished Equipment GFI: Government Furnished Information GFP: Government Furnished Property ISTS: Industrial Security Technologies and Strategy IVR: International Visit Request KO: Contracting Officer LAN: Local Area Network MSR: Monthly Status Report NAESOC: National Access Elsewhere Security Oversight Center NATO: North Atlantic Treaty Organization NCCS: NISP Contracts Classification System NI2: National Industrial Security System Increment 2 NISP: National Industrial Security Program NISS: National Industrial Security System NMP: NISP Mission Performance OCI: Organizational Conflict of Interest OPSEC: Operations Security PASS: Pre-Award Security Survey PM: Program Manager POC: Point of Contact PoP: Period of Performance PPE: Personal Protective Equipment PRS: Performance Requirements Summary PWS: Performance Work Statement QASP: Quality Assurance Surveillance Plan QPR: Quarterly Performance Review QSR: Quarterly Status Report RAC: Region AA&E Coordinator SAAR: System Authorization Access Request SAP: Special Access Program SCI: Sensitive Compartmented Information SEAD: Security Executive Agent Directive SOP: Standard Operating Procedure SOWM: Start of Work Meeting T5 / T5R: Tier 5 / Tier 5 Reinvestigation TASS: Trusted Associate Sponsorship System VDI: Virtual Desktop Infrastructure

PART 3

GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICES

3. Government Furnished Items and Services

3.1. Services, Systems, and Network Access

The Government will provide LAN access and credentials to necessary Government databases and systems (e.g., NISS, DISS, NI2, ACCESS, sam.gov, WEBFLIS, and DTS) required to perform the tasks in this PWS. The Contractor must comply with all agency policies, procedures, and Acceptable Use Policies (AUPs) pertaining to LAN and network access.

3.2. Facilities and Equipment

The Government will provide necessary desk space, telephones, and office utilities for on-site Contractor personnel supporting this effort at the Quantico, VA and Hanover, MD facilities.

3.2.1. Government Furnished Equipment (GFE): The Government will provide laptops or Virtual Desktop Infrastructure (VDI) access for all Contractor personnel requiring network access. Government-issued laptops are authorized for routine, pre-approved telework. Cellular communications will not be provided.

3.2.2. GFP Accountability & Removal: Because GFE laptops and associated peripherals will be removed from Government facilities for authorized telework, this contract is subject to the provisions of FAR Part 45 and FAR clause 52.245-1. The Contractor must safeguard all GFE and be financially responsible for replacement should the equipment be lost, stolen, or damaged due to negligence. The Contractor must track 100% of GFP/GFE and submit a GFE Accountability Report within fifteen (15) days of contract start, and monthly/quarterly thereafter.

3.3. Information and Materials

The Government will provide necessary Government Furnished Information (GFI) and materials, including standard operating procedures (SOPs), administrative policies, document templates, security policies, systems documentation, database schemas, and current manuals as required for task performance.

3.4. Software and Source Code

The Government will provide, system documentation, hosting facilities, and commercial off-the-shelf (COTS) software required to execute tasks. All documentation, data, and other materials generated or received under this contract remain the sole property of the U.S. Government in accordance with FAR clause 52.227-14 (Rights in Data—General).

3.5. System Modernization & Upgrades

The Government may replace, modify, or modernize equipment and systems at its own expense. The Contractor must operate updated or modernized systems at no additional cost to the Government.

PART 4

CONTRACTOR FURNISHED ITEMS AND SERVICES

4. Contractor Furnished Items and Responsibilities

4.1. General

The Contractor must furnish all personnel, management, overhead support, tracking databases, and services required to perform work under this contract that are not explicitly listed as Government-furnished under Part 3. The Contractor must not assume that the Government will provide any additional equipment, material, or information.

PART 5

SPECIFIC TASKS

The workload volumes, transaction counts, and historical hours represented in this section and consolidated into Part 7 represent planning estimates based on historical data. The Contractor must manage resources dynamically to meet all performance thresholds and quality metrics within a variance of +/- 5% of these planning targets.

5.1. Task Area 1: Contract Level Status and Performance Reports

5.1.1 Monthly Status Report (MSR): The Contractor must provide, via email, a Monthly Status Report (MSR) submitted to the COR, KO, and contract specialist 30 days after contract award and on the first Monday of each month, or on the following business day when the first Monday is a holiday. The purpose of the MSR is to describe the Contractor’s monthly activities and serve as the objective evidence of work completed to support the contractor’s monthly invoice submission. The MSR shall include:

· Executive Summary

· High level tasks/work accomplished

· Deliverable tracker matrix and schedule variance

· Identification of schedule risks (High/medium/low) and resolution

· Performance related work, issues and actions with mitigation strategy

· Staffing status, turnover and vacancies

· Problems/issues during the report period and their resolution

· Planned actions for the following month

MSR data will be used by IS and the COR to (1) identify the magnitude and impact of actual and potential problem areas causing schedule variances from plan; (2) provide valid, timely, and auditable task status information to COR; (3) track projects and the timeframes to complete projects in order to define future requirements; and (4) identify potential process improvements and streamlining including the potential use of Artificial Intelligence.

5.1.2 Quarterly Performance Review (QPR): The Contractor must prepare, conduct, and document virtual Quarterly Contract Performance Review (QPR) meetings to ensure ongoing alignment with Government objectives, validate performance metrics, and address any risks or issues associated with the delivery of services under this PWS. Each QPR shall take place no later than fifteen (15) calendar days following the close of each contract performance quarter. At a minimum, the Contractors program manager and Key Personnel on this contract must be in attendance at each QPR. The COR, in conjunction with the KO, will apprise the Contractor of how the Government views the Contractor's performance.

For each QPR, the Contractor must:

· Schedule and coordinate each QPR

· Develop and submit a comprehensive meeting agenda to the COR and KO at least five (5) business days prior to each scheduled QPR.

· Develop and present a Quarterly Status Report (QSR) and briefing deck for each QPR. The QSR and briefing deck must be submitted to the COR and KO at least 3 business days prior to each QPR. At a minimum, the QSR and briefing deck will cover the following:

· Executive summary of work accomplished and deliverables submitted during the previous quarter.

· Review of Performance Requirements Summary (PRS) metrics, Quality Assurance Surveillance Plan (QASP) results, and any Acceptable Quality Level (AQL) deviations.

· Risk management updates, including identified risks, current mitigation strategies, and any issues requiring Government intervention or resolution.

· Process improvements

· Projected activities, milestones, and schedule for the upcoming quarter.

· Record, draft, and submit comprehensive meeting minutes documenting all attendees, discussions, assigned action items, and decisions made during each QPR. The Contractor must submit meeting minutes within five (5) business days after the conclusion of each QPR.

5.2. Task Area 2: International and Special Programs (ISP) Support The Industrial Security ISP Office oversees DCSA's international responsibilities regarding cleared industry involvement with foreign governments, foreign contractors, and the North Atlantic Treaty Organization. ISP also manages the security oversight function of direct and indirect support to the Special Access Program (SAP) community as well the DoD Arms, Ammunition and Explosives (AA&E) program. The Contractor must execute operational support across division initiatives, focusing on visits, transfers, security assurances, Special Access Programs, and AA&E while identifying process optimizations and AI applications.

5.2.1. ISP Portfolio and Program Meeting Support

The Contractor must coordinate end-to-end administration for ISP internal and external meetings. This includes managing meeting logistics, preparing members with pre-read materials, recording official notes, and publishing comprehensive After Action Reports (AARs) to maintain rigorous portfolio governance.

5.2.2. Special Programs and SAP Portfolio Support

The Contractor must enhance the quality, timeliness, and communication surrounding SAP processes, policies, and initiatives through the preparation and tracking of annual eligibility and annual SAP training information packages, drafting correspondence, coordinating, filing and recording stakeholder responses, communicating ISP initiatives, programs, and projects to support stakeholders, collecting data from relevant databases and resources, analyzing data to identify trends and insights, developing and maintaining performance dashboards, recording and reporting findings to ISP leadership, while…