N0018919QZ220_N0018919QZ220_PWS.docx

Performance Work Statement for Training Support for the Center for Information Warfare Training

Work under this performance-based contract shall be performed in accordance with the following description/ specifications/statement of work (SOW) which herein shall be referred to as Performance Work Statement (PWS):

1.0 PURPOSE

1.1 BACKGROUND

The Center for Information Warfare Training (CIWT) exists to provide the fleet with optimally trained sea and joint force warriors who will create a tactical advantage for mission success in the information domain. CIWT’s mission is to deliver trained information warfare professionals to the Navy and joint services, enabling optimal performance of information warfare across the full spectrum of military operations.

1.2 SCOPE

This performance-based task encompasses Training Support for CIWT Training Directorate, Technical Support, and Delivery of Learning and Performance Solutions for WFTD. During the period of performance, status reporting, financial reporting, and personnel assignment of Training Specialists/Subject Matter Experts (SME) shall be closely coordinated with the Contracting Officer’s Representative (COR).

2.0 APPLICABLE DOCUMENTS (AND DEFINITIONS)

All work shall be accomplished using the best commercial practices and current acceptable industry standards. In accordance with Defense Acquisition Policy changes, maximum utilization of non-government standards will be made wherever practical. Where backward compatibility with existing systems is required, selected interoperability standards will be invoked. For purposes of proposing, the following documents are not exclusive; however, all contractors shall be able to meet those cited when applicable to the contract.

2.1 REQUIRED DOCUMENTS

The following instructional documents are mandatory for use. Unless otherwise specified, the document’s effective date of issue is the date on the request for proposal.

Document Number and Title

a. CIWTINST 1553.2A – Learning Standards Office Handbook

b. DoD 5220.22-M DoD Manual – National Industrial Security Program Operating Manual (NISPOM)

c. DoDI 5220.22 DoD Instruction – National Industrial Security Program

d. DoDM 5200.02 DoD Manual – Procedures for the DoD Personnel Security Program (PSP)

e. DoDI 8500.01 DoD Instruction – Cybersecurity

f. DoDI 8510.01 Risk Management Framework (RMF) for DoD Information Technology (IT)

g. SECNAVINST 5239.20A – DoN Cyberspace Information Technology and Cyberspace Workforce Management and Qualification

h. SECNAVINST 5510.30B DoN Regulation – Personnel Security Program

i. NIST SP 800-Series National Institute of Standards and Technology Special Publications 800 Series

– Computer Security Policies, Procedures, and Guidelines

j. DoDD 8140.01 – Cyberspace Workforce Management

k. DoD 8570.01-M – Information Assurance Workforce Improvement Program

l. DoDD 5205.02E DoD Directive – Operations Security (OPSEC) Program

m. DoD 5205.02 DoD Manual – DoD Operations Security (OPSEC) Program Manual

2.2 GUIDANCE DOCUMENTS

The following documents are to be used as guidance. Unless otherwise specified, the document’s effective date of issue is the date on the request for quotations.

Document Number and Title:

a. CIWTINST 1553.2A Learning Standards Office Handbook, July, 31 2018

b. HPSD-12 Homeland Security Presidential Directive – Policy for a Common Identification Standard for Federal Employees and Contractors, August 27, 2004

c. DoDI 1000.13 Instruction – Identification (ID) Cards for Members of the Uniformed Services, Their Dependents, and Other Eligible Individuals (Change 1 dtd 14 Dec 2017)

d. FIPS PUB 201-2 Federal Information Processing Standards Publication 201-2 – Personal Identity Verification (PIV) of Federal Employees and Contractors, August 2013

e. Form I-9, OMB No. 1615-0047 – Employment Eligibility Verification

2.3 SOURCE OF DOCUMENTS

The contractor shall obtain all applicable documents. Specifications and commercial/industrial documents may be obtained from the following sources:

Copies of Federal Specifications may be obtained from General Services Administration Offices in Washington, DC, Seattle, San Francisco, Denver, Kansas City, MO., Chicago, Atlanta, New York, Boston, Dallas and Los Angeles.

Copies of military specifications may be obtained from the Commanding Officer, Naval Supply Depot, 3801 Tabor Avenue, Philadelphia, PA 19120-5099. Application for copies of other Military Documents should be addressed to Commanding Officer, Naval Publications and Forms Center, 5801 Tabor Ave., Philadelphia, PA 19120-5099.

All other commercial and industrial documents can be obtained through the respective organization’s website.

2.4 ACRONYMS

ANA - Advanced Network Analysis ADNS - Automated Digital Network System CANES - Consolidated Afloat Networks and Enterprise Services CeTARS - Corporate Enterprise and Training Activity Resource System CIWT - Center for Information Warfare Training E2E - Network E2E Advanced Analyst Course EHF - Extremely High Frequency FoS - Family of Systems FTE - Full Time Employees HF - High Frequency ICMC - Information and Communications Managers Course ISNS - Integrated Shipboard Network Systems ISSM - Information Systems Security Manager IWTC - Information Warfare Training Command IWTS - Information Warfare Training Site JCC - Journeyman Communications Course NSVT - Network Security Vulnerability Technician NTCSS - Navy Tactical Command Support System SHF - Super High Frequency SME - Subject Matter Expert TRR - Training Requirements Review UHF - Ultra High Frequency

3.0 PERFORMANCE REQUIREMENTS

3.1 RELEVANT EXPERIENCE

3.1.1 Program Management - The contractor shall work closely with the COR manager and when applicable provide support at the requiring Command. The contractor shall provide SMEs with at least seven (7) years of experience supporting systems listed in para 3.2.

3.1.2 Program Support - Some programs shall require a contractor to work closely with the COR and support the needs of the program at the sponsor level. As directed in delivery order, coordination of meetings, preparing budget drills, developing agenda items, attending high-level meetings, generating minutes, and tracking action items may be required. Other support may require a contractor to recommend policies, doctrine, tactics, and procedures at the Federal, State, and Local level given their past experience or using analysis of actual outcomes.

3.1.3 Program Support Documentation

The contractor shall draft and/or develop various program management (PM) documents (CDRL A001). At a minimum, the following documents are typical PM Deliverables that the contractor shall have knowledge writing:

- Meeting Agenda and Minutes – Provide Agenda the day before and Minutes the day after the Meeting

- Plans of Action and Milestone – Provide 10 days after contract award

3.2 TRAINING DELIVERY AND SUPPORT

The contractor shall provide qualified training specialists and SMEs with formal instructor training with at least seven (7) years relevant experience and formal military training on systems they are tasked to deliver training on. Course Curriculum, Reference Material, and Scheduling documentation will be provided by CIWT. Training will be taught in Government-provided facilities on Government equipment at each location. The contractor shall submit CIWT Course Completion Reports (CDRL A002) 5 days after completion. The contractor shall also provide technical support associated with the delivery of training courses; this work consists of course unique support including, but not limited to, the following: performing IAVA updates; providing maintenance, to include baselining the system back to normal in terms of software and non-faulted circuit boards as required; reviewing curriculum materials as SMEs on the covered equipment and systems; classroom setup; normalizing classrooms upon completion of each training session; entering trouble tickets as needed to report technical training equipment issues. SMEs shall be on-site in a full-time capacity to execute these training support functions. (Historically, with the exception of the SMEs for the ICMC courses, all instructors have been FTE.)

Specific courses to be taught include:

a. AN/USQ-144 K(V)2 - AUTOMATED DIGITAL NETWORKING SYSTEM (ADNS)

b. AN/USQ-153D - INTEGRATED SHIPBOARD NETWORK SYSTEM (ISNS)

c. AN/USQ-185A - COMBINED ENTERPRISE REGIONAL INFORMATION EXCHANGE

SYSTEM-MARITIME MULTI ENCLAVE (CENTRIXS-MME)

d. ADVANCED NETWORK ANALYST (ANA)

e. NETWORK E2E ADVANCED ANALYST

f. NETWORK SECURITY VULNERABILITY TECHNICIAN (NSVT)

g. INFORMATION SYSTEMS SECURITY MANAGER (ISSM)

h. JOURNEYMAN COMMUNICATIONS COURSE (MRTS 3D):

(1) Major Systems: AN/USQ-144H(V)4; AN/URT-23E; AN/WSC-3(V)7, 9, 11, 15; R-2368; AN/USQ-145(V); AN/URC-61(C); AN/USQ-195(V)1 BFTN; AN/USR-10(V)4,5 GBS;

AN/USC-38(V)9 EHF FOT; TD-1271 DAMA; C-12509D (TIP); AN/WSC-9(V)2 NMT; AN/USC-69(V)2,3 CBSP;

(2) Supporting Systems:

Switching/Patching: SA-2112(V)3, SB-4124, SB-3332, SB-4267, SA-2000, AN/USQ-155(V) Multiplexing/Modem: MD-1324A, CV-3510, FCC-100(V)9, MD-1366 A/U, SLM-5650 Couplers: OA-9123, AN/SRA-56/57/58, AN/URA-38, AN/SRA-49 Cryptographic: KY-58, KG-84A, KG-84C, KYV-5, KIV-7M, KG-175, KGV-136; AN/CYZ-10, AN/PYQ-10 Audio: C-10276, TA-970, AM-3729, LS-474/U, CV-3510, C-10316 Test Equipment: FIREBERD 6000, PSA-65C Spectrum Analyzer; TDS3000B Oscilloscope

i. AN/USQ-208(V) - CONSOLIDATED AFLOAT NETWORKS AND ENTERPRISE SERVICES (CANES)

SYSTEM ADMINISTRATOR/MAINTAINER

(Instr. Days)

** Location has Secret Facility

Table 1. Course details

3.2.1 Course material required for the students, both hardcopy student guides.

776958

Table 2. Course material

3.2.2 Information and Communication Manager Course (ICMC) procurement In support of Sea Power 21, Force Net objectives, CIWT exists to deliver the right training, at the right time, in the right place, utilizing technology, innovation, and science of learning. ICMC instructors should have 10-15 years of experience in the following areas:

- Fleet Network Systems Architecture/Defense Information System Network (DISN)

- Local Area Network Protocols and Network Devices (TCP/IP)

- Expeditionary Communications Systems

- Combat and Cyber Systems

- Operational and Tactical Command and Control Systems

- Information Assurance/Computer Network Defense/Information System Security ISS Incident Response and Management

- Knowledge Management (KM)

- Operational Risk Management

- Satellite Communications/Terrestrial Architecture

- Spectrum Management/Space and Orbits

- Radio Frequency (RF) Communications

- Message Systems and Organizational Messages

(Instr. Days)

** Location has Secret Facility Table 3. ICMC course details

3.3 CIWT N7 STAFF SUPPORT

3.3.1 The contractor shall provide a SME with at least ten (10) years of system experience for JCC course content development and JCC course management at CIWT Pensacola. The contractor shall attend JCC pilot course reviews at IWTC San Diego, CA and IWTC Virginia Beach, VA and the JCC TRR (Training Requirements Review) at IWTC Virginia Beach. CeTARS account required for this position. Travel not to exceed that listed in paragraph 13.1.

3.3.2 The contractor shall provide a SME with at least ten (10) years of experience supporting systems listed in para 3.2 for Waterfront training course management and scheduling at IWTC Virginia Beach. The contractor shall attend waterfront training reviews at IWTC San Diego and CIWT Pensacola, FL. CeTARS account required for this position. Travel not to exceed that listed in paragraph 13.1.

3.4 INFORMATION ASSURANCE

Information Assurance (IA) includes tasks which the contractor shall protect and defend information and information systems by ensuring their availability, integrity, authentication, confidentiality, and non-repudiation. This includes providing for restoration of information systems by incorporating protection, detection, and reaction capabilities.

3.4.1 Information Assurance Training and Certification

In accordance with DFAR clause 252.239-7001 and DoDD 8140.01, contractor personnel performing IA functions shall meet all information assurance (IA) training, certification, and tracking requirements as cited in DoD 8570.01-M and the revised – DoD 8140, prior to accessing DoD information systems. Personnel tracking information, which includes subcontractor personnel, shall be included in the monthly contract status report (CDRL A003). Training and certification can be obtained at http://iase.disa.mil/eta/cyberchallenge/launchPage.htm

3.4.2 Design Changes

Any equipment/system installed or integrated into Navy platform shall meet the IA requirements as specified under DoDI 8500.01.

3.4.3 Training Specialist must have DOD Cyber IT/CSWF Certifications for the following courses.

JCC (HF/UHF, SHF ,EHF) MRTS 3D

IWTC San Diego, CA

Not Applicable

Security+, Network+

4.0 CONTRACT ADMINISTRATION

Contract Administration is required for all contracts; it provides the government a means for contract management and monitoring. Regardless of the level of support, the ultimate objective of the contractor is ensuring the government’s requirements are met, delivered on schedule, and performed within budget.

4.1 CONTRACT LIAISON

The contractor shall assign a technical single point of contact, also known as the Program Manager (PM) who shall work closely with the government Contracting Officer and COR, as applicable. The contractor PM, located in the contractor’s facility, shall ultimately be responsible for ensuring that the contractor’s performance meets all government contracting requirements within schedule. PM shall have the requisite authority for full control over all company resources necessary for contract performance. Responsibilities shall also include, but not be limited to, the following: personnel management; management of government material and assets; and personnel and facility security. In support of open communication, the contractor PM shall initiate periodic meetings with the COR.

4.2 CONTRACT MONITORING AND MAINTENANCE

The contractor shall have processes established to provide all necessary resources and documentation during various times throughout the day. To address urgent requirements, the contractor shall have processes established during business and non-business hours/days to provide all necessary documentation and resources.

4.2.1 Contract Administration Documentation

Various types of contract administration documents are required throughout the life of the contract. At a minimum, the contractor shall provide the following documentation, unless otherwise specified:

4.2.1.1 Contract Status Report (CSR) and Contract Funds Status Report (CFSR) Contract Status Reports (CDRL A003 and CDRL A005) shall be developed and submitted monthly at least 30 days after contract award on the 10th day of each month. The prime shall be responsible for collecting, integrating, and reporting all subcontractor reports. The contract status reports shall be provided to the COR via email, and as per DD1423; see DD1423 for additional reporting details.

(a) Monthly CSR – A monthly status report shall be provided to the COR and government Project Engineer, as applicable. Commencing one full month after the contract award date, CSR status reports shall be submitted no later than the 10th day of each month. The monthly status report shall, as a minimum, include the following items and data:

1. Percentage of work completed

2. Percentage of funds expended per ship/sub/shore command and system

3. Updates to the POA&M and narratives to explain any variances

4. If applicable, notification when obligated costs have exceeded 75% of the amount authorized

(b) Monthly CFSR – A monthly financial status report shall be provided to the COR. Commencing one full month after the contract award date, CFSR status reports shall be submitted no later than the 10th day of each month.

4.2.1.2 WAWF Invoicing Notification and Support Documentation In accordance with contract clause 252.232-7003 and 252.232-7006, the contractor shall submit payment requests and receiving reports using Wide Area Work Flow (WAWF) which is a secure government Web-based system for electronic invoicing, receipt, and acceptance. The contractor shall provide e-mail notification to the COR when payment requests are submitted to the WAWF. As requested by the COR, the contractor shall provide a soft copy (CDRL A004) of the invoice and any supporting documentation in order to assist the COR in validating the invoiced amount against the products/services provided during the billing cycle.

5.0 QUALITY ASSURANCE

5.1 QUALITY ASSURANCE SYSTEM

Upon contract award, the prime contractor shall have and maintain a quality assurance process that meets contract requirements and program objectives while ensuring customer satisfaction and defect-free products/process. The quality system shall be documented and contain procedures, planning, and all other documentation and data necessary to provide an efficient and effective quality system based on a contractor’s internal auditing system. Thirty (30) days after contract award, the Contractor shall provide to the government a copy of their Quality Assurance (QA) plan (CDRL A006). The quality system shall be made available to the government for review at both a program and worksite services level during predetermined visits. Existing quality documents that meet the requirements of this contract may continue to be used. The Contractor shall also require all subcontractors to possess a quality assurance and control program commensurate with the services and supplies to be provided as determined by the prime’s internal audit system. The Government reserves the right to disapprove the contractor’s and/or subcontractor’s quality system or portions thereof when the quality system(s) fails to meet contractual requirements at either the program or worksite services level. The Government reserves the right to participate in the process improvement elements of the contractor’s quality assurance plan as needed. At a minimum, the contractor’s quality system shall meet the following key criteria:

- Establish capable processes

- Monitor and control critical product and process variations

- Establish mechanisms for feedback of field product performance

- Implement and effective root-cause analysis and corrective action system

- Establish procedures for continuous process improvement

5.2 QUALITY MANAGEMENT PROCESS COMPLIANCE

5.2.1 General

The contractor shall have processes in place that shall coincide with the government’s quality management processes. As required, the contractor shall use best industry practices including, when applicable, ISO/IEC 15288 for System life cycle processes and ISO/IEC 12207 for Software life cycle processes. The contractor shall provide technical program and project management support that will mitigate the risks to successful program execution.

5.3 QUALITY CONTROL

Unless otherwise directed, the Contractor is responsible for all quality control inspections necessary in the performance of the various tasks as assigned and identified by the respective WBS, POA&M or procedural quality system document. The Government reserves the right to perform any inspections deemed necessary to assure that the Contractor provided services, documents, and material meet the prescribed requirements and to reject any or all services, documents, and material in a category when nonconformance is established.

6.0 DOCUMENTATION AND DELIVERABLES

6.1 CONTRACT DATA REQUIREMENT LISTINGS (CDRLs)

The following CDRL listing identifies the data item deliverables required under this contract and the applicable section of the PWS for which they are required. Section J includes the DD Form 1423s that itemize each CDRL required under the basic contract. The contractor shall establish a practical and cost-effective system for developing and tracking the required CDRLs generated under each task.

6.2 ELECTRONIC FORMAT

At a minimum, the Contractor shall provide deliverables electronically by email; hard copies are only required if requested by the government. To ensure information compatibility, the contractor shall guarantee all deliverables (i.e., CDRLs), data, correspondence, and etc., are provided in a format approved by the receiving government representative. All data shall be provided in an editable format compatible with standard software configuration as specified below.

- Deliverable Software to be used:

a. Word Processing Microsoft Word

b. Technical Publishing PageMaker/Interleaf/SGML/ MS Publisher

c. Spreadsheet/Graphics Microsoft Excel

d. Presentations Microsoft PowerPoint

e. Scheduling Microsoft Project

6.3 INFORMATION SYSTEM

6.3.1 Electronic Communication

The contractor shall have broadband Internet connectivity and an industry standard email system for communication with the government. The contractor shall be capable of Public Key Infrastructure client side authentication to DoD private web servers. Unless otherwise specified, all key personnel on contract shall be accessible by email through individual accounts during all working hours.

7.0 SECURITY

7.1 ORGANIZATION

7.1.1 Classification

As specified in clause 5252.204-9200, classified work shall be performed under this contract. The contractor shall have at the time of Contract Award and prior to commencement of classified work, a SECRET facility security clearance (FCL). Clearance is required to access and handle classified and personal personnel material, attend program meetings, and/or work within restricted areas unescorted.

7.1.2 Security Officer

The contractor shall appoint a Security Officer to support those contractor personnel requiring access to government facility/installation and/or access to information technology systems under this contract. The Security Officer shall be responsible for tracking the security requirements for all personnel (subcontractors included) utilized on contract. Responsibilities include entering and updating the personnel security related and mandatory training information within the Staffing Plan document, which is part of the DD Form 1423 Contract Data Requirements List, Contract Status Report (CDRL A003) – applicable Staffing Plan sheets include: Security Personnel Tracking sheet, CAC Badge Tracking sheet, Mandatory Training Sheet, and CSWF Personnel sheet.

7.2 PERSONNEL

The contractor shall conform to the security provisions of DoD 5220.22M – National Industrial Security Program Operating Manual (NISPOM), SECNAVINST 5510.30B, DoD-8570.01M/DoD-8140, and the Privacy Act of 1974. Prior to any labor hours being charged on contract, the Contractor shall ensure their personnel possess and can maintain security clearances at the appropriate level(s) ), and are certified/credentialed for the Cyberspace Information Technology and Cybersecurity Workforce, as applicable. At a minimum, the contractor shall validate that the background information provided by their employees charged under this contract is correct, and the employee shall hold a minimum of a trustworthy determination. Cost to meet these security requirements is not directly chargeable to delivery order.

NOTE: If a final determination is made that an individual does not meet the minimum standard for a Position of Trust (SF 85P) (National Agency Check with Inquires (NACI) or Moderate Risk Background Investigation (MBI)), then the individual shall be permanently removed from CIWT facilities, projects, and/or programs. If an individual who has been submitted for a security clearance is "denied" for a clearance or receives an "Interim Declination" that individual shall be removed from CIWT facilities, projects, and/or programs until such time as the investigation is fully adjudicated or the individual is resubmitted and is approved. All contractor and subcontractor personnel removed from facilities, projects, and/or programs shall cease charging labor hours directly or indirectly on task and contract.

7.2.1 Personnel Clearance

All Training Specialist/SME/PM associated with this contract shall possess a SECRET clearance as these programs/tasks include, as a minimum, contractor personnel having the appropriate clearances required for access to classified data as required. (See DD Form 254 - Department of Defense Contract Security Classification Specification.) Prior to starting work on the task, contractor personnel shall have the required clearance granted by the Defense Industrial Security Clearance Office (DISCO) and shall comply with IT access authorization requirements. In addition, contractor personnel shall possess the appropriate IT level of access for the respective task and position assignment as required by DoDI 8500.01, Cybersecurity. Any future revision to the respective directive and instruction shall be applied to the DO level as required. Contractor personnel shall handle and safeguard any unclassified but sensitive and classified information in accordance with appropriate Department of Defense security regulations. Any security violation shall be reported immediately to the COR.

7.2.2 Access Control of Contractor Personnel

7.2.2.1 Physical Access to Government Facilities and Installations Contractor personnel shall physically access government facilities and installations for purposes of site visitation, supervisory and quality evaluation, work performed within government spaces (either temporary or permanent), or meeting attendance. Individuals supporting these efforts shall comply with the latest security regulations applicable to the government facility/installation.

(a) The majority of government facilities require contractor personnel to have an approved visit request on file at the facility/installation security office prior to access. The Contractor shall initiate and submit a request for visit authorization to the COR in accordance with DoD Manual 5220.22-M (NISPOM) not later than one (1) week prior to visit – timeframes may vary at each facility/installation. For visitation to all govt. locations, visit request documentation shall be forwarded directly to the on-site facility/installation security office (to be identified at delivery order level) via approval by the COR.

(b) Depending on the facility/installation regulations, contractor personnel shall present a proper form of identification(s) and vehicle proof of insurance or vehicle rental agreement.

(c) All contractor persons engaged in work while on Government property shall be subject to inspection of their vehicles at any time by the Government, and shall report any known or suspected security violations to the Security Department at that location

7.2.2.2 Identification and Disclosure Requirements

As required in DFARS 211.106, Contractors shall take all means necessary to not represent themselves as government employees. All Contractor personnel shall follow the identification and disclosure requirement as specified in clause 5252.237-9602

7.2.2.3 Government Badge Requirements

As specified in contract clause 5252.204-9202, some contract personnel shall require a government issued picture badge. While on government installations/facilities, contractors shall abide by each site’s security badge requirements. Various government installations are continually updating their security requirements to meet Homeland Security Presidential Directive (HSPD-12) identification standards. Contractors are responsible for obtaining and complying with the latest security identification requirements for their personnel as required. Contractors shall submit valid paper work (e.g., site visit request, request for picture badge, and/or SF85P for CAC) to the applicable government security office via the contract COR. The contractor’s appointed Security Officer, which is required in clause 5252.204-9200, shall track all personnel holding local government badges at contract or DO level.

7.2.2.4 Personnel Check-in and Check-out Procedures

All CIWT contractor personnel requiring or possessing a government badge and/or CAC for facility and/or IT access shall be in compliance with the most current revision of Check-in and Check-out Procedures for Contractors applicable to the facility cited in the contract. At contract award throughout contract completion, the contractor shall provide necessary employee information and documentation for employees hired, transferred, and/or terminated in support of this contract within the required timeframe as cited in the Check-in and Check-out instructions. Contractor’s Security Officer shall ensure all contractor employees whose services are no longer required on contract return all applicable government documents/badges to the appropriate government representative.

7.2.3 IT Position Categories

In accordance with DoDI 8500.01, SECNAVINST 5510.30B, DoD 8140.01 and applicable to unclassified DoD information systems, a designator shall be assigned to certain individuals that indicates the level of IT access required to execute the responsibilities of the position based on the potential for an individual assigned to the position to adversely impact DoD missions or functions. As defined in DoDM 5200.02 and SECNAVINST 5510.30B, the IT Position categories include:

IT-I (Privileged) IT-II (Limited Privileged) IT-III (Non-Privileged) Investigative requirements for each category vary, depending on the role and whether the individual is a U.S. civilian contractor or a foreign national. The Contractor PM shall assist the COR in determining the appropriate IT Position Category assignment for all contractor personnel. All required Single-Scope Background Investigation (SSBI), SSBI Periodic Reinvestigation (SSBI-PR), and National Agency Check (NAC) adjudication shall be performed in accordance with DoDI 8500.01 and SECNAVINST 5510.30B. IT Position Categories shall be determined based on the following criteria:

7.2.3.1 IT-I Level (Privileged) - Positions in which the incumbent is responsible for the planning, direction, and implementation of a computer security program; major responsibility for the direction, planning and design of a computer system, including the hardware and software; or, can access a system during the operation or maintenance in such a way, and with a relatively high risk for causing grave damage, or realize a significant personal gain. Personnel whose duties meet the criteria for IT-I Position designation require a favorably adjudicated SSBI or SSBI-PR. The SSBI or SSBI-PR shall be updated a minimum of every 5 years.

7.2.3.2 IT-II Level (Limited Privileged) - Positions in which the incumbent is responsible for the-direction, planning, design, operation, or maintenance of a computer system, and whose work is technically reviewed by a higher authority at the IT-II Position level to insure the integrity of the system. Personnel whose duties meet the criteria for an IT-II Position require a favorably adjudicated NAC.

7.2.3.3 IT-III Level (Non-privileged) - All other positions involved in computer activities. Incumbent in this position has non-privileged access to one or more DoD information systems/applications or database to which they are authorized access. Personnel whose duties meet the criteria for an IT-III Position designation require a favorably adjudicated NAC.

7.2.4 Security Training

Regardless of the contract security level required, the contractor shall be responsible for verifying applicable personnel (including subcontractors) receive all required training. At a minimum, the contractor’s designated Security Officer shall track the following information: security clearance information dates possessing Common Access Cards, issued & expired dates for SSC Atlantic Badge, Information Assurance (IA) training, Privacy Act training, and Cyberspace IT and Cyber Security Workforce (Cyber IT/CSWF) certifications, etc. The contractor shall educate employees on the procedures for the handling and production of classified material and documents, and other security measures as described in the PWS in accordance with DoD 5220.22-M.

7.2.5 Disclosure of Information

Contractor employees shall not discuss or disclose any information provided to them in the performance of their duties to parties other than authorized Government and contractor personnel who have a "need to know". Any information or documentation developed by the contractor under direction of the government shall not be used for other purposes without the consent of the government.

7.3 OPERATIONS SECURITY (OPSEC) REQUIREMENTS

Security programs are oriented towards protection of classified information and material. Operations Security (OPSEC) is an operations function which involves the protection of any critical information – focusing on unclassified information that may be susceptible to adversary exploitation. As directed in DoDD 5205.02E OPSEC program implements requirements in DoD 5205.02 – OPSEC Program Manual. Note: OPSEC requirements are applicable when contract personnel have access to classified information or unclassified Critical Program Information (CPI)/sensitive information.

7.3.1 Local and Internal OPSEC Requirement

Contractor personnel, including subcontractors if applicable, shall adhere to the OPSEC program policies and practices and existing local site OPSEC procedures. The contractor shall development their own internal OPSEC program specific to the contract.

7.3.2 OPSEC Training

Contractor shall track and ensure applicable personnel receive initial and annual OPSEC awareness training. Training may be provided by the government or a contractor’s OPSEC Manager and shall, as a minimum, cover OPSEC as it relates to contract work, discuss the Critical Information applicable in the contract, and review OPSEC requirements if working at a government facility. Any training materials developed by the contractor shall be reviewed by the CIWT OPSEC Officer, who will ensure it is consistent with CIWT OPSEC policies. OPSEC training requirements are applicable for personnel during their entire term supporting CIWT contracts.

7.3.3 CIWT OPSEC Program

Contractor shall participate in CIWT OPSEC program briefings and working meetings as required. As required, contractor shall complete any OPSEC survey or data call within the timeframe specified.

7.3.4 Classified Contracts

OPSEC requirements identified under a classified contract shall have specific OPSEC requirements listed on the DD Form 254

7.4 DATA HANDLING AND USER CONTROLS

7.4.1 Data Handling

At a minimum, the contractor shall handle all data received or generated under this contract as For Official Use Only (FOUO) material. Any classified information received or generated shall be handled in accordance with the attached DD Form 254 and in shall be in compliance with all applicable PWS references and to other applicable Government policies and procedures that include DoD/Navy/CIWT.

7.4.2 Effective Use of Controls

The contractor shall screen all electronic deliverables or electronically provided information for malicious code using DoD approved anti-virus software prior to delivery to the Government. The contractor shall utilize appropriate controls (firewalls, password protection, encryption, digital certificates, etc.) at all times to protect contract related information processed, stored or transmitted on the contractor’s and Government’s computers/servers to ensure confidentiality, integrity, availability, authentication and non-repudiation. This includes ensuring that provisions are in place that will safeguard all aspects of information operations pertaining to this contract in compliance with all applicable PWS references. Encryption/digital signing of communications is required for authentication and non-repudiation.

7.5 OTHER REQUIREMENTS

7.5.1 Enterprise-wide Contractor Manpower Reporting Application (ECMRA) In accordance with NMCARS 5237.102-90 “Enterprise-wide Contractor Manpower Reporting Application (ECMRA)”, the contractor shall report contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract. Contracted services excluded from reporting are based on Product Service Codes (PSCs). The excluded PSCs are:

(1) W, Lease/Rental of Equipment;

(2) X, Lease/Rental of Facilities;

(3) Y, Construction of Structures and Facilities;

(4) S, Utilities ONLY;

(5) V, Freight and Shipping ONLY.

The contractor is required to completely fill in all required data fields using the following web address https://www.ecmra.mil.

Reporting inputs will be for the labor executed during the period of performance during each Government (FY), which runs October 1 through September 30. While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year. Contractors may direct questions to the help desk, linked at https://www.ecmra.mil.

7.5.2 Contractor Unclassified Access to Federally Controlled Facilities, Sensitive Information, Information Technology (IT) Systems or Protected Health Information Homeland Security Presidential Directive (HSPD)-12, requires government agencies to develop and implement Federal security standards for Federal employees and contractors. The Deputy Secretary of Defense Directive-Type Memorandum (DTM) 08-006 – “DoD Implementation of Homeland Security Presidential Directive – 12 (HSPD-12)” dated November 26, 2008 (or its subsequent DoD instruction), directs implementation of HSPD-12. This clause is in accordance with HSPD-12 and its implementing directives.

(a) Applicability: This clause applies to contractor employees requiring physical access to any area of a federally controlled base, facility or activity and/or requiring access to a DoD computer/network/system to perform certain unclassified sensitive duties. This clause also applies to contractor employees who access Privacy Act and Protected Health Information, provide support associated with fiduciary duties, or perform duties that have been identified by DOD as National Security Position, as advised by the command security manager. It is the responsibility of the responsible security officer of the command/facility where the work is performed to ensure compliance.

Each contractor employee providing services at a Navy Command under this contract is required to obtain a Department of Defense Common Access Card (DoD CAC). Additionally, depending on the level of computer/network access, the contract employee will require a successful investigation as detailed below.

(b) Access to Federal Facilities: Per HSPD-12 and implementing guidance, all contractor employees working at a federally controlled base, facility or activity under this clause will require a DoD CAC. When access to a base, facility or activity is required contractor employees shall in-process with the Navy Command’s Security Manager upon arrival to the Navy Command and shall out-process prior to their departure at the completion of the individual’s performance under the contract.

(c) Access to DoD IT Systems: In accordance with SECNAV M-5510.30, contractor employees who require access to DoD networks are categorized as IT-I, IT-II, or IT-III. The IT-II level, defined in detail in SECNAV M-5510.30, includes positions which require access to information protected under the Privacy Act, to include Protected Health Information (PHI). All contractor employees under this contract who require access to Privacy Act protected information are therefore categorized no lower than IT-II. IT Levels are determined by the requiring activity’s Command Information Assurance Manager. Contractor employees requiring privileged or IT-I level access, (when specified by the terms of the contract) require a Single Scope Background Investigation (SSBI) which is a higher level investigation than the National Agency Check with Law and Credit (NACLC) described below. Due to the privileged system access, a SSBI suitable for High Risk public trusts positions is required. Individuals who have access to system control, monitoring, or administration functions (e.g., system administrator, database administrator) require training and certification to Information Assurance Technical Level 1, and must be trained and certified on the Operating System or Computing Environment they are required to maintain.

Access to sensitive IT systems is contingent upon a favorably adjudicated background investigation. When access to IT systems is required for performance of the contractor employee’s duties, such employees shall in-process with the Navy Command’s Security Manager and Information Assurance Manager upon arrival to the Navy command and shall out-process prior to their departure at the completion of the individual’s performance under the contract. Completion and approval of a System Authorization Access Request Navy (SAAR-N) form is required for all individuals accessing Navy Information Technology resources. The decision to authorize access to a government IT system/network is inherently governmental. The contractor supervisor is not authorized to sign the SAAR-N; therefore, the government employee with knowledge of the system/network access required or the COR shall sign the SAAR-N as the “supervisor”.

The SAAR-N shall be forwarded to the Navy Command’s Security Manager at least 30 days prior to the individual’s start date. Failure to provide the required documentation at least 30 days prior to the individual’s start date may result in delaying the individual’s start date.

When required to maintain access to required IT systems or networks, the contractor shall ensure that all employees requiring access complete annual Information Assurance (IA) training, and maintain a current requisite background investigation. The Contractor’s Security Representative shall contact the Command Security Manager for guidance when reinvestigations are required.

(d) Interim Access: The Navy Command's Security Manager may authorize issuance of a DoD CAC and interim access to a DoD unclassified computer/network upon a favorable review of the investigative questionnaire and advance favorable fingerprint results. When the results of the investigation are received and a favorable determination is not made, the contractor employee working on the contract under interim access will be denied access to the computer network and this denial will not relieve the contractor of his/her responsibility to perform.

(e) Denial or Termination of Access: The potential consequences of any requirement under this clause including denial or termination of physical or system access in no way relieves the contractor from the requirement to execute performance under the contract within the timeframes specified in the contract. Contractors shall plan ahead in processing their employees and subcontractor employees. The contractor shall insert this clause in all subcontracts when the subcontractor is permitted to have unclassified access to a federally controlled facility, federally-controlled information system/network and/or to government information, meaning information not authorized for public release.

(f) Contractor’s Security Representative: The contractor shall designate an employee to serve as the Contractor’s Security Representative. Within three work days after contract award, the contractor shall provide to the requiring activity’s Security Manager and the Contracting Officer, in writing, the name, title, address and phone number for the Contractor’s Security Representative. The Contractor’s Security Representative shall be the primary point of contact on any security matter. The Contractor’s Security Representative shall not be replaced or removed without prior notice to the Contracting Officer and Command Security Manager.

(g) Background Investigation Requirements and Security Approval Process for Contractors Assigned to National Security Positions or Performing Sensitive Duties: Navy security policy requires that all positions be given a sensitivity value based on level of risk factors to ensure appropriate protective measures are applied. Navy recognizes contractor employees under this contract as Non-Critical Sensitive [IT-II] when the contract scope of work requires physical access to a federally controlled base, facility or activity and/or requiring access to a DoD computer/network, to perform unclassified sensitive duties. This designation is also applied to contractor employees who access Privacy Act and Protected Health Information (PHI), provide support associated with fiduciary duties, or perform duties that have been identified by DoD as National Security Positions. At a minimum, each contractor employee must be a US citizen and have a favorably completed NACLC to obtain a favorable determination for assignment to a non-critical sensitive or IT-II position. The NACLC consists of a standard NAC and a FBI fingerprint check plus law enforcement checks and credit check. Each contractor employee filling a non-critical sensitive or IT-II position is required to complete:

- SF-86 Questionnaire for National Security Positions (or equivalent OPM investigative product)

- Two FD-258 Applicant Fingerprint Cards (or an electronic fingerprint submission)

- Original Signed Release Statements Failure to provide the required documentation at least 30 days prior to the individual’s start date shall result in delaying the individual’s start date. Background investigations shall be reinitiated as required to ensure investigations remain current (not older than 10 years) throughout the contract performance period. The Contractor’s Security Representative shall contact the Command Security Manager for guidance when reinvestigations are required.

Regardless of their duties or IT access requirements ALL contractor employees shall in-process with the Navy Command’s Security Manager upon arrival to the Navy command and shall out-process prior to their departure at the completion of the individual’s performance under the contract. Employees requiring IT access shall also check-in and check-out with the Navy Command’s Information Assurance Manager. Completion and approval of a System Authorization Access Request Navy (SAAR-N) form is required for all individuals accessing Navy Information Technology resources. The SAAR-N shall be forwarded to the Navy Command’s Security Manager at least 30 days prior to the individual’s start date. Failure to provide the required documentation at least 30 days prior to the individual’s start date shall result in delaying the individual’s start date.

The contractor shall ensure that each contract employee requiring access to IT systems or networks complete annual Information Assurance (IA) training, and maintain a current requisite background investigation. Contractor employees shall accurately complete the required investigative forms prior to submission to the Navy Command Security Manager. The Navy Command’s Security Manager will review the submitted documentation for completeness prior to submitting it to the Office of Personnel Management (OPM). Suitability/security issues identified by the Navy may render the contractor employee ineligible for the assignment. An unfavorable determination made by the Navy is final (subject to SF-86 appeal procedures) and such a determination does not relieve the contractor from meeting any contractual obligation under the contract. The Navy Command’s Security Manager will forward the required forms to OPM for processing. Once the investigation is complete, the results will be forwarded by OPM to the DOD Central Adjudication Facility (CAF) for a determination.

If the contractor employee already possesses a current favorably adjudicated investigation, the contractor shall submit a Visit Authorization Request (VAR) via the Joint Personnel Adjudication System (JPAS) or a hard copy VAR directly from the contractor’s Security Representative. Although the contractor will take JPAS “Owning” role over the contractor employee, the Navy Command will take JPAS "Servicing" role over the contractor employee during the hiring process and for the duration of assignment under that contract. The contractor shall include the IT Position Category per SECNAV M-5510.30 for each employee designated on a VAR. The VAR requires annual renewal for the duration of the employee’s performance under the contract.

(h) Background Investigation Requirements and Security Approval Process for Contractors Assigned to or Performing Non-Sensitive Duties: Contractor employee whose work is unclassified and non-sensitive (e.g., performing certain duties such as lawn…