ITSS Recompete - Enterprise IT_DRAFT PWS_RFI .pdf

SECTION C – DESCRIPTIONS AND SPECIFICATIONS

UNITED STATES (U.S.) ARMY TEST AND EVALUATION COMMAND (ATEC)

INFORMATION TECHNOLOGY SUPPORT SERVICES (ITSS) PERFORMANCE

WORK STATEMENT (PWS)

Para # Title

C.1 General

C.1.1 Scope

C.1.2 Summary

C.1.3 Background

C.1.4 Installation Information

C.1.5 Organizational Conflict of Interest

C.1.6 Contractor Management and Administration

C.1.7 Key Personnel

C.1.8 Personnel

C.1.9 Hours of Operation

C.1.10 Training

C.1.11 Certifications

C.1.12 Travel/Temporary Duty

C.1.13 Safety

C.1.14 Security

C.1.15 Government Vehicles and Equipment Operations C.1.16 Vehicle Registration

C.1.17 Identification of Contractor Employees

C.1.18 Quality Control (QC)

C.1.19 Quality Assurance (QA)

C.1.20 Internal Controls

C.1.21 Accounting for Direct and Indirect Charges

C.1.22 Items Purchased under Other Direct Costs (ODCs) Cost Category

C.1.23 Hazardous Material Reporting

C.1.24 Interface with Government Operations

C.1.25 Business Relations

C.1.26 Work Areas

C.1.27 Files

C.1.28 Accountability of Government-Furnished Facilities/Office Space/

Property/Items

C.1.29 Personal/Contractor-Owned Property

C.1.30 Data Rights

C.1.31 Electronic Invoicing

C.1.32 Transition

C.1.33 Post Award Conference/Performance Evaluation Meetings

Technical Coordination

DRAFT

C.2 Definitions and Acronyms

C.2.1 Definitions

C.2.2 Acronyms

C.3 Government-Furnished Items and Services

C.3.1 Government-Furnished Facilities/Office Space

C.3.2 Government-Furnished Property/Items

C.3.3 Government-Furnished Services

C.4 Contractor-Furnished Items and Services

C.4.1 General

C.4.2 Contractor-Furnished Facilities/Office Space

C.4.3 Contractor-Furnished Items

C.4.4 Contractor-Furnished Services

C.5 Specific Tasks

C.5.1 General

C.5.2 Information Technology Support

C.5.3 Software Development and Software Support Activity

C.5.4 Logistics

C.5.5 Other Support Services

C.6 Deliverables

C.7 Regulations

SECTION C.1. GENERAL.

SCOPE. This is a non-personal services contract to provide Information Technology (IT), IT logistics, and cybersecurity support to Army Test and Evaluation Command (ATEC) Headquarters (HQs), Aberdeen Proving Ground (APG), MD; the U.S. Army Aberdeen Test Center (ATC), APG, MD; the

Operational Evaluation Command (OEC), Fort Hood, TX and APG, MD; White Sands Missile Range

(WSMR) White Sands Missile Range, NM; and possibly other test locations. Minimal support may also be required at Fort Bragg, NC; Fort Huachuca, AZ; Fort Bliss, TX; Fort Sill, OK; Huntsville, AL or other locations throughout the life of this contract. The level of effort and staffing at each location may vary based on mission needs. The contractor shall provide all qualified personnel, equipment, tools, materials, supervision, management, and other items/services not otherwise provided to fulfil these requirements. The contractor shall provide all qualified personnel, equipment, tools, supplies, materials, facilities, transportation, supervision, and other items and non-personal services necessary to provide Information Technology (IT) Management Support Services as defined in this Performance

Work Statement (PWS), except for those items specified as government furnished property and services

The scope of support covers the following networks:

• Non-secure Internet Protocol Router Network (NIPRNET)

• Secret Internet Protocol Router Network (SIPRNET)

• Defense Research and Engineering Network (DREN) and Secret DREN (SDREN)

• Defense Research and Engineering Domain (DRED) and Secret DRED (SDRED)

• White Sands Internet Service Provider Resource (WISPR)

• Test Support Network (TSN Black & TSN Red)

• Fast Burst Reactor Network (FBRNet)

C.1.1 SUMMARY: Currently, there are approximately 900 IT users at ATEC

HQs/AEC, 1,500 at ATC, 900 at OEC and 1,100 at WSMR. On an intermittent basis, the contractor shall be required to perform non-personal services in support of other Department of Defense

(DOD) activities at locations other than the locations identified in Paragraph C.1 above. Not all of the functions described within this PWS will be required at all of the locations. Performance requirements and locations will be determined at the task order level. As set forth in Revolutionary

FAR Overhaul (RFO) Federal Acquisition Regulations (FAR) 7.5, the contractor shall not perform inherently governmental functions. The Government will not exercise any supervision or control over the contract personnel performing services herein. All personnel engaged in performing the services under this contract (i.e., direct labor and subcontracted labor) shall be accountable solely to the contractor who, in turn, is responsible to the Government. Any effort reflected in this PWS may be identified during contract performance for higher priority, different performance locations, and varied level of intensity. The Government will provide to the contractor’s leaders all workforce prioritization requirements, which may include intermittent/infrequent and fluctuating efforts for

IT, IT-associated services, and direct test support. The contractor shall be capable of meeting these requirements by means of increasing, decreasing, or relocating personnel, equipment, and materials at various locations in the continental United States (CONUS). The contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to provide Information Technology (IT) Support

Services as defined in this Performance Work Statement (PWS) except for those items specified as government furnished property and services.

C.1.2 BACKGROUND.

C.1.2.1 ATEC is one of DOD’s foremost test and training organizations supporting DOD, non-

DOD, and commercial materiel developers by testing a broad spectrum of equipment throughout their life cycles, from concept through deployment. As such, ATEC is not a material, item, or system developer. Rather, it provides crucial test support to such developers who are ATEC's primary customers. This contract support is devoted primarily to support ATEC HQ and its subordinate organizations as they conduct tests, operate and maintain the ranges, facilities, and equipment necessary to perform testing for their customers.

C.1.2.2 ATEC’s mission is to plan, conduct, and integrate developmental testing, independent operational testing, independent evaluations, assessments, and experiments in order to provide essential information to decision makers for our Nation's Warfighter. ATEC provides the most flexible, responsive, innovative, and diverse set of test capabilities, assets, and services throughout the Army for providing test and test support services for authorized customers.

C.1.2.3 One of the major missions of the Enterprise Services is to manage and maintain the IT infrastructure and manage the IT assets including but not limited to servers, workstations, notebook computers (including all peripherals), tablets, switches, routers, supporting software, Cloud Technology solutions, Printers (MFD and desktop), Virtual Private Networks (VPN), Communications Security

(COMSEC), public facing and internal web services, Cybersecurity (CS) Operations, Intrusion

Detection Systems (IDS), and a wide variety of other IT services.

C.1.2.4 To accomplish this, ATEC will:

a. Deliver value-added products and services to its customers.

b. Identify and optimize the process and capabilities essential to providing quality and timely products and services.

c. Provide, develop, sustain, and integrate people, technological capabilities, and procedures; and,

d. Identify, secure, and allocate resources necessary to meet ATEC’s mission requirement through efficient, flexible and responsive management.

C.1.2.5. To successfully support ATEC's mission, ATEC requires the ability to rapidly move, store, and retrieve data from a wide variety of sources and locations in a highly reliable and secure manner. ATEC requires a high level of technical expertise, flexibility, and depth of professional and technical expertise in order to meet its mission goals and objectives. A technical staff capable of modifying and operating sophisticated information management systems in a timely and cost-efficient manner is required to meet the needs of ATEC.

C.1.3 INSTALLATION INFORMATION. Information regarding the locations in

Paragraph C.1 above can be found on the following websites:

https://home.army.mil/apg https://home.army.mil/bliss https://home.army.mil/bragg https://home.army.mil/hood https://home.army.mil/huachuca https://home.army.mil/sill https://home.army.mil/wsmr

C.1.3.1 The contractor shall fully comply with local military installation, city, county, state, and federal laws, regulations, and/or ordinances pertinent to performance of the contractual services required under this contract.

C.1.3.2 The contractor and employees shall observe all rules and regulations issued by the Installation Commanding Officers pertaining to but not limited to fire, safety, sanitation, severe weather, admission to the installation, conduct of operations, etc.

C.1.3.3 The contractor shall be in compliance with all Army, federal, state, local, ATEC, OEC, ATC, APG, Fort Hood, Fort Huachuca, Fort Bliss, Fort Sill, and Fort Bragg regulations, policies, and procedures. Compliance shall be required where services are provided under this contract, as they apply to the following: IT, cybersecurity, information security, operational security (OPSEC), physical security, personnel security, public affairs, and foreign disclosure and contact.

C.1.3.4 Road Closures: Access roads to and within the boundaries for some locations are subject to closing for live missile firings or other military operations.

Roadblocks are normally one to two hours in duration. This does not relieve the contractor from performance of contractual responsibilities. Occasional rescheduling of work requirements may result due to missile firings or other military operations. It is the contractor’s responsibility to reschedule any and all work requirements due to roadblocks and evacuations

DRAFT

https://home.army.mil/apg https://home.army.mil/bliss https://home.army.mil/bragg/ https://home.army.mil/hood/ https://home.army.mil/huachuca https://home.army.mil/sill https://home.army.mil/wsmr

C.1.3.5 Accident Reporting. The contractor shall report all accidents resulting in injury, death, or property damage in accordance with (IAW) the regulations of the organization/military installation at their designated performance locations.

C.1.3.6 Fraud, Waste, and Abuse. The contractor shall be responsible for maintaining proper conduct and good discipline within contractor occupied work area(s). Contractor personnel shall be encouraged to be alert to and report suspected situations of fraud, waste, and abuse, or other intentionally dishonest conduct against the Government to the Contracting

Officer’s Representative (COR).

C.1.4 CONFLICT OF INTEREST (OCI).

C.1.4.1 The contractor, to include the prime and all subcontractors, shall remain

OCI- free during the entire duration of the contract IAW Title 10, USC Section 2399, and

RFO FAR, Subpart 9.5.

C.1.4.2 In the event that the prime or a subcontractor intends to or becomes involved in development of DOD systems under eventual ATEC test and evaluation (T&E) oversight as part of its Title 10 responsibilities, the contractor shall provide written notification to the COR within three (3) working days of the potential OCI issue The contractor shall not begin or continue performance once the contractor becomes aware of a 10 USC Section 2399 violation or any other OCI situation without the Contracting Officer’s (KO) approval. The contractor shall own the burden to monitor, report, and resolve any Title 10, USC Section 2399, violations and all potential OCI issues that arise during the performance of this contract.

C.1.4.3 The Contracting Officer (KO) will analyze all potential OCIs and determine if an actual OCI exists and whether an actual OCI can be mitigated. The KO will provide the rationale for an OCI determination and request a mitigation plan when the OCI is of a type that can be mitigated. The KO will evaluate the mitigation plan and either approve or disapprove the mitigation plan.

C.1.4.4 The contractor shall not employ off-duty Government personnel who represent the KO or who perform contract surveillance, nor any other person who is an employee of the U.S. Government or DOD, either military or civilian, if such employment would create a conflict of interest or be contrary to the policies contained in Section I clauses regarding conflicts of interest. The contractor shall not employ any person who is an employee of the Department of the Army (DA), military or civilian, to perform work under this effort without first obtaining approvals required by DOD 5500.7-R and implementing Army regulations. In no event shall such personnel be used in a supervisory capacity in the performance of this contract. In addition, the contractor shall not employ any person who is a family member of either current contractor employees or current ATEC employees

(either military or civilian) without first providing personnel qualifications, supervisory chain, and proposed employment duration to the KO for review and concurrence.

C.1.5 CONTRACTOR MANAGEMENT AND ADMINISTRATION.

C.1.5.1 The contractor shall provide personnel with the necessary skills to perform the required support and services of this PWS. The contractor shall ensure that all personnel employed against this effort are properly trained and meet the minimum qualifications in

Attachment 4 - Position Qualifications for their job position prior to employment. Personnel performing work are not considered employees of the Government.

C.1.5.2 The Contractor shall maintain records of training, qualifications, and applicable certification or licenses as required and shall ensure that the employees remain fully qualified.

The Contractor shall provide records, when requested, to the COR for evaluation in compliance with this PWS.

C.1.5.3 The Contractor shall perform Program Management and provide an on-site

Program Manager (PM). The PM shall be the central point of contact with the Government for performance of all work under this Contract Agreement. The Contractor shall notify the

Contracting Officer Representative (COR) when the PM is absent and designate an acting alternate PM. The PM and any individuals designated to act in that capacity shall have full authority to bind the contractor for prompt action on matters pertaining to execution of the

Contract Agreement to the KO and COR. In addition, on-site management must be available

24 hours to respond to any Government concern or situation. The on-site management’s responsibility includes coordinating work schedules, travel requirements, reporting, accountability, conduct, and performance of Contractor personnel.

C.1.6 KEY PERSONNEL. Key personnel are those contractor employees considered to be essential to the successful performance of the requirements. This includes certain skilled/experienced professional and/or technical personnel as designated by the Government.

Key personnel for this contract are one (1) Program Manager (PM) and three (3) Project

Managers (one at ATC, one at OEC, and the other at WSMR). There will also be one Facility

Security Officer (FSO) at WSMR. The PM shall be physically present at APG, MD during normal duty hours and perform overall management of the contract.

C.1.7 PERSONNEL. At a minimum, all contractor personnel shall have high school diploma or equivalent. All contractor personnel shall be able to speak, read, write, and understand English proficiently and be a U.S. citizen. All contractor personnel must be proficient in the use of computers and software required to perform work (e.g., Microsoft

Office software). Also, on contract start date, all personnel shall possess the required training, certification(s), security clearance and experience IAW Attachment 4 – Position

Qualifications.

C.1.7.1 Prior to starting the process to backfill for a vacated position, creating a new position, or increasing labor support, the contractor shall provide the following information to the COR to ensure that the additional support is necessary to support the PWS requirements and that sufficient space is available at the Government site:

Contract Number/Contractor Name;

Contract Period of Performance and current year of performance;

Labor category and level;

Number of employees to be hired and hourly rate;

Relevant PWS Task Area(s) employee will support;

Description of duties.

*If backfill, name of employee who departed and date position was vacated; If new contractor position or additional labor support, identify begin and end dates of new requirement. (NOTE: the begin date is needed but the end date can be indefinite.);

* If new contractor position or additional labor support, identify if additional space at Government facility will be required.

*If new contractor position or additional labor support, identify if a contract modification has or will be executed to support the additional support.

*If no contract modification will be executed, explain why additional personnel are required above that identified in the contract as awarded; and Government technical POC name and phone number (if other than relevant COR).

Any changes in labor support or labor rates require KO approval prior to implementation.

C.1.7.2 Prior to making an offer to an employee, the contractor shall provide a resume to the

COR not later than five (5) calendar days prior to the effective date of employment. Resumes should include the following: current and previous employment history to include employer names, position titles, relevant duties and accomplishments, dates of employment, education, licenses/certifications, and other relevant information. The COR will review the resume to ensure qualifications and/or experience identified in Attachment 4 – Position Qualifications have been met. If the qualifications and/or experience have not been met, the resume will be returned to the contractor within two (2)-work days of receipt. In emergency situations and cases of adverse action where five (5) calendar days' notice is not possible, the contractor shall submit the change in writing and resume to the COR not later than 24 hours after the change is implemented. Key personnel positions shall not be vacant longer than 45 calendar days, unless the KO grants an extension.

C.1.7.3 Contractor personnel shall practice high standards of personal hygiene and maintain a clean, neat appearance while on duty. Additionally, contractor personnel shall comply with the dress code applicable for the facility and location being supported.

C.1.7.4 The contractor shall manage its workforce to ensure that excessive turnover does not interfere with mission requirements. The contractor shall track and analyze hiring and termination trends as well as the number of personnel employed by labor category, by location, and by cost center. The contractor shall ensure that all vacancies for non-key personnel are filled within 45 calendar days of notification of the requirement. Any issues outside of the contractor’s control that may delay bringing individuals on board passed the 45-calendar day requirement, such as backlog at

Defense Security Services, shall be brought to the COR’s attention one week prior to the 45 calendar-day expiration date.

C.1.7.5 The contractor shall ensure that all contractor employees return all Government identification/security badges and permits issued by the Government at the completion of their employment. All Government identification/security badges shall be returned to the Government on the employee’s last day of employment with the Government. If departure is after normal business hours, the contractor Facility Security Officer will collect the badges on the last day of employment and turn the badge(s) in to the Government Security Manager the next work day. Keys will be returned to the issuing key custodian prior to the employee departing the installation. In addition, contractor personnel briefed on Special Access Programs (SAPs) shall contact Government Security personnel to complete a termination briefing prior to termination of employment. The contractor shall develop in/out- processing procedures and checklists to be used by all contractor employees and shall be completely filled in and signed by designated individuals below on the first and last days of employment. The contractor shall develop an employment/installation clearance procedure and checklist to ensure that an employee has turned in all Government identification/security badges, Government property, and keys before leaving employment on the installation and access to the local area network (LAN)/email has been cancelled. At a minimum, the in/out- processing checklist will contain signature blocks for these Government employees: COR/ACOR; Technical Monitors

(TMs); ATEC HQs/ATC/OEC/WSMR Security Manager; and the designated IT LAN representative; to ensure contractor employees have cleared all aspects of employment at the various locations. Contractor personnel shall not begin or end employment without a completed and signed checklist.

C.1.8 Recognized Holidays: The contractor is not required to perform services on these holidays unless specifically stated in assigned Task Orders (TO):

New Year’s Day Labor Day

Martin Luther King Jr.’s Birthday Columbus Day

President’s Day Veteran’s Day

Memorial Day Thanksgiving Day

Independence Day Juneteenth

Christmas Day

C.1.9 HOURS OF OPERATION. Unless indicated below, contractor operations will be Monday through Friday from 6:00 a.m. to 6:00 p.m. (Eastern Time (ET) for MD, Central Time (CT) for

TX, and Mountain Standard Time (MST) for NM, except Federal holidays or when the

Government facility closes due to local or national emergencies, administrative closings, or similar Government directed facility closings, or as specified in section C.1.9.5.8. of the PWS.

Core staff operations will be on Monday through Friday from 7:30 a.m. to 4:30 p.m. (ET for MD, CT for TX, and MST for NM), excluding federal holidays. The contractor shall provide minimal staffing coverage from 6:00 a.m. to 7:30 a.m. and 4:30 p.m. to 6:00 p.m. Minimal staffing is defined as two employees. The Government will approve the contractor’s start/end times schedule to ensure minimum and maximum coverage. All changes to this schedule must be approved by the Government.

C.1.9.1 ATC’s core hours will be Monday through Friday from 7:00 a.m. to 4:30 p.m. ET, excluding federal holidays. Minimal staffing outside of the core hours is not required for ATC.

C.1.9.2 To accomplish mission requirements, the contractor may be required to provide services/technical expertise outside of normal duty hours, to include but not limited to, tests, repair of equipment failures, and/or documentation generation, which may include weekends, holidays, and other times specified by the Government. Support may run sequentially or concurrently, day or night, extended workdays, weekend, shift, or in any combination.

C.1.9.3 Alternate Work Schedules (AWS) with Regular Day Off (RDO). To ensure compliance with Section 778.105 of Interpretative Bulletin, 29 CFR (CFR) Part 778, the contractor's base pay-week shall not exceed 40 hours; therefore, the start and end time of the pay week shall be adjusted accordingly. The contractor shall work their schedules IAW the paragraphs below.

C.1.9.3.1 ATEC HQ civilian personnel currently work either the AWS or the regular five, eight-hour day schedule. If contractors are working the AWS, RDOs shall be either the first

Friday of the pay period or the second Friday of the pay period provided there is coverage five days per week as depicted below, however, RDOs shall be staggered for some personnel due to the requirement to provide limited coverage on the Friday off. In a two-week pay period, the work schedule is eight workdays of nine hours each, one work day of eight hours, and every other

Friday off (RDO) as depicted below:

Option 1:

M T W T F S S

Week 1 9 9 9 9 8 Off Off

Week 2 9 9 9 9 RDO Off Off

Option 2:

Week 1 9 9 9 9 RDO Off Off

Week 2 9 9 9 9 8 Off Off

C.1.9.3.2 ATC is currently operating under an AWS and is closed for normal business on the 2nd Friday of the pay period as depicted below. ATC contractors using an RDO schedule shall stagger personnel schedules in order to meet the requirement for limited coverage on the

Friday off. In a two-week pay period, the work schedule is eight work days of nine hours each, one work day of eight hours, and every other Friday off (RDO) as depicted below:

Or Option 2 for limited coverage:

C.1.9.3.3 At OEC (Fort Hood, Fort Huachuca, Fort Bliss, Fort Sill, and Fort

Bragg) the workforce does not work the AWS.

C.1.9.3.4 At WSMR, the civilian and contractor workforce operates under a compressed work schedule consisting of four 9-hour days with core hours between 0700 – 1630 Monday thru

Thursday and one 8 hour day on either the first or second Friday of the pay period with the alternate

Friday as a non-workday. Outside the core working hours listed below, some facilities may not be accessible and reduced Government oversight may limit contractor access. Exceptions shall be worked through the COR and where necessary the KO.

Or Option 2 for limited coverage:

Contractor employees shall not work more than nine hours per day without written authorization for

Overtime from the COR/KO. Personnel providing direct test support shall work a variable tour of duty as identified by Range Mission requirements that will be communicated to the contractor by the issuance of subsequent task order.

C.1.9.3.4.1 The Government has the option to temporarily or permanently change the hours and days of operation or require additional shifts. Normally, hours of operation for the second and third shifts, if required, are 4:30 p.m. through 1:00 a.m. and 11:30 p.m. through 8:00 a.m., respectively

(including a 30-minute meal period), five days a week, eight hours a day.

C.1.9.5.5 Contractors shall not work overtime on a Time and Materials basis unless the

COR/ACOR concurs with the necessity prior to it being worked. The contractor shall submit overtime requests one (1) week in advance if possible. In certain situations, as determined by the

Government, overtime may be required with as little as a one-hour advance notice. Last-minute overtime requirements will be handled on a case-by-case basis.

C.1.9.5.6 After-Hours Support: The contractor shall be responsible for correcting issues to include but not limited to spillages, service interruptions, inspections and hardware/software failures on the systems that the contractor is supporting. All after-hours support shall be coordinated with the Contracting Officer’s Representative prior to commencement.

C.1.9.5.7 The contractor is not required to perform work on Federal holidays, unless authorized by the Government. Federal holidays are listed in the following website:

https://www.opm.gov/policy-data-oversight/pay-leave/federal-holidays/#url=Overview

C.1.9.5.8 Installation Closures. The contractor shall adhere to curtailing operations of the Government which includes any time when the Government is in a non-operational status for events including, but not limited to, emergency situations, inclement weather, power curtailments, furlough, shutdowns, organization events, and planned training days. The contractor workforce shall adhere to the Government curtailment or closure schedule and any costs associated with the contractor workforce during non-operational status shall not be charged to the Government.

However, some contractor employees may be required to work during those periods and/or may be required to report to an alternate work site. These contractor employees will be identified by the

Government. The COR will notify the contractor of the dates of curtailment and closure and of any contractor employees required to work during such events and whether telework may be an option. Additionally, the COR may direct the contractor to view local television/radio stations for announcements or updates on any such delays or closures.

C.1.9.5.9 Telework. For purposes of this contract, “telework” is defined as a work arrangement in which contractor personnel perform contract requirements at an alternative duty location. No diminishment of contract performance is allowed as a result of telework. Individual employee eligibility for telework should be determined on a case-by-case basis by the contractor in coordination with the Government.

C.1.9.5.9.1 Telework at OEC locations is not routinely authorized. Contractor personnel shall perform services on-site at Government-designated duty locations at Fort Hood, TX; Fort Bliss, TX; Fort Bragg, NC; Fort Sill, OK; and Fort Huachuca, AZ.

C.1.9.5.10 Situational Telework. For the purpose of this contract “Situational

Telework” is telework performed on an occasional, one-time, or ad hoc basis. Contractors in positions not typically eligible for telework may be able to telework on a situational basis when necessary. Situational telework includes:

https://www.opm.gov/policy-data-oversight/pay-leave/federal-holidays/#url=Overview

(a) Pandemic Health Crisis. Contractors may be asked to telework to prevent the spread of disease, viruses, or other health risks.

(b) Weather/Safety/Unplanned Closure or Event. When adverse weather is anticipated or the organization/installation is closed, situational telework may be authorized.

(c) Other case-by-case situations where a contractor is temporarily unable to physically report to the normal duty station but is capable of performing their normal contract requirements from their telework location. This will be managed by the Contractor PM and coordinated with the

Contractor Officer’s Representative (COR) and the Technical Point of Contact (TPOC).

(d) Situational Telework at OEC locations may only be authorized on a case-by-case basis by the Government during installation closures, emergency situations, or other Government-directed events.

C.1.9.5.11 Telework Plan. The contractor shall not independently determine telework eligibility for their personnel. The contractor shall submit a telework plan to the COR for approval before any telework/situational telework is authorized. The Plan should address the following:

(a) Contract positions eligible for telework/situational telework.

(b) Controls to ensure contract requirements are being met (e.g., performance-based requirements/metrics, mechanisms to address performance issues, etc.)

(c) Information security measures to ensure protection of information accessible from telework locations, including measures to protect work records from unauthorized disclosure.

(d) Compatibility and availability of telework enhancing office tools (e.g., Microsoft Teams, teleconference, etc.).

(e) Parameters of telework (e.g., maximum number of days/weeks for telework, mechanisms for ensuring face-to-face meetings, when necessary, specific locations, etc.).

(f) Any additional conditions that are germane to contract performance under this contract.

C.1.10. TRAINING.

C.1.10.1 The contractor shall develop a training program to ensure contractor personnel are trained to accomplish the requirements of this PWS. Mandatory training for contractor employees is identified in Section C.3.3. The contractor shall maintain records of all scheduled and completed training, which will be available for periodic inspections by the

Government.

C.1.10.2 The Government will only reimburse the contractor one time for training in new technologies or unique skills that are required to perform a task of this PWS and not for employee’s advancement. Duplication of training costs shall be considered an unallowable cost in accordance with RFO FAR 31.201-6, Accounting for Unallowable Costs.

Additionally, IAW DoD Directive 8140.01, DOD 8570.01-M, and AR 25-2, IT personnel shall achieve the required baseline certification prior to contract award and obtain computing environment (CE) certification within 6 months of appointment to IT functions. All travel, training, and per diem requirements that are to be reimbursed to the contractor must be pre-approved by the COR and the COR/ACOR within 20 workdays prior to commencement of training/travel. Any retraining needed due to contract employee departure will be at the contractor’s expense. In addition, copies of training certificates shall be available upon request by the COR/ACOR as proof of training completion prior to reimbursement, as required.

C.1.10.3 The contractor shall cross-train employees through on-the-job training during duty hours. On the effective date of the contract, the contractor shall provide a list depicting the names of the primary and alternates for each functional area and location.

C.1.11 CERTIFICATIONS.

C.1.11.1. INFORMATION ASSURANCE CONTRACTOR TRAINING AND

CERTIFICATION (JAN 2008)

C.1.11.1.1 The Contractor shall ensure that all personnel performing cybersecurity functions are qualified for their assigned position, category, and level in accordance with the

DoD Cyber Workforce Framework (DCWF), as outlined in the DoD 8140.0x series of publications (including, but not limited to, DoDD 8140.01, DoDI 8140.02,DoDM 8140.03 and

DoD 8570.01-M). The Contractor shall meet all applicable DCWF qualification requirements, which may include baseline certifications, specialty area certifications, and maintaining continuous professional education credits. Personnel accessing information systems have the proper and current information assurance certification to perform information assurance functions in accordance with DoD 8570.01-M, Information Assurance Workforce Improvement

Program. The Contractor shall meet the applicable information assurance certification requirements, including—

C.1.11.1.2 DoD-approved information assurance workforce certifications appropriate for each category and level as listed in the current version of DoD 8570.01-M; and

C.1.11.1.3 Appropriate operating system certification for information assurance technical positions as required by DoD 8570.01-M.

C.1.11.1.4 Upon request by the Government, the Contractor shall provide documentation supporting the information assurance certification status of personnel performing information assurance functions.

C.1.11.1.5 Contractor personnel who do not have proper and current certifications shall be denied access to DoD information systems for the purpose of performing information assurance functions.

C.1.11.1.6 All software and systems developed, integrated, or maintained by the

Contractor shall adhere to the principles of secure-by-design and applicable secure coding and application security guidelines. This includes, but is not limited to, standards defined in the

Defense Information Systems Agency’s (DISA) Security Requirements Guides (SRGs), Security Technical Implementation Guides (STIGs), and other applicable federal or DoD secure software development. All software developed by the contractor for the Government shall adhere to the code review standards defined in the Defense Information Systems Agency’s

(DISA) Control Correlation Identifiers (CCIs), Security Requirements Guides (SRGs) and

Security Technical and Implementation Guides (STIGS) as applicable to the writing of software code, its compilation and linkage into executable software programs.

C.1.11.2 Cybersecurity/Information Technology (IT) Certification. Per the DoD

8140.0x series and applicable Army regulations (e.g., AR 25-2), contractor employees performing cybersecurity/IT functions shall be fully qualified for their assigned work role prior to commencing unsupervised duties on the contract. Any required Computing

Environment (CE) or specialty qualifications not held upon contract start must be achieved within six (6) months of appointment. Per DoD 8140.01, DoD 8570.01-M, and AR 25-2, contractor employees supporting cybersecurity/IT functions shall achieve the required baseline certification prior to contract award. Appropriate Computing Environment (CE) certifications must also be achieved, within 6 months of appointment, if performing duties requiring CE certifications IAW DoD 8570.01-M. The COR/ACOR/TM will ensure all contractor personnel are certified IAW DOD and DA regulations. The DOD organization receiving services may provide additional training on local or system procedures.

C.1.11.3 Cybersecurity Training and Certification. For acquisitions that include cybersecurity functional services for DoD information systems, or that require any appropriately cleared contractor personnel to access a DoD information system to perform contract duties, the requiring activity is responsible for providing to the COR:

C.1.11.3.1 A list of required DCWF work roles and proficiency levels needed to fulfill the requirements of this PWS and/or list of information assurance functional responsibilities for DOD information systems by category (e.g., technical or management) and level (e.g., computing environment, network environment, or enclave); and

C.1.11.3.2 The information assurance training, certification, certification maintenance, and continuing education or sustainment training required for the information assurance functional responsibilities.

C.1.11.3.3 After contract award, the requiring activity is responsible for ensuring that the certifications and certification status of all contractor personnel performing information assurance functions as described in DOD 8570.01-M, Information Assurance Workforce

Improvement Program, are in compliance with the manual and are identified, documented, and tracked.

C.1.11.3.4 The responsibilities specified in this section apply to all DOD information assurance duties supported by a contractor, whether performed full-time or part-time as additional or embedded duties, and when using a DOD contract, or a contract or agreement administered by another agency (e.g., under an interagency agreement).

C.1.11.3.5 See PGI 239.7102-3 for guidance on documenting and tracking certification status of contractor personnel, and for additional information regarding the requirements of DOD 8570.01-M.

C.1.11.3.6 Privileged Access Requirements for Non-Coded Positions subject to a PWS, and shall not be construed to conflict with DODM 8140.03.

C.1.11.3.7 Privileged access is defined as any authorized access and use of an

ATEC system which requires permissions beyond those available to a standard user to perform such actions as but not limited to: configuring system settings; installing/removing software; controlling system functions; monitoring system and/or network logs; or accessing sensitive data. Privileged access typically provides access to control functions of the

IS/network, administration of users’ computer or network accounts or permissions, access to configuration for network equipment, servers, or workstations, the ability to change program files, configure security-relevant settings, or direct access to operating system functions.

Privileged access typically does not include elevated permissions with an application that itself is not able to execute security-relevant changes to the underlying operating system or network. In the case of uncertainty, final determination as to whether any function or task is considered privileged is per the discretion of the ATEC Program Information System Security

Manager (P-ISSM) or Deputy P-ISSM. (Reference AR 25-2 and DA PAM 25-2-7).

C.1.11.3.8 Only eligible personnel with relevant assigned tasks will be granted privileged access. Privileged access may be revoked without notice at the sole discretion of the government without notice.

C.1.11.3.9 The following requirements for privileged access must be met unless otherwise specifically delineated elsewhere in this PWS:

C.1.11.3.10 Contractors requiring privileged access must have their required duties aligned under one or more work roles specified by the Defense Cyber Workforce Framework

(DCWF) to determine their requirements for meeting foundational qualification for privileged access to an ATEC system or network. Work roles with Knowledge, Skills, Abilities, and

Tasks (KSATs) that align with privileged use can frequently be found under the work roles for

Database Administrator, Network Operations Specialists, System Administrator, Technical

Support Specialist, Cyber Defense Analyst, Cyber Defense Infrastructure Support Specialist, and Vulnerability Assessment Analyst. Access to the work roles and associated KSATs can be found here: https://www.cyber.mil/dod-workforce-innovation-directorate/dod-cyber-workforce-framework/dcwf. Proficiency levels within each work role must be determined in accordance with the tasks and performance expectations required to be accomplished by each individual. Personnel assigned a basic proficiency must have familiarity with basic concepts and processes and the ability to apply these with frequent, specific guidance as well as be able to perform successfully in routine, structured situations. Personnel assigned to an intermediate proficiency must have extensive knowledge of basic concepts and processes and experience applying these with only periodic high-level guidance as well as be able to perform successfully in non-routine and sometimes complicated situations. Personnel assigned to an advanced proficiency must have an in-depth understanding of advanced concepts and processes and experience applying these with little to no guidance, be able to provide guidance to others, as well as be able to perform successfully in complex, unstructured situations. If personnel are performing duties than span multiple work roles according to the outlined KSATs they may be assigned multiple proficiency levels.

Contractors must align with all foundational qualification requirements assigned to the work roles and proficiency levels under which their KSATs align in accordance with current DoDM

8140 foundational qualification standards https://www.cyber.mil/dod-workforce-innovation-directorate/dod8140/qualification-matrices. Foundational qualification requirements must be obtained prior to engagement and maintained throughout employment while engaged in duties requiring privileged access to ATEC systems.

C.1.11.3.11 Additional work roles that MAY have KSATs related to privileged access included but not limited to: Enterprise Architect, Systems T&E Specialist, System

Developer, Incident Responder, Information System Security Developer, System Security

Analyst, Data Analysts, and Data Scientist. If privileged access is required that does not align with any of the current published work role KSATs, the ATEC P-ISSM or Deputy P-ISSM should be consulted for determination.

C.1.11.3.12 Contractors who require privileged access will be appointed via a designation letter signed by an Information System Security Manager (ISSM) outlining their assigned functions and must sign a Privileged Access Agreement. All documents, certifications, assessments, and training must be entered in the ATEC Training and

Certification Tracking System (ATCTS). All contract employees with privileged access to

ATEC systems must comply with technical environment requirements as published by ATEC

HQ within six months of appointment to privileged functions.

C.1.11.3.13 Contractors with privileged access are required to maintain

20 Continuous Professional Development credits per year that align with their current

KSATs.

C.1.12 TRAVEL/TEMPORARY DUTY.

C.1.12.1 Travel to other Government facilities or other contractor facilities within

CONUS may be required. All travel requirements (including plans, agenda, itinerary, or dates) shall be pre-approved by the Government (subject to local policy procedures), and is on a strictly cost reimbursable basis. The contractor shall have personnel available and ready to travel on the required date. Contractor will be authorized travel expenses consistent with the provisions of RFO FAR 31.205-46 (Travel Costs) and the limitation of funds clause and shall be reimbursed under the cost category entitled ODCs in Section B.

C.1.12.2 The contractor shall be capable of supporting temporary efforts at locations other than those identified within this PWS without drawing from personnel supporting the mission. The contractor shall have the capability to support remote efforts using personnel resources in that area.

C.1.12.3 Travel Time Compensation. Exempt and non-exempt employees covered by the Fair Labor Standards Act are described in 5 CFR 551. Contractor employees who travel outside of their normal duty hours shall be paid wages for travel hours under certain circumstances as described in 5 CFR 551.422.

C.1.13 SAFETY. The contractor shall take proper safety and health precautions to protect the work, the employees, the public, and the property of others. The contractor shall develop and implement a safety program for contractor employees in compliance with regulations at all site(s), installation(s), state and federal laws, Occupational Safety and Health

Act (OSHA), etc. The contractor shall submit the Safety Plan to the Government for approval

30 days after award of the contract. Revisions shall be submitted 10 days prior to the effective date of the change. The contractor shall:

C.1.13.1 Participate fully in any safety or accident prevention program of any

Government installation that the contractor employees may be required to enter. This includes all required safety training.

C.1.13.2 Exercise care and caution commensurate with the dangers or hazards of the work being performed with due consideration of physical surroundings, equipment, facilities, personnel, and other factors involved.

C.1.13.3 Report immediately to the local commander, or the authorized representative with notification to the COR/ACOR, all accidents or property damage involving the contractor or its employees, which occur on a Government installation or other premises under the direct control of the Government.

C.1.14 SECURITY.

C.1.14.1 Contractor personnel shall obtain an appropriate security clearance, depending on assigned positions, prior to assignment and maintain eligibility for the designated clearance level throughout their tenure. The contractor shall comply with the requirements identified in Contract Security Classification Specification (DD Form 254)

(Attachment 3).

C.1.14.2 This contract may require access up to TOP SECRET classified military information. The contractor shall possess a Top Secret (TS) facility clearance as prescribed by DD Form 254.

C.1.14.3 All contractor employees shall be required to have a Tier 3 (T3)/ Tier 3R

(T3R) or higher-level investigation completed and possess a minimum of a SECRET clearance.

Contractor personnel shall not report to work until, at a minimum, an interim SECRET clearance is granted. All IT contractor personnel who administer classified systems and/or networks or are designated by the Government as having critical- or special-sensitive duties, shall possess a favorable Tier 5 (T5) / Tier 5R (T5R) and shall be SCI eligible. Contractor personnel who hold a clearance may require access to Restricted Data (RD), Critical Nuclear Weapon Design

Information (CNWDI), Foreign Government Information (FGI), Formally Restricted Data

(FRD), Alternative or Compensatory Control Measures (ACCM) and North Atlantic Treaty

(NATO) Information. Contractor personnel may be required to be indoctrinated into SCI to provide support inside an ATEC Sensitive Compartmented Information Facility (SCIF).

Additional details on SCI work are contained in the SCI Addendum to the DD Form 254.

Contractor personnel whose security clearances are suspended will not be permitted to work under this contract until their security clearance is reinstated.

C.1.14.4 The contractor shall submit a visit authorization request for all contractor employees performing on this contract in the Joint Personnel Adjudication System using the following Security Management Office (SMO) codes: ATEC HQs – W3Q2AA; ATC –

W4QUAA; OEC – W469AA; Fort Huachuca – W46908; Fort Sill – W46910; Fort Bliss –

W46909; and Fort Bragg – W469076.

C.1.14.5 All contractor personnel requiring access to the LAN and other IT systems shall be required to have a favorable T3/T3R or higher-level investigation completed, the cybersecurity training completion must be recorded in the Army Training and Certification

Tracking System (ATCTS) (https://atc.us.army.mil) database, and Acceptable Use Policy

(AUP) must be signed. In accordance with AR 25-2, contractor personnel without a security clearance shall not have access to IT systems.

C.1.14.6 Contractor personnel who have not received the required security clearance shall not be granted access to classified information nor allowed to perform classified work.

C.1.14.7 All contractor employees shall be registered in the Defense Enrollment

Eligibility Reporting (DEERS) System. Once the registration is completed, contractor employees requiring computer access shall be required to apply for a Common Access Card

(CAC) using the Mission Partner Identity, Credential, and Access Management (MP ICAM) at the following web address: https://mpartnerregweb.dmdc.osd.mil/mpartnerregweb/app/. Once that is completed, the COR/ACOR will enter the required information in MP ICAM and then the contractor employee can report to the local badging office to be issued a CAC. It should be noted that the Government will issue a contractor a CAC only if duties involve one of the following:

a. Both physical access to a DoD facility and access, via logon, to DOD networks on-site or remotely

b. Remote access, via logon, to a DOD network using DOD-approved remote access procedures

c. Physical access to multiple DOD facilities or multiple non-DOD federally controlled facilities on behalf of the DOD on a recurring basis for a period of 6 months or more.

At the discretion of the sponsoring activity, an initial CAC may be issued based on a favorable review of the FBI fingerprint check and a successfully scheduled T1 investigation at the Office of

Personnel Management.

C.1.14.8…