DRAFT PWS CST_SSM - SSN.docx

UNCLASSIFIED

Performance Work Statement Operational Test and Evaluation Force (OPTEVFOR) CST/SSM Support ISO CA-07 Renovation Bldg. CA-07

1. BACKGROUND

The mission of the Operational Test and Evaluation Force (OPTEVFOR) demands the secure handling of highly sensitive operational testing data, necessitating the construction of a new, state-of-the-art Sensitive Compartmented Information Facility (SCIF). To safeguard the integrity of this facility during its construction and accreditation lifecycle, OPTEVFOR requires a dedicated, specialized workforce of Site Security Managers (SSMs) and Construction Surveillance Technicians (CSTs) to oversee all on-site construction contractors. Under the strict mandates of Intelligence Community Directive (ICD) 705 (Sensitive Compartmented Information Facilities), physical and technical security must be continuously maintained from the breaking of ground through final accreditation to mitigate the threat of clandestine surveillance penetration, technical compromise, or structural vulnerability.

Site Security Manager (SSM) Oversight: The SSM serves as the principal advisor and authority on all construction security matters. The SSM is responsible for executing the Construction Security Plan (CSP), managing the daily access control of personnel and materials, and documenting the entire construction process for the Accrediting Official (AO).

Construction Surveillance Technician (CST) Monitoring: CSTs provide continuous, proactive visual and technical surveillance of all uncleared construction workers, materials, and activities within the SCIF boundary. They actively inspect construction elements, monitor transit and storage of sensitive building materials, and prevent the unauthorized introduction of anomalies or listening devices.

The future renovation of this building’s location will be CONUS in the state of Virginia and hosted by Operational Test and Evaluation Force, located at 7970 Diven Street, Norfolk VA 23505.

U.S. Department of War Special Access Program sponsored renovation projects are subject to overarching and unique program considerations. The infrastructure, equipment, and services being acquired will be critical to ensure that this renovation project complies with the requirements defined in the ICD 705, "Physical and Technical Security Standards for Sensitive Compartmented Information Facilities". In addition, the ICD 705 has several implementing documents to include ICS 705-I, ICS 705-2 and the "IC Technical Specifications for Renovation and Management of Secure areas, IC Tech Spec for ICD/ICS 705," dated 26 July 2021.

2. OBJECTIVE

The objective of this requirement is to provide renovation site security services to support secure renovation projects in accordance with (IAW) the Intelligence Community Directive (ICD) 705, Department of War (DOW) and DONSAPCO policies. Historically complying with the above may require the provision of a TS/SCI eligible Site Security Manager (SSM), two (2) TS SCI eligible Construction Surveillance Technicians (CST), and Pre-Renovation Services for Design Review to provide renovation security surveillance services for the individual project. Each of these positions will be to support renovation schedules and activities.

References Applicable to this requirement:

a. ICD/ICS 705 Series/Volumes: https://www.dni.gov/files/NCSC/documents/Regulations/IC_Technical_Specifications_for_Construction_and_Management_of_Sensitive_Compartmented_Information_Facilities_v151_PDF.pdf

b. DODM 5205.7 Vol. 1-3” Special Access Program Manual” https://securityawareness.dcsa.mil/cdse/multimedia/shorts/sap-sec-incident/common/scenarios/industry_day/common/files/resources/5205.pdf

c. DODD 5205.07 “Special Access Program Policy https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodd/520507p.pdf

d. Committee on National Security Systems Advisory Memorandum (CNSSAM) TEMPEST/01-13, RED/BLACK Installation Guidance. (Electronic (UNCLASS) copy available upon request, not available online).

e. Fixed Facility Checklist, provided as Attachment 1

f. TEMPEST Checklist, provided as Attachment 2

g. OPTEVFOR Test and Evaluation Force Construction Security Plan (CSP) Dated 06 March 2025: Electronic (UNCLASS) provided as Attachment 3

3. SCOPE

The Contractor shall provide the personnel, management, materials, equipment, prerequisite safety and security training, and facilities (not otherwise provided by the Government) necessary to perform the objectives of this performance work statement. These efforts will be performed at the location directly behind the main building OPTEVFOR (CA-10) at 7970 Diven Street, Norfolk a 23505-1498. The government will provide the contractor with the means to document/record renovation activities electronically.

4. PERIOD AND PLACE OF PERFORMANCE

PERIOD: The period of performance for this requirement will be for one (1) twelve-month base period, one (1) twelve-month option period, and one (1) six-month option period to be exercised at the discretion of the Government in accordance with FAR Clause 52.217-8.

PLACE: The primary place of performance shall be on-site Project Building (CA-07) located behind CA-10 Main Building at 7970 Diven Street, Norfolk VA 23505-1498, USA.

*Wage Determination 2015-4341 Revision No. 34 Dated 5/14/2026 is incorporated into this contract*

5. REQUIREMENTS/TASKINGS

5.1 Construction Surveillance Technicians (CST): The Contractor shall provide U.S. (Minimum) TS SCI eligible person(s) specially trained in surveillance and the renovation trade to deter technical penetrations and thwart implanted technical collection devices as well as ensuring that the renovation to CA-07 are done to meet all the technical specifications contained within IC Tech Spec – for ICD/ICS 705. Additionally, the CST shall perform the following tasks:

5.1.1 Monitor the activities of all uncleared renovation workers and personnel on the Secure Renovation Site at all times.

5.1.2 At the conclusion of each workday, the CST shall provide an electronic daily report (0002) and photo documentation (0003) to the government Technical Point of Contact (OPTEVFOR Special Security Officer (SSO) which documents renovation activities occurring that day to include activities but not limited to:

· Renovation material deliveries,

· Installation of radiofrequency (RF) shielding,

· Frames,

· Heating,

· Ventilation and Air Conditioning (HVAC),

· Acoustic countermeasures, and drywall layers,

· Walls painted above and below false floor/ceiling,

· All penetrations,

· and main bar installation.

The daily report details shall include the date, time, location, work being performed, and accompanying photos for certification documentation IAW Navy/DOW governing regulations (i.e., ICD/ICS 705) – see documentation below). On the timeline required by the Construction Security Plan (CSP), provide a written summary (0003) of the previous week’s work performed along with photo documentation as required.

5.1.3 Document all security violations from the CSP that occur on the Secure Renovation Site and notify the Site Security Manager (SSM), who will then immediately notify the OPTEVFOR SSO in the timeline required by the CSP. If a Deviation is required, the CST will notify the OPTEVFOR SSO for any required permissions. Any security violations shall include date, time, person(s) involved, description of incident and accompanying photos (if applicable).

5.1.4 Ensure that procedures to control site access are in accordance with the ICD 705 tech specs and the CSP.

5.1.5 Immediately notify the OPTEVFOR SSO and the Government Watch stander onsite of any unauthorized access to site IAW CSP.

5.1.6 Conduct security inspections of renovation materials finished and unfinished renovation work and photographic documentation of those inspections. All material inspections will be done at the direction of the OPTEVFOR SSO or designated representative in accordance with the CSP and documented in the daily report of the day the inspection was performed.

5.1.7 Identify and document anomalies and variances in finished renovation work against the official project renovation plans. Details shall include the date and time of discovery, description of anomaly, location, and accompanying photos.

5.1.8 Using the government furnished process and procedures, carry out opening and closing procedures of the Secure Renovation Site each day as directed by OPTEVFOR SSO.

5.1.9 Conduct random searches at site entry and exit points.

5.1.10 Ensure all signage/placards are intact and readable at all entry points listing prohibited and restricted items (e.g., cameras, firearms, explosives, drugs, etc.).

5.1.11 Ensure all physical security barriers that are in place to deny unauthorized access, are in their necessary locations and in good working order. The CST will report any discrepancies to the SSM at once prior to the start of the day’s work.

5.1.12 Shall conduct Vehicle inspections for any vehicle that is providing a delivery to the renovation site prior to any offloading of that delivery occurring by the driver of the delivery vehicle.

5.2 Site Security Manager (SSM): The SSM is responsible for the security aspects of CA-07 renovation that align with the Construction Security Plan. The SSM is also responsible for ensuring compliance of all regulatory requirements for the accreditation of the facility. The contracted SSM serves as the overall on-site security lead. They are responsible for managing access lists, coordinating security inspections, and acting as the primary liaison between the construction contractors and the government's Accrediting Official (AO) or government Special Security Office (SSO). The SSM shall work closely with Planners, Project Managers, Design Managers, Designers, and Renovation Managers as well as the supported command to determine the requirements for each project and ensure the implementation of the policy-based requirements. The SSM will be provided a government furnished Laptop and desk within the 1st deck of the security office (Orange Room) and necessary tools to support accomplishment of the deliverables to the SSO of OPTEVFOR.

5.2.1 The contracted SSM will provide documentation to the OPTEVFOR SSO upon completion of each week and a final report at the end of the project.

5.2.2. The Contractor shall always maintain a binder of printed weekly reports on site maintained in chronological order.

5.2.3. The contracted SSM will provide Daily reports to OPTEVFOR and consolidated written weekly reports at the end of each work week.

5.2.4. The contracted SSM and CSTs will utilize the government provided electronic devices/tools to accomplish digital documentation and daily reports of documented activities.

5.2.5. Handwritten documentation will NOT be accepted on this project, and it is the responsibility of the CST/SSM to develop a digital documentation process, in conjunction with the SSM/PSO/SAO, using government provided equipment.

5.2.6. The contracted SSM provides direct daily supervision and operational oversight to the CSTs on-site. They coordinate the CSTs' schedules, assign their surveillance zones, and evaluate their performance

5.2.7. Access Control & Lists: The SSM is responsible for drafting and maintaining the "Site Access List." The CSTs use this official list at the gate to screen, verify, and escort workers and materials

5.2.8. Reporting Escalation: When a CST identifies a security violation, construction anomaly, or potential technical penetration (counterintelligence concern), they document the incident and immediately escalate it to the SSM. The SSM then reviews it and notifies the government security authority.

5.2.9. SSM's Core Fixed Facility Checklist Duties (0005 and 0006): The Fixed Facility Checklist (FFC) is a comprehensive, multi-page document detailing every physical, acoustic, and electronic security aspect of the SCIF/SAPF, answering Technical Security Profiles: The SSM must personally complete and verify sections regarding the facility's walls (e.g., Wall Type A/B/C), GSA-approved doors, and lock specifications.

5.2.10. Intrusion Detection Systems (IDS) & Access Control Systems (ACS): The SSM details the layout of motion sensors, balanced magnetic switches (BMS), and keypad access, attaching certified UL 2050 installation layout certifications directly to the FFC

5.2.11. Acoustic Protection (STC): The SSM documents how the facility meets Sound Transmission Class (STC) ratings, including details on perimeter drywall, sound baffles, and acoustic door seals

5.2.12. Telecommunications Baseline: Within the FFC, the SSM lists every phone system (e.g., VoIP), network line (SIPR, JWICS), and data cable entering the space, ensuring they conform to RED/BLACK isolation standards.

5.2.13. The TEMPEST Checklist evaluates the facility's vulnerability to compromising electromagnetic emanations that could allow adversaries to intercept classified data.

5.2.14. SSM's Core TEMPEST Duties (0005 and 0006): Liaising with the CTTA: The SSM does not act as the CTTA, but they are responsible for implementing the CTTA's pre-construction requirements (such as installing RF foil, dielectric breaks on plumbing/pipes, or protective power line filters) and documenting them on the checklist.

5.2.15. RED/BLACK Separation: The SSM shall use the checklist to detail physical distance separations between "RED" processors (handling classified data) and "BLACK" utilities (unclassified phone lines, power conduits, or public radios).

5.2.16. Shielding Verification: If the facility utilizes an RF shielded enclosure, the SSM documents the shielding effectiveness test results (RF testing reports) within the TEMPEST submittal.

5.2.17 Prior to initial access to the site, all construction personnel shall receive a security briefing by the SSM or designee on the security procedures to be followed.

6 QUALIFICATIONS/PREREQUISITES:

6.1 CST: IAW the ICD 705 Series

6.2 SSM:

6.2.1 Minimum required security clearance is eligibility for TS/SCI.

6.2.2 Must have at least five (5) years of renovation experience. Security experience may supplement up to two (2) years of renovation experience if the security experience is directly related to ICD 705 secure facility renovation or physical security.

6.2.3 Must be familiar with the sixteen (16) standards divisions of construction

6.2.4 Must hold a valid certificate for the successful completion of a forty (40) hour or greater CST training course.

6.2.5 Must be able to stand, sit, bend, walk, kneel, and other related physical activities for long periods of time.

6.2.6 Must have a solid understanding of the most recent ICD/ICS-705 version and tech specs as demonstrated by experience gained from working on 2 or more ICD-705 projects.

6.2.7 Must have any/all necessary certifications and training on safety equipment use to allow for full access to the renovations site.

6.2.8 To Facilitate access to the OPTEVFOR Network, the SSM will also require having completed: Cyber Awareness Training, Privacy Training, CUI Training, OPSEC Annual Training.

· https://public.cyber.mil/training/cyber-awareness-challenge/

· https://public.cyber.mil/training/identifying-and-safeguarding-personally-identifiable-information-pii

· https://securityawareness.dcsa.mil/cui/index.html

· https://securityawareness.usalearning.gov/opsec/story.html

7 WORKING CONDITIONS

The contract will require work performance in a construction zone inside and outside. This work may also require exposure to loud equipment noises and associated dust typically found in construction zone areas. The contractor shall provide all contractors assigned to the project with all personal safety equipment as required on the renovation site (i.e., hard hats, safety boots, eye protection, safety vest, hearing protections, etc.)

In conjunction with their contracted work, the contractor may require access to scaffolding, ladders, and other equipment requiring fall protection and ladder certifications in accordance with the applicable Occupational Safety and Health Administration (OSHA) standards. The contractor will be required to provide all certifications and training for all contracted employees assigned to the project and provide documentation to the COR of this contract.

8 WORK HOURS

Primary hours of work will include a standard 8-hour workday with one half hour for lunch in conjunction with the NAVFAC Awarded contractor’s schedule. Work may include work on Saturdays and Sundays. Adjustments to working hours due to extenuating renovation activities, like concrete pours, may be required. Contractor activities must be driven by calendars that reflect Saturdays, Sundays and all Federal Holidays as non-workdays, unless otherwise defined in this contract. Federal Holidays are as defined in 5 USC 6103.

· New Year's Day (January 1)

· Martin Luther King, Jr. Day (third Monday in January)

· Washington's Birthday (third Monday in February)

· Memorial Day (last Monday in May)

· Juneteenth National Independence Day (June 19)

· Independence Day (July 4)

· Labor Day (first Monday in September)

· Columbus Day (second Monday in October)

· Veterans Day (November 11)

· Thanksgiving Day (fourth Thursday in November)

· Christmas Day (December 25)

9 DELIVERABLES. Contractor format is acceptable

Renovation activities with photos.

Prior to initial access to the site, all construction personnel shall receive a security briefing by the SSM or designee on the security procedures to be followed as required by the SSO.

10 GOVERNMENT FURNISHED PROPERTY, MATERIAL, EQUIPMENT, OR INFORMATION (GFP, GFM, GFE OR GFI)

10.1 The Government will provide the following GFE in support of this contract:

a. Camera/s and memory cards to document renovation/construction and installation of materials.

b. The government shall provide a secure workspace with a table to accommodate a standard size set of Blueprints for the CA07 project. Upon award, the government shall also provide a copy of the approved blueprints for the CA07 for the contractors’ use through the period of support for the CA07 project.

c. The government shall provide materials and equipment found in an office setting (i.e., office space, computer, phone, email access, Microsoft Office software) as well as other unique software programs, agency specific information, resource material and documents needed to accomplish the required tasks.

d. The Contractor will be supplied with a government furnished laptop to facilitate day-to-day reports. The government shall provide work consumables such as pens, notebooks, and post notes.

e. All government furnished equipment, software, and information shall be returned to the government upon completion of performance of this contract.

10.2 The Contractor shall provide all supplies, equipment, facilities and services that are required to perform the work under this contract not listed in Section 10.1

11 SECURITY

The scope of work requires a minimum access to TOP SECRET/SENSITIVE COMPARTMENTED INFORMATION (ELIGIBILITY FOR TS/SCI) access for contractor personnel deemed necessary for successful execution. All contractor personnel must have the necessary clearances at TOP SECRET and eligibility as proposed and must maintain the level of security required for the life of the contract. All contractor personnel designated to perform shall be United States citizens (no exceptions).

Additionally, the offeror shall provide proof/verification that it possesses a current TOP SECRET facilities clearance at time of proposal submission.

Security will be in accordance with the attached/awarded DD254. ICS 705-1 and IC Tech Spec-for ICD/ICS 705 provide the security standards. Per IC Tech Spec-for ICD/ICS 705, exceeding or not meeting a standard, even when based upon risk, requires an approved waiver. Both the SSM and the CST positions shall be TS/SCI Eligible by proposal submission.

The Contractor shall establish appropriate administrative, technical, and physical safeguards to protect all nonpublic Government data to ensure the confidentiality, integrity, and availability of Government data.

Comply with applicable DOW, Navy, and project cyber-security, information technology (IT) systems, network, and/or security applicable instructions and policies, and ensure all contractor personnel have read and agree to comply with such instructions and policies. The contractor shall especially be familiar with DoN Acceptable Use Policies and provide training to its personnel as to appropriate practices when interacting with Government IT systems and networks.

12 PRIVACY ACT AND HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT (HIPPA)

The contractor may be in contact with data and information subject to the Privacy Act (Title 5 of the U.S. Code Section 552a). The contractor shall ensure that its employees assigned to this effort understand and adhere to the requirements of the Privacy Act and to DOW and DON regulations that implement the Privacy Act. DON policy and procedures implementing the Privacy Act are detailed in SECNAVINST 5211.5F (DON Privacy Program). The contractor shall identify and safeguard data, information and reports accordingly. In addition, the contractor shall ensure that contractor personnel assigned to the contract are trained on properly identifying and handling data and information subject to the Privacy Act prior to commencing work.

The Contractor agrees to assume responsibility for protecting such information, using best practices, and compliance with applicable references.

13 SAFETY

Nothing in the Performance Work Statement nor any Government action or failure to act in performance of the contract shall relieve the contractor of its responsibility for the safety of the contractor's personnel and property, the Government's personnel and property, and the public. Furthermore, nothing in this PWS shall relieve the contractor of its responsibility for complying with applicable Federal, State, and Local laws, ordinances, codes, and regulations (including those requiring applicable licenses and permits) in connection with the performance of this contract.

14 TRAVEL

Travel requirements will not be required for this project.

15 QUALITY CONTROL

To align with the ICD 705 series and CSP, the contractor shall implement and maintain a Quality Control Plan (QCP) to ensure work performed conforms to the scope of work and meets the requirements under this PWS. The QCP shall, at a minimum provide a method for performing inspections; identifying, correcting and preventing problems/defective service; addressing customer complaints, and improving the quality of services over the life of the contract.

16 QUALITY ASSURANCE

The Government reserves the right to perform inspections and surveillance to evaluate the Contractor’s compliance with the contract terms and performance of the requirements in the PWS. The Government will make every effort to ensure that the surveillance methods used are conducted in an objective, fair, and consistent manner. The Government will assign a Contracting Officer’s Representative (COR) who will be responsible for monitoring performance in accordance with the requirements of the PWS. The COR will make every effort to ensure that the surveillance methods used are conducted in an objective, fair, and consistent manner.

Contract Discrepancy Report (CDR). In the event of unsatisfactory contractor performance, the KO will issue a CDR that will explain the circumstances and findings concerning the incomplete or unsatisfactory service. The contractor shall acknowledge receipt of the CDR and respond in writing as to how he/she shall correct the unacceptable performance and avoid a recurrence. The Government will review the contractor's corrective action response to determine acceptability and will use any completed CDR as part of an overall evaluation of Contractor performance when determining present or future contractual actions.

17 STATEMENT OF NON-PERSONAL SERVICE

This is not a personal services contract. The contractor/sub-contractor should be well educated in respect to “personal services”. No one (government employee, including military) may task the Contractor to perform work that is not listed in the contract, nor does the Contractor take direction in the performance of their task from anyone other than their corporate manager and/or prime Contractor, as appropriate. Contractor personnel performing services under this PWS will be controlled and supervised at all times by contractor management personnel. Contractor management shall ensure that contractor personnel properly comply with the performance work standards outlined in the PWS. Contractor personnel shall perform their duties independent of, and without the supervision of, any Government official.

The tasks, duties, and responsibilities set forth in this contract shall not be interpreted or implemented in any manner that results in any contractor personnel creating or modifying federal policy, obligating the appropriated funds of the U. S. Government, overseeing the work of federal employees, providing direct personal services to any federal employee, or otherwise violating the prohibitions set forth in Parts 7 and 37 of the Federal Acquisition Regulation (FAR) https://www.acquisition.gov/far . The government shall control access to the facilities and shall perform the inspection and acceptance of completed work.

18 CONTRACTING OFFICER AND REPRESENTATIVE

Only a duly appointed Procuring Contracting Officer (PCO), and no other government personnel, is authorized to change the specifications, terms and conditions under this contract. The OPTEVFOR Contracting Officer’s Representative (COR) is responsible for technical management of this contract and will serve as the Contracting Officer’s Primary Point of Contact. The COR shall oversee execution of this PWS and resolve any potential issues. The COR is responsible for: liaising with OPTEVFOR personnel and Contractor personnel on site; contractual advice, recommendations and clarification regarding the statement of work; delivery of this PWS placed under this contract; providing an independent government estimate of the effort described in the statement of work; quality assurance of services performed and acceptance of the services or deliverables; government furnished property; security requirements aboard government installations; providing the PCO or his/her designated Ordering Officer with appropriate funds for issuance of the delivery; and the certification of invoice for payment.

19 CONTRACTOR IDENTIFICATION

Contractor employees shall identify themselves as contractor personnel by introducing themselves or requesting they be introduced as contractor personnel and display distinguishing badges or other visible identification for meetings with Government personnel. In addition, contractor personnel shall appropriately identify themselves as contractor employees in telephone conversations and formal and informal written correspondence.

20 AUTHORIZED CHANGES ONLY BY THE CONTRACTING OFFICER AND REPRESENTATIVE

(a) Except as specified in paragraph (b) below, no order, statement, or conduct of Government personnel who visit the Contractor's facilities or in any other manner communicate with Contractor personnel during the performance of this contract shall constitute a change under the "Changes" clause of this contract.

(b) The Contractor shall not comply with any order, direction or request of Government personnel unless it is issued in writing and signed by the Contracting Officer, or is pursuant to specific authority otherwise included as a part of this contract.

(c) The Contracting Officer is the only person authorized to approve changes in any of the requirements of this contract and notwithstanding provisions contained elsewhere in this contract, the said authority remains solely with the Contracting Officer. In the event the Contractor effects any change at the direction of any person other than the Contracting Officer, the change will be considered to have been made without authority and no adjustment will be made in the contract price to cover any increase in charges incurred as a result thereof. The address and telephone number of the Contracting Officer is:

21 CONTRACTOR UNCLASSIFIED ACCESS TO FEDERALLY CONTROLLED FACILITIES, SENSITIVE INFORMATION, IT SYSTEMS OR PROTECTED HEALTH INFORMATION

Executive Order 13467, Reforming Processes Related to Suitability for Government Employee, Fitness for Contractor Employees and Eligibility for Access to Classified National Security Information, Homeland Security Presidential Directive (HSPD)-12, requires government agencies to develop and implement Federal security standards for Federal employees and contractors. The 5 CFR 32 Part 157 in concert with DoD Manual 1000.13, Vol 1, implements the Federal Standards.

APPLICABILITY

This text applies to all DoD sponsored individuals who require CAC eligibility (or login and P/W if acceptable per contract) for: Physical access to DoD facilities or non-DoD facilities on behalf of DoD; Logical access to information systems (whether on site or remotely); or remote access to DoD networks that use only the CAC logon for user authentication, or access to sensitive and protected information. This applies to the Office of the Secretary of Defense (OSD), the Military Departments, the Office of the Chairman of the Joint Chiefs of Staff and the Joint Staff, the Combatant Commands, the Office of the Inspector General of the DoD, the Defense Agencies, the DoD Field Activities and all other organizational entities within the DoD (hereinafter referred to collectively as the "DoD Components").

Each contractor employee providing services at a Navy command under this contract is required to obtain a DoD CAC. Additionally, depending on the level of computer/network access, the contract employee will require a successful investigation as detailed below.

ACCESS TO FEDERAL FACILITIES

Definition. As used in this clause - Military installation means a base, camp, post, station, yard, center, or other activity under the jurisdiction of the Secretary of a military department, or, in the case of an activity in a foreign country, under the operational control of the Secretary of a military department or the Secretary of Defense (see 10 U.S.C. 2801(c)(4)).

Per HSPD-12 and implementing guidance, all contractor employees working at a federally controlled base, facility or activity under this clause will require a DoD CAC. When access to a base, facility or activity is required contractor employees shall in-process with the Command's Security Manager (CSM) upon arrival to the command and shall out-process prior to their departure at the completion of the individual's performance under the contract.

Training. Contractor employees who require routine physical access to a Federally controlled facility or military installation shall complete “Level I Antiterrorism Awareness Training” prior to gaining access to a facility and annually thereafter in accordance with DoDI O-2000.16 Vol. 1. In accordance with Department of Defense Instruction O-2000.16 Volume 1, DoD Antiterrorism (AT) Program Implementation: DoD AT Standards, Level I Antiterrorism Awareness Training shall be completed by:

1. Completion of “Level I Antiterrorism Awareness Training” available at https://jkodirect.jten.mil/pdf/atl1/launch.html; or

2. Under the instruction of a qualified Level I Antiterrorism Awareness instructor; or

3. By providing a training certificate for “Level I Antiterrorism Awareness Training” training showing completion within the last calendar year.

The contractor will submit certificates of completion for each affected contractor employee and subcontractor employee to the COR or to the contracting officer, if a COR is not assigned, prior to being granted access to a Federally controlled facility or military installation.

Subcontracts. The Contractor shall include the substance of this clause, including this paragraph (d), in subcontracts, including subcontracts for commercial items, when subcontractor performance requires routine physical access to a Federally-controlled facility or military installation.

OPERATION SECURITY (OPSEC)

It is DoD policy according to DoD Directive 5205.02E, “DoD Operations Security (OPSEC) Program,” June 20, 2012, as amended to establish and maintain OPSEC programs to ensure national security-related missions and functions are protected.

Training: Contractor employees shall comply with all DoD OPSEC requirements and complete “OPSEC Awareness for Military Members, DoD Employees and Contractor” training within 30 days of onboarding the contract and annual refresher training thereafter. Training shall be completed through a DoD sponsored and certified computer or web-based learning instruction available at https://securityawareness.usalearning.gov/opsec/index.htm.

The contractor will submit certificates of completion for each affected contractor employee and subcontractor employee to the COR or to the contracting officer, if a COR is not assigned, within 30 calendar days after training is completed by all employees and subcontractor personnel.

START-UP PERIOD

All contractor resource onboarding documents must be submitted via the prime contractor. The prime contractor shall make all necessary preparations to assume full responsibility for productive performance as of the performance start date.

Definition of "productive":

a. OF-306 signed by contractor employee

b. FD-258 Fingerprint Card (Contingent upon availability of electronic fingerprinting submission)

c. Completed Electronic Investigation (e-QIP)

d. All contractor employees with need for a Common Access Card (CAC) must have an active Defense Information System for Security (DISS) profile.

e. Common Access Card (CAC)

f. DISS Visit Request submitted (Contingent upon classification of work being performed, Confidential, Secret, Top Secret).

Note (1): Invoicing by the contractor will begin as of the commencement of the performance period of services and no reimbursement will be paid by the government for efforts expended during the start-up period.

Note (2): Foreign Nationals are not allowed access to the functional/system side of Enterprise Resource Planning (ERP).

ACCESS TO DOD INFORMATION TECHNOLOGY (IT) SYSTEM

In accordance with DON CIO Memorandum (IT LEVEL DESIGNATION ON DD FORM 2875 SYSTEM AUTHORIZATION ACCESS REQUEST) 08 September 2020, contractor employees who require access to Department of the Navy (DoN) or DoD networks are categorized as Privileged, Enhanced, or Authorized users. All user level accesses may include positions which require access to Controlled Unclassified Information (CUI). CUI includes sensitive information protected under the Privacy Act, to include Protected Health Information (PHI). IT System levels are determined by the requiring activity's Command Information System Security Manager (ISSM)/Information Assurance Manager (IAM).

Contractor employees requiring privileged access, (when specified by the terms of the contract) require a Tier 5 (T5) or T5R equivalent investigation, which is a higher level investigation than the Tier 3 (T3) and T3R described below. Due to the privileged system access, an investigation suitable for High Risk national security positions is required. Individuals who have access to system control, monitoring, or administration functions (e.g. system administrator, database administrator) require training and certification to Information Assurance (IA) Technical Level 1, and must be trained and certified on the Operating System or Computing Environment they are required to maintain.

Contractors requiring Enhanced access, (when specified by the terms of the contract) require a T3, T3R, or equivalent investigation, which is a higher level investigation than the Tier 1 (T1) described below. Due to the enhanced system access, an investigation suitable for Moderate Risk national security positions is required.

Access to sensitive IT systems is contingent upon a favorably adjudicated background investigation. When access to IT systems is required for performance of the contractor employee's duties, such employees shall in-process with the Navy CSM and ISSM/IAM manager upon arrival to the Navy command and shall out-process prior to their departure at the completion of the individual's performance under the contract. Completion and approval of a System Authorization Access Request Navy (SAAR-N) form is required for all individuals accessing Navy IT resources. The decision to authorize access to a government IT system/network is inherently governmental. The contractor supervisor is not authorized to sign the SAAR-N; therefore, the government employee with knowledge of the system/network access required or the Contracting Officers Representative (COR) shall sign the SAAR-N as the supervisor.

The SAAR-N shall be forwarded to the CSM upon contractor employee acquiring a Common Access Card (CAC) credential. Failure to obtain a CAC credential may result in delaying the individual's start date.

When required to maintain access to required IT systems or networks, the contractor shall ensure that all contractor employees requiring access complete annual Cyber Awareness training, and maintain a current requisite background investigation. The contractor's security representative shall contact the CSM for guidance when reinvestigations are required.

INTERIM ACCESS

The CSM may authorize issuance of a DoD CAC and interim access to a DoN or DoD unclassified computer/network upon a favorable review of the investigative questionnaire and advance favorable fingerprint results. When the results of the investigation are received and a favorable determination is not made, the contractor employee working on the contract under interim access will be denied access to the computer network and this denial will not relieve the contractor of his/her responsibility to perform.

DENIAL OR TERMINATION OF ACCESS

The potential consequences of any requirement under this clause including denial or termination of physical or system access in no way relieves the contractor from the requirement to execute performance under the contract within the timeframes specified in the contract. Contractors shall plan ahead in processing their employees and subcontractor employees. The contractor shall insert this clause in all subcontracts when the subcontractor is permitted to have unclassified access to a federally controlled facility, federally-controlled information system/network and/or to government information, meaning information not authorized for public release.

ACCESS TO CONTROLLED UNCLASSIFIED INFORMATION

Safeguarding sensitive unclassified information is critical to achieve NAVSUP Modernization efforts and deliver cutting-edge and uncompromised capabilities. The Secretary of Defense’s operations security (OPSEC) campaign plan stresses the importance of protecting controlled unclassified information (CUI). CUI encompasses OPSEC, critical technology, intelligence, and personally identifiable information that, if not properly identified, marked, and controlled, could impair NAVSUP’s ability to conduct its mission. Contractor employees with access to Controlled Unclassified Information (CUI) shall comply with DoDI 5200.48 - Controlled Unclassified Information (CUI) and complete DoD approved initial and annual refresher CUI training.

CONTRACTOR'S SECURITY REPRESENTATIVE

The contractor shall designate an employee to serve as the contractor's security representative. Within three (3) work days after contract award, the contractor shall provide to the requiring activity's Security Manager and the Contracting Officer, in writing, the name, title, address and phone number for the contractor's security representative. The contractor's security representative shall be the primary point of contact on any security matter. The contractor's security representative shall not be replaced or removed without prior notice to the Contracting Officer and CSM.

BACKGROUND INVESTIGATION REQUIREMENTS AND SECURITY APPROVAL PROCESS FOR CONTRACTORS ASSIGNED TO NATIONAL SECURITY POSITIONS OR PERFORMING SENSITIVE DUTIES

Navy security policy requires that all positions be given a sensitivity value based on level of risk factors to ensure appropriate protective measures are applied. If the Security Office validates the contractor’s position is Non-Critical Sensitive or if the IT system user level is determined to be Enhanced, at a minimum, each contractor employee must be a US citizen and have a favorably completed T3, T3R, or equivalent investigation to obtain a favorable determination for assignment to a non-critical sensitive or Enhanced position. The investigation consists of a standard National Agency Check and a FBI fingerprint check plus law enforcement checks and credit check. Each contractor employee filling a non-critical sensitive or Enhanced position is required to complete:

Failure to provide the required documentation at least thirty (30) days prior to the individual’s start date shall result in delaying the individual’s start date. Background investigations shall be reinitiated as required to ensure investigations remain current (not older than ten (10) years) throughout the contract performance period. The Contractor’s Security Representative shall contact the CSM for guidance when reinvestigations are required.

Regardless of their duties or IT access requirements ALL contractor employees shall in-process with the CSM upon arrival to the command and shall out-process prior to their departure at the completion of the individual’s performance under the contract. Employees requiring IT access shall also check-in and check-out with the Navy Command’s ISSM/IAM. Completion and approval of a System Authorization Access Request Navy (SAAR-N) form is required for all individuals accessing Navy IT resources. The SAAR-N shall be forwarded to the CSM upon the contractor employee acquiring a Common Access Card (CAC) credential. Failure to obtain a CAC credential or provide the required documentation shall result in delaying the individual’s start date.

The contractor shall ensure that each contract employee requiring access to IT systems or networks complete annual Cyber Awareness training, and maintain a current requisite background investigation. Contractor employees shall accurately complete the required investigative forms prior to submission to the CSM. The CSM will review the submitted documentation for completeness prior to submitting it to the OPM. Potential suitability or security issues identified may render the contractor employee ineligible for the assignment. An unfavorable determination is final (subject to SF-86 appeal procedures) and such a determination does not relieve the contractor from meeting any contractual obligation under the contract. The CSM will forward the required forms to OPM for processing. Once the investigation is complete, the results will be forwarded by OPM to the DoD Central Adjudication Facility (CAF) for a determination.

For classified contracts, if the contractor employee already possesses a current favorably adjudicated investigation, the contractor shall submit a Visit Access Request (VAR) via the Defense Information Security System (DISS). If the contractor employee does not have a current favorably adjudicated investigation, the contractor shall submit the Visit Access Request in DISS until the contractor employee has at a minimum an interim clearance. If the contract only requires access to unclassified information, even if the contractor takes a DISS “owning” role over the contractor employee, the Navy Command will also take a DISS “owning” role over the contractor employee during the hiring process and for the duration of assignment under that contract. If the contract requires access to classified information, the contractor’s Facility Security Office (FSO) will take a DISS “ownership” role and the Navy command will take a DISS “servicing” role during the hiring process and the duration of assignment under that contract. All VARs requires annual renewal for the duration of the employee’s performance under the contract.

BACKGROUND INVESTIGATION REQUIREMENTS AND SECURITY APPROVAL PROCESS FOR CONTRACTORS ASSIGNED TO OR PERFORMING NON-SENSITIVE DUTIES

Contractor employee whose work is unclassified and non-sensitive (e.g., performing certain duties such as lawn maintenance, vendor services, etc...) and who require physical access to publicly accessible areas to perform those duties shall meet the following minimum requirements:

To be considered for a favorable trustworthiness determination, the CSR must submit for all employees each of the following:

The contractor shall ensure each individual employee has a current favorably completed NACI or T1 equivalent investigation, or ensure successful FBI fingerprint results have been gained and investigation has been processed with OPM.

Failure to provide the required documentation at least thirty (30) days prior to the individual's start date may result in delaying the individual's start date.

22 ABILITY ONE

NAVSUP FLCN may utilize contractor support through the AbilityOne Program, as needed, to perform contract closeout functions for this acquisition. Information, including business sensitive/confidential or proprietary data, that the offeror provides to the Government or information already in the possession of the Government may be viewed and utilized by the AbilityOne Program support contractor personnel during the course of its contract performance. The information that may be made available to the support contractor may include, for example, pricing and technical proposals, historical contract, pricing and performance information, Commercial Asset Visibility (CAV) reporting information and similar data/information.

By submission of a proposal in response to this solicitation, the offeror and its subcontractors consent to a release of their business sensitive/confidential or proprietary data to the Government's AbilityOne Program support contractor personnel in order to perform close out services. Prior to the release of any such information to the support contractor, the support contractor will have in place with the Government a Non-Disclosure/Non-Use Agreement in accordance with the terms of the AbilityOne Program support contract.

Offerors may execute their own Non-Disclosure Agreement with the AbilityOne Program (AbilityOne contact information available from the contracting point of contact). The support contractor must provide copies of the executed agreements to the Contracting Officer and the Contracting Officer's Representative (COR) for the support contract; and the offeror/contractor for this acquisition must provide copies of the executed Agreement to the Contracting Officer for this acquisition. If the offeror/contractor seeks such a Non-Disclosure Agreement with the AbilityOne Program support contractor, the Agreement must be executed no later than the date of final delivery under the resulting NAVSUP FLCN contract.