N0018919DQXXX_PWS_NAVSUP_BSC_8A_Requirement.pdf

Performance Work Statement (PWS)

Naval Supply Systems Command (NAVSUP) Business Systems Center (BSC)

Program Support Services

1.0 Introduction

The Naval Supply Systems Command (NAVSUP) Business Systems Center (BSC) has the need for contractor support services to support a variety of initiatives to improve overall organizational effectiveness and operational efficiency. Support services are required for emergent program support needs, in the areas of information technology, supply chain and logistics areas.

2.0 Background:

NAVSUP BSC works closely with their stakeholders to provide information systems and program support through its Business Systems Center. NAVSUP BSC is the Navy's premier Information Technology provider of choice with responsibility to design, develop, and maintain information systems supporting numerous activities in the functional areas of logistics, supply chain management, transportation, finance and accounting.

2.1 Requiring Organization

The organization requiring the services outlined in the Performance Work Statement (PWS) is:

NAVSUP Business Systems Center 5450 Carlisle Pike Bldg. 409 Mechanicsburg, PA 17055

2.2 Project Description

NAVSUP BSC must collaborate with their stakeholders on a wide range of mission and business challenges so that the services, processes, and policies of NAVSUP are enabled by information systems that are efficient, effective, and affordable. NAVSUP BSC and their stakeholders both rely on the ability to bring together a superior workforce to accomplish their shared mission through a combination of Government and contractor personnel and delivery teams. This Performance Work Statement (PWS) sets the parameters for obtaining contractor support under an IDIQ contract for services that are intended to benefit both the stakeholders and NAVSUP

BSC.

It is anticipated that individual task orders will be formalized around specific tasks supporting ongoing or upcoming project requirements included in the scope of work defined in the PWS.

Specific details of task assignments, deliverables, documentation and applicable standards will be provided in awarded task orders.

3.0 Scope

The scope of this Indefinite Delivery Indefinite Quantity (IDIQ) contract is to provide the necessary level of professional and technical support required to facilitate shared objectives of stakeholders and NAVSUP BSC.

The goal of this PWS is to obtain contractor support services to provide program support services to the NAVSUP BSC staff in the areas of IT, business support services and analysis positions to be introduced in the requirements sections of this document and fully within individual task orders.

4.0 Directives

The contractor shall comply with the following directives, and any updated/future versions as they are released, and consider them in developing their technical proposal and management plan:

Directive Description Date

DoDI 8330.01 Interoperability and Supportability Information Technology (IT) and Nati Security Systems (NSS)

21 May 2014

DoDD 5000.01 The Defense Acquisition System 21 May 2003

DoDI 5000.02 Operation of the Defense Acquisition System

07 January 2015

DoDD 5141.02 Director of Operational Test and Evaluation (DOT&E)

02 February 2009

DoDM 5200.01-V1 DOD INFORMATION SECURITY PROGRAM:

OVERVIEW, CLASSIFICATION, AND

DECLASSIFICATION

24 February 2012

DoDM 5200.01-V2 DOD INFORMATION SECURITY PROGRAM:

MARKING OF CLASSIFIED INFORMATION

(incorporating Change 2 dated 19 Mar 2013)

24 February 2012

DoDM 5200.01-V3 DOD INFORMATION SECURITY PROGRAM:

PROTECTION OF CLASSIFIED INFORMATION

(incorporating Change 2 dated 19 Mar 2013)

24 February 2012

DoDM 5200.01-V3 DOD INFORMATION SECURITY PROGRAM:

CONTROLLED UNCLASSIFIED INFORMATION

(CUI)

24 February 2012

DoDI 8500.01 CYBERSECURITY 14 March 2014

CJCSI 3170.01I Requirements Generation System 23 January 2015

OPNAVIST 4000.84C Support Agreements 31 May 2012

SECNAVINST 5000.2E DEPARTMENT OF THE NAVY IMPLEMENTATIO

AND OPERATION OF THE DEFENSE ACQUISI

01 September 2011

SYSTEM AND THE JOINT CAPABILITIES

INTEGRATION AND DEVELOPMENT SYSTEM

SECNAV 5510.30 Department of the Navy Personnel Security Program

01 June 2006

DoDD 4500.09E TRANSPORTATION AND TRAFFIC MANAGEMEN 11 September 2007

DoDM 4140.01-V1 DOD SUPPLY CHAIN MATERIEL MANAGEMENT

PROCEDURES: OPERATIONAL REQUIREMENTS

10 February 2014

5.0 Requirements/Tasks

The contractor shall be contractually obligated to perform every requirement in this performance work statement. Not every performance requirement has a related performance standard or assessment measure expressed in this document. In such cases, the performance standard or performance measure is either inherent in the requirement or performance is to be in accordance with NAVSUP BSC Code 98 standards.

Per DFARS 211.106, contractor employees shall identify themselves as contractor personnel by introducing themselves or being introduced as contractor personnel and displaying distinguishing badges or other visible identification for meetings with Government personnel. In addition, contractor personnel shall appropriately identify themselves as contractor employees in telephone conversations and in formal and informal written correspondence.

5.1 IT Software Engineering

The contractor shall provide IT software engineering support including:

analyzing and refining systems requirements;

translating systems requirements into applications prototypes;

planning and designing systems architecture;

writing, debugging, and maintaining code;

determining and designing applications architecture;

determining output media/formats;

designing user interfaces;

working with customers to test applications;

assuring software and systems quality and functionality;

integrating hardware and software components;

writing and maintaining program documentation;

evaluating new applications software technologies; and ensuring the rigorous application of information security/ information assurance policies, principles, and practices to the delivery of application software services.

5.2 IT Customer Support

The contractor shall provide IT customer support including:

diagnosing and resolving problems in response to customer reported incidents;

researching, evaluating, and providing feedback on problematic trends and patterns in customer support requirements;

developing and maintaining problem tracking and resolution databases;

installing, configuring, troubleshooting, and maintaining customer hardware and software;

developing recommendations for customer service performance requirements;

developing recommendations for customer support policies, procedures, and standards;

providing customer training; and ensuring the rigorous application of information security/information assurance policies, principles, and practices in the delivery of customer support services.

5.3 IT Data Management

The contractor shall provide IT data management support including:

analyzing and defining data requirements and specifications;

designing, normalizing, developing, installing, and implementing databases;

maintaining, monitoring, performance tuning, backup, and recovery of databases;

installing, configuring, and maintaining database management systems software;

analyzing and planning for anticipated changes in data capacity requirements;

developing and administering data standards, policies, and procedures;

developing and implementing data mining and data warehousing programs;

evaluating and providing recommendations on new database technologies and architectures; and ensuring the rigorous application of information security/ information assurance policies, principles, and practices in the delivery of data management services.

5.4 IT Internet Development

The contractor shall provide IT internet development support including:

determining overall technical design and structure of Internet services;

monitoring functionality, security, and integrity of Internet services;

troubleshooting and resolving technical problems with the design and delivery of Internet services;

collecting and analyzing Internet services usage and performance statistics;

evaluating new Internet services and technologies;

providing technical advice to Internet content providers; and ensuring the rigorous application of information security/ information assurance policies, principles, and practices in the delivery of Internet services.

5.5 IT InfoSec

The contractor shall provide IT InfoSec support including:

developing recommendations for policies and procedures to ensure information systems reliability and accessibility and to prevent and defend against unauthorized access to systems, networks, and data;

conducting risk and vulnerability assessments of planned and installed information systems to identify vulnerabilities, risks, and protection needs;

promoting awareness of security issues among management and ensuring sound security principles are reflected in organizations’ visions and goals;

conducting systems security evaluations, audits, and reviews;

developing systems security contingency plans and disaster recovery procedures;

developing and implementing programs to ensure that systems, network, and data users are aware of, understand, and adhere to systems security policies and procedures;

participating in network and systems design to ensure implementation of appropriate systems security policies;

facilitating the gathering, analysis, and preservation of evidence used in the prosecution of computer crimes;

assessing security events to determine impact and implementing corrective actions; and ensuring the rigorous application of information security/ information assurance policies, principles, and practices in the delivery of all IT services.

5.6 IT Network

The contractor shall provide IT network support including:

analyzing and defining network requirements;

defining and maintaining network architecture and infrastructure;

configuring and optimizing network servers, hubs, routers, and switches;

analyzing network workload;

monitoring network capacity and performance;

diagnosing and resolving network problems;

developing network backup and recovery procedures;

installing, testing, maintaining, and upgrading network operating systems software; and ensuring the rigorous application of information security/ information assurance policies, principles, and practices in the delivery of network services.

5.7 IT Operating Systems

The contractor shall provide IT operating systems support including:

analyzing systems requirements in response to business requirements, risks, and costs;

evaluating, recommending, verifying, and validating the systems software environment;

evaluating, recommending, and installing compilers, assemblers, and utilities;

integrating hardware and software components within the systems environment;

monitoring and fine-tuning performance of the systems environment;

evaluating new systems engineering technologies and their effect on the operating environment;

and ensuring that information security/information assurance policies, principles, and practices are an integral element of the operating environment.

5.8 IT Systems Administration

The contractor shall provide IT systems administration support including:

planning and scheduling the installation of new or modified hardware and operating systems and applications software;

managing accounts, network rights, and access to systems and equipment;

managing systems resources including performance, capacity, availability, serviceability, and recoverability;

implementing security procedures and tools;

developing and documenting systems administration standard operating procedures;

resolving hardware/software interface and interoperability problems;

ensuring systems availability, functionality, integrity, and efficiency;

maintaining systems configuration;

managing the installation and integration of systems fixes, updates, and enhancements; and ensuring the rigorous application of information security/ information assurance policies, principles, and practices in the delivery of systems administration services.

5.9 IT Systems Analysis

The contractor shall provide IT systems analysis support including:

performing needs analyses to define opportunities for new or improved business process solutions;

consulting with customers to identify and specify requirements;

developing overall functional and systems requirements and specifications;

conducting business process reengineering;

conducting feasibility studies and trade-off analyses;

preparing business cases for the application of IT solutions;

defining systems scope and objectives;

developing cost estimates for new or modified systems;

ensuring the integration of all systems components; e.g., procedures, databases, policies, software, and hardware;

planning systems implementation; and ensuring the rigorous application of information security/ information assurance policies, principles, and practices to the systems analysis process.

5.10 Operations Research and Analysis

The contractor shall provide operations research and analysis support including:

Provide statistical analysis, stochastic modeling, network analysis and optimization, as well as modeling and simulation, and decision support

Methods Development and Assessment – applying expert knowledge of particular classes of problems and the ability to develop associated problem solving methods;

Problem Solving –working directly to correct deficiencies or improve the performance of systems, processes, or operations;

Problem Definition – utilizing/framing “what if” questions in the formulation of problem statements;

Model Development – representing the important factors of the problem and their relationships to selected features of the real world;

Hypothesis Testing and Investigation –Successive integration of analogies, patterns, and relationships, and usually involves feedback and further restructuring; and

Predictions/Explanations – Predicting future events or explain past events, recommendation of the best alternatives, and presentation of relevant tradeoffs and limitations to decision makers.

5.11 Supply Systems Analysis

The contractor shall provide supply systems analysis support including:

initiating, developing, installing, or administering a supply program;

coordinating with customers and overseeing the implementation of actions involving requirements determination, acquisition of supplies and materials, managing property accountability systems, and assuring that property is in place where and when needed;

developing and issuing supply handbooks and other publications for agency and/or industry use;

sponsoring and developing training programs, conferences and seminars;

conducting surveys and studies of supply operations to determine proper application of improved supply methods or approved industry techniques;

providing technical advice, guidance, and assistance on supply operations to agency personnel;

developing, installing, or advising on financial or other management control programs for supply operations for such purposes as controlling operations, determining supply costs, planning and budgeting, and evaluating supply management performance;

developing design specifications, reviewing data processing systems that support supply programs, and documenting additions, changes, or deletions;

monitoring and making recommendations to modify inventory control systems for subordinate and regional level programs;

evaluating storage and distribution systems for potential introduction of automated controls and systems of data flow and reports; and other combinations of work that involve program management, or review, analysis, and recommending improvements in operations, programs, automated systems, methods, or procedures.

5.12 Visual Communications

The contractor shall provide visual communications support including:

design, creation, display of visual materials;

produce illustrations, charts, or graphs;

production of videotape, radio, motion picture, or other audiovisual presentations. Such positions involve planning, organizing, and directing the work of writers, actors, narrators, set designers, camera operators, sound technicians, and other audiovisual production personnel;

select visual materials such as photographs, illustrations, models, and specimens to be used in the communication of information;

design the placement and appearance of visual materials;

design the placement of text in relation to art;

decide type styles and typographical effects; and plan effective use of color schemes, textures, and shapes considering the technical constraints of a particular method of communication (i.e., printed publication, exhibit, or oral presentation);

desk top publishing; and long-range planning, participating in the development of the program with management officials, selecting the means of communication to be used, and determining where emphasis should be placed and resources should be used.

Performance Measurement Criteria: Task success will be evaluated by the success of contractor at meeting imposed due dates for deliverables and documentation. This effort includes providing qualified personnel following industry accepted methodologies and other pertinent practices. The effort is further characterized by always operating with the Government’s best interest in mind, using efficient and effective methods and demonstrating sound cost control.

The government reserves the right to periodically review personnel qualifications and certification of personnel working on this order and ask for the removal of any person not maintaining their qualifications or certifications. Performance Standards and Assessment Methods will be further defined at the task order level.

6.0 Deliverables: All deliverables must meet the format requirements specified by the individual task orders. Documentation related to these services shall be made available electronically. The following list details the contract deliverables:

6.1 Monthly Status Report. Status reports shall be sent electronically to the TA and COR within seven (7) days following the end of the monthly period documenting the performance on the task order. The monthly status report shall include the following elements:

o Resources by name o Date project/task received o Status of work with accomplishments documented o Percentage of project/task completed o Estimated date of project/task completion o Issues/problems encountered or possible and recommended solutions o Changes to the Project Management Plan (PMP) to include roles and responsibilities and schedule changes o Identify any Government dependencies that are overdue which impact schedule or performance o Evaluate performance and determine adequacy of staffing.

6.2 Contractor’s Quality Assurance Plan. The contractor shall develop and maintain a quality assurance plan. This QA Plan should detail the methodology to be used by the contractor to monitor and ensure that all support services are provided and individual qualifications and certifications remain current. The contractor shall provide the Initial Quality Assurance Plan to the COR and TA not later than ten (10) days after contractor award.

Unless stated otherwise, the following instructions apply to all deliverables:

All versions of the deliverables required by the task order shall be delivered electronically to the COR and/or his/her designee and shall be subject to Government review and approval.

Deliverable due dates shall take into account the review periods described below.

Draft deliverables will be reviewed and feedback and/or requested changes provided within 7 business days (unless otherwise specified).

Government reserves the right to request a formal review session with the contractor during these timeframes and can request that the contractor make changes to any version of a deliverable.

Government will review and approve or reject all final versions of all deliverables within 7 business days of receipt (unless otherwise specified).

If any deliverable is rejected, the contractor will be notified within the specified time periods and will have 7 calendar days within which to rework the deliverable and resubmit for Government approval. All changes to any version of a deliverable and/or deliverable outline shall be approved by the COR. If more than the specified number of calendar days is required for Government review and approval, the COR will inform the contractor of the need for an extension within the initial review period.

Contractor shall prepare and submit the deliverables on or before the required due date to the COR or designee via email. For deliverables that are not documents the contractor shall submit a description of the deliverable and any associated documentation or descriptive information. In no case shall any deliverable be received by the Government less than 21 calendar days prior to the end of the task order Period of Performance.

Rejection of any deliverable by the Government does not excuse the contractor from meeting the baseline due dates for any other deliverables.

7.0 Period of Performance

The ordering period of performance for this IDIQ contract will be a base year and four, one-year options.

8.0 Places of Performance

The primary place of performance will be Mechanicsburg, PA 17055. Additional on-site support may be required at other CONUS locations, OCONUS locations to include Hawaii, or off-site locations to be determined by each task order.

9.0 Travel

Specific travel requirements will be addressed as required at the task order level. If not the primary place of performance, travel may be expected to be accomplished to other locations (including international) in support of projects when pre-approved by the TA and COR.

Obtaining a passport will be the responsibility of the traveler/company to include all costs to obtain passports. It is not anticipated that there will be a requirement for contractor to travel for any conference attendance.

If the contractor is required to travel to other locations, such travel shall be in accordance with FAR 31.205-46. All travel must be pre-approved in writing by the TA and COR prior to the actual travel and all travel must be funded in the contract prior to any travel expenses being incurred. No travel shall occur outside of the period of performance dates of the contract.

Travel 12 hours or less, per diem does not apply.

If travel is required, the contractor is responsible for making all needed arrangements for their personnel.

9.1 Travel Policy. The Government will reimburse the contractor for allowable travel costs incurred by the contractor in performance of this PWS and determined to be in accordance with FAR subpart 31.2, subject to the following provisions:

• Travel required for tasks assigned under this contract shall be governed in accordance with rules set forth for temporary duty travel in FAR 31.205-46.

Unallowable travel costs:

Change or cancellation fees for travel.

9.2 Travel other. Travel, subsistence, and associated labor charges for travel time are authorized whenever a task assignment requires work to be accomplished at a temporary alternate worksite. Travel performed for personal convenience will not be reimbursed.

9.3 Air/Rail Travel. In rendering the services, the contractor shall be reimbursed for the actual costs of transportation incurred by its personnel not to exceed the cost of economy class rail, or plane fare, to the extent that such transportation is necessary for the performance of the services hereunder and is authorized by the Contracting Officer’s Representative (COR).

Such authorization by the COR shall be indicated in the order or in some other suitable written form.

10.0 Security

All positions are classified as noncritical-sensitive. Future task orders may require a security clearance for requirements (DD254 may be required at the task order level). Per SECNAV M-

5510.30 (Department of the Navy Personnel Security Program) and DOD 5220.22-M (National Industry Security Program Operating Manual), only U.S. Citizens are eligible for security clearances.

This clause does not apply to non-U.S. Nationals (foreign nationals) who are contactor employees performing work overseas.

The clause is applicable to the United States Nationals living in the U.S. or overseas who are performing work on a Navy contract.

The investigation of a non-U.S. national at a foreign location must be consistent with a NACI, to the extent possible, and include a fingerprint check against the FBI criminal history database, an FBI investigations file (name check) search, and a name check against the terrorist screening database.

Also, the above cited reference notes that Foreign Nationals may not be granted CAC Credentials until completion of their investigation and not in the interim.

Per DoD 5200.2-R, DoD Components must initiate and ensure completion of a background investigation before applying the credentialing standards to a non-U.S. national at a foreign location. The background investigation must be favorably adjudicated before a CAC can be issued to a non-U.S. national at a foreign location. The type of background investigation may vary based on standing reciprocity treaties concerning identity assurance and information exchanges that exist between the U.S. and its allies or agency agreements with the host country.

SUPTXT204-9400(7-18) Contractor Unclassified Access to Federally Controlled Facilities, Sensitive Information, Information Technology (IT) Systems or Protected Health Information (JUN 2018)

Executive Order 13467, Reforming Processes Related to Suitability for Government Employment, Fitness for Contractor Employees, and Eligibility for Access to Classified National Security Information, and Homeland Security Presidential Directive (HSPD)-12, requires government agencies to develop and implement Federal security standards for Federal employees and contractors. The 5 CFR 32 part 157 in concert with DoD Manual 1000.13, Vol 1, implements the Federal Standards.

APPLICABILITY

This text applies to all DoD sponsored individuals who require CAC eligibility (or login and P/W if acceptable per contract) for: Physical access to DoD facilities or non-DoD facilities on behalf of DoD; Logical access to information systems (whether on site or remotely); or remote access to DoD networks that use only the CAC logon for user authentication, or access to sensitive and protected information. This applies to the Office of the Secretary of Defense, the Military Departments, the Office of the Chairman of the Joint Chiefs of Staff and the Joint Staff, the Combatant Commands, the Office of the Inspector General of the DoD, the Defense Agencies, the DoD Field Activities, and all other organizational entities within the DoD (hereinafter referred to collectively as the "DoD Components").

Each contractor employee providing services at a Navy Command under this contract is required to obtain a Department of Defense Common Access Card (DoD CAC). Additionally, depending on the level of computer/network access, the contract employee will require a successful investigation as detailed below.

ACCESS TO FEDERAL FACILITIES

Per HSPD-12 and implementing guidance, all contractor employees working at a federally controlled base, facility or activity under this text will require a DoD CAC. When access to a base, facility or activity is required contractor employees shall in-process with the Command’s Security Manager upon arrival to the Command and shall out-process prior to their departure at the completion of the individual’s performance under the contract.

START-UP PERIOD

All contractor resource onboarding documents must be submitted via the prime contractor. The prime contractor shall make all necessary preparations to assume full responsibility for productive performance as of the performance start date.

Definition of “productive”:

a. Visit Authorization Request (VAR)

b. Contractor Information Sheet (CIS)

c. FD-258 fingerprint card

d. Completed EQIP (Electronic Investigation)

e. All contractor resource(s) must have an active JPAS profile

f. Common Access Card (CAC)

Note (1): Invoicing by the contractor will begin as of the commencement of the performance period of services, and no reimbursement will be paid by the Government for efforts expended during the start-up period.

Note (2): Dual Citizenship and Foreign Nationals are not allowed access to the functional/system side of Enterprise Resource Planning (ERP).

ACCESS TO DOD IT SYSTEMS

In accordance with SECNAV M-5510.30, contractor employees who require access to DoN or DoD networks are categorized as IT-I, IT-II, or IT-III. The IT-II level, defined in detail in SECNAV M-5510.30, includes positions which require access to sensitive information.

Sensitive information includes information protected under the Privacy Act, to include Protected Health Information (PHI). All contractor employees under this contract who require access to Privacy Act protected information are therefore categorized no lower than IT-II. IT Levels are determined by the requiring activity’s Command Information System Security Manager (ISSM)/Information Assurance Manager (IAM).

Contractor employees requiring privileged or IT-I level access, (when specified by the terms of the contract) require a Single Scope Background Investigation (SSBI) or T5 or T5R equivalent investigation, which is a higher level investigation than the National Agency Check with Law and Credit (NACLC)/T3/T3R described below. Due to the privileged system access, an investigation suitable for High Risk national security positions is required. Individuals who have access to system control, monitoring, or administration functions (e.g. system administrator, database administrator) require training and certification to Information Assurance Technical Level 1, and must be trained and certified on the Operating System or Computing Environment they are required to maintain.

Access to sensitive IT systems is contingent upon a favorably adjudicated background investigation. When access to IT systems is required for performance of the contractor employee’s duties, such employees shall in-process with the Navy Command’s Security Manager and Information System Security Manager (ISSM)/Information Assurance Manager (IAM) upon arrival to the Navy command and shall out-process prior to their departure at the completion of the individual’s performance under the contract. Completion and approval of a System Authorization Access Request Navy (SAAR-N) form is required for all individuals accessing Navy Information Technology resources. The decision to authorize access to a government IT system/network is inherently governmental. The contractor supervisor is not authorized to sign the SAAR-N; therefore, the government employee with knowledge of the system/network access required or the COR shall sign the SAAR-N as the “supervisor”.

The SAAR-N shall be forwarded to the Command’s Security Manager at least 30 days prior to the individual’s start date. Failure to provide the required documentation at least 30 days prior to the individual’s start date may result in delaying the individual’s start date.

When required to maintain access to required IT systems or networks, the contractor shall ensure that all employees requiring access complete annual Cyber Awareness) training, and maintain a current requisite background investigation. The Contractor’s Security Representative shall contact the Command Security Manager for guidance when reinvestigations are required.

INTERIM ACCESS

The Command's Security Manager may authorize issuance of a DoD CAC and interim access to a DoN or DoD unclassified computer/network upon a favorable review of the investigative questionnaire and advance favorable fingerprint results. When the results of the investigation are received and a favorable determination is not made, the contractor employee working on the contract under interim access will be denied access to the computer network and this denial will not relieve the contractor of his/her responsibility to perform.

DENIAL OR TERMINATION OF ACCESS

The potential consequences of any requirement under this text including denial or termination of physical or system access in no way relieves the contractor from the requirement to execute performance under the contract within the timeframes specified in the contract. Contractors shall plan ahead in processing their employees and subcontractor employees. The contractor shall insert this text in all subcontracts when the subcontractor is permitted to have unclassified access to a federally controlled facility, federally-controlled information system/network and/or to government information, meaning information not authorized for public release.

CONTRACTOR’S SECURITY REPRESENTATIVE

The contractor shall designate an employee to serve as the Contractor’s Security Representative.

Within three work days after contract award, the contractor shall provide to the requiring activity’s Security Manager and the Contracting Officer, in writing, the name, title, address and phone number for the Contractor’s Security Representative. The Contractor’s Security Representative shall be the primary point of contact on any security matter. The Contractor’s Security Representative shall not be replaced or removed without prior notice to the Contracting Officer and Command Security Manager.

BACKGROUND INVESTIGATION REQUIREMENTS AND SECURITY APPROVAL

PROCESS FOR CONTRACTORS ASSIGNED TO NATIONAL SECURITY POSITIONS

OR PERFORMING SENSITIVE DUTIES Navy security policy requires that all positions be given a sensitivity value based on level of risk factors to ensure appropriate protective measures are applied. Contractor employees under this contract are recognized as Non-Critical Sensitive [ADP/IT-II] positions when the contract scope of work require physical access to a federally controlled base, facility or activity and/or requiring access to a DoD computer/network, to perform unclassified sensitive duties. This designation is also applied to contractor employees who access Privacy Act and Protected Health Information (PHI), provide support associated with fiduciary duties, or perform duties that have been identified as National Security Positions. At a minimum, each contractor employee must be a US citizen and have a favorably completed NACLC or T3 or T3R equivalent investigation to obtain a favorable determination for assignment to a non-critical sensitive or IT-II position. The investigation consists of a standard NAC and a FBI fingerprint check plus law enforcement checks and credit check. Each contractor employee filling a non-critical sensitive or IT-II position is required to complete:

•SF-86 Questionnaire for National Security Positions (or equivalent OPM investigative product) •Two FD-258 Applicant Fingerprint Cards (or an electronic fingerprint submission) •Original Signed Release Statements

Failure to provide the required documentation at least 30 days prior to the individual’s start date shall result in delaying the individual’s start date. Background investigations shall be reinitiated as required to ensure investigations remain current (not older than 10 years) throughout the contract performance period. The Contractor’s Security Representative shall contact the Command Security Manager for guidance when reinvestigations are required.

Regardless of their duties or IT access requirements ALL contractor employees shall in-process with the Command’s Security Manager upon arrival to the command and shall out-process prior to their departure at the completion of the individual’s performance under the contract.

Employees requiring IT access shall also check-in and check-out with the Navy Command’s Information Systems Security Manager (ISSM)/Information Assurance Manager (IAM)Manager.

Completion and approval of a System Authorization Access Request Navy (SAAR-N) form is required for all individuals accessing Navy Information Technology resources. The SAAR-N shall be forwarded to the Navy Command’s Security Manager at least 30 days prior to the individual’s start date. Failure to provide the required documentation at least 30 days prior to the individual’s start date shall result in delaying the individual’s start date.

The contractor shall ensure that each contract employee requiring access to IT systems or networks complete annual Cyber Awareness training, and maintain a current requisite background investigation. Contractor employees shall accurately complete the required investigative forms prior to submission to the Command Security Manager. The Command’s Security Manager will review the submitted documentation for completeness prior to submitting it to the Office of Personnel Management (OPM); Potential suitability or security issues identified may render the contractor employee ineligible for the assignment. An unfavorable determination is final (subject to SF-86 appeal procedures) and such a determination does not relieve the contractor from meeting any contractual obligation under the contract. The Command’s Security Manager will forward the required forms to OPM for processing. Once the investigation is complete, the results will be forwarded by OPM to the DoD Central Adjudication Facility (CAF) for a determination.

If the contractor employee already possesses a current favorably adjudicated investigation, the contractor shall submit a Visit Authorization Request (VAR) via the Joint Personnel Adjudication System (JPAS) or a hard copy VAR directly from the contractor’s Security Representative. Although the contractor will take JPAS “Owning” role over the contractor employee, the Navy Command will take JPAS "Servicing" role over the contractor employee during the hiring process and for the duration of assignment under that contract. The contractor shall include the IT Position Category per SECNAV M-5510.30 for each employee designated on a VAR. The VAR requires annual renewal for the duration of the employee’s performance under the contract.

BACKGROUND INVESTIGATION REQUIREMENTS AND SECURITY APPROVAL

PROCESS FOR CONTRACTORS ASSIGNED TO OR PERFORMING NON-

SENSITIVE DUTIES

Contractor employee whose work is unclassified and non-sensitive (e.g., performing certain duties such as lawn maintenance, vendor services, etc. ...) and who require physical access to publicly accessible areas to perform those duties shall meet the following minimum requirements:

• Must be either a US citizen or a US permanent resident with a minimum of 3 years legal residency in the United States (as required by The Deputy Secretary of Defense DTM 08-006 or its subsequent DoD instruction) and

• Must have a favorably completed National Agency Check with Written Inquiries (NACI) or T1 investigation equivalent including a FBI fingerprint check prior to installation access.

To be considered for a favorable trustworthiness determination, the Contractor’s Security Representative must submit for all employees each of the following:

• SF-85 Questionnaire for Non-Sensitive Positions

• Two FD-258 Applicant Fingerprint Cards (or an electronic fingerprint submission)

• Original Signed Release Statements

The contractor shall ensure each individual employee has a current favorably completed National Agency Check with Written Inquiries (NACI) or T1 equivalent investigation, or ensure successful FBI fingerprint results have been gained and investigation has been processed with

OPM

Failure to provide the required documentation at least 30 days prior to the individual’s start date may result in delaying the individual’s start date.

* Consult with your Command Security Manager and Information Systems Security Manager (ISSM)/Information Assurance Manager (IAM) for local policy when IT-III (non-sensitive) access is required for non-US citizens outside the United States.

DoD 8570.01-M Information Assurance Workforce Improvement Program.

_____ No Additional IA Certification Required

____X_ Information Assurance DoD 8570.01-M Required:

IA Certification Level: If additional IA Cert is required, it will be detailed at the task order level.

DoD Directive 8570.1 of 15 Aug 2004, Information Assurance Training, Certification, and Workforce Management DoD 8570.01- Manual of 19 December 2005, IA Workforce Improvement Program SECNAV Instruction 5239.3B of 17 June 2009, DON Information Assurance Policy SECNAV Manual-5239.2 of 29 May 2009, DON Information Assurance Workforce Management Manual to Support the Information Assurance Workforce Improvement Program

Computing Environment Certification: If Comp Environment Certification is required, it will be detailed at the task order level.

Privileged system access may be required; it will be detailed at the task order level.

The Contractor shall ensure that personnel accessing information systems have the proper and current information assurance certification to perform information assurance functions in accordance with DoD 8570.01-M, Information Assurance Workforce Improvement Program.

The Contractor shall meet the applicable information assurance certification requirements, including-

(1) DoD-approved information assurance workforce certifications appropriate for each category and level as listed in the current version of DoD 8570.01-M.

(2) Appropriate operating system certification for information assurance technical positions as required by DoD 8570.01-M.

(a) Upon request by the Government, the Contractor shall provide documentation supporting the information assurance certification status of personnel performing information assurance functions.

(b) Contractor personnel who do not have proper and current certifications shall be denied access to DoD information systems for the purpose of performing information assurance functions.

Proof of the above indicated IA baseline certification is to be provided for all contractor personnel prior to time of engagement. In addition to the IA certificate, active enrollment and participation in the certification maintenance program must be established prior to contract award to ensure the appropriate access can be secured by contractor resources.

All required IA baseline certifications must be current at the contract period start date;

there is no “grace” period to obtain these certifications. Computing environment certification must be current no later than six (6) months after start. Questions and additional information requirements may be addressed by contacting the NAVSUP Business Systems Center Information System Security Manager (ISSM).

Certification shall be forwarded to:

Jacquelin Jamison, Code 94

NAVSUP Business Systems Center ISSM

5450 Carlisle Pike, Bldg. 409

Mechanicsburg, PA 17055

Email: Jacquelin.jamison@navy.mil

11.0 Government Furnished Equipment / Information / Materials

Work is expected to be performed at the government site or offsite, depending on the task order. Contractor is authorized to use government network, computers, copiers, and other equipment assigned in government facilities as needed. The government will provide work facilities to the on-site contractor. The government will provide computer hardware and software required and access to local telephones with voicemail and long distance access when the contractor is acting on behalf of the government at the government site. The government will provide all equipment, tools and servers used to maintain software and host these applications. If the contractor is supporting off-site, the government will provide GFE computers for access to government systems (if needed). Equipment usage forms will be filled out and kept on file for all GFE.

12.0 Qualifications/Experience

In response to task order requirement, the contractor shall provide individuals with the experience and qualifications defined in the task order PWS.

13.0 Non-Disclosure Agreement

Contractor and subcontractor employees performing work under this task order are required to sign a Non-Disclosure Agreement (NDA) as part of their onboarding process. The contractor shall maintain copies of all signed agreements and have the documents readily available at the COR’s request. Refer to DFARS 252.204-7000, Disclosure of Information, and DFARS 252.204-7003, Control of Government Personnel Work Product.

14.0 Other Requirements

Section 508 Compliance

Section 508 of the Rehabilitation Act requires Federal agencies to make their electronic and information technology accessible to people with disabilities. This applies to all Federal agencies when they develop, procure, maintain, or use electronic and information technology.

All electronic and information technology (EIT) procured through this task order must meet the applicable accessibility standards specified in 36 CFR 1194.2, unless an agency exception to this requirement exists. Any agency exceptions applicable to this task order are listed below.

The standards define Electronic and Information Technology, in part, as “any equipment or interconnected system or subsystem of equipment, that is used in the creation, conversion, or duplication of data or information.” The standards define the type of technology covered and set forth provisions that establish a minimum level of accessibility. The application section of the standards (1194.2) outlines the scope and coverage of the standards. The standards cover the full range of electronic and information technologies in the Federal sector, including those used for communication, duplication, computing, storage, presentation, control transport and production. This includes computers, software, networks, peripherals and other types of electronic office equipment.

Privacy Act

During performance of this order, the contractor may have access to Privacy Act data. Should this occur, the contractor shall safeguard all privacy information, and ensure this data is accessed and maintained in accordance with applicable laws and regulations. If access occurs, FAR 52.224-1 and 52.224-2 apply.

Key Personnel

Under this contract, the Contractor may be required to provide Key Personnel, defined as those individuals who contribute to the development or execution of a project in a substantive measurable way. In all task orders that require Key Personnel, the contractor shall notify the Contracting Officer and COR in writing prior to making any change in personnel identified as key for the duration of the task order PWS. Notification will occur no less than 14 days prior to such change. If substitutions are to be made, the contractor shall demonstrate that the qualifications of the prospective person(s) are at least equal to the person(s) replaced.

The Government reserves the right to request substitute contractor support personnel due to unsatisfactory performance, insufficient knowledge, or inadequate skill levels necessary to complete assigned task.

Wide Area Workflow

Invoices for materials/services rendered under this PWS shall be submitted electronically through Wide Area Workflow (WAWF) in accordance with the WAWF Routing Table listed in the contract. The invoices shall be submitted monthly unless the contract specifies differently. The WAWF website is https://wawf.eb.mil.

Enterprise-wide Contractor Manpower Reporting Application (ECMRA)

The contractor shall report ALL contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract for ECMF via a secure data collection site.

The contractor is required to completely fill in all required data fields using the following web address https://doncmra.nmci.navy.mil. Reporting inputs will be for the labor executed during the period of performance during each Government fiscal year (FY), which runs October 1 through September 30. While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year. Contractors may direct questions to the help desk, linked at https://doncmra.nmci.navy.mil.

15.0 NAVSUP Business Systems Center Procedures for Contractor

Access/Visit Authorization Request (VAR):

1. A company letter to the Technical Assistant (TA) containing the following information:

a. Contract Information

(1) Contract Number

(2) Date Issued

(3) Date of Expiration

(4) Name and phone number of the Technical Assistant

(5) Purpose

(6) Systems to be accessed

(7) Files/Data required

(8) Type of access required (i.e., inquiry/update/delete)

(9) Equipment to be used with location and mode of access identified

(10) Security point of contact including address and phone number

b. Information for all contractor employees requesting access, to include:

(1) Full Name

(2) Job Title

(3) Date of Birth

(4) Place of Birth

(5) Citizenship

(6) Social Security Number

(7) Naturalization Number (if applicable)

(8) Type and date of Security Investigation.

(9) Government Clearance Level (if applicable)

(10) Valid email address for the Contractor’s employee

c. Appropriate Company Official's signature

2. A System Authorization Access Request Navy (SAAR-N) form (OPNAV 5239/14) with original signatures and a copy of the DOD Annual IA Awareness Training Completion Certificate for each contractor employee sent to the Technical Assistant (TA).

15.1 Common Access Card (CAC)

The Government Contractor CAC card serves as the primary method of identification for the contractor employees, as well as providing the basis of Public Key Infrastructure (PKI) access to the Navy/ Marine Corps Intranet (NMCI), and numerous Navy web sites, which may also require PKI access. Navy Information Assurance (IA) policies require that a background investigation be completed on each contractor prior to granting access to government computer systems. In the event that the investigation has been initiated, but not completed, an Advanced Fingerprint Check must be successfully accomplished prior to the issuance of an interim CAC card. The final CAC cannot be issued until the full investigation has been completed.

15.2 Return of CAC cards

In the event that contract employees resign, are dismissed, or laid off, the contractor is responsible for obtaining any Government issued identification from the former employee and to turn over those items to TA or COR within five (5) days of the termination of employment.

15.0…