1.20 b Drafted DEFENSIVE CYBER OPERATIONS PWS.pdf

Performance Work Statement (PWS)

Defensive Cyber Operations Support

For Navy Cyber Defense Operations Command

SCOPE OF WORK:

The CONTRACTOR shall provide 24/7 support of Defensive Cyber Operations. This includes Information Systems

Security Engineering (ISSE), Host Based Security System (HBSS), and Risk Management Framework (RMF) support and similar services in support of mission tasking.

PERIOD OF PERFORMANCE:

The period of performance for this contracting action is 30 September 2024 through 29 September 2025, with provisions for two (2) additional option years.

PLACE OF PERFORMANCE:

Work performed in accordance with this PWS shall be at: Navy Cyber Defense Operations Command (NCDOC), 112

Lake View Parkway, Suffolk, VA 23435.

The CONTRACTOR will not perform work at any other location unless the Contracting Officer’s Representative (COR) has authorized that work in writing.

SECURITY REQUIREMENTS:

SECURITY: The CONTRACTOR shall be responsible for adhering to all Department of Defense (DOD), Department of the Navy (DON) and Command instructions, guidance, orders, directives, and supplements relative to performing tasks set forth in this PWS. The CONTRACTOR shall not disclose and must safeguard procurement sensitive information, computer systems and data, Privacy Act data, and Government personnel work products that are obtained or generated in the performance of this contract. This includes dissemination of protocols and papers not generally available through the public literature. Neither the CONTRACTOR nor any of its contract service providers shall disclose or cause to disseminate any information concerning operations of military activities. Such action(s) could result in violation of the contract and possible legal actions.

Access will be granted to Government facilities as required in support of the tasking. CONTRACTOR personnel performing work under this contract must meet all requirements for gaining access to US Government installations. The

CONTRACTOR shall conform to all DoD, DON, and local (base/installation) security instructions; refer to

CONTRACTOR Unclassified Access to Federally Controlled Facilities, Sensitive Information, Information Technology

(IT) Systems or Protected Health Information.

The scope of work requires access to GENSER/SECRET information for all CONTRACTOR personnel, and TOP

SECRET/SENSITIVE COMPARTMENTED (TS/SCI) access for specified personnel. CONTRACTOR personnel shall have the appropriate security clearance as of the first day of the period of performance. Where annotated, GENSER

SECRET clearance must adhere to T-3 criteria. GENSER/SECRET is required for any position where system access has the potential of requiring special privileges, including system administration and configuration changes, are expected.

Interim SECRET based upon T-3 criteria is acceptable pending final adjudication; TS//SCI clearances must be “final”

TS//SCI e.g. completely adjudicated upon first day of employment.

All work is to be performed in accordance with DOD and Navy Operations Security (OPSEC) requirements and in accordance with the DD254 and all attachments.

The CONTRACTOR shall comply with all applicable federal, state and local laws and ensure performance is secure while protecting material, equipment, and supplies from damage and loss. Government security personnel shall have the express right to inspect for security violations at any time during the term of the contract.

The CONTRACTOR shall be responsible for safeguarding all government equipment, information and property provided for CONTRACTOR use. At the close of each work period, government facilities, equipment and materials shall be secured.

The Government CONTRACTOR Common Access Card (CAC) card serves as the primary method of identification for the CONTRACTOR employees, as well as providing the basis of Public Key Infrastructure (PKI) access to the

Navy/Marine Corps Intranet (NMCI), the NCDOC Excepted network, and numerous Navy web sites, which may also require PKI access. The COR shall assist in providing the CONTRACTOR the appropriate documentation for obtaining

CACs. The CONTRACTOR shall be responsible for obtaining any Government issued identification cards from former employees or employees whose access has been terminated and to turn those items over to the COR upon termination of employment or access.

Contract personnel shall wear a badge that clearly identifies them as a CONTRACTOR employee. The badge will be issued by the COR, via the Special Security Office (SSO), and will contain a personal picture, name of employee, and

CONTRACTOR's name. Badges shall be worn on the outer garment, above the waist, in full view at all times, attached to the outer shirt or jacket pocket by a button or clip or worn around the neck secured by an appropriate identification card lanyard.

PRIVACY ACT COMPLIANCE: The CONTRACTORs may be in contact with data and information subject to the

Privacy Act of 1974 (Title 5 of the U.S. Code Section 552a). The CONTRACTORs shall ensure that its employees assigned to this effort understand and adhere to the requirements of the Privacy Act and to Department of Defense and

Department of the Navy regulations that implement the Privacy Act. Department of Navy policy and procedures implementing the Privacy Act are detailed in SECNAVINST 5211.5E (Department of the Navy (DON) Privacy Act (PA)

Program). The CONTRACTORs shall identify and safeguard data, information and reports accordingly. In addition, the

CONTRACTOR shall ensure that CONTRACTOR employees assigned to the contract are trained on properly identifying and handling data and information subject to the Privacy Act prior to commencing work.

GOVERNMENT FURNISHED INFORMATION (GFI): GFI will be provided to CONTRACTOR employees as needed to complete the tasks set forth in this performance work statement. Access to classified information must be granted in accordance with the terms and conditions contained in DOD Manual 5220.22-M and DD Form 254 (Contract Security

Classification Specification). The CONTRACTOR shall comply with all current information assurance awareness, information security policies, procedures, and statutes applicable to DOD information technology; including DOD

Instruction 8500.01 on Cyber Security.

DODD 8140.X SERIES CYBER SECURITY WORKFORCE (CSWF) REQUIREMENTS:

The CONTRACTOR shall ensure employees have all required certifications/licenses (current and valid) for each applicable occupation category before commencement of work. CONTRACTOR must meet this qualification upon first day of employment.

Procedures surrounding the qualification of the DON Cyberspace IT/Cybersecurity Workforce must be in accordance with

(current at time of award) DoD Directive 8140.X series most recent revision. The SECNAV M-5239.2 establishes mandatory procedures for the uniform identification, management, and qualification of the Cyberspace IT/Cybersecurity

Workforce (Cyber IT/CSWF). All Cyber IT/CSWF personnel must meet and maintain the minimum qualification standards of their assigned Specialty Area and proficiency level. DON has identified appropriate training, education, and industry certification requirements along with proficiency demonstration in the lab or on the job. These individuals are required to carry an approved certification for their particular job classification.

Any full or part-time CONTRACTOR, with privileged access to a DoD information system, performing Cyber Security

(information assurance) functions, regardless of job or occupational series, must meet the requirements associated with the

CSWF specialty area outlined in the position description to maintain employment as part of this contracting effort.

Additionally, all CONTRACTORs must participate in a continuous learning program as described in SECNAVINST

1543.2. A minimum of 40 hours of Cyber IT/CSWF related continuous learning must be annually documented and available to NCDOC’s CSWF Program Manager and/or COR. Additionally, all CONTRACTORs must provide proof that required annual maintenance fees are paid within seven (7) days of the due date, as stated in the NCDOCINST 1500.1

(Series).

All reporting CONTRACTORs must meet the requirement for their position immediately upon arrival.

GENERAL/ADMINISTRATIVE MATTERS:

The CONTRACTOR shall only conduct business with designated government personnel listed as points of contact

(POCs). Names of authorized personnel shall be provided to the CONTRACTOR by the government COR, in writing, and updated as necessary throughout the contract period.

All inquiries, comments or complaints arising from any matter observed, experienced, or learned of as a result of, or in connection with the performance of this contract, the resolution of which may require the dissemination of official information, shall be directed to the COR. The COR will forward inquiries, comments or complaints to the Contracting

Officer (KO).

STAFFING: The CONTRACTOR shall provide a fully qualified work force on the first day of contract performance.

All contract personnel attending meetings, answering Government telephones, and working in other situations where their

CONTRACTOR status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. They must also ensure that all documents or reports produced by CONTRACTORs are suitably marked as CONTRACTOR products or that

CONTRACTOR participation is appropriately disclosed. Additionally, they must clearly indicate on email title blocks their company name and that they are CONTRACTOR personnel.

All positions are defined to fulfill tasking based on working hours. For the purpose of this PWS, Full-Time Employee

(FTE) is defined as 1920 of billable work hours per calendar year.

U.S. Government records, copies of original results and reports, verified original data, corrected data, and corrected supporting final reports are maintained by the CONTRACTOR, but remain the property of the U.S. Government. These files/results must be surrendered to the COR immediately upon demand.

CONTRACTOR QUALITY ASSURANCE: The CONTRACTOR shall develop and maintain a Quality Assurance Plan

(QA Plan) in order to ensure only qualified personnel, as defined in the position descriptions, are assigned to fulfill the requirements stated in this PWS. The CONTRACTOR shall detail in its quality assurance plan how it intends to maintain personnel qualifications and ensure contract employees have up-to-date training and knowledge in their respective areas of endeavor.

This QA Plan shall detail the methodology to be used by the CONTRACTOR to monitor and grade the performance of its personnel as they carry out the requirements of this PWS. The QA Plan shall address the CONTRACTOR’s courses of action to address under-performing employees.

GOVERNMENT QUALITY ASSURANCE SURVEILLANCE: The Government shall evaluate the CONTRACTOR’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan is primarily focused on what the Government must do in order to ensure that the CONTRACTOR is performing in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

COMPLAINTS LODGED AGAINST CONTRACTOR PERSONNEL: In the event that a complaint is made regarding the conduct or ability of CONTRACTOR personnel, the individual receiving the complaint will contact the COR. The

COR will notify the CONTRACTOR. The Contract Overarching Project Manager and COR will cooperate in investigating complaints made against CONTRACTOR employees. If the results of the investigation prove the complaint(s) to be valid, the CONTRACTOR shall have a maximum of three (3) working days to propose a corrective plan for resolving the matter and preventing future similar occurrences. This plan shall be submitted in writing to the

Contracting Officer and COR. In the event that the Government deems the corrective plan insufficient for resolution of the problem, a written response to the CONTRACTOR shall be provided within three (3) working days.

OFFICE SPACE: Government will provide office space, desk, chair, and common office supplies. In addition to office space, each contract employees shall be provided with access to government computers and telephones, but not cellular phones, for official use only. Under no circumstances will CONTRACTOR-provided personal computers will be connected to either the Navy/Marine Corps Intranet (NMCI), the NCDOC Excepted network or any other DOD network.

CONTRACTOR personnel shall comply with all DOD and Navy internet usage and cybersecurity policies.

STATEMENT OF NON-PERSONAL SERVICE: CONTRACTOR employees performing services under this contract will be controlled, directed, and supervised at all times by management personnel of the CONTRACTOR. CONTRACTOR management shall ensure that employees properly comply with the performance work standards outlined in the PWS.

CONTRACTOR employees shall perform their duties independent of, and without the supervision of, any Government official. The tasks, duties, and responsibilities set forth in this contract shall not be interpreted or implemented in any manner that results in any CONTRACTOR employee creating or modifying Federal policy, obligating the appropriated funds of the United States Government, overseeing the work of Federal employees, providing direct personal services to any Federal employee, or otherwise violating the prohibitions set forth in Parts 7.5 and 37.1 of the Federal Acquisition

Regulation (FAR) https://www.acquisition.gov/browse/index/far The Government shall control access to the facilities and shall perform the inspection and acceptance of completed work.

MANDATORY TRAINING: Government has annual training requirements for the safety and security of personnel and data that will be required to be completed by all assigned CONTRACTORs. This training is will be provided by

Government personnel, either in person or via computer, for completion during normal working hours. The COR will provide the annual required training list to the Company Program Manager on an annual basis, and completion will be tracked by NCDOC Training Department.

SUPPORT SERVICES/QUALIFICATIONS/DUTIES

Support listed in the Scope of Work above will be provided via fulfillment of the following positions:

Position

Number

Labor Category Level of

Effort

Number of FTEs

Position 1 System Administrator (ISSE) 3840 hours 2

Position 2 HBSS Support System Administrator 3840 hours 2

Position 3 HBSS System Administrator 3840 hours 2

Position 4 Risk Management Framework Specialist 5760 hours 3

1.) System Administrator-ISSE (SME II): (Clearance requirement is GENSER/SECRET). This position has been designated as a Cyber IT/Cybersecurity Workforce position in Specialty Area 45 and as a condition of employment incumbents of the position is required to comply with the DON Cyber IT/CSWF Program requirements of SECNAV

M-5239.2. Administers server-based systems, security devices, distributed applications, network storage, and performs systems monitoring. Consults on network, application, and customer service issues to support computer systems’ security and availability. CONTRACTOR will administer physical and virtual Linux servers running Red

Hat Enterprise Linux (RHEL) and SUSE Linux Enterprise Server (SLES).

QUALIFICATIONS REQUIRED:

• 7 - 10 years of experience as Linux System Administrator on systems running RHEL and SLES in an enterprise level environment.

• 3 years’ experience working with RMF based Information Security Systems Engineer (ISSE) documentation.

• Familiar with VMware vSphere.

• Proficient in the application of Secure Technical Implementation Guides (STIG) on Linux-based systems.

• ACAS/Tenable security suite experience.

• Proficiency in shell scripting.

• Familiar with enterprise backup software and administration.

• Familiar with enterprise storage administration and concepts.

• Ability to work in team setting, as well as independently.

https://www.acquisition.gov/browse/index/far

• Self-starter: identify issues and create action plan for resolution.

• Demonstrated initiative, flexibility and ability to concurrently manage multiple deadline-driven tasks and projects.

• Excellent communication skills.

REQUIRED DUTIES:

• Provide Subject Matter Expert level support for Linux system administration on RHEL and SLES.

• Maintain systems patches.

• Maintain systems security posture.

• Implement STIGs.

• Review ACAS/Tenable security scans and remediate vulnerabilities as required.

• Improve system administration productivity by authoring/updating relevant shell scripts.

• Provide timely reports on projects status and other systems administration work, as required.

*** Required level of effort is a System Administration SME II 3840 HRS:

TWO (2) FTE - DAY SHIFT (07:00 AM/0700 - 3:30 PM/1530) working position (Monday – Friday)

2.) HBSS Support System Administrator (SME I): (Clearance requirement is GENSER/SECRET). This position has been designated as a Cyber IT/Cybersecurity Workforce position in Specialty Area 45 and as a condition of employment incumbents of the position is required to comply with the DON Cyber IT/CSWF Program requirements of SECNAV M-5239.2. CONTRACTOR will Install, configure, troubleshoot, and maintain Navy Assured

Compliance Assessment System (ACAS) collection system server and systems configurations (hardware and software) to ensure confidentiality, integrity, and availability Administers server-based systems, security devices, distributed applications, network storage, messaging, and performs systems monitoring. Consults on network, application, and customer service issues to support computer systems’ security and sustainability. The

CONTRACTOR shall facilitate delivery of HBSS SME tracking / artifacts / documentation to the HBSS Overarching

Project Management / Team Lead or his / her designated representative.

QUALIFICATIONS REQUIRED:

• 7 years IT experience

• 2+ years previous helpdesk experience

• Knowledge and experience in working with the McAfee Host Intrusion Prevention System

• Knowledge and experience in working with McAfee Data Loss Prevention Endpoint products

• McAfee HBSS ePO administration

• Microsoft Structured Query Language (SQL) server working knowledge

• Ability to work independently

• Organizational skills

• Escalate issues/problems to support solution development

• Report compliance status IAW Navy mandates, and management direction

• Manage ticketing system

• Monitor/Analyze ePO rollup event feeds and respond/report IAW approved Navy TTPs/SOPs

• Monitor/ Analyze ePO rollup asset feeds and respond/report IAW approved Navy TTPs/SOPs

• Knowledge and experience in working with McAfee Data Loss Prevention Endpoint products

• Troubleshoot HBSS product issues and outages

• Review of HBSS threat events

*** Required level of effort is 2 x HBSS Support Administrators SME I 3840 HRS:

ONE (1) FTE - DAY SHIFT (07:00 AM/0700 - 3:30 PM/1530) working position (Monday – Friday)

ONE (1) FTE - EVE SHIFT (3:30 PM/1530 – 12:00 AM/12:00) working position (Monday – Friday)

3.) HBSS System Administrator (SME II): (Clearance requirement is GENSER/SECRET). This position has been designated as a Cyber IT/Cybersecurity Workforce position in Specialty Area 45 and as a condition of employment incumbents of the position is required to comply with the DON Cyber IT/CSWF Program requirements of SECNAV

M-5239.2. CONTRACTOR will Install, configure, troubleshoot, and maintain Navy Assured Compliance

Assessment System (ACAS) collection system server and systems configurations (hardware and software) to ensure confidentiality, integrity, and availability. Administers server-based systems, security devices, distributed applications, network storage, messaging, and performs systems monitoring. Consults on network, application, and customer service issues to support computer systems’ security and sustainability. The CONTRACTOR shall facilitate delivery of HBSS SME tracking / artifacts / documentation to the HBSS Overarching Project Management /

Team Lead or his / her designated representative.

• 10 years IT experience

• 7+ years administrating servers

• 3+ years administrating ePO or Certified McAfee Security Specialist (CMSS) certification in one of the following areas: McAfee ePolicy Orchestrator; McAfee Host Intrusion Prevention System

• Knowledge and experience in working with the McAfee Host Intrusion Prevention System

• Knowledge and experience in working with McAfee Data Loss Prevention Endpoint products

• Solid understanding of Microsoft operating systems and networking

• Knowledge and experience in working with Firewalls desired

• Knowledge and experience in working with Intrusion Detection and Prevention Systems (IDPS) desired

• Host Intrusion Prevention System (HIPS) signature development experience desired

• Ability to work independently and in a mentorship position

• Organizational skills

• Understanding of Linux/Unix operating systems

• Troubleshoot HBSS product server issues and outages

• Administer policy catalog management

• Coordinate ASI details and planning as needed

• Maintain system patches

• Maintain O/S, SQL, and HBSS STIG compliance

• Develop, test, monitor and work with HBSS Support Admins on internal TTPs/SOPs

• Resolve ePO server (O/S, ePO, or SQL) issues

• Maintain the ePO server (automated tasks, task scheduler, database maintenance tasks, etc.)

*** Required level of effort is 2 x HBSS System Administrators SME II 3840 HRS:

ONE (1) FTE - DAY SHIFT (07:00 AM/0700 - 3:30 PM/1530) working position (Monday – Friday)

ONE (1) FTE - EVE SHIFT (3:30 PM/1530 – 12:00 AM/12:00) working position (Monday – Friday)

4.) Risk Management Framework Specialist (SME II): (Clearance requirement is TS//SCI) This position has been designated as a Cyber IT/Cybersecurity Workforce position in Specialty Area 74 and as a condition of employment incumbents of the position is required to comply with the DON Cyber IT/CSWF Program requirements of SECNAV

M-5239.2. This position will provide project management, detailed subject matter expertise, and expert guidance to government personnel in the execution of Command-wide Cybersecurity. Managing cybersecurity, certification and accreditation and configuration change boards of all NCDOC Classified and Unclassified networks.

• Certified Information Systems Security Professional (CISSP) certification.

• 1-3 years of experience with Assured Compliance Assessment System (ACAS) and/or Nessus.

• 5-10 years Certification and Accreditation (C&A) package assembly experience

• Risk Management Framework (RMF) training and certification is desired

• Prior appointment as a Fully Qualified Navy Validator is preferred (experience with DOD validation will be considered on a case-by-case basis)

• Creates, reviews, updates, and validate Cybersecurity Standard Operations Procedures (SOPs) as required.

• Reviews and maintains an inventory of authorized software (software custodian)

• Reviews and maintains an inventory of devices and media

• Audits and validates configurations deployed on laptops, workstations, and servers

• Audits and validates configurations of network devices based on DISA STIGs, or defining and implementing compensating controls of such STIGs as required to ensure mission execution.

• Maintain and update all Risk Management Framework (RMF) and C&A documentation to ensure the relevancy and currency of Navy Red Team assets to include required revisions and updates in eMass.

• Conduct comprehensive annual RMF package reviews to ensure continued compliance of the Navy Red Team tool suite and/or Networks.

• Ensure traceability is maintained throughout the RMF submission process (e.g.: C&A Plan, POAM, RAR, Topology, Software, Ports Protocols and Services, Test Plan).

• Maintain network and system documentation in DITPR-DON / DADMS.

• Maintain documentation and registration of Network Ports, Protocols, and Services.

• Maintain circuit registrations in Global Interconnection Approval Process System (GIAP) and Systems/Network

Approval Process (SNAP).

• Maintain and report on the status of all outstanding C&A items and supporting documentation.

• As a member of the Configuration Control Board (CCB), ensures CCB approved changes are timely and accurately reflected in the C&A documentation.

• Support compliance validation of current and future directives (e.g.: IAVs, STIGs, CTOs).

• Provide recommendations for corrective action of any non-compliant security controls.

• Execute DISA STIG validations for systems in conjunction with C&A package reviews annually.

• Provide security expertise to ensure security controls are implemented and the resulting documentation and artifacts are current.

• Prepare reports on scanning results and configuration management observations monthly.

• Document assessment activities and results in sufficient detail to enable external review of all assessment processes, activities, results, and conclusions.

• Conduct and document a semi-annual table top exercise (two times) each calendar year.

• Produce test plans, draft after actions and other documents for review and comment.

• Review and/or revise Business Impact Analysis (BIA) to include business process, IT dependency, and physical security assessments annually.

• Review and analyze IT contingency / disaster recovery plans for NIST and DoN Compliance, and produce checklists for IT systems.

• Assist with exercise and/or training and documentation of IT contingency plan and execution.

*** Required level of effort is 3 x RMF Support SME II 5760 HRS:

THREE (3) FTE – DAY SHIFT (07:30 AM/0730 - 4:00 PM/1600) working position (Monday – Friday)

TRAVEL REQUIREMENTS:

Upon award there is no travel required in support of this task order. If travel becomes a requirement the contract will be modified to include a cost type of travel CLIN. All travel costs incurred will be separately priced and executed in accordance with the Federal Travel Regulations (FTR).

Travel expenses shall be reimbursed on the basis of actual costs in accordance with the Joint Travel Regulations. All travel requests shall be submitted to the COR utilizing the travel authorization request form. All travel shall be approved in advance by the COR.

DELIVERABLES

The Government and the CONTRACTOR shall jointly establish due dates specific to individual work products (ex., drafts of documentation identified in the Scope of Work section, reports, presentations, analysis, etc.). Deliverables shall be prepared in CONTRACTOR’s format where not otherwise specified by the Government. Deliverables shall be provided to the COR. All final deliverable submissions shall remain the property of the U.S. Government. All revisions will be due in the specified timeframe as identified by the Government. All methodologies and recommendations shall be reviewed and approved by the Government prior to submission/implementation.

CONTRACTOR QUALITY ASSURANCE PLAN: Due within 30 days of period of performance start date and updated annually thereafter (refer to General/Administrative Matter Section).

MONTHLY STATUS REPORT: The CONTRACTOR shall provide the COR a monthly In Progress Review (IPR) no later than the 20th day of the month. The IPR shall be a formal review whereby the CONTRACTOR will discuss matters such as project requirements, current and planned project activities, contract personnel status, and problems encountered or anticipated that may impact schedule. The report shall contain the following information at a minimum:

a. Task/project status (include originator/user, personnel assigned to complete, goal/end-state, estimated completion date, percent complete)

b. Personnel issues

c. Upcoming Travel

d. Anticipated activity for next reporting period

SPECIFIC WORK PRODUCTS: The following specific work products are anticipated to be delivered by the

CONTRACTOR to the Government during the base period of performance. This list does not constitute a definitive list of all work products to be delivered.

• In provision of 24/7 support of Network Operations, CONTRACTOR will work with NNWC principles (via the

COR) to plan and execute the migration of Shipboard HBSS accounts, and implement Shipboard ACAS, leveraging the contracting company’s SME personnel. This translates out to the development of Plan(s) of

Actions and Milestones (POAM), and execution of the migration.

• Updates to TTPs/SOPs

• Deployment of System Patches

• Validation of Information Assurance (IA) Controls

MONTHLY FINANCIAL REPORT: The Monthly Financial Report shall be submitted not later than 10 business days after end of the month reported on. The report shall contain the following information at a minimum: Invoices submitted but not paid.

Deliverable Product Format: All reports and documentation will be developed using recent versions of Adobe Acrobat, Microsoft Office Professional Products to include Word, Excel, PowerPoint, etc. unless otherwise specified by the COR.

Electronic submission shall be made via email, unless otherwise agreed upon with the COR. Oral status reports may also be requested periodically.

The COR will have the right to reject or require correction of any deficiencies found in the deliverables that are contrary to the information contained the CONTRACTORs accepted proposal. In the event of a rejected deliverable, the

CONTRACTORs shall be notified in writing by the COR of the specific reasons for rejection. The CONTRACTORs shall have five (5) workdays to correct the rejected deliverable and return it per delivery instructions.

Service Contract Reporting (SCR) (NMCARS 5237.102-90)

Services Contract Reporting (SCR) requirements apply to this contract. The contractor shall report required SCR data fields using the SCR section of the System for Award Management (SAM) at following web address: https://sam.gov/SAM/.

https://sam.gov/SAM/