Performance Work Statement.docx

Performance-Based Work Statement for Mission Assurance Programs BUMED N45

1. Introduction

This PWS outlines the requirements for contractor support to Navy Medicine’s N45 – Mission Assurance Program. The contractor shall support Personnel Security with emphasis on Suitability and Fitness, Emergency Management (EM) via responsibilities associated with the Health and Human Services (HHS) Federal Coordinating Center (FCC). The contractor shall provide expert services to facilitate development of Navy Medicine policy and procedures to conduct criminal history background checks on service members involved in the provision of childcare services for children under the age of 18 in Department of Defense (DoD) programs (medical treatment programs under Navy Medicine purview) in accordance with 34 USC Section 20351, 32 CFR Part 86 and DoDI 1402.05. The contractor shall maintain operational readiness and continuity, ensure policy compliance, and facilitate effective coordination and communication across interagency and internal Navy stakeholders to promote effective risk mitigation, readiness.

The contractor shall ensure all FCC/NDMS-related products and actions are aligned with applicable guidance, including (at a minimum) DoDI 6010.22 (Medical Readiness and related supporting responsibilities), applicable DoD patient movement/medical response policy, and HHS/NDMS coordination constructs, while ensuring Navy Medicine internal issuances, operational plans, and governance products reflect current regulatory requirements and clearly define roles, responsibilities, and reporting relationships across Navy Medicine stakeholders and interagency partners.

2. Background

The DoD has established comprehensive policies and procedures to ensure the safety and well-being of children under the age of 18 participating in its programs. These policies are rooted in the Crime Control Act of 1990 and further addressed in 34 USC Section 20351, 32 CFR Part 86 and DoDI 1402.05. A cornerstone of this framework is the requirement for thorough background checks for all individuals who have regular contact with children under 18 years of age in DoD-sanctioned childcare services which include medical treatment programs under Navy Medicine. Navy Medicine relies on the BUMED N45 Mission Assurance office to develop enterprise policy and procedures to conduct these additional background checks.

The DoD directed the Navy management, oversight and program development four FCCs (NMRTC Portsmouth, VA, NMRTC Jacksonville, FL, NMRTC San Diego, CA and NMRTC Camp Pendleton, CA (Orange County). The inclusion of FCC support within N45 responsibilities reflects the importance of interagency coordination during public health emergencies and disaster response scenarios such as large-scale combat operations.

3. Scope

The contractor will provide subject matter expertise and operational support focusing on personnel security and emergency management. This includes drafting and supporting the development of policy for childcare background checks in line with Department of Defense instructions, developing procedures for installation records checks, and creating clear adjudication criteria. The role also involves extensive support for the National Disaster Medical System (NDMS) Federal Coordinating Center (FCC), which encompasses developing operational plans, coordinating patient reception and movement, integrating with Military Treatment Facility (MTF) and civilian Health Care Coalition (HCC) emergency programs, and maintaining readiness documentation to ensure continuity of operations and effective defense support to civil authorities.

4. Tasks

4.1. Personnel Security with emphasis on Suitability and Fitness

4.1.1. Develop a Gap Analysis Report that summarizes all mandatory requirements for personnel subject to the additional requirements of the Child Care National Agency Check and Inquiries (CNACI), identifies areas where Navy Medicine policy is absent or deficient, and provides recommendations for the new policy's structure and content.

4.1.2. Facilitate development of Navy Medicine policy and procedures to conduct CNACIs from initiation to adjudication including due process.

4.1.3. Collect and adjudicate all comments on the DD818 and feedback received during the staffing process, making necessary revisions to the documents.

4.1.4. Prepare the final, revised policy package for the signature of the Surgeon General of the Navy or designated authority.

4.1.5. Assist in the development of a database or tool to track all staff requiring a CNACI, annual recertification and 5-year renewal.

4.1.6. Develop an SOP template that provides subordinate commands with clear, actionable steps for initiating, tracking, and documenting each background check from submission to final adjudication. It should include specific components of the background checks, adjudication criteria, and timelines for completion and renewal.

4.1.7. Create a suite of training materials, including presentation slide decks, fact sheets, and frequently asked questions tailored for different audiences (e.g., commanding officers, security managers, program directors).

4.1.8. Provide a monthly status report as a summary of progress for gap analysis, policy development, database tracking tool, SOP development and suite of training materials via the monthly program performance summary.

4.2. National Disaster Medical System (NDMS) Required Products

4.2.1. Revise and update the FCC NDMS Operational CONOPS as needed.

4.2.2. Develop Patient Reception Operations Plan and throughput model.

4.2.3. Facilitate HCC Framework with partner hospitals.

4.2.4. Assist with FCC Staffing Model and develop Recall Rosters for activation.

4.2.5. Manage Bed Reporting and Patient Tracking Integration Plan in JPATS, TRACE2S and Geo Healthsystem.

4.2.6. Develop NDMS Training and Exercise Support Packages.

4.2.7. Create FCC Readiness Metrics matrix aligned with NDMS performance expectations in FCC Guide.

4.2.8. Develop Annual NDMS Capability Assessment for submission to senior leadership.

4.2.9. Develop Strategic White Papers identifying sustainment requirements and risks, as needed.

4.2.10. Develop Executive Briefs supporting Navy Medicine participation in NDMS governance.

4.2.11. Travel is required to various locations in support to the exercises and other government-directed activities. Travel locations include, but are not limited to the FCC locations, Portsmouth VA, Jacksonville FL, San Diego CA and Camp Pendleton CA.

4.2.12. Attend FCC-related meetings, at least monthly or as needed.

4.2.13. Coordinate with FCC Director/Coordinator and external stakeholders to include identifying and recruitment of National Disaster Medical System partners and facilitate enrollment and participation

4.2.14. Ensure quality control reviews, data validation and version control of NDMS-related systems/databases such as TRAC2ES, JPATS and BUMED Portal For Readiness & Emergency Preparedness (PREP) ensuring proper access and information sharing.

4.2.15. Develop and report monthly FCC readiness metrics to include, but not limited to, personnel assigned, qualifications, equipment, interagency coordination requirements and overall program health on each individual FCC assigned.

5. Other Pertinent Information

5.1. Acronyms

Evacuation System

5.2. Period of Performance

The base period of performance for this requirement is a one-year base period and will feature (4) one-year option periods consecutively following the base period.

5.3. Place of Performance

Performance will predominantly occur at the Defense Health Headquarters, supporting the Bureau of Medicine and Surgery, with five (5) remote locations near Portsmouth, VA; Jacksonville, FL; San Diego, CA; Camp Pendleton/Oceanside, CA; and Los Alamitos, CA.

The split between Government and Contractor site labor at DHHQ is 60/40. The first number is the percentage of work performed at Government site and the second number is the percentage of work performed at the Contractor site. Remote work is available subject to Government approval for all sites.

5.4. Level of Effort

5.5. Minimal Qualifications

5.5.1. General Requirements

5.5.1.1. Minimum of a Bachelor’s degree in a relevant field (Emergency Management, Security Studies, Public Policy, or related discipline).

5.5.1.2. Minimum 5 years of relevant professional experience; OR in lieu of degree, 10 years of progressively responsible experience.

5.5.1.3. Successful completion of the Federal Coordinating Center (FCC) Course within the last 3 years: https://health.mil/Military-Health-Topics/Education-and-Training/DMRTI/Course-Information/Federal-Coordinating-Center-Course; or enroll within 180 days upon onboarding.

5.5.1.4. Contractors performing FCC functions under this contract will be U.S. Citizens and are required to obtain and maintain favorable a Tier 3 security clearance with SECRET Eligibility. SECRET access must be granted to access SIPRNET and attend meetings classified at the SECRET level. Contractors performing other functions on this contract are required to obtain and maintain favorable Tier 3 security clearance with No Eligibility.

5.5.1.5. Proficiency with Microsoft Office Suite and collaboration tools.

5.5.1.6. Excellent written and oral communication skills.

5.5.2. Security Manager

5.5.2.1. Knowledge of Office of Personnel Management suitability and fitness standards, information, and industrial security policies within federal or DoD environments.

5.5.2.2. Ability to develop suitability and fitness policy and manage compliance programs.

5.5.2.3. Demonstrated expertise in DoD/OPM suitability adjudication.

5.5.2.4. Completion of OPM Fundamentals of Suitability for Suitability and Fitness Adjudicators course: https://www.opm.gov/suitability/suitability-executive-agent/suitability-training/#url=Fundamentals-of-Suitability within the last 3 years; or enroll within 60 days upon onboarding.

5.5.2.5. Familiarity with DoD childcare background check policies.

5.5.2.6. Experience drafting, reviewing, and revising policies, SOPs, CONOPS, and implementation plans.

5.5.2.7. Advanced knowledge of DoD interagency coordination, policy development, and action officer responsibilities.

5.5.2.8. Strong database management and reporting skills.

5.5.2.9. Ability to coordinate meeting minutes, action tracking, and partner engagement documentation

5.5.3. Emergency Management Specialist

5.5.3.1. Experience supporting Disasters (natural, manmade and technological), DSCA, COOP, and NDMS operations.

5.5.3.2. Experience in planning and participating in Department of War and other Federal Agencies Full-Scale Exercises like Ultimate Caduceus, Citadel Shield/Solid Curtain.

5.5.3.3. Familiarity with FCC operations, including TRAC2ES, JPATS, GEO-Health Systems and NDMS systems.

5.5.3.4. Experience coordinating and evaluating Department of War/NDMS exercises (tabletop, full-scale).

5.5.3.5. Produce training materials, after-action reports (AARs), and Improvement Plans (IP) exercise planning packages per federal standards.

5.5.3.6. Demonstrates capability to understand all phases of Emergency Management to include but not limited to: Mitigation, Preparedness, Response, Recovery.

5.5.3.7. Experience in creating, reviewing, and revising policies, SOPs, and CONOPS

5.5.3.8. Advanced knowledge of DoD interagency coordination, policy development, and action officer responsibilities.

5.5.3.9. Strong database management and reporting skills.

5.5.3.10. Ability to coordinate meeting minutes, action tracking, and partner engagement documentation.

5.5.3.11. Coordinates resource management and logistics during incidents.

5.5.4. FCC Training & Exercise Specialist

5.5.4.1. Develop annual FCC Training Plan.

5.5.4.2. Maintain Individual Training Records for FCC Staff.

5.5.4.3. Coordinate with DoW/NDMS/FEMA/HHS/BUMED on training requirements.

5.5.4.4. Identify training gaps and corrective actions.

5.5.4.5. Coordinate Reserve and Active Component integration training.

5.5.4.6.

5.5.4.7. Ensure compliance with BUMEDINST 3440.10C and applicable DoW Directives.

5.5.4.8. Experience coordinating and evaluating emergency management exercises (tabletop, full-scale).

5.5.4.9. Capability to produce exercise training materials, after-action reports, and exercise planning packages per federal standards

5.5.5. Policy Analyst

5.5.5.1. Experience drafting, reviewing, and revising policies, SOPs, CONOPS, and implementation plans related FCC.

5.5.5.2. Advanced knowledge of DoD interagency coordination, policy development, and action officer responsibilities.

5.6. Government Furnished Equipment/Property/Information

The Government will provide access to office, workspace and furnishings at a Government site for onsite primary locations. The Government will furnish local, Defense Switched Network (DSN), and long-distance telephone service on-site for direct performance of the contract. The Government will also provide access to computers, terminals, common use software, communications networks, mobile devices and other resources owned or leased and operated by the Government. This enables secure access to DoD networks and government systems, ensure cybersecurity and data-protection compliance, and enable standardized, rapid response during NDMS activations and contingency operations. The Contractor shall provide email notification of receipt of any GFE. The Contractor shall report to the Government within ten (10) calendar days of any GFE found damaged, malfunctioning, or otherwise unsuitable for use. The Contractor shall not modify or forward GFE without written approval from the COR.

5.7. Security Requirements

The highest level of security required for this requirement is Tier 3. See the attached DD254 for details.

5.8. Travel

The estimated travel requirements are as follows. Travel locations include but are not limited to the FCC locations, Portsmouth VA, Jacksonville FL, San Diego CA, and Camp Pendleton CA. The government reserves the right to direct travel to other locations as necessary to fulfill the requirements of this contract. Travel may be required if the tasks and deliverables warrant those expenses. All travel shall be IAW Government’s Joint Travel Regulations (JTR) or Federal Travel Regulations (FTR). A trip report shall be submitted no later than seven (7) days following the completion of required travel. The ceiling for travel per year is $20,000, not including applicable indirect costs. Travel Requirements at the discretion of the Government.

FCC Portsmouth: Naval Medical Center Portsmouth or Naval Medical Forces Atlantic 620 John Paul Jones Cir Portsmouth, VA 23708

Jacksonville, FL 32214

San Diego, CA 92134

San Diego, CA 92136

Los Alamitos, CA 20720

Camp Pendleton, CA 92055

5.9. Training Requirements

Contractor and subcontract employees will comply with BUMED Fiscal Year Annual Training Plan and complete assigned training within the time period specified on the BUMED Notice.

6. List of Deliverables

As required

7. Performance Standards

Contract Deliverables Contract deliverables furnished as prescribed in the PWS, attachments, CDRLs, Task Orders, etc., as applicable.

Inspection by the

COR

100% inspection of all contract deliverables.

>95% of deliverables submitted timely and without rework required.

Overall Contract Performance Overall contract performance of sufficient quality to earn a Satisfactory (or higher) rating in the COR’s annual report on Contractor Performance Assessment by the COR

performance elements rated Satisfactory (or higher)

8. Points of Contact

COR

CPO Patrick Vickers patrick.r.vickers2.mil@health.mil

(808) 471-4628

9.5.9.2. Per HSPD-12 and implementing guidance, all contractor employees working at a federally controlled base, facility or activity under this clause will require a DoD CAC. When access to a base, facility or activity is required contractor employees shall in-process with the (ASM) upon arrival to the command and shall out-process prior to their departure at the completion of the individual's performance under the contract.

9.5.10.2. The Contractor shall make available to the technical representatives authorized by the Government all program data (e.g., working documents, databases, tracking systems), including electronic access to computer files, pertaining to the Contractor and subcontractor activities in the performance of this contract.

9.5.12. PROGRAM SECURITY REQUIREMENTS

9.5.12.1. The Contractor shall adhere to all security requirements imposed by the National Industrial Security Program Operating Manual (NISPOM), 32 CFR Part 117, MIL-HDBK-1785 (DOD System Security Engineering Program Management Requirements) and the Contract Security Classification Specification (DD 254), Attachment J-1.

9.5.12.2. The Contractor shall maintain Information Security policies and procedures in accordance with the NISPOM and meet Defense Counterintelligence and Security Agency (DCSA) certifications where applicable.

9.5.12.3. The Contractor shall maintain a SECRET facility security clearance. The Contractor shall maintain a level of safeguarding for classified information and material at the SECRET level. The Contractor personnel shall have access to classified source data up to and including the level SECRET. The Contractor shall classify National Security Classified Information generated in support of this contract in accordance to its source material or Security Classification Guide (SCG) on the Defense Technical Information Center (DTIC) site: https://login.dtic.mil/l/index.jsp. Automated Information Systems (AIS) must be certified and accredited by the Cognizant Security Agency (CSA) prior to processing classified information associated with this contract.

9.5.12.4. The Contractor will be involved in the creation, modification, transmission, and disposal of Controlled Unclassified Information (CUI) in the performance of this SOW. The Contractor shall appropriately identify, mark, control and disseminate all CUI in accordance with DoDI 5200.48 Controlled Unclassified Information.

9.5.12.5. Due to the sensitive nature of this contract, the Contractor shall adhere to and follow all OPSEC procedures and policies throughout the performance of this contract. The Contractor shall develop and submit for approval an OPSEC Plan

9.5.12.6. Information Security programs are usually oriented towards the protection of classified information and materials. Operations Security (OPSEC) involves the protection of critical information focusing on unclassified information that may be susceptible to adversary exploitation. Pursuant to DoDD 5205.02E, Department of Defense Operations Security (OPSEC) Program (May 11, 2018), SECNAVINST 3070.2A, OPERATIONS SECURITY (9 May 2019), SECNAVINST 5510.36B, DON INFORMATION SECURITY PROGRAM (Jul 16 2019), and BUMEDINST 3070.1A (8 JUL 2024), BUMED OPSEC's OPSEC program implements requirements in DoD 5205.02, DoD Operations Security (OPSEC) Program Manual (November 3, 2008, Incorporating Change 1, Effective April 26, 2018). OPSEC requirements are applicable when contractor personnel have access to or generate CUI as defined in DFARS 225.204-7012. As such, OPSEC Measures (i.e., the planned action to conceal or protect identified critical information and indicators from disclosure, observation, or detection and to protect the same from collection) are applicable to this acquisition. Contractor is cautioned to study Addendum “A” and comply accordingly.

9.5.12.7. All contractor and subcontractor personnel shall comply with BUMEDINST 3070.1A (8 JUL 2024). BUMEDINST 3070.1A is available from the Contracting Office. All contractor and subcontractor personnel assigned to this acquisition, shall complete annually the Center for Development of Security Excellence (CDSE) “OPSEC Awareness for Military Members, DoD Employees and Contractors” located on the CDSE eLearning website at https://www.cdse.edu/toolkits/deliveruncompromised/index.html, or similar Contracting Officer approved annual OPSEC training, no later than 30 September of each year. Contractors and their subcontractors will report to BUMED OPSEC by 15 October each year the number of their employees assigned to the acquisition, who were trained, the number remaining to be trained, and the completion percentage. Failure to comply with the requirement for annual OPSEC training may result in termination of the acquisition and may be reported as non- compliant with BUMED OPSEC requirements. The point of contact (POC) for reporting annual OPSEC training under this acquisition is Contracting Officer’s Representative, or the Contracting Officer if the POC is unavailable.

9.5.12.7.1. Note: the following clauses have been incorporated in this acquisition - DFARS 252.204.7000 Disclosure of Information, 252.204-7008 Compliance with Safeguarding Covered Defense Information Controls, 252.204-7009 Limitations on the Use or Disclosure of Third-Party Contractor Reported Cyber Incident Information, and 252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting. DFARS Clause 252.204-7000 restricts the release of unclassified information outside contractor's organization without prior Contracting Officer permission, with exceptions; DFARS Clause 252.204-7008 requires contractor compliance with Safeguarding Covered Defense Information Controls; DFARS Clause 252.204-7009 limits the use or disclosure of contractor reported cyber incident information, and DFARS 252.204-7012 requires contractor to provide adequate security for all covered contractor information systems (including implementation of National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 “Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations” in effect at the acquisition is issued) and to comply with cyber incident reporting requirements.