N0018900X0001_N0018900X0001_-_PWS_-_RFI_DRAFT.docx

PERFORMANCE WORK STATEMENT

INFORMATION MANAGEMENT/INFORMAITON TECHNOLOGY (IM/IT)

PROGRAM MANAGEMENT SUPPORT SERVICES

1. Background:

The Navy Medical Research Center (NMRC) is located at the Forest Glen Annex, in Silver Spring, MD, building 8400, Fort Detrick, MD, and a single department at Walter Reed National Military Medical Center, Bethesda, MD. The command requires Information technology (IT) Support Services to support the computer users, network devices, and general day-to-day IT operations.

The contractor shall comply with all regulations, policies and directives of the Department of Defense (DoD), the Defense Information System Agency (DISA), the Department of the Navy (DoN), Bureau of Medicine and Surgery (BUMED), NMRC and their respective commands, including but not limited to areas of IT, information security, e-mail administration, network management, system administration, software, hardware, equipment, and responses to requests for information. The following are some of the regulations, policies and directives:

· DoD M-8570 series – Information Assurance Workforce Improvement Program

· DoDI 8500 series – Cybersecurity

· DoDI 8510 series – Risk Management Framework (RMF) for DoD Information Technology (IT)

· SECNAV m-5239 series – Cyberspace Information Technology and Cybersecurity Workforce Manual and Qualification Manual

· SECNAV m-5510 series – Department of the Navy Personnel Security Program

Contractors may obtain these regulations, policies and directives at one of the following websites:

· DoD Directives: http://www.esd.whs.mil/DD/

· DoN Directives: http://doni.documentservices.dla.mil/allinstructions.aspx

· NIST Publications: https://www.nist.gov.publications

2. Objectives:

This (DRAFT) Performance Work Statement (PWS) outlines the IT Support Services that shall be required of a contractor to support the computer users, network devices and general day-to-day IT operations of the NMRC.

Provision of IT support services to manage and maintain the NMRC networks and systems to ensure consistent network connectivity, network security, internet access, user accounts, e-mail services, applications support, information assurance support, operate a local help desk and provide customer support. The primary goals of the contractor shall be to: ensure the NMRC networks and systems deliver a consistently high level of performance; reliability; develop and provide high quality solutions; and that customers received excellent service that resolves issues quickly. The contractor will directly support the NMRC Chief Information Officer with information technology oversight and collaboration roles.

3. Non-Personal Services:

This award identifies services that are strictly non-personal in nature.

The Government shall not exercise any supervision or control over the contractor performing the services herein. The contractor is responsible for the quality and timely performance and delivery of the services required in this PWS.

4. Required Tasks and Areas of Responsibility:

The use of a Non-disclosure and/or Non-Use Agreement may apply to all or portions of the scope of the work.

5.2 Information Assurance/ Security Requirements:

Appropriate administrative, technical, and physical safeguards to protect any and all Government data will be established by the contractor to ensure the confidentiality, integrity, and availability of government data.

5.3 Privacy Act and health Insurance Portability and Accountability (HIPPA):

All requirements of the Privacy Act of 1974 shall apply as well as all agency rules and regulations issued under the Act.

All Health Insurance Portability and Accountability Act of 1996 (HOPPA) (P.L. 104-191) requirements apply. This includes the Standards for Electronic transactions, the standards for Privacy of Individually Identifiable Health Information and the Security Standards.

All Privacy Act and HIPAA related rules and regulations as they are published will be adhered to and all associated training, both initial core training courses and annual refresher training topics thereafter will be complied with.

5.4 Government Furnished Equipment (GFE)/Information (GFI)/Property (GFP):

The government will provide use of all available NMRC facilities and support services, materials, publications and forms, and equipment required for contract performance (except as designated). Government furnished supplies, equipment, and work areas will be kept safe, orderly and clean. When maintenance of equipment or replenishment of supplies are required, the Government shall be notified.

Telephones, facsimile machines, copiers and computer equipment are authorized for transaction of official business only and shall not be sued for personal business. Personal long distance calls are not authorized. Telephones, facsimile machines and computer equipment are subject to communications security monitoring at all times.

All issued keys shall be safeguarded from loss, theft, duplication or destruction and must display all keys signed for at scheduled or unscheduled key control inspections. Lost keys shall be subject to reimbursement to the Government if damaged, lost, or stolen.

If smart phones are issued, they shall be safeguarded from loss, theft, or destruction and must display the phone for scheduled or unscheduled control inspection. Smart phones shall be subject to reimbursement to the Government if damaged, lost, or stolen.

5.6 Data Rights:

The Government will retain rights to all data produced in the course of developing, deploying, training, using and supporting NMRC or other Federal Agencies.

6. Personnel Security Procedures:

Common Access Cards shall be required. Additionally, depending on the level of computer/network access, successful background investigations shall be required.

6.1 Facility Security Office (FSO):

All FSO representatives shall be identified and provided to the Government and shall be the primary point of contact on all personnel security matters.

6.2 Access to DoD Systems:

In accordance with SECNAV M-5510.30, contractors who require access to DoD networks are categorizes as IT-I, IT-II, or IT-III. This clause applies to contractors who require IT0II privileged access to a DoN or DoD unclassified computer network; the IT-II Level, defined in detail in SECNAV M-5510.30, includes positions which require access to information protected under the Privacy Act, to include Protected Health Information (PHI). All contract health care worker positions under this contract requires access to Privacy Act protected information and are therefore categorized as no lower the IT-II.

6.2.1 To obtain a favorable determination, each contractor employee must have a favorably completed National Agency check with Local Credit Checks (NACLC)/tier 3 which consists of a NACI including a FBI fingerprint check plus credit and law enforcement checks. Each contractor employee is required to complete:

· SF-86 Questionnaire for National Security Positions (or equivalent OPM investigative product)

· Electronic Fingerprints

· Original Signed Release Statements Failure to provide the required documentation at least 30 days prior to the individual’s start date shall result in delaying the individual’s start date. to maintain continuing authorization for an employee to access Privacy Act information on a DoD unclassified computer/network, the contractor shall ensure the individual employee has a current requisite background investigation. The contractors’ FSO representative shall be responsible for initial investigations and reinvestigations as required and ensuring that background investigations remain current (not older than 10 years) throughout the contract performance period.

When access to IT systems is required for performance of the contractor employee’s duties, such employees shall in-process with the Navy Command’s Security Manager and Information Systems Security manager (ISSM) upon arrival to the Navy command and shall out-process prior to their departure at the completion of the individual’s performance under the contract. Completion and approval of a system Authorization Access request Navy (SAAR-N) form is required for all individuals accessing Navy Information technology resources. The SAAR-N shall be forwarded to the Navy Command’s Security manager at least 30 days prior to the individual’s start date. Failure to provide the required documentation at least 30 days prior to the individual’s start date shall result in delaying the individual’s start date.

When required to maintain access to required IT systems or networks, the contractor shall ensure that all employees requiring access complete annual Cyber Awareness training, and maintain a current requisite background investigation. The contractor’s FSO Representative shall contact the Command Security Manager for guidance when reinvestigations are required.

The contractor’s FSO Representative shall ensure that each individual employee pending assignment shall accurately complete the required forms for submission to the Navy Command Security manager for review. The contractor’s FSP Representative shall screen the investigative questionnaires of completeness and accuracy and for potential suitability/security issues prior to sending the request to the Navy Command’s Security Manager for review and approval for interim access. These required items, shall be forwarded to the Navy Command’s Security Manager for processing at least 30 days prior to the individual employee’s anticipated date for reporting for duty. The Navy Command’s Security Manager will review the documentation for completeness and accuracy prior to contractor FSO submitting it in the EQip system. Suitability/security issues identified by the Navy may render the contract employee ineligible for the assignment. An unfavorable determination made by the Navy is final (subject to SF-86 appeal procedures) and such a determination does not relive the contractor from meeting any contractual obligation under the contract. If contractor employees already possess a current favorably adjudicated investigation, the Navy Command’s Security Manager will use the Visit Authorization request (VAR) via the joint personnel Adjudication System (JPAS) sent by the contractor. The contract or shall include the IT position category per SECNAV M-5510.30 for each employee designated on VAR. The VAR requires annual renewal for the duration of the employee’s performance under the contract.

The Facility Security Officer for the contractor will forward the required forms to OPM/DISCO for processing.

6.3 Denial of Access

The potential consequences of any requirements under this clause including denial of physical or system access no way relieves the contractor from the requirement to execute performance under the contract within the timeframes specified in the contract. Contractors shall plan ahead in processing their employees and subcontractor employees. The contractor shall insert this clause in all subcontracts when the subcontractor is permitted to have physical access to a federally controlled facility and/or access to a federally-controlled information system/network and/or access to government information.

6.4 Interim Access

The navy Command’s Security Manager may authorize issuance of a CAC card and interim access to a DoN or DoD unclassified computer/network upon a favorable review of the SF-86 questionnaire and advance fingerprint results. When the results of the investigation are received and a favorable determination is not made, contractor employees working on the contract under interim access shall be removed immediately and will no longer authorized to work on the contract.

There shall be a draft plan for incoming transition proposed.

7.2 Outgoing Transition Plan:

There shall be a draft plan for outgoing transition proposed.