Draft Performance Work Statement- Common Nominations Portal.docx

PERFORMANCE WORK STATEMENT

Common Nominations Portal Section I – Description of Services

General Section 575 of the Fiscal Year 2021 National Defense Authorization Act (NDAA) requires the Secretary of Defense and the Superintendents of the U.S. Military Academy, the U.S. Naval Academy, and the U.S. Air Force Academy to create an online portal to support the Service Academy nominations process, which all applicants must complete to receive an appointment to a Service Academy. The portal must facilitate the nominations selection process for Congressional and non-Congressional nomination sources and provide streamlined data analytics capabilities to support Congressional reporting requirements outlined in Section 575. Additionally, the law requires an annual report to be made publicly available. Agile software development methodologies will be used to rapidly prototype and develop the portal and report creation using software specified by the government.

Scope This action is for the acquisition of non-personal support services to manage, build, and maintain a fully operational online portal that addresses the statutory requirements defined in Section 575 of the FY21 NDAA. Data visualization and data analytics professional support services are required to address Congressional reporting requirements defined in Section 575. The portal will only support the nomination process and corresponding reporting requirements for the U.S. Military Academy, U.S. Naval Academy, and U.S. Air Force Academy.

Background To attend a Military Service Academy (MSA), applicants must apply for admission and receive a nomination from a “nominating source,” an authority that is authorized by law to grant a nomination. Nominating sources include Members of Congress (“Congressional nomination sources”) as well as the Service Secretaries, Service Academy Superintendents, President, and Vice President, among others (“non-Congressional nomination sources”). Prospective applicants to the Service Academies complete separate application processes for admissions and nominations.

Each MSA has its own process and information technology system for collecting nomination information from Congressional and non-Congressional nomination sources. One of the objectives of Section 575 of the FY21 NDAA, titled “Information on Nominations and Applications for Military Service Academies,” is to provide a single online entry point for Congressional and non-Congressional sources to record their nomination decisions. Section 575 details the specific data points that the portal must collect from each nominating source, including demographic information as consistent with Office of Management and Budget (OMB) Directive No. 15.

In addition, Section 575 requires annual Congressional reports to capture data on the demographics of military Service Academy applicants. Some of these data points are currently captured by the MSAs as part of the annual admissions process, while others will be collected as part of the data intake process in the Common Nominations Portal (CNP) being developed, deployed, and maintained.

During this performance period, the CNP is at an advanced stage of development and almost ready for deployment, dependent upon a successful Authorization to Operate (ATO). The first year for the non-personal services would be spent with finalizing development, deployment, and stabilizing the system. The subsequent years would be for sustainment and maintenance. Additional development efforts, as requested by the customer base, will be approved by the government prior to implementation. Training materials and knowledge base articles will be maintained by the contractor and approved by the government. The Configuration Control Board (CCB) and release schedule shall be maintained by the contractor with oversight by the government. Composition of the CCB membership will be determined by the government.

Section I – Tasks

Task 1 – Portal Development and Deployment The Contractor shall leverage software specified by the government to build and deploy the nominations portal.

The CNP shall have the following functions and capabilities for the MSA Admissions staff:

· Multi-factor authentication as well as user/password login.

· The ability to see when congressional offices have and have not submitted nominations.

· Display of nomination information in various ways to determine which congressional offices cannot nominate due to reaching the maximum number of nominations per MSA.

· Communicate with congressional staff directly in the application.

· Report bugs, issues, and enhancement requests to the personnel monitoring the system in order to address help desk requests.

· Perform any action on behalf of congressional staff.

The CNP shall have the following functions and capabilities for the congressional staff members:

· Multi-factor authentication

· Display of applicant information as received from the MSAs

· Allow for nomination selections for each MSA for a nominations cycle

· The ability to view applicant information for those nominated by the congressional member as well as constituent information for those attending MSAs regardless of nomination source.

· Easily view the number of open vacancies and open slots per vacancy.

· Allow for different nominating methods and easy changing of method.

· Principal candidate with numbered alternates

· Principal candidate and unnumbered alternates

· Principal candidate with a mixed of numbered and unnumbered alternates

· No ranking for any candidate

· View nomination sources for any constituent after the nominations cycle is over.

· View training and knowledge base materials as well as Frequently Asked Questions (FAQs).

· Communicate with admissions staff directly in the application.

· Report bugs, issues, and enhancement requests to the personnel monitoring the system in order to address help desk requests.

The Contractor shall provide initial training prior to and during the deployment of the application into production. Training shall be conducted on a routine schedule as determined by the Government. Virtual training shall be offered to congressional staffers and admissions staff members. At times it may be necessary to provide one-on-one training for personnel having major issues with understanding the new system. Congressional staff members have a high turn-over rate.

The Contractor shall assist the COR in obtaining a Preliminary Authorization (PA) or Authority to Operate (ATO) by providing technical specifications required from the authorizing authority.

The Contractor shall apply all STIGS in adherence to National Institute of Standards and Technology (NIST) standards for Risk Management Framework (RMF). The standards require application of Security Technical Implementation Guide (STIG) requirements within the cloud infrastructure.

The Contractor shall ensure the environment for the cloud infrastructure is in adherence of NAVSUP Neptune Cloud Services requirements as stated in SECNAVINST 5510.30C. The environment is RedHat Enterprise servers within an IL4 secure environment.

The Contractor shall work with representatives from the MSAs to obtain data needed to meet the Congressional reporting requirements included in Section 575 of the FY21 NDAA. The Contractor shall leverage a reporting tool specified by the government to produce reports and dashboards for the MSAs for each application cycle.

Report and dashboard elements shall include, but are not limited to, the following topics:

· The number of individuals who submitted an application for admission to an academy for a given application cycle.

· The overall demographics of the applicant pool, disaggregated by the classifications in OMB Directive No. 15.

· The number and percentage who received an offer for appointment to the academy, disaggregated by the classifications in OMB Directive No. 15.

· The number and percentage who accepted an appointment to the academy, disaggregated by the classifications in OMB Directive No. 15.

The report and dashboard elements shall be accessible on a public Department of Defense (DOD) webpage. The Contractor shall work with the relevant representatives from the MSAs and DOD to facilitate posting the report/dashboard elements on the webpage. Additional reports/dashboards will be specified by the government.

Task II- Portal Sustainment Following deployment of the portal in the Base Year, which is estimated to be between February and July of 2027, the Contractor shall operate and maintain the portal in the remainder of the Base Year and the Option Years to refine/enhance the system over time and ensure business continuity. As part of this task, the Contractor shall provide the following services:

· System Administrator functions, such as password resets, license provisioning, user creation and deactivation.

· Defect identification and remediation.

· System refinements and enhancements – the Contractor shall work with the Contracting Officer’s Representative (COR) to identify in-scope features and enhancements that were not included in the initial release and create a prioritized backlog for implementation.

· Ongoing data integration support using software of the government’s selection to complete remaining outstanding integration tasks from Base Year and implement additional integration refinements.

· Ad-hoc training support to assist Government System Administrators and Congressional/Non-Congressional nominating sources with learning portal functionality.

· Help desk monitoring in order to address reported issues. The contractor shall remediate all problems/issues where possible, assign tickets to Admissions personnel where appropriate, and submit higher level requests for software support when issues cannot be resolved.

· Cybersecurity monitoring of both the portal and Neptune Cloud Services environment. This will involve interaction with NAVSUP, when needed, in order to remediate security vulnerabilities.

· Maintain a data mapping document with any updates to data sent to and from the service academies. This information needs to be provided to the Government in order to maintain data interchange agreements between the service academies.

The Contractor shall design, build, and deploy the portal using best practices in Agile and Scrum-based software development (e.g., daily standups, sprint planning and sprint review sessions, sprint demonstrations).

The Contractor shall maintain a Project Management Plan (PMP), which shall provide the basis for performing and controlling the project’s activities. The PMP describes the technical approach, organizational resources, deliverables, documentation, and management controls to be employed to meet the cost, performance, and schedule requirements throughout the period of performance.

These management activities shall establish control, management, monitoring, and notification mechanisms and shall include working with and reporting to the COR to ensure that tasks and their subtasks stay on track and important milestones are met. Representative project management activities include, but are not limited to:

· Plan, organize, secure, and manage resources with appropriate knowledge and skills to perform ongoing activities.

· Create, manage, and control the project work plan and schedules.

· Risk Management including working with the COR on timely risk escalation and resolution.

· Quality Assurance in the form of regular system checks and data integrity checks.

· Coordinate with Government stakeholders to ensure that tasks and subtasks are executed in line with program direction, priorities, and processes.

· Participate in meetings in different capacities, as required.

· Track monthly and cumulative performance metrics as applicable.

· Participate in CCB reviews and provide data/information on the best path forward for requested changes.

Section II – Deliverables

The Contractor shall submit the deliverables that are indicated in the table below to the Government COR. The COR shall evaluate each written deliverable and determine acceptability of services performed and products delivered. The COR shall review and accept/reject the Contractor’s deliverable no later than 15 business days after receipt of a deliverable. If the COR rejects the deliverable, the Contractor shall acknowledge, address and resolve any comments or concerns no later than 10 business days after notification of a rejected deliverable.

Deliverable Description Delivery/Frequency Monthly Status Report Summary of project activities completed over the past month.

Summary of risks from Risk Register and mitigation plans for any future risks.

Summary of any personnel changes (arrivals/departures).

The 15th of every month. If the 15th falls on a weekend, the Monday following the 15th.

Technical Design Document (TDD) The TDD is an ongoing document and shall include an:

Entity Relationship Diagram (ERD), which provides a visual overview of the object relationships and key fields within the portal environment.

User Persona Matrix/Security Model, indicating which user groups should have Read/Write access to specific data objects.

MSA Data Transfers Listing of data items transferred from the MSAs to the data migration tool and data items MSAs receive from the CNP. The listing will be used to create addenda to the data transfer agreements between MSAs. This listing should be updated as changes occur in order to modify the official agreements.

NLT 2 weeks before deployment and updates throughout the contract period of performance

User Guide The User Guide shall provide screenshots and walkthroughs of key portal processes. It shall also provide steps for common troubleshooting issues (for example, resetting a user’s password, configuring a new user in the environment, etc.).

NLT 2 weeks before deployment and updated quarterly as needed

Training Plan The Training Plan shall provide an outline of topics and methodologies that will be addressed during training sessions. The Contractor shall work with the COR to determine the number of training sessions, training session attendees, and training venue (virtual vs. in person).

NLT 2 weeks before scheduled training

Full Deployment from Development to Production Environment It is projected that full deployment into production will occur in option year two. The Salesforce cloud organization, the Mulesoft implementation, and the Tableau report implementation will all move from development to production with full integration testing to ensure data integrity and accuracy in a secure manner.

NLT July 2027 pending the PA or ATO for the system being in place.

Common Nominations Portal The portal will be delivered to the government in a production environment for use by the congressional staffers and admissions staff from the MSAs. All documentation for the portal will be delivered to USNA. A minimal viable product is required, which means full functionality replacement of the legacy systems at the service academies and a single point for nominators to enter their nominations.

NLT end of July 2027 pending the PA or ATO for the system being in place.

Annual Statistical Report The annual statistical report required by law to be available on a publicly accessible website must be filterable, downloadable, and can be sorted. The product to create the report is Tableau, which must be stored in a secure environment. Additionally, the report must adhere to new requirements in OMB Directive #15 Race and Ethnic Standards for Federal Statistics and Administrative Reporting. The military service academies have five (5) years to implement the changes in their Admissions systems, so the report shall account for possible changes from the academies being deployed at different times.

NLT July 2027 pending the PA or ATO for the system being in place.

Full Knowledge Transfer to USNA The turn-over of the systems from the contractor to the government will require several meetings to allow for complete transfer of all documentation and specific knowledge of the maintenance of the system.

NLT end of FY31

Section III– Government-Provided Property & Equipment The Contractor shall furnish all necessary supplies, equipment, facilities, and services required to perform work under this contract. The Government shall furnish the necessary number of laptops needed to access the data migration environment. The Contractor will return the laptops upon completion of the contract. Should any technical issues occur with the government laptops, the Government will replace them.

Section IV – General Information

Privacy Act. Work on this contract may require that personnel have access to information protected by the Privacy Act. Contractor personnel shall adhere to the Privacy Act, Title 5 of the U.S. Code, Section 552a and applicable agency rules and regulations when handling such information.

Records. All records created and received by the Contractor in the performance of this contract shall be maintained and readily accessible. Records shall remain the property of the Government.

Project Policy. The Contractor shall comply with all industry standards. All work shall be done in accordance with all federal, local, and state laws and regulations.

Potential Changes to Legislation. Since this application will be used by congressional staff members, requests will be made for enhancements. Requests for enhancements will be evaluated with respect to the current contractor work force and budgetary restrictions. Should a request be well outside the capabilities of the application it might not be addressed. This could result in laws being enacted which might impact the CNP. If this is the case, additional contractor personnel might be required. This would be evaluated by the government and the government would request to modify the contract to accommodate changes to law.

Non-Personal Services. The Government will not supervise or task Contractor employees in any manner that generates actions of the nature of personal services, or that creates the perception of personal services. It is the responsibility of the Contractor to manage its employees directly and to guard against any actions that are of the nature of personal services or give the perception of personal services to the Government or to Government personnel. If the Contractor feels that any actions constitute, or are perceived to constitute personal services, it is the Contractor’s responsibility to notify the CO immediately. Non-personal Contractor services shall not be used to perform work of a policy/decision making or management nature.

Contracting Officer Representative. The COR will be identified separately from this Performance Work Statement and will be an employee of the U.S. Naval Academy. The COR monitors all technical aspects of the contract and assists in contract administration. The COR is authorized to perform the following functions:

· Assure the contractor performs the technical requirements of the contract.

· Perform inspections necessary in connection with contract performance.

· Maintain written and oral communications with the contractor concerning technical aspects of the contract.

· Issue written interpretations of technical requirements, such as Government product specifications.

· Monitor contractor's performance and notify both the Contracting Officer and contractor of any deficiencies.

A letter of designation issued to the COR, a copy of which is sent to the contractor, states the responsibilities and limitations of the COR, especially regarding changes in cost or price, estimates, or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting order.

Section V – Place of Performance/Travel The Contractor’s place of performance for this contract shall be remote. Day-to-day work shall be conducted virtually via teleconferencing software, e.g. Microsoft Teams, Google Meet, or Zoom.

Contractor personnel may be required to conduct travel in the performance of this contract at the Government’s request. All travel must be pre-approved in writing by the Contracting Officer’s Representative (COR). The Contractor will be reimbursed for travel costs in accordance with Part 31 of Federal Acquisition Regulation (FAR) and the Federal Travel Regulation (FTR).

Section VI – Period of Performance The Period of Performance (POP) is a 1-year (12 month) Base Period plus four (4) 1-year Option Periods that shall be exercised at the discretion of the Contracting Officer.

Section VIII – Security Requirements

General All personnel performing work under this PWS must comply with all applicable Federal, DoD directives, instructions, and standard operating procedures (SOPs) while working on behalf of the Government or accessing and handling information as part of this contract. It is the Contractor’s responsibility to provide personnel that follow the latest security requirements.

Access Control All persons performing work as a part of this contract must be a citizen of the United States and may be required to submit proof of citizenship in the form of a notarized birth certificate, U.S. Passport, U.S. Citizenship and Immigration Service (USCIS) Certificate of Citizenship, or USCIS Certificate of Naturalization. All persons and materials entering Government facilities as part of this contract are subject to inspection at any time.

Information Security All personnel performing work under this contract shall protect and safeguard information in accordance with DoD directives, instructions, and procedures. These same persons shall immediately report, upon discovery, any deviation or violation of this guidance, or any unusual or suspicious activity to the U.S. Naval Academy Command Security Office (CSM). These same persons shall assist and cooperate in any subsequent investigations or inquiries conducted by U.S. Naval Academy or other Governmental agencies.

Confidentiality The project and all material provided to the contractor by the DoD to include results, conclusions, and recommendations obtained thereof shall be considered confidential in nature and treated with the same level of care that the contractor treats its own confidential business information. The information shall not be disclosed, copied, modified, used (except in completion of this project) or otherwise disseminated to any other person or entity at any time to include, but not limited to inclusion in any database external to DoD without DoD's expressed written consent.

Non-Disclosure Unless required by law, the Contractor shall not access, use, or disclose Government data unless specifically authorized by the terms of this PWS issued hereunder. If authorized by the terms of this PWS, any access to, or use or disclosure of, Government data shall only be for purposes specified herein. Contractor shall ensure that each of its employees and representatives, and any others (e.g., subcontractor employees) performing duties hereunder, shall, prior to obtaining access to any Government data, be bound by nondisclosure terms.

SUPTXT204-9400(4-22) CONTRACTOR UNCLASSIFIED ACCESS TO FEDERALLY CONTROLLED FACILITIES, SENSITIVE INFORMATION, INFORMATION TECHNOLOGY SYSTEMS OR PROTECTED HEALTH INFORMATION The investigation of a non-U.S. national at a foreign location must be consistent with a National Agency Check with Written Inquiries (NACI), to the extent possible and include a fingerprint check against the Federal Bureau of Investigation (FBI) criminal history database, an FBI investigations file (name check) search and a name check against the terrorist screening database. Also, the above cited reference notes that Foreign Nationals may not be granted CAC credentials until completion of their investigation and not in the interim. Per Department of Defense Memorandum (DoDM) 5200.2, Department of Defense (DoD) components must initiate and ensure completion of a background investigation before applying the credentialing standards to a non-U.S. national at a foreign location. The background investigation must be favorably adjudicated before a CAC can be issued to a non-U.S. national at a foreign location. The type of background investigation may vary based on standing reciprocity treaties concerning identity assurance and information exchanges that exist between the U.S. and its allies or agency agreements with the host country.

CONTRACTOR UNCLASSIFIED ACCESS TO FEDERALLY CONTROLLED FACILITIES, SENSITIVE INFORMATION, IT SYSTEMS OR PROTECTED HEALTH INFORMATION Executive Order 13467, Reforming Processes Related to Suitability for Government Employee, Fitness for Contractor Employees and Eligibility for Access to Classified National Security Information, Homeland Security Presidential Directive (HSPD)-12, requires government agencies to develop and implement Federal security standards for Federal employees and contractors. The 5 CFR 32 Part 157 in concert with DoD Manual 1000.13, Vol 1, implements the Federal Standards.

APPLICABILITY

This text applies to all DoD sponsored individuals who require CAC eligibility (or login and P/W if acceptable per contract) for: Physical access to DoD facilities or non-DoD facilities on behalf of DoD; Logical access to information systems (whether on site or remotely); or remote access to DoD networks that use only the CAC logon for user authentication, or access to sensitive and protected information. This applies to the Office of the Secretary of Defense (OSD), the Military Departments, the Office of the Chairman of the Joint Chiefs of Staff and the Joint Staff, the Combatant Commands, the Office of the Inspector General of the DoD, the Defense Agencies, the DoD Field Activities and all other organizational entities within the DoD (hereinafter referred to collectively as the "DoD Components"). Each contractor employee providing services at a Navy command under this contract is required to obtain a DoD CAC. Additionally, depending on the level of computer/network access, the contract employee will require a successful investigation as detailed below.

ACCESS TO FEDERAL FACILITIES

Per HSPD-12 and implementing guidance, all contractor employees working at a federally controlled base, facility or activity under this clause will require a DoD CAC. When access to a base, facility or activity is required contractor employees shall in-process with the Command's Security Manager (CSM) upon arrival to the command and shall out-process prior to their departure at the completion of the individual's performance under the contract.

START-UP PERIOD

All contractor resource onboarding documents must be submitted via the prime contractor. The prime contractor shall make all necessary preparations to assume full responsibility for productive performance as of the performance start date.

Definition of "productive":

a. Contractor Information Sheet (CIS)

b. Completed Electronic Investigation (EQIP)

c. All contractor resource(s) must have an active Joint Personnel Adjudication System (JPAS) profile

d. Common Access Card(CAC) Note (1): Invoicing by the contractor will begin as of the commencement of the performance period of services and no reimbursement will be paid by the government for efforts expended during the start-up period.

Note (2): Foreign Nationals are not allowed access to the functional/system side of Enterprise Resource Planning

(ERP).

ACCESS TO DOD INFORMATION TECHNOLOGY (IT) SYSTEM

In Accordance With (IAW) Secretary of the Navy (SECNAV) M-5510.30, contractor employees who require access to Department of the Navy (DoN) or DoD networks are categorized as IT-I, IT-II, or IT-III. The IT-II level, defined in detail in SECNAV M-5510.30, includes positions which require access to sensitive information. Sensitive information includes information protected under the Privacy Act, to include PHI. All contractor employees under this contract who require access to Privacy Act protected information are therefore categorized no lower than IT-II. IT Levels are determined by the requiring activity's Command Information System Security Manager (ISSM)/Information Assurance Manager (IAM).

Contractor employees requiring privileged or IT-2 level access, (when specified by the terms of the contract) require a Single Scope Background Investigation (SSBI) or T5 or T5R equivalent investigation, which is a higher level investigation than the National Agency Check (NAC) with Law and Credit (NACLC)/T3/T3R described below. Due to the privileged system access, an investigation suitable for High Risk national security positions is required. Individuals who have access to system control, monitoring, or administration functions (e.g. system administrator, database admi) require training and certification to Information Assurance (IA) Technical Level 1, and must be trained and certified on the Operating System (OS) or Computing Environment (CE) they are required to maintain.

Access to sensitive IT systems is contingent upon a favorably adjudicated background investigation. When access to IT systems is required for performance of the contractor employee's duties, such employees shall in-process with the Navy CSM and ISSM/IAM manager upon arrival to the Navy command and shall out-process prior to their departure at the completion of the individual's performance under the contract. Completion and approval of a System Authorization Access Request (SAAR) form is required for all individuals accessing Navy IT resources. The decision to authorize access to a government IT system/network is inherently governmental. The contractor supervisor is not authorized to sign the SAAR; therefore, the government employee with knowledge of the system/network access required or the Contracting Officers Representative (COR) shall sign the SAAR as the supervisor.

The SAAR shall be forwarded to the CSM at least thirty (30) days prior to the individual's start date. Failure to provide the required documentation at least thirty (30) days prior to the individual's start date may result in delaying the individual's start date.

When required to maintain access to required IT systems or networks, the contractor shall ensure that all employees requiring access complete annual Cyber Awareness training, and maintain a current requisite background investigation. The contractor's security representative shall contact the CSM for guidance when reinvestigations are required.

INTERIM ACCESS

The CSM may authorize issuance of a DoD CAC and interim access to a DoN or DoD unclassified computer/network upon obtaining an interim clearance. When the results of the investigation are received and a favorable determination is not made, the contractor employee working on the contract under interim access will be denied access to the computer network and this denial will not relieve the contractor of his/her responsibility to perform.

DENIAL OR TERMINATION OF ACCESS

The potential consequences of any requirement under this clause including denial or termination of physical or system access in no way relieves the contractor from the requirement to execute performance under the contract within the timeframes specified in the contract. Contractors shall plan ahead in processing their employees and subcontractor employees. The contractor shall insert this clause in all subcontracts when the subcontractor is permitted to have unclassified access to a federally controlled facility, federally-controlled information system/network and/or to government information, meaning information not authorized for public release.

CONTRACTOR'S SECURITY REPRESENTATIVE

The contractor shall designate an employee to serve as the contractor's security representative. Within three (3) work days after contract award, the contractor shall provide to the requiring activity's Security Manager and the Contracting Officer, in writing, the name, title, address and phone number for the contractor's security representative. The contractor's security representative shall be the primary point of contact on any security matter. The contractor's security representative shall not be replaced or removed without prior notice to the Contracting Officer and CSM. The contractor’s security representative will also act as the Facilities Security Officer for purposes of initiating and following contracted personnel background investigations.

BACKGROUND INVESTIGATION REQUIREMENTS AND SECURITY APPROVAL PROCESS FOR CONTRACTORS ASSIGNED TO NATIONAL SECURITY POSITIONS OR PERFORMING SENSITIVE DUTIES Navy security policy requires that all positions be given a sensitivity value based on level of risk factors to ensure appropriate protective measures are applied. Contractor employees under this contract are recognized as Non-Critical Sensitive [ADP/IT-II] positions when the contract scope of work require physical access to a federally controlled base, facility or activity and/or requiring access to a DoD computer/network, to perform unclassified sensitive duties. This designation is also applied to contractor employees who access Privacy Act and PHI, provide support associated with fiduciary duties, or perform duties that have been identified as National Security Positions. At a minimum, each contractor employee must be a US citizen and have a favorably completed NACLC or T3 or T3R equivalent investigation to obtain a favorable determination for assignment to a non-critical sensitive or IT-II position. The investigation consists of a standard NAC and a FBI fingerprint check plus law enforcement checks and credit check. Each contractor employee filling a non-critical sensitive or IT-II position is required to complete:

- SF-86 Questionnaire for National Security Positions (or equivalent Office of Personnel Management (OPM) investigative product), e.g. EQIP.

- Original Signed Release Statements

Failure to provide the required documentation at least thirty (30) days prior to the individual's start date shall result in delaying the individual's start date. Background investigations shall be reinitiated as required to ensure investigations remain current (not older than ten (10) years) throughout the contract performance period. The contractor's security representative shall contact the CSM for guidance when reinvestigations are required.

Regardless of their duties or IT access requirements ALL contractor employees shall in-process with the CSM upon arrival to the command and shall out-process prior to their departure at the completion of the individual's performance under the contract. Employees requiring IT access shall also check-in and check-out with the Navy command's ISSM/IAM. Completion and approval of a SAAR form is required for all individuals accessing Navy IT resources. The SAAR shall be forwarded to the Navy CSM at least thirty (30) days prior to the individual's start date. Failure to provide the required documentation at least thirty (30) days prior to the individual's start date shall result in delaying the individual's start date.

The contractor shall ensure that each contract employee requiring access to IT systems or networks complete annual Cyber Awareness training, and maintain a current requisite background investigation. Contractor employees shall accurately complete the required investigative forms prior to submission to the CSM. The CSM will review the submitted documentation for completeness prior to submitting it to the OPM; Potential suitability or security issues identified may render the contractor employee ineligible for the assignment. An unfavorable determination is final (subject to SF-86 appeal procedures) and such a determination does not relieve the contractor from meeting any contractual obligation under the contract. The CSM will forward the required forms to OPM for processing. Once the investigation is complete, the results will be forwarded by OPM to the DoD Central Adjudication Facility (CAF) for a determination.

If the contractor employee already possesses a current favorably adjudicated investigation, the contractor shall be input into the appropriate security system (e.g. DISS) by the contractor's security representative. Although the contractor will take JPAS owning role over the contractor employee, the Navy command will take JPAS "Servicing" role over the contractor employee during the hiring process and for the duration of assignment under that contract. The contractor shall include the IT position category per SECNAV M-5510.30 for each employee designated on a VAR. The VAR requires annual renewal for the duration of the employee's performance under the contract.

BACKGROUND INVESTIGATION REQUIREMENTS AND SECURITY APPROVAL PROCESS FOR CONTRACTORS ASSIGNED TO OR PERFORMING NON-SENSITIVE DUTIES Contractor employee whose work is unclassified and non-sensitive (e.g., performing certain duties such as lawn maintenance, vendor services, etc...) and who require physical access to publicly accessible areas to perform those duties shall meet the following minimum requirements:

- Must be either a U.S. citizen or a U.S. permanent resident with a minimum of 3 years of legal residency in the U.S. (as required by the Deputy Secretary of Defense DTM 08-006 or its subsequent DoD Instruction (INST)) and

- Must have a favorably completed NACI or T1 investigation equivalent including a FBI fingerprint check prior to installation access.

To be considered for a favorable trustworthiness determination, the CSR must submit for all employees each of the following:

- SF-85 Questionnaire for Non-Sensitive Positions

- Two FD-258 Applicant Fingerprint Cards (or an electronic fingerprint submission)

- Original Signed Release Statements The contractor shall ensure each individual employee has a current favorably completed NACI or T3 equivalent investigation, or ensure successful FBI fingerprint results have been gained and investigation has been processed with OPM. Failure to provide the required documentation at least thirty (30) days prior to the individual's start date may result in delaying the individual's start date.* Consult with your CSM and ISSM/IAM for local policy when IT-III (non-sensitive) access is required for non-U.S. citizens outside the U.S..* Contractor and all Contractor personnel with access to or responsibility for assisting in the ATO of this contract shall comply with DoD Directive 8500.1E IA, DoDI 8510.01 Risk Management Framework (RMF) for DoD IT, DoD Directive 5400.11 DoD Privacy Program, DoD 5200.2-R Personnel Security Program and HSPD 12.

X.1 Be CAC ready at the IT Level II prior to reporting for work.

X.2 At minimum, all contractor personnel must possess/maintain a favorable Tier 3 investigation; formerly a NAC with Local Agency Check and Credit Check (NACLC). This requirement is critical in order to access the data base systems within NAVSUP. It is Contracting Companies; responsibility to ensure that 100% of the contractors have the Tier 3 investigation/IT Level II. In addition, interim approval of clearances is not authorized.

X.3 Be citizens of the U.S.

X.4 If at any time, any contractor person requiring a CAC is unable to possess/maintain an adjudicated Tier 3 investigation, the contractor shall immediately notify the NAVSUP COR to coordinate removal of such a person from work under this contract.

X.5 Contractor personnel with access to or responsibility for nonpublic government data under this contract must comply with HSPD-12 Personal Identity Verification (PIV) issuance requirements, known as the CAC for NAVSUP.