IT Services PWS 2021-10-25 Sep_v2.4 (1).docx

PERFORMANCE WORK STATEMENT (PWS) v2.4 (25 Oct 2021) United States Army Reserve Information Technology Services

PART 1 GENERAL INFORMATION

1 General This is a non-personal services contract to provide Command, Control, Communications, Computers, and Information Management (C4IM) Information Technology (IT) Support Services.

The Government shall neither supervise contractor employees nor control the method by which the contractor performs the required tasks. Under no circumstances shall the Government assign tasks to, or prepare work schedules for individual contractor employees. It shall be the responsibility of the contractor to manage its employees and to guard against any actions that are of the nature of personal services, or give the perception of personal services. If the contractor believes that any actions constitute, or are perceived to constitute personal services, it shall be the contractor's responsibility to notify the Contracting Officer (KO) immediately.

1.1 Description of Services/Introduction

Contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform C4IM IT Support Services, as defined in this Performance Work Statement (PWS), except for those items specified as government furnished property and services. Contractor shall perform in accordance with (IAW) the terms and conditions of the contract and consistently with the established standards in this PWS and contract.

1.2 Background

The United States Army Reserve (USAR) plays a critical role in defending our nation. Under Title 10 of the U.S. Code, the mission of the USAR is to provide trained, equipped, and ready Soldiers and cohesive units to meet the global requirements across the full spectrum of operations. The Army Reserve is a key element in the Army multicomponent unit force, training with Active and National Guard units to ensure all components work as a fully integrated team.

United States Army Reserve Command (USARC) G-6 owns and operates Army Reserve Network (ARNet) and Secure Army Reserve Network (SARNet) to provide continuous secure and nonsecure data, voice, and video transport, data center services, hosted applications, file services, collaboration tools, cybersecurity, remote access, continuity of operations, and customer service across the USAR enterprise IAW Army Regulation (AR) 25-1 Army Information Technology and other governing documents and outlined in the Army’s Command, Control, Communications, Computers and Information Management (C4IM) Services List. These services are provided to 65,000 users with network accounts at approximately 700 locations, primarily in the continental United States with a few in Puerto Rico, Europe, Asia, and the Pacific region. 2 of the locations contain the primary and secondary enterprise network processing centers. For Europe and Pacific regions, this contract does not provide touch labor Tier I/2 customer support.

1.3 Objectives

The objective of this Performance Work Statement (PWS) is to obtain reliable secure network capabilities, enhanced operational effectiveness, and reduced capital and operations costs through operational consolidation. Contractor shall work collaboratively with current and future USAR contractors, service providers, and vendor partners to focus on USAR’s success, and maintain continuous delivery and management of consistent data, voice, video, collaboration and data center services, application hosting, file storage and retrieval, cybersecurity compliance, and disaster recovery/continuity of operations and maintenance to USAR facilities. All IT projects and services shall align with the intent and direction of Department of the Army and Department of Defense.

Full documentation of processes, projects, and configurations shall be produced and regularly revised for currency.

1.4 Scope

Contractor shall provide design, configuration, installation, implementation, testing, connectivity, monitoring, operations and maintenance, detection of cybersecurity malicious attacks, risk analysis, remote and onsite touch labor and/or replacement, enterprise architecture, security architecture, project management, change management, administrative and technical services, lifecycle management (excluding procurement and leasing of software and hardware), asset and license management, and logistics services for hardware, software, and firmware integral to ARNet. The C4IM Services List as adapted by USAR is considered the baseline of service requirements. Attachment 5 is the list of C4IM services adapted by USAR.

Government shall have and retain operational visibility, oversight, and command and control of its IT infrastructure.

Contractor shall use Government approved customer service ticket system, Information Technology Information Library (ITIL) based processes for daily operations, and follow Project Management Institute principles to manage projects. Contractor shall incorporate Government approved ITIL practices into C4IM processes to improve efficiency. Application of ITIL principles and framework will be IAW Army regulations.

Services are provided in the following categories.

1.4.1 Network Services

· Operate and maintain ARNet consisting of Virtual Private Network (VPN) circuits, wide area network (WAN), campus area network (CAN), and local area network (LAN) equipment and interconnections for approximately 700 sites

· Operate and maintain network monitoring/management platforms and tools for ARNet and SARNet infrastructure

· Provide for segmented transport for specialty traffic by use of Virtual Routing and Forwarding (VRF) tunnels and Virtual Local Area Networks (VLAN)

· Monitor ARNet and SARNet 24x7x365 in a combined Network Operations Center (NOC) and Security Operations Center (SOC) located at HQ USARC

· Provide data network planning

1.4.2 Voice Services

· Operate and maintain the USAR voice services environment consisting of the enterprise Voice over IP system and circuits

· Operate and maintain redundant enterprise session controllers, voice firewalls, telephones, calling features, voice mail boxes, auto attendant, DSN connectivity, e911 service, long distance, integrated messaging system

· Manage moves, adds, changes, delete actions for 7,000 phone lines associated with emergency services (e.g. 911), elevators, arms vaults, fire alarms, intrusion detection systems, and other life safety requirements

· Monitor voice services 24x7x365 in NOC

· Provide telephone services billing review, audit, disputes, payment, and related functions

1.4.3 Data Systems and Applications Services

· Operate and maintain the primary and secondary datacenters consisting of physical and virtual servers, storage area network, and network area storage for backup/archive, multilayer switches, and datacenter routers

· Provide datacenter services to ARNet, including Active Directory (AD), Domain Name System (DNS), Dynamic Host Configuration Protocol (DHCP), Top Level Organizational Unit (TLOU) Management, Group Policy Object (GPO) Management, user/computer object management, Distributed File System (DFS), Key Management Services (KMS), Certificate Authority (CA), System Center Operations Manager (SCOM), System Center Configuration Manager (SCCM), and Active Directory Federated Services (ADFS)

· Maintain and operate applications and systems, including server administration, Simple Mail Transfer Protocol (SMTP) Mail Relay, whitelisting, enterprise print services, Linux operating system support, and Army Reserve Account Management Portal (ARAMP), a custom software

· Monitor ARNet and SARNet datacenters 24x7x365 in Network Operations Center

· Provide technical advice and operations necessary to transition to a cloud solution

1.4.4 Cybersecurity Operations Services

· Maintain FISMA and STIG device compliance on networks

· Use a defense in depth approach to protect ARNet from threats, attacks, and vulnerabilities

· Operate and maintain security appliances and devices, monitoring, scanning, port security, policies, training, and certification requirements. Appliance and tools include firewalls, intrusion detection system (IDS), wireless intrusion detection system (WIDS), intrusion protection system (IPS), identity services engine providing 802.1x, Assured Compliance Assessment Solution (ACAS) scanning, comply to connect protections, and other security appliances and tools.

· Provide laptop and end user authentication services, including custom imaging, end point configuration, hard drive encryption services, and DoD Public Key Infrastructure (PKI)

· Operate and maintain network based security system monitoring and management platform and tools

· Monitor cybersecurity operations 24x7x365 in the SOC.

1.4.5 Customer Service

· Operate an Enterprise Customer Service Center providing tiered customer service to 65,000 customers

· Provide software and application installation and configuration, diagnostic and touch labor services, both remote and touch labor for laptops and peripheral devices

· Provide operations and maintenance for printers

· Provide wireless mobility device implementation and maintenance services (e.g., smart phones, tablets)

· Provide walk up customer services for approximately 900 users at HQ USARC

· Provide Tier I Contractor owned/Contractor (CO/CO) operated virtual or physical customer service desk which is the initial contact point for all incidents, problems and requests. Customer service desk is reached either by toll free number or web access. Contractor shall provide a call system that provides for Interactive Voice Response (IVR) and an Agent Call Distribution (ACD).

· Locate Service Desk Operations Manager at HQ USARC

· Locate Tier II technicians and regional managers strategically across the continental United States for optimum service response.

· Use Government provided customer service ticket system

1.4.6 Administrative and Technical Services

· Provide disaster recovery and continuity of operations (COOP) services

· Service Level Management

· Network and datacenter service support planning

· Provide operations planning services

· Provide enterprise architecture services

· Provide service design and service management services

· Provide logistics management services

· Provide asset and license management services

· Provide technical writing and documentation services

1.5 Period of Performance

Phase-In: 60 day Period Base Year: 10 month Period Option Years: 4 12 month Option Periods

1.6 Quality Control

Quality control is the responsibility of Contractor. Contractor shall develop, implement, and maintain a Quality Control Program (QCP) detailed in a Quality Control Plan (QC Plan) in Microsoft Word to ensure all work described in this contract is performed at or above the standard defined in the Performance Requirements Summary (PRS). The QCP is developed by Contractor to ensure that it performs and delivers high-quality service and products. The QCP shall include methods of documenting and enforcing quality control operations of both prime Contractor and/or subcontractor work; including inspection and testing.

1.6.1 Contractor shall submit their QC Plan in electronic format within 10 days of contract start. After acceptance of the QC Plan, Contractor shall receive KO’s acceptance in writing or any proposed changes to the QC procedures. Contractor shall submit QC Plan changes within 5 days to the KO and Contracting Officer’s Representative (COR) for review and acceptance prior to implementation.

1.6.2 Inspection System. Contractor shall develop, implement and maintain a system to inspect their services as well as their subcontractor services and products to ensure compliance with PWS requirements, and applicable laws and regulations. It shall specify tasks or areas to be inspected on a scheduled or unscheduled basis, the manner in which inspections are to be conducted, the titles of the individuals who will perform the inspections, and the percentage of the work that will be inspected on a recurring basis.

1.6.3 Inspection Files. Contractor shall document all inspections conducted, and the necessary corrective and preventive actions taken.

1.6.4 Deficiency Identification, Prevention and Correction. The QC Plan shall include a method of identifying and preventing deficiencies in the quality of services performed before the level of performance becomes unacceptable as defined in the PRS, without dependence upon Government direction. Contractor shall identify and prevent defects in quality of products and services performed before the level becomes unacceptable and before they are provided to the Government. The QC Plan shall address process control and continuous process improvement; procedures for scheduling, conducting and documentation of inspection; discrepancy identification; procedures for root cause analysis; corrective and preventive action procedures to include procedures for addressing Government discovered non-conformances; procedures for trend analysis; and procedures for collecting and addressing customer feedback/complaints. The QC Plan shall document process control and process performance measurement procedures that shall include how Contractor shall implement preventive corrective actions. Contractor shall demonstrate that it has designed quality into the delivery of services thereby mitigating the risk(s) associated with delivery of deficient or nonconforming services.

1.6.5 Contractor shall keep records on-site of all inspections conducted by Contractor and necessary corrective action taken. These documents shall be available for inspection by the Government during the term of the contract.

1.6.6 The QC Plan shall contain methods of communications (direct and indirect) with the Government regarding performance of the contract. Communication shall include regular and formal meetings with the Government for review and analyses of key process indicators, analysis of process deficiencies, and problem resolution.

1.6.7 Upon request from the KO or COR, Contractor shall provide all reports generated as a result of Contractor’s quality control efforts. This shall include any summary information used to track quality control, including any charts/graphs.

1.7 Reserved

1.8 Quality Assurance (QA). The Government will evaluate Contractor’s performance under this contract and reserves the right to inspect or test any supplies or services that have been tendered for acceptance.

1.8.1. Non-conforming Services. When a contractor’s performance does not meet contract requirements and/or approved work schedules and/or timeframes it is considered non-conformance. Non-conforming services shall be re-performed at no increase in contract price. If non-conforming services are cannot be re-performed, are recurring, or the services fail to achieve to the performance standard listed within the specific task and/or Performance Requirements Summary (PRS), the Government may reject the nonconforming service(s) and document Contractor’s performance record and may issue a Nonconformance Report (NCR). Non-conformance will be classified in one of three categories: level I (Minor), level II (Major) or level III (Critical). The Government may re-inspect work designated for re-performance or late performance. The Government can reduce payment to Contractor IAW the PRS, or reduce payment to reflect the value of the services performed, or may perform the services and charge Contractor for any related cost incurred and/or may terminate this contract for cause.

1.8.1.1. Level I (Minor) non-conformance. Defined as a non-conformance that is not likely to materially reduce the usability of the supplies or services for their intended purpose, or is a departure from established standards having little bearing on the effective use or operation of the supplies or services. Minor non-conformance usually can be corrected on the spot, where no further CA response is necessary, and can be issued by the COR to Contractor. Minor non-conforming services shall be re-performed within a specified time frame at no increase in contract price. If minor non-conformances are recurring or re-performance is not completed in full and within the specified time a Level II non-conformance may be issued to Contractor by the Contracting Officer (KO).

1.8.1.2 Level II (Major) non-conformance. Defined as a non-conformance, other than critical, that is likely to result in failure of the supplies or services, or to materially reduce the usability of the supplies or services for their intended purpose. Recurring Minor non-conformances, or a non-responsive contractor, indicating a trend or failure of Contractor’s quality control, can also be classified as a Major non-conformance. Major non- conformance’s will result in the issuance of a written NCR from the KO to Contractor requiring the development of a Corrective Action Plan (CAP) by Contractor which identifies the root cause, corrective action (CA) for the root cause, CA for the specific non-conformance and the date CAs will be completed.

1.8.1.3 Level III (Critical) non-conformance. Defined as a non-conformance that is likely to result in hazardous or unsafe conditions for individuals using, maintaining, or depending upon the supplies or services; is likely to prevent performance of a vital agency mission; is for a repeated or uncorrected level II NCRs; or is for a non- responsive contractor to a level II NCR. Critical non-conformance’s shall result in the issuance of a written NCR from the KO, or higher level within the contracting office, to Contractor requiring the development of a CAP by Contractor which identifies the root cause, CA for the root cause, CA for the specific non-conformance and the date CAs will be completed.

The COR will evaluate Contractor’s performance under this contract IAW the Quality Assurance Surveillance Plan (QASP). This plan is primarily focused on what the COR must do to ensure that Contractor has performed IAW the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s). When an observation indicates defective performance, the COR will require Contractor or designated on-site representative to initial the observation to acknowledge the defective performance. The acknowledgement of the observation does not necessarily constitute Contractor concurrence with the observation, only that Contractor has been made aware of the defective performance.

1.9 Property Management

Property management is the responsibility of Contractor. Contractor shall develop, implement, and maintain a Contractor Property Management Plan (CPM Plan) to ensure all Government furnished equipment (GFE) and Government furnished property (GFP) is protected from loss or damage. The CPM Plan is developed by Contractor to ensure that it safeguards and maintains full visibility and control of all GFE and GFP in its possession. The CPM Plan shall include methods of documentation and enforcing inventory control operations of both prime Contractor and/or subcontractor personnel.

1.9.1 Contractor shall submit their CPM Plan in Microsoft Word format within 10 days of contract start. After acceptance of the CPM Plan, Contractor shall receive KO’s acceptance in writing or any proposed changes to the CPM Plan. Contractor shall submit CPM Plan changes within 5 days to the KO and COR for review and acceptance prior to implementation.

1.9.2 Inspection System. Contractor shall develop, implement and maintain a Property Management System (PMS) that includes controls for receiving, inspection, acceptance, inventory, and turn in of Government furnished equipment and property by part number and serial number to ensure compliance with PWS requirements, and applicable laws and regulations. The PMS shall be capable of providing periodic inventory reports of GFE.

1.9.3 The CPM Plan shall specify GFE inventory inspections to be conducted on a scheduled basis, the manner in which inspections are to be conducted, and the titles of the individuals who will perform the inspections and the percentage of the work that will be inspected on a recurring basis.

1.9.4 Inspection Files. Contractor shall document all inventories conducted, and the necessary corrective and preventive actions taken.

1.9.5 Deficiency Identification, Prevention and Correction. The CPM Plan shall include a method of identifying and preventing deficiencies in the inventory control of GFE without dependence upon Government direction. Contractor shall identify and prevent defects in property management procedures and loss or damage to GFE. The CPM Plan shall address process control and continuous process improvement; procedures for scheduling, conducting and documentation of inventory inspections; discrepancy identification; procedures for root cause analysis; corrective and preventive action procedures. The CPM Plan shall document procedures that shall include procedures for tracking down and recovering lost GFE, procedures for restoring damaged GFE, and how Contractor shall implement preventive corrective actions. Contractor shall demonstrate that it has incorporated necessary management controls to mitigate risk of loss or damage.

1.9.6 Contractor shall keep records onsite of all inventory inspections conducted by Contractor and necessary corrective actions taken. These documents shall be available for inspection by the Government during the term of the contract. An annual inventory report in shall be delivered in Microsoft Excel format 30 days prior to end of each period of performance (PoP) to KO and COR.

1.9.7 The CPM Plan shall contain methods of direct and indirect communications with the Government regarding inventory control. Communication shall include regular and formal meetings with the Government for review of GFE held, analysis of process deficiencies, and problem resolution.

1.9.8 Upon request from the COR, Contractor shall provide all reports generated as a result of Contractor’s inventory control efforts. This shall include any summary information used to track inventory control, including any charts and graphs.

1.10 Safety

Contractor is responsible for complying with applicable Federal Occupational Safety and Health Administration standards (OSHA), Department of Transportation (DOT), DoD, Army, federal, state, county, township, and local safety and health requirements. The stricter requirement shall apply in cases where standards conflict. The Government’s interest is to protect personnel working in or around Contractor operations, and the protection of Government equipment/property. Contractor shall take proper safety and health precautions to protect the lives and health of its employees, military personnel, Government employees, the public, and the property of others. Contractor shall be the controlling employer as defined by OSHA while performing work under this contract.

Contractor shall not construe the requirements of this PWS as making the Government the controlling employer.

1.10.1 Safety Plan. Contractor shall establish and maintain a Safety Plan that delineates the processes and procedures Contractor shall use to prevent accidents, protect property, and preserve the life and health of contractor and Government personnel then implement a Safety Program based upon this Safety Plan. Contractor shall submit the plan to the KO and COR no later than 20 business days after performance start date and 5 business days prior to any change. Safety Plan shall address health, emergency, and fire responses and be compliant with OSHA directives for a safe workplace to include hearing conservation, hazard communication, hazardous energy, confined space, respiratory protection, and fire prevention and fall protection.

1.10.1.1 Contractor shall pass all safety and security inspections or remediate all findings within 48 hours of an identified deficiency.

1.10.1.2 Contractor shall be responsible for all damages to persons or property that occur as a result of the fault or negligence of Contractor or Contractor employees.

1.10.2 Provisions: Contractor’s Safety Plan shall address how Contractor quality control safety duties will be performed and contain, as a minimum, the following provisions:

· Specific procedures for compliance with applicable environmental, transportation and worker safety standards and codes of OSHA, DOT, DoD, Army, Federal, 63rd, state, county, township, and local authorities.

· Procedures for compliance with the safety-related requirements of PWS

· Specific procedures for compliance with all applicable fire codes and inspections by fire prevention personnel.

Contractor shall be liable for all fines, penalties, and costs which result from violations of, or failure to comply with, all such local state, or Federal laws, rules, and regulations.

1.10.3 Contractor shall perform work in a safe manner IAW OSHA Safety and Health Requirements. Contractor shall provide a verbal notification to the KO as soon as possible of each occurrence of damage to Government property or an accident resulting in death, injury, occupational disease, or adverse environmental impact.

1.10.4 Contractor shall involve employees in safety and security processes and furnish written orientations and training plans for all employees. Contractor shall report all accidents and injuries on any Government Installation to the COR and KO within 24 hours of the mishap. Contractor shall keep accurate records of all training and mishaps. Contractor shall provide a completed copy of required Accident Investigation Reports to the KO within 5 calendar days of each occurrence.

1.10.5 All unsafe acts or conditions fostered by Contractor or Contractor personnel may be grounds for the KO to halt all Contractor performance with a commensurate deduction of monies due Contractor until such unsafe conditions are corrected. Contractor shall take due caution not to endanger personnel during performance of this contract. Upon discovery of any hazard such as, but not limited to, fire or large fuel spill, Contractor shall immediately notify the KO or COR.

1.10.6 The contractor shall provide a licensing / certification program that validates the abilities of contractor personnel to operate the vehicles and equipment necessary for use during this effort. In accordance with Department of Defense Directive (DoDD) 4500.36-R, Department of Defense (DoD) contractor personnel shall comply with state licensing requirements and local motor vehicle laws. Contractor employees assigned to operate Government furnished equipment in the performance of this contract must be certified, by the contractor and at the contractor's expense, as being fully qualified to operate the vehicles or equipment to which they are assigned. Contractor personnel who operate Government furnished equipment shall possess a valid state driver's license or a Commercial Driver’s License (CDL), if required. A record of required licensing / certification(s) and status of each employee will be available to the Government upon request during normal business hours or at any time following damage, destruction to Government property or following any contractor or Government employee injury resulting in lost time from work or requiring medical attention.

1.11 Recognized Federal Holidays

Contractor may maintain minimum staffing when notified in person or telephonically by COR that USAR facilities are otherwise closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. Contractor shall maintain an adequate workforce to provide uninterrupted performance of all tasks defined within this PWS. Some individuals shall be identified as emergency or essential employees and shall be required to continue to provide services in the event of unforeseen conditions or contingencies.

1.12 Hours of Operation

Contractor shall provide Tier I customer service and network monitoring/management services 24 hours per day, 7 days per week, 365 days per year (24x7x365). Tier II customer support shall be provided from 7:00 a.m. to 7:00 p.m. Eastern Time weekdays and during battle assembly weekends.

Contractor shall at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the government facility is not closed for the above reasons. When hiring personnel, Contractor shall keep in mind that the stability and continuity of the workforce are essential to successful performance under this contract. No overtime (OT) or compensatory time (CT) is authorized.

Flexible work schedule may be considered. Performance of work by Contractor personnel under the terms of this contract shall not interfere with regularly scheduled government operational activities.

1.13 Place of Performance

Contractor shall have routine access to Government-controlled facilities. The work under this task order shall be performed at USAR facilities around the world, augmented by approved contractor-provided sites and contractor- provided remote agents to meet required service levels.

The primary appointed place of duty for work to be performed under this contract is at Ft. Bragg, North Carolina. Network operations and customer service desk dedicated to USARC headquarters will be located at Ft. Bragg, NC. Datacenter personnel will be located at primary and secondary Installation Processing Nodes (IPNs). Contractor shall determine location of Tier I and Tier II personnel. Contractor shall locate Tier II personnel geographically in USAR centers to optimize services. Distribution shall take into account population and command structure. Network based security system support personnel shall be located at Fort Bragg, NC and Fort McCoy, WI.

1.14 Contractor Location Requirements

Any Contractor provided facilities must meet physical security requirements of a DoD Mission Assurance Category II sensitive system as specified in DoD Instruction 8500.2, IA Controls. The facility shall meet the requirements of DoD Directive 8500.1E Cybersecurity in Defense Acquisition, DoD Instruction 8500.2 Cybersecurity Implementation, Army Regulation 25-2 Cybersecurity, and DoD CIO Guidance and Policy Memorandum No. 6-8510 Department of Defense Global Information Grid Cybersecurity. Travel to and from USAR sites across CONUS and OCONUS will be required throughout the period of performance. See Attachment 3, USAR Site List – Snapshot in Time for reference.

1.14.1 Telework. Contractors who telework must complete the course, Telework Fundamentals - Employee Training, available at https://www.telework.gov/training-resources/telework-training/virtual-telework- fundamentals-training-courses/employee-course/index.htm. Employees must complete all of the lessons and receive a completion certificate for this course. Contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee, to the COR prior to commencement of telework, but NLT 30 calendar days after completion of training by all employees and subcontractor personnel.

1.15 Alternate Place of Performance for Contingency

As determined by the COR, Contractor personnel may be required to work at an alternate place of performance (e.g., home or another approved facility within the local travel area) in cases of unforeseen conditions or contingencies (e.g., exercises, inclement weather, pandemic, or Government designated emergencies).

Employees other than essential employees shall not report to a closed Government facility. Essential employees are those who must perform tasks onsite to monitor, operate, maintain, or restore essential IT services during an event of the type listed in this paragraph.

1.16 Security Requirements

1.16.1 Security Clearance. Contractor shall complete the necessary steps to obtain proper clearances within 10 business days of commencing work under this contract. Contractor personnel performing work under this contract may have an Interim Secret Clearance within 10 business days, but must have a final Secret Clearance within 180 days with no waivers and must maintain the level of security required for the duration of the contract. The security requirements are IAW the attached DD254. Contractor personnel shall comply with all applicable security and safety regulations, guidance, and procedures, including local, referenced in this PWS and in effect at the work sites. All personnel must meet requirements IAW DoDD 8140.01 Contractor personnel assigned to perform work under this contract shall be required to pass a national agency check prior to their assignment. The security requirements are in accordance with the DD Form 254, Department of Defense (DoD) Contract Security Classification Specification The COR will provide POC information of the security monitor responsible for initiating this form to the contractor to obtain the clearance.

1.16.2 Contractor shall initiate requests for background investigations of employees requiring national agency checks. This requirement also applies to vendor employees subcontracted to perform tasks at USAR facilities. If more demanding security requirements occur for a site, they shall be included in the order. Originate the request through your company Facility Security Officer (FSO) based on bona fide contractual occupational requirement.

1.16.3 All individuals requiring access to information technology (IT) systems shall have the appropriate security clearance and will be granted access according to their security clearance, need to know and their IT position/category. Additional position category and investigation guidance is available in DoD 5200.2-R. As referenced from AR 25-2, employees requiring access to information systems processing classified information to fulfill their duties shall possess the required favorable security investigation, security clearance, formal access approval IAW DoD Directive (DoDD) 8570, and need to know.

1.16.4 Common Access Card (CAC) Issuance. Contractor employee requires, at a minimum, a favorably adjudicated National Agency Check with Inquiries (NACI), or an equivalent or higher investigation IAW Army Directive 2014-05 and the requirements of this contract. Contractor employee will be issued a CAC only if duties involve one of the following: (1) Both physical access to a DoD facility and access, via logon, to DoD networks on-site or remotely; (2) Remote access, via logon, to a DoD network using DoD-approved remote access procedures; or (3) Physical access to multiple DoD facilities or multiple non-DoD Federally-controlled facilities on behalf of the DoD on a recurring basis for a period of 6 months or more. At the discretion of the sponsoring activity, an initial CAC may be issued based on a favorable review of the FBI fingerprint check and a successfully completed NACI at the Office of Personnel Management. Contractors will NOT be sponsored to obtain a CAC or given access to ARNet and SARNet until this can be verified in Defense Information Security System (DISS). The Trusted Associate Sponsorship System (TASS) Trusted Associate (TA) has the responsibility to verify Contractor’s clearance.

1.16.4.1 Contractor shall immediately report any lost or stolen CAC or government issued identification cards to the COR and Military and/or DoD police agencies. Contractor shall immediately collect the CAC and other government issued forms of identification upon termination of employee, or at the end of the contract performance period. The CAC and other government issued forms of identification shall be returned to the COR within one hour of employee termination, or at the end of contract performance period, whichever comes first. Final payment may be delayed if Contractor fails to comply with these requirements.

1.17 National Industrial Security Program (NISP)

Contractor shall implement and maintain a security program for control of personnel, property, and information, including unclassified and classified materials, documents, and records. Contractor shall comply with Federal Acquisition Regulation (FAR) 52.204-2, Security Requirements. This clause involves access to information classified “Confidential,” “Secret,” or “Top Secret” and requires Contractors to comply with The Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (NISPOM), DoD Directive 5220.22-M, and any revisions to DoDD 5220.22-M. Contractor shall safeguard information, materiel, equipment and records, regardless of media, from being compromised, altered, destroyed, mutilated, damaged, or lost in accordance with AR 25-1, AR 25-55, AR 25-400-2, AR 340-21, AR 380-5, and all other policies specifically mentioned in section C-5. Title 18 United States Code (U.S.C.) §2071 defines possible penalties for destruction of Government records.

Contractor’s security program shall include provisions for

1.17.1 Initial and Annual Operations Security (OPSEC) awareness training IAW AR 530-1. Operations Security, new contract employees shall complete Level I OPSEC training within 30 calendar days of their reporting for duty and annually thereafter.

1.17.2 Receiving, storing, disseminating, transmitting, transporting, and protecting items classified as CONFIDENTIAL or SECRET by the Government, including the use of courier cards.

1.17.3 In-processing and out-processing Contractor personnel for security matters.

1.17.4 Obtaining Contractor personnel security clearances.

1.17.5 Documenting and reporting actual and potential security problems.

1.17.6 Initiating proper procedures to correct documented problems and implementing corrective procedures in Contractor's security program.

1.17.7 Filing Classified Documents. All Government-furnished classified and unclassified files in existence at the contract performance start date and those generated under this contract shall be maintained IAW AR 25- 400-2 or other applicable regulations. Files shall be transferred to the KO or designated representative upon completion of the contract period or last day of contract performance, whichever comes first. Such files are the property of the U.S. Government. Contractor shall provide security of classified documents IAW AR 380-5, 380-40, and DoD 5200.1-R, NISPOM.

1.17.8 Physical Security Plan. This portion of Contractor’s security program shall address physical security aspects associated with contract performance and describe how Contractor shall prevent unauthorized access, vandalism, pilferage, larceny, sabotage, and arson directed toward Contractor-controlled facilities and Government Furnished Property (GFP). The plan shall also provide internal safeguards for the security of all Government property and for the control of information, including personnel security requirements related to handling and accessing classified information. The following shall apply when developing the physical security plan: AR 190-11, 190-13, and 190-51; Department of Defense Instruction (DoDI) 5100.76, DoDI 5220.22. Contractor shall develop and implement a physical security plan IAW AR 190-13 The Army Physical Security Program. The plans shall be submitted to the COR for approval no later than 60 days after performance start date and no less than 30 calendar days prior to any proposed change.

1.17.9 Key Control. Contractor shall include in the physical security section of Contractor’s security plan a key control plan IAW applicable regulations, policies and directives ensuring keys/key cards issued to Contractor by the Government are not lost or misplaced and are not used by unauthorized persons. The key control plan shall include requirements of AR 380-5, if classified materials are being stored. NOTE: All references to keys include key cards. No keys issued to Contractor by the Government shall be duplicated. Such procedures shall include turn-in of any issued keys by personnel who no longer require access to locked areas. Contractor shall immediately report any occurrences of lost or duplicate keys/key cards to the COR.

1.17.9.1 In the event keys are lost or duplicated, Contractor shall, upon direction of the KO, re-key or replace the affected lock or locks; however, the Government, at its option, may replace the affected lock or locks or perform re-keying. When the replacement of locks or re-keying is performed by the Government, the total cost of rekeying or the replacement of the lock or locks shall be deducted from the monthly payment due Contractor. In the event a master key is lost or duplicated, all locks and keys for that system shall be replaced by the Government and the total cost deducted from the monthly payment due Contractor.

1.17.9.2 Contractor shall prohibit the use of Government issued keys/key cards by any persons other than authorized Contractor’s employees. Contractor shall prohibit the opening of locked areas by Contractor personnel to permit entrance of persons other than Contractor personnel engaged in the performance of assigned work in those areas, or personnel authorized entrance by the KO.

1.17.10 Lock Combinations. Contractor shall establish and implement methods of ensuring that all lock combinations are not revealed to unauthorized persons. Contractor shall ensure that lock combinations are changed when personnel having access to the combinations no longer have a need to know such combinations. These procedures shall be included in Contractor’s security program plan.

1.17.11 Access and General Protection/Security Policy and Procedures. Contractor and all associated subcontractor employees shall provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services, or Security Office. Contractor workforce must comply with all personal identity verification requirements (Federal Acquisition Regulation (FAR) clause 52.204-9, Personal Identity Verification of Contractor Personnel) as directed by DoD, HQDA, and/or local policy. In addition to the changes otherwise authorized by the “changes clause” of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

1.17.12 Contractors That Do Not Require CAC But Require Access to a DoD Facility or Installation. Contractor and all associated subcontractors employees shall comply with adjudication standards and procedures using the National Crime Information Center Interstate Identification Index (NCIC-III) and Terrorist Screening Database (TSDB), Army Directive 2014-05, AR 190-13, and applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by government representative), or, at OCONUS locations, IAW status of forces agreements and other theater regulations.

1.17.13 Anti-Terrorism (AT) Level I Awareness Training. All Contractor personnel, including subcontractor personnel, requiring access to Army installations, facilities, and controlled-access areas shall complete AT Level I awareness training within 30 calendar days after the contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable. AT Level I awareness training is available at https://jko.jten.mil.

1.17.14 AT Awareness Training for Contractor Personnel Traveling Overseas. US based contractor employees and associated subcontractor employees will make available and receive government provided area of responsibility (AOR) specific AT awareness training as directed by AR 525-13. Specific AOR training content is directed by the combatant commander with the unit ATO being the local point of contact.

1.17.15 iWATCH Training. Contractor shall brief all personnel performing work under this contract on the local iWATCH program. This local developed training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the COR. This training shall be completed within 30 calendar days of contract start with the results reported to the COR NLT 45 calendar days after contract start. New employees shall complete the training within 10 calendar days of commencing performance of work under this contract, with the results reported to the COR NLT 15 calendar days of employee commencing performance of work under this contract.

1.17.15.1 iWATCH is simply common awareness. Contract employees can be good sources of information. iWATCH training would include organization instructions on “things to look for” and a phone number to call in case the contract employees have information regarding possible terrorist or criminal activities. Providing Contractors with awareness materials such as the iWatch brochure or wallet card is a cost effective alternative to training. The card describes suspicious activity and can be modified to include the COR in reporting procedures. Samples of the iWatch brochure and posters are available on the Antiterrorism Enterprise Portal (ATEP) at https://army.deps.mil/army/sites/PMG/prog/ATEP/iWATCH%20Army/Forms/AllItems.aspx and https://www.army.mil/e2/c/downloads/287489.pdf.

1.17.16 Threat Awareness Reporting Program. For all Contractor personnel with security clearances Threat Awareness and Reporting Program (TARP), contracting employees must receive annual TARP training by Counter Intelligence (CI) Agent or other trainer IAW AR 381-12, para. 2-4b.

1.17.17 Army Training Certification Tracking System (ATCTS). Contractor shall have access to Government controlled information systems during performance of work under this contract. All Contractor personnel and associated subcontractors who require access to a government information system shall be registered in the Army Training Certification Tracking System (ATCTS) within 5 days of contract start. All Contractor personnel and associated subcontractor personnel must complete the DoD IA awareness training before issuance of network access and annually thereafter. IAW DoDD 8570.01 and AR25-2, all contractor personnel supporting Cybersecurity functions shall complete appropriate training within specified timelines and attain and maintain the required Information Technology (IT) and cybersecurity training certifications. The baseline certification as stipulated in DoD 8570.01-M must be completed upon contract start.

1.18 Organizational Conflict of Interest

Contractor and subcontractor shall not employ any person or perform a contract in a situation where the existence of conflicting roles may bias Contractor's judgement or prevent unfair competitive advantage IAW Organizational Conflict of Interest Rules in FAR 9.5. Contractor and subcontractor personnel performing work under this contract may receive, have access to or participate in the development of proprietary or source selection information (e.g., cost or pricing information, budget information or analyses, specifications or work statements, etc.) or perform evaluation services which may create a current or subsequent Organizational Conflict of Interests (OCI) as defined in FAR Subpart 9.5. Contractor shall notify the KO immediately whenever Contractor becomes aware that such access or participation may result in any actual or potential OCI and shall promptly submit a plan to the KO to avoid or mitigate any such OCI. Contractor’s mitigation plan will be determined to be acceptable solely at the discretion of the KO and in the event the KO unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the KO may affect other remedies as he or she deems necessary, including prohibiting Contractor from participation in subsequent contracted requirements which may be affected by the OCI.

1.19 General Information

All Contractor personnel shall comply with the following.

1.19.1 Classified Information. Contractor shall comply with FAR 52.204-2, Security Requirements for Contractor personnel that handle or have access to classified information. This clause involves access to information classified “Confidential,” “Secret,” or “Top Secret” and requires Contractor personnel to comply with (1) The Security Agreement (DD Form 441), National Industrial Security Program Operating Manual (NISPOM), DoD Directive (DoDD) 5220.22-M; and any revisions to DoDD 5220.22-M, notice of which has been furnished to Contractor. Contractor shall be well versed in the rules and regulations governing the storage (all media) and protection of classified information.

1.19.2 Army Email Account. Contractor personnel shall apply for an Army email account within one business day of obtaining their Common Access Card (CAC). Contractor personnel shall maintain an email account. Contractor personnel’s Global Address Listing shall include name, job title, work address, telephone number and location, which shall be “Reserve.” Contractor’s employees shall have the appropriate USAR standardized signature block including Contractor company name on all email correspondence. The COR will provide the PM an example of the appropriate signature block upon award.

1.19.3 Privacy Act. Work on this project requires that Contractor personnel have access to Privacy Information. IAW FAR Clause 52.224-2 (Privacy Act), Contractor shall adhere to AR 55-20, the Army Privacy Program, the Privacy Act, Title 5 of the U.S. Code, Section 552a, and applicable agency rules and regulations. Contractor shall ensure personnel adhere to Personally Identifiable Information (PII), Personal Health Information (PHI) and Privacy Act standards.

1.19.4 Certifications. Contractor shall be responsible for ensuring all personnel…