M9549422R0016_ATFP-Follow-On_RFI PWS.pdf

PERFORMANCE WORK STATEMENT (PWS)

Plans, Policies and Operations (PP&O) Security Division (PS)

Anti-Terrorism Program Support

1.0 Background

Headquarters Marine Corps (HQMC), Plans, Policies and Operations (PP&O), Security Division (PS) is responsible for supporting the safeguarding of personnel, property, and resources during all phases of operations in coordination with the United States Marine Corps (USMC) Antiterrorism (AT) Program. The AT Program is designed to deter, detect, delay, deny, or defend against acts of terrorism and destructive or potentially destructive events, enhance protection and AT awareness, and assign AT responsibilities for Marine Corps elements and personnel. Diverse and changing threats require the development of a multi- faceted and comprehensive AT program. The essential elements of an AT program must include: risk management, planning, training and exercises, resource application, and comprehensive program review to ensure commanders at all levels develop prescriptive and comprehensive AT Plans that include these five (5) essential AT program elements.

2.0 Scope

The purpose of this requirement is to provide AT support for the following Task Areas:

Task 1: Information Sharing/Information Fusion (ISIF) and Intel Analytical Support Task 2: Provide Surveillance Detection Capability Support Task 3: Provide Antiterrorism Training Support Task 4: Provide Analytical Gap Analysis Support for Anti-Terrorism (AT) Program

The intent of this requirement is to ensure that the Marine Corps remains the most effective fighting force possible by ensuring that AT is embedded in all aspects of Marine Corps planning, operations, and daily activities in an operating environment of constant and asymmetric threats. The Contractor must provide a multi-faceted, comprehensive AT program that includes an all-hazard, Mission Assurance (MA) approach, is proactive in nature, and is coordinated throughout appropriate commands. Exhibit A provides the orders and directives that apply to this effort.

3.0 Tasks

The HQMC Threat Fusion Cell is the capstone terminology used to manage the USMC intelligence and threat information and reporting requirements and its services are detailed within Tasks 1 and 2.

3.1 Task 1 - Information Sharing/Information Fusion (ISIF) and Intel Analytical Support

A. AT Program Coordination Support

Contractor services are required to facilitate the Marine Corps AT program coordination efforts amongst other DoD stakeholders. The Contractor must provide technical and programmatic services to support the following components: Critical Infrastructure Protection (CIP); Chemical, Biological, Radiological, Nuclear (CBRNE); Mission Assurance (MA); Physical Security (PS); Law Enforcement (LE); Emergency Management (EM); Fire and Emergency Services (FES) and Information Sharing/Information Fusion (IFIS).

The Contractor must:

• Analyze and provide recommendations to respond to Requests for Information (RFI) from Naval Criminal Investigative Service (NCIS) and USMC Criminal Intelligence Division (CID) Criminal Intelligence (CRIMINT). RFI topics shall include: naval aspects of NCIS's Multiple Threat Alert Center (MTAC) missions (e.g., Threat Assessment Port visits); HQMC Threat Fusion Cell (TFC) matters; Insider Threat Programs; and analytical/planning tool assessments.

• Provide recommendations to standardize RFI responses, threat indicators, and warning information. The intent of this task is to establish a seamless, real-time information exchange between internal and external agencies that provide detection, deterrence, and recovery missions to the Marine Corps.

• Analyze Marine Corps information sharing procedures through needs assessments and system design reviews and provide recommendations to enhance these capabilities.

• Program Guide - The Contractor must develop a detailed Program Guide that summarizes the requirements under this task to include analysis summaries, reports, plans of actions and milestones, action items, standard operating procedures, and points of contact, as applicable. The Program Guide must be submitted in accordance with the Contract Data Requirements List (CDRL), Exhibit C.

Contract Data Requirements List (CDRL) C001: Requests for Information (RFIs) Responses, Recommendations

CDRL C002: Program Guide – Coordination Support

B. Threat Information Sharing - Indications and Warnings

The Contractor must:

• Identify opportunities to consolidate and develop efficiencies related to information sharing and overall coordination efforts between the USMC Threat Fusion Cell, USMC Insider Threat, and NCIS Liaison.

• Liaise with HQMC, PP&O, Marine Corps Operations Center (MCOC), MCICOM Watch Officer, Marine Corps Component Commands, Marine Corps Intelligence Activity (MCIA), and MTAC. This task shall include receiving USMC programmatic guidance from PS to share threat information across the USMC enterprise and attend applicable working groups such as but not limited to the HQMC AT Working Group, Senior Leaders Security Conference and Marine Corps Mission Assurance Working Groups.

• Utilize the Marine Corps Suspicious Activity Information Portal (MCSAIP), a.k.a. the TrapWire system, to detect activity patterns indicative of terrorist, criminal, or hostile intelligence service surveillance operations occurring at or near USMC sites in the United States and overseas. In addition, the Contractor will develop a MCSAIP Operators Course and Master Trainers Course. The objective of this task is to train and provide those responsible for site security with the ability to detect terrorist and other surveillance activity in the early stages, thereby enabling the USMC to take appropriate counter- measures to prevent the attack and to assist in the apprehension of the perpetrators.

• Analyze classified and unclassified intelligence and law enforcement databases, message traffic, and finished intelligence products for indications and warnings of threats to Marine Corps equities.

Produce quarterly and annual Suspicious Activity Reports and other threat pattern trend analysis reports as directed and identified in the CDRL, Exhibit C. Research includes Non-classified Internet

Protocol (IP) Router Network (NIPRNet), Secret Internet Protocol Router Network (SIPRNet), and Joint Worldwide Intelligence Communications System (JWICS) message traffic and finished intelligence products from national-level intelligence agencies and federal, state, local, and military law enforcement agencies.

• Threat Assessments - Research, compile, analyze, and interpret threat indications and warnings from the Marine Corps and outside agency reports to make appropriate and timely notifications.

• Analyze and evaluate threat information for source credibility, placement and access, threat intent, and capability. The Contractor must integrate the information with previous threat reports to determine the likelihood of impact to Marine Corps personnel or facilities and advise the Government on recommended courses of action.

• Analyze intelligence information, including association matrices and link analysis, to determine threats and vulnerabilities of Marine Corps equities and special events and advise the Government on recommended courses of action. Special events examples include: the Commandant’s Ball, Summer and Evening Parades, Fleet Weeks and DoD Warrior Games.

• Disseminate all relevant information, that is not an active component to an open investigation, to HQMC PS Division, the appropriate regional threat information managers, installations, and commands (i.e., Marine Forces Command (MARFORCOM), Marine Forces Pacific (MARFORPAC), Marine Corps Installations Command (MCICOM), Marine Forces Reserve (MARFORRES), Marine Corps Recruiting Command (MCRC), etc.), Provost Marshals, CID Crime Analysts, and MCOC, as appropriate, to support regional and installation threat working groups and commanders' protection decisions.

• Attend and provide pertinent updates during daily NCIS MTAC Synchronization Meetings to ensure all members and agencies within the MTAC are aware of USMC interests and to obtain threat information with the potential to impact Marine Corps interests from other agencies. The Contractor must submit meeting minutes in accordance with the CDRL, Exhibit C.

• Provide recommendations to respond to RFI's from the Marine Corps protection community including law enforcement, antiterrorism, and intelligence personnel as well as federal, state, and local intelligence and law enforcement agencies.

• Attend regional meetings and threat working groups of law enforcement and intelligence personnel in order to share and receive information on criminal, terrorist, and foreign intelligence threats, patterns, new methodologies, and developing tools.

• Provide recommendations to develop executive threat reports for PS staff when significant threats and trends emerge.

• Provide recommendations to streamline processes related to threat information collection, reporting, analysis, and dissemination within the Marine Corps to include execution and implementation efforts and long-range plans for information sharing.

CDRL C003: Executive Threat Reports

CDRL C004: Suspicious Activity Reports (SAR) – Quarterly

CDRL C005: Suspicious Activity Report (SAR) – Annual

CDRL C006: Threat Pattern, Trend Analysis Report

CDRL C007: Meeting Minutes

C. Suspicious Activity Reporting (SAR) Tracking and Analysis

The Marine Corps Suspicious Activity Reporting process consists of four (4) stages: Collection;

Reporting; Analysis; and Dissemination of Threat Information. The collection of Suspicious Activity Reports (SAR) relies primarily on the use of the Marine Corps' Eagle Eyes (EE) Suspicious Activity Reporting Program (www.usmceagleeyes.org) to educate non-security personnel and community members on identifying and reporting suspicious activity (SA).

• Utilize EE to analyze all SAR. This tracking tool allows the Contractor MTAC Liaison Officer (LNO) analysts to record suspicious activity reporting from multiple sources and also displays that data geospatially for analysis.

• Develop and provide all Marine Corps SARs to the NCIS MTAC Watch. The Contractor must ensure Marine Corps SAR is sent to the appropriate NCIS Field Office.

• Integrate information from federal, state, and local law enforcement agencies; other service criminal investigative organizations; and Marine Corps SARs to form a comprehensive suspicious incident/threat picture for Marine Corps protection members.

• Present analyses and statistics in various internal and external forums and brief PS leadership and installation protection members (LE and AT) on pertinent threat intelligence.

• Analyze statistical data resources to assist in proactive investigations, preventative enforcement and education, identification of patterns and trends, and identification of known and repeat offenders.

• Research, compile, analyze, and interpret statistical data from an internal SAR database in order to identify strategic SAR patterns and trends. The Contractor must analyze long-term SAR trends using probability studies and complex statistical analyses such as random samplings, correlation, and regression analysis.

• Produce and disseminate quarterly and annual SAR Summaries for PS and installation protection staffs.

CDRL C004: Suspicious Activity Reports (SAR) – Quarterly

CDRL C005: Suspicious Activity Report (SAR) – Annual

D. Crisis Support

The Contractor must assist NCIS MTAC and the HQMC Threat Fusion Cell analysts with making contact with active duty Marines and support personnel abroad during crises and increased threat situations. The Contractor must provide NCIS with the contact information and location for deployed Marines and embassy personnel.

E. Liaison

The intent of this task is to develop and strengthen partnerships between NCIS, USMC Insider Threat, and the USMC Threat Fusion Cell.

The Contractor must:

• Attend the Senior Analyst Working Group and other relevant working groups/meetings in the Russell- Knox building at MCB Quantico, Virginia.

• Develop weekly USMC force disposition handouts and distribute them to the NCIS MTAC geographic division analysts and MTAC Watch Officer when requested. The intent of these products is to improve MTAC identification of threat indications and warnings that may impact Marine Corps interests.

• Attend Threat Working Groups, Mission Assurance Working Groups and insider threat Working Groups as required/directed.

• Share pertinent threat information with USMC Threat Information Managers.

CDRL C008: Force Disposition Bulletins

3.2 Task 2 - Provide Surveillance Detection Capability Support

The Contractor must:

• Analyze Evaluate TrapWire data that supports threat information gathering and sharing to ensure quality assurance and policy compliance.

• Conduct account maintenance on the Marine Corps Surveillance Detection and Suspicious Activity Reporting System. The Contractor must validate new account requests and delete unused accounts (longer than 90 days).

• Teach the TrapWire Operator Course (TOC) and Intelligence Integration Course to law enforcement and mission assurance personnel at all Marine Corps bases and revise the course criteria when current policies and procedures are updated.

• Develop, update/maintain, and implement a Surveillance Detection Training Course (SDC) that will be used at all Marine Corps bases.

• Program Guide - The Contractor must develop a detailed Program Guide that summarizes the requirements under this task to include analysis summaries, reports, plans of actions and milestones, action items, standard operating procedures, and points of contact, as applicable. The Program Guide must be submitted in accordance with the CDRL, Exhibit C.

CDRL C009: Program Guide – Surveillance Detection

3.3 Task 3 - Provide Antiterrorism Training Support

3.3.1. The current Antiterrorism Officer (ATO) Level II course is a 5-day, 40-hour evolution that was revised by the Mobile Training Team (MTT) instructors to focus on the Mission Assurance Strategy the Marine Corps mandates along with other applicable directives (see Exhibit B). The intent of ATO Level II is to provide a broad knowledge of ATO responsibilities whether assigned to an installation, reserve center, recruiting center, or a Fleet Marine Forces Command.

• Provide recommendations to refine and improve the following courses:

ATO Level II Marine Corps Antiterrorism Level III Commanders Course and related spouses training Emergency Operations Center training Installation Commanders Course Marine Corps Antiterrorism Level IV Executive Level Course

• Provide technical support to develop Antiterrorism Course modules for the Marine Corps Military Police Officer course and ATO LV II. Course modules must meet the Systems Approach to Training (SAT) standard set forth by Training and Education Command.

• Provide technical support for the Contractor instructors of the ATO Level II Course MTT.

Contractor support shall include uploading course materials to Government-owned and approved external hard drives that are provided to students. The Contractor instructors must teach the ATO Level II Course in accordance with the AT Terminal and Enabling Learning Objectives and comply with the directives in Exhibit B.

• Provide 20 ATO Level II Courses of instructions annually. Training shall be conducted in accordance with Section 6.0 and in coordination with the Contracting Officer's Representative (COR).

The anticipated frequency of training events is two (2) courses in a two-week period. Student evaluations will be posted to the AT SharePoint portal for review by the Program Manager (PM) and

COR.

• Provide technical support to facilitate course scheduling and student enrollment. The Contractor must ensure that course schedules, registration pages, and updates are published to the AT SharePoint Portal.

• Annually support the AT government lead in conducting a Control Board to revise and update the ATO Level II, III and IV Courses IAW applicable policy references and student feedback.

• Program Guide - The Contractor must develop a detailed Program Guide that summarizes the requirements under this task to include analysis summaries, reports, plans of actions and milestones, action items, standard operating procedures, and points of contact, as applicable. The Program Guide must be submitted in accordance with the CDRL, Exhibit C.

• Provide instructions for ATO's to access the following:

AT information relevant to their respective MA programs such as announcements/messages, training videos, community contact information, and discussion areas

Training travel requirements Eagle Eyes Suite C4I Suite

CDRL C010: Training – Curriculum/Modules Development

CDRL C011: Program Guide – Training Support

3.3.2. Develop and implement an Antiterrorism Officer (ATO) Level II Advanced Course as a 3-day, 24-hour evolution. The intent of ATO Level II Advanced Course is to provide a broader knowledge of ATO responsibilities whether assigned to an installation, reserve center, recruiting center, or OPFOR unit.

• Provide technical support to develop Antiterrorism Advanced Course. Course modules must meet the Systems Approach to Training (SAT) standard set forth by Training and Education Command.

• Provide technical support for the Contractor instructors of the ATO Level II Advanced Course Mobile Training Team (MTT). Contractor support shall include uploading course materials to Government-owned and approved external hard drives that are provided to students. The Contractor instructors must teach the ATO Level II Course in accordance with the AT Terminal and Enabling Learning Objectives.

• Provide 3 ATO Level II Advanced Courses of instructions annually. Training shall be conducted in accordance with Section 6.0 and in coordination with the Contracting Officer’s Representative (COR). Student evaluations will be posted to the AT SharePoint portal for review by the PM and

COR.

• Provide technical support to facilitate course scheduling and student enrollment. The Contractor must ensure that course schedules, registration pages, and updates are published to the AT SharePoint Portal.

• NOTE: Prospective students must have an eHQMC account (access to HQMC domain) prior to access being granted to the AT SharePoint Portal.

• Annually support the AT Government lead in conducting a Control Board to revise and update the ATO Level II Advanced Course.

3.4 Task 4 Provide Analytical Gap Analysis Support

The Contractor must:

• Provide analytical support to identify protection related gaps for the Protection Advocate.

Contractor support shall include protection related data sets and conducting studies to advocate the annual gap list.

• Protection Program Reports - The Contractor must conduct studies and develop reports for the Government to support strategic level initiatives to reduce risk to protection programs. Studies shall include Doctrine, Organization, Training, Materiel, Leadership and Education, Personnel, Facilities and Policy (DOTMLPFP) requirements and provide strategic recommendations and methodologies to support emergent requirements.

• Review policies, publications, and doctrine and provide recommendations to support programmatic actions to meet current and emergent requirements.

• Provide recommendations to develop strategic level mission focus statements to aid commanders at all levels in understanding critical mission components.

• Provide support to plan, execute, and coordinate Senior Leader Events. The Contractor must develop After Action Reports (AAR) to summarize each event in accordance with the CDRL, Exhibit C.

• Program Guide - The Contractor must develop a detailed Program Guide that summarizes the requirements under this task to include analysis summaries, reports, plans of actions and milestones, Operating procedures, and points of contact, as applicable. The Program Guide must be submitted in accordance with the CDRL, Exhibit C.

CDRL C012: After Action Reports (AARs)

CDRL C013: Program Guide – Gap Analysis

4.0 Key Personnel

The Contractor agrees to assign to this contract individuals meeting or exceeding the requisite education and/or experience as required in the Key Personnel Matrix (Attachment 1); and whose resumes were submitted with this proposal as necessary to fulfill the requirements of this contract.

4.1 Key Personnel Substitutions

During the first 90 days of the contract performance period, no personnel substitutions by the Contractor will be made unless substitutions are necessitated by an individual's sudden illness, death, or termination of employment. In any of these events, the Contractor must promptly notify the Contracting Officer and provide the information required by Paragraph C below. After the initial 90 day period, all proposed substitutions must be submitted, in writing, at least 10 days in advance of the proposed substitutions to the Contracting Officer and provide information required by Paragraph C below.

4.2 Request for Key Personnel Substitutions

All requests for substitutions must provide a detailed explanation of the circumstances necessitating the proposed substitution, a resume for the proposed substitute, and any other information requested by the Contracting officer. All proposed substitutes must have qualifications equal to or higher than the qualifications stated in the PWS and the personnel being substituted. The Contracting Officer or his/her authorized representative will evaluate such requests and promptly notify the Contractor of his/her approval or disapproval thereof.

5.0 Place of Performance

Performance shall take place at the following locations:

• At the Contractor’s facility

• Russell-Knox Building, Quantico VA for the MTAC LNO

• Marine Corps Base Quantico for Insider threat and threat fusion cell support

• AT Level II Instructors: At Contractor’s facilities and on all Marine Corps installations where training takes place both CONUS and OCONUS.

6.0 Working on a Government Installation

Contractor employees must be clearly identifiable while on Government property by wearing appropriate badges at all times. The Contractor shall provide each employee with an identification badge, which identifies, by photograph, the individual as an employee of the Contractor. These badges shall be worn at all times and presented for examination upon request from the Contracting Officer, COR, Military Police, or any other Government Official with a need to see the badge. The Contractor and its employees shall be subject to all traffic, security, and registration regulations for personnel and vehicles.

All Contractor personnel attending meetings, answering Government telephones, in electronic messages or correspondence related to this contract, working on site, where their Contractor status is not known to third parties, must identify themselves as Contractors, to include wearing ID badges, which identify them as Contractor personnel. Contractor personnel shall also ensure that when logged onto Government equipment that their profile shows them as Contractor personnel. Unless otherwise directed by the COR, all documents produced or revised by Contractors or developed through Contractor participation must be marked as “Contractor generated documents” or otherwise identified in a manner that discloses the contractor’s participation. (Note: No deliverable shall contain any proprietary markings inconsistent with the Government's data rights set forth in this TO.)

Contractor-occupied facilities (on Government installations) such as offices, separate rooms, or cubicles must be clearly identified with Contractor supplied signs, name plates or other identification, showing that these are work areas for Contractor personnel. When required to work in a Government facility, the Contractors will be provided workstation access in the Russell-Knox Building, Quantico

VA.

7.0 Travel Reimbursement

The Contractor should expect to make several trips to Marine Corps installations every year (approximately 1-2 Contractor employees on each trip). Each trip is estimated to last between six (6) to nine (9) days to the locations listed below. These trips are estimations and are subject to change throughout the contract.

• 20 trips for AT LVII Courses throughout the year

• Three (3) trips for AT LV II Advanced Course instruction

• Three (3) trips to regional MCI Commands for TOC, SDC and Master Trainer Course instruction Any travel under this contract must be specifically requested in writing by the Contractor and approved by the COR, prior to incurring any travel expense. The Contractor must submit the written request to the COR five (5) days in advance. The travel request must include as a minimum, the following:

• Contract number

• Date, time, and place of proposed travel

• Purpose of travel and how it relates to the contract

• Contractor’s estimated cost of travel with a breakdown of the estimated costs of transportation, lodging, meals, and incidentals; and

• Name(s) of individual(s) traveling.

The COR must review and approve/disapprove (as appropriate) all travel requests submitted giving written notice of such approval or disapproval to the Contractor.

The Contractor must be reimbursed for the reasonable actual cost of transportation, lodging, meals and incidental expenses. However, actual costs must be considered reasonable, allowable, and reimbursable only to the extent that they do not exceed on a daily basis the maximum per diem rate in effect at the time of travel as set forth in the DoD Joint Travel Regulations located at https://secureapp2.hqda.pentagon.mil/perdiem/. Actual cost does not include handling charges, general and administrative cost, overhead, profit or any other indirect cost.

The Contractor must use the allowable Government personnel rates for transportation and lodging.

Reimbursement for airfare must not exceed the lowest customary standard, coach, or equivalent airfare quoted during normal business hours. The Contractor will not be reimbursed for travel https://secureapp2.hqda.pentagon.mil/perdiem/ expenses unless audited records for transportation contain evidence, such as original receipts, substantiating actual expenses incurred for travel. In no event will reimbursement exceed the published rates of common carriers. Expenses for lodging, meals and incidental expenses must be reimbursed to the Contractor, provided that the overnight stay was documented as necessary.

The contract includes a not-to-exceed (NTE) funding limitation for travel costs. The Contractor must adhere to the notice requirements of FAR Clause 52.232-22, Limitation of Funds, in performance of any approved travel. The Contractor must not exceed or incur costs that exceed the amount of funding stated on the reimbursable travel CLIN. The Government is not obligated to reimburse the Contractor for otherwise reimbursable travel in excess of the funded amount stated on the reimbursable travel

CLIN.

The Contractor is not obligated to continue performance of any reimbursable work under this Contract or otherwise incur costs for reimbursable travel in excess of the funded amount stated on the reimbursable travel CLIN unless the Contracting Officer notifies the Contractor in writing that the funded amount stated under the applicable reimbursable travel CLIN has been increased. In the event notification is made orally, such notification must be followed up in writing within two working days.

No notice, communication, or representation from any person other than the Contracting Officer must affect the Government’s obligation to reimburse the Contractor.

Change orders must not be considered an authorization to exceed the funded amount stated under the reimbursable travel CLIN unless they contain a statement expressly increasing the funded amount of that reimbursable CLIN by a sufficient amount to cover the change order.

8.0 Performance Requirements Surveillance Table

All deliverables will be inspected for content, completeness, accuracy, and conformance to contract requirements by the COR. Inspection may include validation of information or software through the use of automated tools, testing, or inspections of the deliverables, as specified in the contract.

Tasks PWS Ref.

Performance Standards

Acceptable Quality Levels

Surveillance Method Incentive

Timeliness of Deliverables Required by the Contract

2.0

3.0

Deliverables must be submitted in accordance with the delivery requirements in the

PWS

95% of the deliverables / reports are submitted on time.

COR

Review

- Invoice Reductions: $250.00 for every five (5) business days late, up to $2,000.00.

- CPARS Ratings

Accuracy of Deliverables Required by the Contract

2.0

3.0

Reports and Deliverables are complete and correct when submitted.

No more than three (3) material (non-clerical) errors per deliverable.

COR

Review

- Final deliverables that exceed the AQL will be determined incomplete and rejected.

- Invoice Reductions: $200.00 for each incomplete deliverable, up to $2,000.00.

Overall Management of Tasks

2.0

Coordinate task activities and provide overall expertise for successful management and completion of each task area.

Meets all requirements.

Problems encountered are minor and resolved in a satisfactory manner.

Customer Input

Random Sampling

COR

Review

CPARS Ratings

Staffing 4.0

Provide key personnel substitution requests in an efficient manner in order to avoid a gap in service/ lapse of personnel supporting the required task areas.

No more than a 3-week gap in support due to a key personnel replacement issue.

COR

- Invoice Reductions: Deduct the key person’s daily rate for each business day exceeding the AQL.

Responsiveness 2.0

Provide services that allow for a rapid response in supporting the MADL operations.

Meets all requirements.

Problems encountered are minor and resolved in a satisfactory manner.

Customer Input

Random Sampling

COR

CPARS Ratings