ATTACHMENT 2 PWS.pdf

[Ver dtd 31 Aug 17] 1 of 15

PERFORMANCE WORK STATEMENT

SHREDDING AND DESTRUCTION SERVICES FOR SPAWARSYSCEN ATLANTIC

SECTION C – DESCRIPTION/SPECS/WORK STATEMENT

SPECIFICATIONS/STATEMENT OF WORK/PERFORMANCE WORK STATEMENT

Work under this performance-based contract will be performed in accordance with the following description/ specifications/ statement of work (SOW) which herein will be referred to as Performance Work Statement (PWS):

SHORT TITLE: COMMAND SHREDDING SERVICES

1.0 PURPOSE

1.1 SCOPE

This PWS provides services to Space and Naval Warfare Systems Center Atlantic (SPAWARSYSCEN Atlantic) in support of the collection, shredding/destruction, and disposal of sensitive Government papers/materials.

1.2 BACKGROUND

The destruction of sensitive Government paperwork will maintain confidentiality to protect from identity theft, in accordance with the following Federal Laws and Regulations:

The Privacy Act of 1974 The Gramm-Leach-Bliley Act of 1999 The Data Protection Act of 1998 DoDD 5200.01-R (Information Security) DoDM 5205.02-M (Operations Security) SECNAV M-5210.1 (Records Management)

2.0 PLACE(S) OF PERFORMANCE

The contractor shall provide support at the following location:

a. SPAWARSYSCEN Atlantic (Charleston, SC)

b. SPAWARSYSCEN Atlantic (St. Julien’s Creek Annex/Hampton Roads, VA)

2.1 GOVERNMENT FACILITIES

No Government facilities (i.e., office space or lab space) are provided on this contract.

2.2 CONTRACTOR FACILITIES

The contractor can have its facility location anywhere as long as the location does not present a hardship to complete work required on task. The contractor shall have real-time communication between the contractor personnel supporting the efforts and government personnel available at time of award.

3.0 PERFORMANCE REQUIREMENTS

The following paragraphs list all required non-personal services tasks that will be required throughout the contract. The contractor shall provide all resources necessary to accomplish the tasks within the identified timeframe. The contractor shall perform requirements in accordance with Federal Acquisition Regulation (FAR) and/or Defense Federal Acquisition Regulation Supplement (DFARS), which do not include performance of inherently governmental functions. The contractor shall

[Ver dtd 31 Aug 17] 2 of 15 complete all required tasks while controlling and tracking performance and goals in terms of costs, schedules, and resources.

3.1 DOCUMENT COLLECTION

For the purposes of this contract, the materials to be shredded/destroyed include, but are not limited to, paper photos, printouts, floppy disk, compact disk, notes, sticky-back paper, envelops, work papers, papers with staples, carbon paper, or any other material containing names, addresses, social security number (SSN), credit information, and any confidential information which has served its purpose to render them unusable and unreadable. All material shredded is considered sensitive and unclassified.

3.1.1 Collection Requirements – General

The contractor shall provide personnel, equipment, tools, materials, supervision, disposal transportation, and other items and services necessary to shred/destroy all material identified above and remove the shredded material from SPAWARSYSCEN Atlantic locations upon completion of the shredding process. The contractor shall meet the following criteria:

3.1.1.1 Only security cleared and bonded employees of the contractor (covered under the contract company’s business license, proper insurance, and payments to a surety company for protection by a bond) will collect/handle the material for shredding.

3.1.1.2 The contractor shall perform collection and shredding as scheduled including during periods of inclement weather unless specific approval to delay is requested by the contractor and approved by SPAWARSYSCEN Atlantic. Such approval will normally be granted only in cases of particularly severe weather, such as snow storms or tornados, etc. When approval to reschedule shredding is granted, the contractor shall accomplish all tasks within 24 hours after the severe weather has terminated, unless otherwise coordinated with the Government Representative. The contractor shall not request additional cost for schedule changes due to inclement weather.

3.1.1.3 The contractor shall clean up any spillage of paper/material that occurs as a result of the contractor’s actions during the shredding process. The contractor shall continue with the shredding process to include any paper/material found during clean up.

3.1.1.4 The contractor shall consider all material designated for destruction under this contract as proprietary to SPAWARSYSCEN Atlantic and shall safeguard all material designated for destruction until such time as destruction of material is certified as complete.

3.1.1.5 The contractor shall report all problems and issues regarding material shredding or disposal to the Government Representative.

3.1.2 Collection Requirements – One-Time Document Collection and Destruction Service The contractor will conduct one-time document collection and destruction services at both SPAWARSYSCEN Charleston, SC and St. Julien’s Creek Annex/Hampton Roads, VA, as described in the following paragraphs.

3.1.2.1 (CLIN 0001) Within the first 30 days after contract award, the contractor shall contact the Government Representative at SPAWARSYSCEN Atlantic (Charleston, SC) and schedule a one-time shred event to eliminate a backlog of approximately 50 pallets of material (paper). The amount of material per pallet may vary, and will contain a combination of 24-32 banker (10” x 15” x 24”) and standard-paper storage (12” x 12” x 12”) boxes. There are approximately 500 pounds/pallet. For contract cost estimation, task would require a total of 72 – 95 gallon (350 pound) capacity container loads to complete. The material is located at the SPAWARSYSCEN Atlantic receiving warehouse at 1639 Avenue B, North Charleston. The contractor shall perform the shred event during business

[Ver dtd 31 Aug 17] 3 of 15 hours, between 7 A.M. and 3 P.M. eastern standard time (EST), Monday through Friday. The contractor shall use a vehicle as describe in Para 3.2 to complete this on-site shred event.

3.1.2.2 (CLIN 0002) A one-time purge event will be conducted annually at one of the SPAWARSYSCEN Atlantic (St. Julien’s Creek Annex/Hampton Roads, VA) locations and coordinated with the on-site Government Representative. This event will be conducted at one of the locations listed in Para 3.1.3.1, and should be estimated at a total of 64 – 95 gallon (350 pound) capacity containers. The contractor shall perform the shred event during business hours, between 7 A.M. and 3 P.M. EST, Monday through Friday, using a vehicle as described in Para 3.2 to complete this on-site shred even.

3.1.3 Reoccurring Collection Requirements – (CLIN 0003 & CLIN 0004) The contractor shall provide for the secure collection and regularly-scheduled paper shredding destruction services of material located at both SPAWARSYSCEN Charleston, SC and St. Julien’s Creek Annex/Hampton Roads, VA. This shall be done using contractor-supplied 65 gallon (approximately 250 pounds), secure, locked containers, and as described in the following paragraphs.

3.1.3.1 This service will include a maximum of six visits per year for the collection and shredding of material from multiple locations throughout the SPAWARSYSCEN Atlantic facilities, as outlined below:

a. SPAWARSYSCEN Atlantic (Charleston, SC) Buildings in proximity to Building 3147, 1 Innovation Drive, N. Charleston, SC 29410.

1.) Joint Base Charleston, South Annex –33 Containers 2.) Charleston Naval Shipyard, North Yard – 4 Containers 3.) Charleston Naval Shipyard, Building 198 – 8 Containers 4.) Charleston Naval Shipyard, Building 187 & 237 – 5 Containers total

b. SPAWARSYSCEN Atlantic (St. Julien’s Creek Annex/Hampton Roads, VA) –

1.) Norfolk Naval Base, Building Z-133, 1837 Morris St., Norfolk, VA - 2 Containers 2.) Norfolk Naval Base, Building V-53, 9456 4th Avenue, Norfolk VA - 2 Containers 3.) St. Julien's Creek Annex (NNSY), Buildings in proximity (within 1 mile) to Building 178, 178 Marsh Road, Portsmouth, VA - 14 Containers 4.) JEB Little Creek Fort Story, Building 1558, 2425 Stalwart Road, Virginia Beach, VA - 2

Containers

If a situation occurs that would require a relocation of the on-site shredding area, SPAWARSYSCEN Atlantic will approve a temporary shred location as agreed upon prior to the shred event taking place.

3.1.3.2 The contractor shall not charge overtime to complete this task. The contractor shall use a vehicle as describe in Para 3.2 to complete the on-site shred event.

3.2 SHREDDING AND DISPOSITION

3.2.1 General Requirements

3.2.1.1 The contractor shall provide on-site shredding services to handle a variety of unclassified materials collected. Contractor employees directly responsible for access on base and handling the material throughout the shredding process shall be security cleared and bonded.

3.2.1.2 The shredder must make paper documents containing personally identifiable information (PII) unrecognizable or beyond reconstruction. Department of Navy (DoN) policy does not specify specific particle size requirements, but best practice states that a cross-cut shredder should be used, and particles should be 1 X 5 mm or smaller. Due to vehicle shredding size limitations and no

[Ver dtd 31 Aug 17] 4 of 15 classified document requirements, particles should be at Level P-3 or smaller using the DIN 66399 industry standard or equivalent for paper shredders

3.2.2.3 Vehicles used by the contractor for shredding shall have watertight bodies which do not permit loss of paper/material. Open-box trucks, with or without canvas cover, shall not be used.

Collection vehicles shall be operated in accordance with activity rules and regulations while in the activity area, and shall be kept closed when moving or when not actually engaged in shredding activity. All vehicular equipment shall be maintained in good repair and in a safe and clean condition.

The contractor’s name must be painted or otherwise displayed prominently on each contractor owned vehicle. Vehicles used for shredding and transporting material to the disposal site shall have locking capability and are required to be locked.

3.2.2.4 After specified destruction is accomplished, shredded material shall be transported and properly disposed in accordance with all applicable local, state, and federal laws and regulations. All shredded paper shall be 100% securely recycled to the greatest extent possible.

3.2.2.5 The contractor shall report the total amount of paper shredded based on the total weight of the shredded material. The contractor shall provide the shredded weight amount on each submitted invoice. The contractor shall pay all associated cost with each disposal.

4.0 INFORMATION TECHNOLOGY (IT) SERVICES REQUIREMENTS

The services provided on contract are not IT related.

5.0 CONTRACT ADMINISTRATION

Administration of the work being performed is required; it provides the Government a means for contract/task order management and monitoring. Regardless of the level of support, the ultimate objective of the contractor is ensuring the Government’s requirements are met, delivered on schedule, and performed within budget.

5.1 CONTRACTING OFFICER REPRESENTATIVE (COR) DESIGNATION

This SAP contract is not technically complex and does not require a COR. A Government Representative will report to the Contracting Officer that all products and/or service from the contractor have been delivered and accepted. The Government Representative for this contract is Mr. Steven H.

Beuchler, phone (843)218-4198, and email steven.beuchler@navy.mil.

5.2 CONTRACTOR MONITORING AND MAINTENANCE

The contractor shall have processes established in order to provide all necessary resources and documentation during various times throughout the day including business and non-business hours in order to facilitate a timely contract/task order response or modification in particular during urgent requirements.

5.2.1 Contract Administration & Documentation

Various types of administration documents are required throughout the life of the contract. At a minimum, the contractor shall provide the following documentation:

5.2.1.1 Enterprise-wide Contractor Manpower Reporting Application Pursuant to NMCARS 5237.102-90, the contractor shall report all contractor labor hours (including subcontractor labor hours) required for performance of services provided under this task order for the DoD via a secure data collection website – Enterprise-wide Contractor Manpower Reporting Application (eCMRA). The Product/Service Codes (PSC) for contracted services excluded from reporting are as follows:

[Ver dtd 31 Aug 17] 5 of 15

(1) W, Lease/Rental of Equipment;

(2) X, Lease/Rental of Facilities;

(3) Y, Construction of Structures and Facilities;

(4) S, Utilities ONLY;

(5) V, Freight and Shipping ONLY.

The contractor shall completely fill-in all required data fields using the following web address:

https://www.ecmra.mil/. Reporting inputs consists of labor hours executed during the task order period of performance within each Government fiscal year (FY) which runs from October 1 through September 30. While inputs may be reported any time during the FY, the contractor shall report all data in the applicable FY no later than October 31 of each calendar year. Contractors may direct questions to the help desk email accessible through the eCMRA web address listed above.

5.2.1.2 WAWF Invoicing Notification and Support Documentation Pursuant to DFARS clause 252.232-7003 and 252.232-7006, the contractor shall submit payment requests and receiving reports using DoD Invoicing, Receipt, Acceptance, and Property Transfer (iRAPT) application (part of the Wide Area Work Flow (WAWF) e-Business Suite) which is a secure Government web-based system for electronic invoicing, receipt, and acceptance. The contractor shall provide e-mail notification to the Government Representative when payment requests are submitted to the iRAPT/WAWF and if requested, the contractor shall include cost back–up documentation (e.g., delivery receipts, time sheets, & material/travel costs, etc.) to the invoice in iRAPT/WAWF. When requested by the Government Representative, the contractor shall directly provide a soft copy of the invoice and any invoice supporting documentation (CDRL A001) directly to the Government Representative within 24 hours of request to assist in validating the invoiced amount against the products/services provided during the billing cycle.

5.3 CONTRACTOR PERFORMANCE MANAGEMENT

In support of tracking contractor performance, the contractor shall provide a Cost and Schedule Milestone Plan (CDRL A002) within 10 days after contract award.

6.0 DOCUMENTATION AND DELIVERABLES

6.1 CONTRACT DATA REQUIREMENTS LIST (CDRL)

The following listing identifies the data item deliverables required under this contract and the applicable section of the PWS for which they are required. Section J includes the DD Form 1423s that itemize each Contract Data Requirements List (CDRL) required under the basic contract. The contractor shall establish a practical and cost-effective system for developing and tracking the required CDRLs generated under each task. The contractor shall not develop any CDRL classified TOP SECRET with SCI.

CDRL # Deliverable Title

PWS

Reference Para

Frequency Date Due

A001 Invoice Support Documentation 5.2.1.2 ASREQ Within 24 hrs from request

A002 Cost and Milestones Schedule Plan

5.3

One time with revisions

(ONE/R)

NLT 10 Days after contract award

(DACA) revision NLT 7 days after receipt of Govt review https://www.ecmra.mil/

[Ver dtd 31 Aug 17] 6 of 15

6.2 ELECTRONIC FORMAT

At a minimum, the contractor shall provide deliverables electronically by e-mail; hard copies are only required if requested by the Government. To ensure information compatibility, the contractor shall guarantee all deliverables (i.e., CDRLs), data, correspondence, and etc., are provided in a format approved by the receiving Government representative.

7.0 QUALITY

7.1 QUALITY SYSTEM

Upon contract award, the prime contractor shall have and maintain a quality system that meets contract and task order requirements and program objectives while ensuring customer satisfaction and defect-free products/process. The contractor shall have an adequately documented quality system which contains processes, procedures, planning, and all other documentation and data necessary to provide an efficient and effective quality system, which includes an internal auditing system. The contractor shall make their quality system available to the Government for review at both a program and worksite services level during predetermined visits. Existing quality documents that meet the requirements of this task order may continue to be used. If any quality documentation is disapproved or requires revisions, the contractor shall correct the problem(s) and submit revised documentation NLT 2 weeks after initial disapproval notification. The contractor shall also require all subcontractors to possess a quality assurance and control program commensurate with the services and supplies to be provided as determined by the prime’s internal audit system. The Government reserves the right to disapprove the contractor’s and/or subcontractor’s quality system or portions thereof when the quality system(s) fails to meet contractual requirements at either the program or worksite services level. The Government reserves the right to participate in the process improvement elements of the contractor’s quality assurance plan or quality system, and development of quality related documents. At a minimum, the contractor shall ensure their quality system meets the following key criteria:

• Establish documented, capable, and repeatable processes

• Track issues and associated changes needed

• Monitor and control critical process, product, and service variations

• Establish mechanisms for feedback of field product and service performance

• Implement and effective root-cause analysis and corrective action system

• Establish methods and procedures and create data used for continuous process improvement

7.2 MANAGE QUALITY COMPLIANCE

7.2.1 General

The contractor shall have quality processes or a Quality Management System (QMS) processes in place that coincide with the Government’s Manage Quality processes which address Quality Control, Quality Assurance, Software Quality, and/or project Quality System tasks. The contractor shall use best industry practices including, when applicable, ISO/IEC 15288 for System life cycle processes and ISO/IEC 12207 for Software life cycle processes. As applicable, the contractor shall also support and/or participate in Acquisition Milestones, Phases, and Decision Points, which are standard elements of the Defense Acquisition System and support DoDD 5000.01 and DoDI 5000.02. The contractor shall provide technical program and project management support that will mitigate the risks to successful program execution including employment and objective evidence of Lean Six Sigma, Risk Management, and System Engineering methodologies; and System and Software Engineering best practices.

7.3 QUALITY ASSURANCE

The contractor shall perform all quality assurance process audits necessary in the performance of the various tasks as assigned and identified in the contractor‘s Quality Assurance Plan (QAP) or by the respective WBS, POA&M, or quality system/QMS documentation in support of continuous

[Ver dtd 31 Aug 17] 7 of 15 improvement. The contractor shall deliver related QAP and any associated procedural documents upon request. The Government reserves the right to perform any additional audits deemed necessary to assure that the contractor processes, products, and related services, documents, and material meet the prescribed requirements and to reject any or all processes or related products, services, documents, and material in a category when noncompliance is established.

7.4 QUALITY CONTROL

The contractor shall perform all quality control inspections necessary in the performance of the various tasks as assigned and identified in the contractor QAP or by the respective WBS, POA&M, or quality system/QMS documentation. The Government reserves the right to perform any inspections or pull samples as deemed necessary to assure that the contractor provided services, documents, material, and related evidence meet the prescribed requirements and to reject any or all services, documents, and material in a category when nonconformance is established.

8.0 SECURITY

8.1 ORGANIZATION

8.1.1 Security Classification

All work performed under this contract is “unclassified.” A facility security clearance (FCL) is not required; therefore, DoD Contract Security Classification Specification, DD Form 254, does not exist.

Pursuant to DoDM 5200.01 – Volume 4, Controlled Unclassified Information (CUI), the contractor shall safeguard any sensitive Government information.

8.2 PERSONNEL

The contractor shall conform to the security provisions of DoDI 5220.22/DoD 5220.22-M – National Industrial Security Program Operating Manual (NISPOM), SECNAV M-5510.30, DoD 8570.01-M, and the Privacy Act of 1974. Prior to any labor hours being charged on contract/task order, the contractor shall ensure all personnel (including administrative and subcontractor personnel) have obtained and can maintain favorable background investigations at the appropriate level(s) for access required for the contract/task order. A favorable background determination is determined by either a Tier 1 (T1) investigation, Tier 3 (T3) investigation, or Tier 5 (T5) investigation and favorable Federal Bureau of Investigation (FBI) fingerprint checks. Investigations are not necessarily required for personnel performing unclassified work who do not require access to Government installations/facilities, Government IT systems and IT resources, or SPAWARSYSCEN Atlantic information. Cost to meet these security requirements is not directly chargeable to contract/task order.

NOTE: If a final determination is made that an individual does not meet or cannot maintain the minimum security fitness requirements, the contractor shall permanently remove the individual from SPAWARSYSCEN Atlantic facilities, projects, and/or programs. If an individual who has been submitted for a fitness determination or security clearance is "denied," receives an "Interim Declination," or unfavorable fingerprint, the contractor shall remove the individual from SPAWARSYSCEN Atlantic facilities, projects, and/or programs until such time as the investigation is fully adjudicated or the individual is resubmitted and is approved. All contractor and subcontractor personnel removed from facilities, projects, and/or programs shall cease charging labor hours directly or indirectly on contract/task orders.

8.2.1 Access Control of Contractor Personnel

8.2.1.1 Physical Access to Government Facilities and Installations Contractor personnel shall physically access Government facilities and installations for purposes of site visitation, supervisory and quality evaluation, work performed within Government spaces (either

[Ver dtd 31 Aug 17] 8 of 15 temporary or permanent), or meeting attendance. Individuals supporting these efforts shall comply with the latest security regulations applicable to the Government facility/installation.

(a) The majority of Government facilities require contractor personnel to have an approved visit request on file at the facility/installation security office prior to access. For admission to SPAWARSYSCEN Atlantic facilities/installations, the contractor shall forward a visit request to Joint Personnel Adjudication System (JPAS) /SMO 652366, or submit request on company or agency letterhead by fax to (843)218-4045 or mail to Space and Naval Warfare Systems Center Atlantic, P.O.

Box 190022, North Charleston, SC 29419-9022, Attn: Security Office. For visitation to Hampton Roads facility locations, the contractor shall forward visit request documentation to JPAS SMO N65580, fax to (757) 541-5860, or mail to Space and Naval Warfare Systems Center Atlantic, 2425 Stalwart Road, Virginia Beach, VA 23459, ATTN: Security Office. For all other Government locations, the contractor shall forward visit request documentation directly to the on-site facility/installation security office.

(b) Depending on the facility/installation regulations, contractor personnel shall present a proper form of identification(s) and vehicle proof of insurance or vehicle rental agreement. NOTE:

SPAWARSYSCEN Atlantic facilities located on Joint Base Charleston require a Common Access Card (CAC) each time physical installation access is required. Contractor shall contact SPAWARSYSCEN Atlantic Security Office directly for latest policy.

(c) All contractor persons engaged in work while on Government property shall be subject to inspection of their vehicles at any time by the Government, and shall report any known or suspected security violations to the Security Department at that location.

8.2.1.2 Identification and Disclosure Requirements

Regardless if a contractor is physically located on Government installation or not, the contractor and subcontractor employees shall take all means necessary to not represent themselves as Government employees. All contractor personnel shall follow the identification and Government facility disclosure requirement as specified in contract clause 5252.237-9602, Contractor Identification.

8.2.1.3 Government Badge Requirements

Some contract personnel shall require a Government issued picture badge in accordance with contract clause 5252.204-9202, Contractor Picture Badge. While on Government installations/facilities, contractors shall abide by each site’s security badge requirements. Various Government installations are continually updating their security requirements to meet Homeland Security Presidential Directive (HSPD-12) identification standards. Contractors are responsible for obtaining and complying with the latest security identification requirements for their personnel. Contractors shall submit valid paper work (e.g., site visit request, request for picture badge, and/or SF-86 for CAC) to the applicable Government security office via the Government Representative or Contracting Officer. The contractor shall track all personnel holding local Government badges at the contract/task order level.

8.2.1.4 Common Access Card (CAC) Requirements

Some Government facilities/installations (e.g., Joint Base Charleston) require contractor personnel to have a CAC for physical access to the facilities or installations. Contractors supporting work that requires access to any DoD IT/network also requires a CAC. Granting of logical and physical access privileges remains a local policy and business operation function of the local facility. The contractor is responsible for obtaining the latest facility/installation and IT CAC requirements from the applicable local Security Office. When a CAC is required to perform work, contractor personnel shall be able to meet all of the following security requirements prior to work being performed:

(a) Pursuant to DoDM 1000.13-V1, issuance of a CAC is based on the following four criteria:

1. Eligibility for a CAC – to be eligible for a CAC, Contractor personnel’s access requirement shall meet one of the following three criteria: (a) individual requires access to multiple DoD facilities or access to multiple non-DoD federally controlled facilities on behalf of the

[Ver dtd 31 Aug 17] 9 of 15

SPAWARSYSCEN Atlantic on a recurring bases for a period of 6 months or more, (b) individual requires both access to a DoD facility and access to DoD network on site or remotely, or (c) individual requires remote access to DoD networks that use only the CAC logon for user identification.

2. Verification of DoD affiliation from an authoritative data source – CAC eligible personnel must be registered in the Defense Enrollment Eligibility Reporting Systems (DEERS) through either an authoritative personnel data feed from the appropriate Service or Agency or Trusted Associated Sponsorship System (TASS).

3. Completion of background vetting requirements according to FIPS PUB 201-2 and DoD 5200.2-R – at a minimum, the completion of FBI fingerprint check with favorable results and submission of a T1 investigation to the Office of Personnel Management (OPM), or a DoD-determined equivalent investigation. NOTE: Contractor personnel requiring logical access shall obtain and maintain a favorable T3 investigation. Contractor personnel shall contact the SPAWARSYSCEN Atlantic Security Office to obtain the latest CAC requirements and procedures.

4. Verification of a claimed identity – all contractor personnel shall present two forms of identification in its original form to verify a claimed identity. The identity source documents must come from the list of acceptable documents included in Form I-9, OMB No. 115-0136, Employment Eligibility Verification. Consistent with applicable law, at least one document from the Form I-9 list must be a valid (unexpired) State or Federal Government-issued picture identification (ID). The identity documents will be inspected for authenticity, scanned, and stored in the DEERS.

(b) When a contractor requires logical access to a Government IT system or resource (directly or indirectly), the required CAC will have a PKI. A hardware solution and software (e.g., ActiveGold) is required to securely read the card via a personal computer. Pursuant to DoDM 1000.13-V1, CAC PKI certificates will be associated with an official Government issued e-mail address (e.g. .mil, .gov, .edu). Prior to receipt of a CAC with PKI, contractor personnel shall complete the mandatory Cybersecurity Awareness training and submit a signed System Authorization Access Request Navy (SAAR-N) form to the contract/task order specified Government Representative. Note: In order for personnel to maintain a CAC with PKI, each contractor employee shall complete annual cybersecurity training. The following guidance for training and form submittal is provided; however, contractors shall seek latest guidance from their appointed company Security Officer and the SPAWARSYSCEN Atlantic Information Systems Security Management (ISSM) office:

1. For annual DoD Cybersecurity/IA Awareness training, contractors shall use this site:

https://twms.nmci.navy.mil/. For those contractors requiring initial training and do not have a CAC, contact the SPAWARSYSCEN Atlantic ISSM office at phone number (843)218-6152 or e-mail questions to ssc_lant_iam_office.fcm@navy.mil for additional instructions.

Training can be taken at the IAM office or online at http://iase.disa.mil/index2.html.

2. For SAAR-N form, the contractor shall use OPNAV 5239/14 (Rev 9/2011). Contractors can obtain a form from the SPAWARSYSCEN Atlantic ISSM office at or from the website:

https://navalforms.documentservices.dla.mil/. Digitally signed forms will be routed to the ISSM office via encrypted e-mail to ssclant_it_secmtg@navy.mil.

8.2.1.5 Contractor Check-in and Check-out Procedures

All SPAWARSYSCEN Atlantic contractor personnel requiring or possessing a Government badge and/or CAC for facility and/or IT access shall have a SPAWARSYSCEN Atlantic Government sponsor and be in compliance with the most current version of Contractor Check-in and Check-out Instruction and Forms as posted on the Command Operating Guide (COG) website. Throughout contract performance, the contractor shall provide necessary employee information and documentation for employees hired, transferred, and/or terminated in support of this contract within the required timeframe as cited in the Check-in and Check-out instructions. The contractor (FSO, if applicable) shall ensure all contractor employees whose services are no longer required on this contract return all applicable Government documents/badges to the appropriate Government Representative. If the contractor does not have access to the SPAWARSYSCEN Atlantic COG https://twms.nmci.navy.mil/ mailto:ssc_lant_iam_office.fcm@navy.mil http://iase.disa.mil/index2.html https://navalforms.documentservices.dla.mil/ mailto:ssclant_it_secmtg@navy.mil

[Ver dtd 31 Aug 17] 10 of 15 website, the contractor shall get all necessary instruction and forms from the Government Representative.

8.2.1.6 Accessing Navy Enterprise Resources Planning (ERP) System Contractor personnel shall not access the Navy Enterprise Resource Planning (Navy ERP) system.

8.3 OPERATIONS SECURITY (OPSEC) REQUIREMENTS

Security programs are oriented towards protection of classified information and material. Operations Security (OPSEC) is an operations function which involves the protection of any critical information

– focusing on unclassified information that may be susceptible to adversary exploitation. Pursuant to DoDD 5205.02E and SPAWARINST 3432.1, SPAWARSYSCEN Atlantic’s OPSEC program implements requirements in DoD 5205.02-M – OPSEC Program Manual and SPAWARSYSCENLANTINST 3070.1B. Note: OPSEC requirements are applicable when contract personnel have access to either classified information or unclassified Critical Program Information (CPI)/sensitive information.

8.3.1 Local and Internal OPSEC Requirement

Contractor personnel, including subcontractors if applicable, shall adhere to the OPSEC program policies and practices as cited in the SPAWARINST 3432.1 and existing local site OPSEC procedures. The contractor shall development their own internal OPSEC program specific to the contract and based on SPAWARSYSCEN Atlantic OPSEC requirements. At a minimum, the contractor’s program shall identify the current SPAWARSYSCEN Atlantic site OPSEC Officer/Coordinator.

8.3.2 OPSEC Training

Contractor shall track and ensure applicable personnel receive initial and annual OPSEC awareness training in accordance with requirements outlined in Para 8.3.1. OPSEC training requirements are applicable for personnel during their entire term supporting this SPAWARSYSCEN Atlantic contract.

8.3.3 SPAWARSYSCEN Atlantic OPSEC Program

Contractor shall participate in SPAWARSYSCEN Atlantic OPSEC program briefings and working meetings, and the contractor shall complete any required OPSEC survey or data call within the timeframe specified.

8.4 INFORMATION SYSTEM SECURITY

8.4.1 Electronic Communication

The contractor shall have broadband Internet connectivity and an industry standard email system for communication with the Government. The contractor shall be capable of Public Key Infrastructure (PKI) client side authentication to DoD private web servers. Unless otherwise specified, all key personnel on task shall be accessible by e-mail through individual accounts during all hours.

8.4.2 Information Security

Pursuant to DoDM 5200.01, the contractor shall provide adequate security for all unclassified DoD information passing through non-DoD information system including all subcontractor information systems utilized on task. The contractor shall disseminate unclassified DoD information within the scope of assigned duties and with a clear expectation that confidentiality is preserved. Examples of such information include the following: non-public information provided to the contractor, information developed during the course of the contract, and privileged contract information (e.g., program schedules and contract-related tracking).

8.4.2.1 Safeguards

[Ver dtd 31 Aug 17] 11 of 15

The contractor shall protect Government information and shall provide compliance documentation validating they are meeting this requirement in accordance with DFARS clause 252.204-7012. The contractor and all subcontractors shall abide by the following safeguards:

(a) Do not process DoD information on public computers (e.g., those available for use by the general public in kiosks or hotel business centers) or computers that do not have access control.

(b) Protect information by at least one physical or electronic barrier (e.g., locked container or room, login and password) when not under direct individual control.

(c) Sanitize media (e.g., overwrite) before external release or disposal.

(d) Encrypt all information that has been identified as controlled unclassified information (CUI) when it is stored on mobile computing devices such as laptops and personal digital assistants, or removable storage media such as portable hard drives and digital optical disks, using DoD Authorized Data-at-Rest encryption technology. NOTE: Thumb drives are not authorized for DoD work, storage, or transfer. Use GSA Awarded DAR solutions (GSA # 10359) complying with ASD- NII/DOD-CIO Memorandum, “Encryption of Sensitive Unclassified Data-at-Rest on Mobile Computing Devices and Removable Storage.” The contractor shall ensure all solutions meet FIPS 140-2 compliance requirements.

(e) Limit information transfer to subcontractors or teaming partners with a need to know and a commitment to at least the same level of protection.

(f) Transmit e-mail, text messages, and similar communications using technology and processes that provide the best level of privacy available, given facilities, conditions, and environment.

Examples of recommended technologies or processes include closed networks, virtual private networks, public key-enabled encryption, and Transport Layer Security (TLS). Encrypt organizational wireless connections and use encrypted wireless connection where available when traveling. If encrypted wireless is not available, encrypt application files (e.g., spreadsheet and word processing files), using at least application-provided password protection level encryption.

(g) Transmit voice and fax transmissions only when there is a reasonable assurance that access is limited to authorized recipients.

(h) Do not post DoD information to Web site pages that are publicly available or have access limited only by domain or Internet protocol restriction. Such information may be posted to Web site pages that control access by user identification or password, user certificates, or other technical means and provide protection via use of TLS or other equivalent technologies. Access control may be provided by the intranet (vice the Web site itself or the application it hosts).

(i) Provide protection against computer network intrusions and data exfiltration, minimally including the following:

1. Current and regularly updated malware protection services, e.g., anti-virus, anti-spyware.

2. Monitoring and control of inbound and outbound network traffic as appropriate (e.g., at the external boundary, sub-networks, individual hosts) including blocking unauthorized ingress, egress, and exfiltration through technologies such as firewalls and router policies, intrusion prevention or detection services, and host-based security services.

3. Prompt application of security-relevant software patches, service packs, and hot fixes.

[Ver dtd 31 Aug 17] 12 of 15

(j) As applicable, comply with other current Federal and DoD information protection and reporting requirements for specified categories of information (e.g., medical, critical program information (CPI), personally identifiable information, export controlled).

(k) Report loss or unauthorized disclosure of information in accordance with contract requirements and mechanisms.

8.4.2.2 Compliance

Pursuant to DoDM 5200.01, the contractor shall include in their quality processes procedures that are compliant with information security requirements.

9.0 GOVERNMENT FURNISHED INFORMATION (GFI)

Government Furnished Information (GFI) is Government owned intellectual property provided to contractors for performance on a contract. For the purposes of this contract, GFI includes manuals, technical specifications, maps, building designs, schedules, drawings, test data, etc. Depending on information contained in a document, the contractor shall comply with additional controls (e.g., completion of a Non-Disclosure Agreements, etc.) for access and distribution.

GFI is not anticipated on this contract.

10.0 GOVERNMENT PROPERTY

As defined in FAR Part 45, Government property is property owned or leased by the Government which includes Government-furnished property (GFP) and Contractor-acquired property (CAP).

Government property is material, equipment, special tooling, special test equipment, and real property.

Government property is not anticipated on this contract.

11.0 TRAVEL

No travel requirements are anticipated under this contract.

12.0 SAFETY ISSUES

12.1 OCCUPATIONAL SAFETY AND HEALTH REQUIREMENTS

The contractor shall be responsible for ensuring the safety of all company employees, other working personnel, and Government property. The contractor is solely responsible for compliance with the Occupational Safety and Health Act (OSHA) (Public Law 91-596) and the resulting applicable standards, OSHA Standard 29 CFR 1910 (general), 1915 (shipboard/submarine) and 1926 (shore), and for the protection, safety and health of their employees and any subcontractors assigned to the contracts. Without Government assistance, the contractor shall make certain that all safety requirements are met, safety equipment is provided, and safety procedures are documented as part of their quality management system. If performing within Government facilities, contractor shall immediately report any accidents involving Government or contractor personnel injuries or property/equipment damage to the Contracting Officer and Government Representative.

Additionally, the contractor is responsible for securing the scene and impounding evidence/wreckage until released by the Contracting Officer or on-site Government Representative.

12.2 SAFETY EQUIPMENT

The contractor shall provide their personnel with any safety equipment required to perform work under this contract and the equipment must be in satisfactory working order. Personal safety

[Ver dtd 31 Aug 17] 13 of 15 equipment includes items such as hard-hats, safety shoes, safety gloves, goggles, hearing protection, non-flammable clothing for hot work personnel, gas/oxygen detectors for confined spaces, face shields, and other types of safety equipment required to assure a safe work environment and compliance with applicable federal, state and local safety regulations.

12.3 SAFETY TRAINING

The contractor shall be responsible to train all personnel that require safety training. Specifically, where contractors are performing work at Navy shore installations, that requires entering manholes or underground services utility the contractor shall provide a qualified person as applicable in 29 CFR 1910 or 29 CFR 1926 or as recommended by the National Institute for Occupational Safety and Health (NIOSH) Criteria Document for Confined Spaces. Also, when contractors are required to scale a tower, all applicable personnel shall have Secondary Fall Protection and Prevention training.

13.0 SUBCONTRACTING REQUIREMENTS

The contractor shall identify the use of all subcontractors throughout the performance of the contract.

14.0 ACCEPTANCE PLAN

Inspection and acceptance is performed by the Government Representative on all services, data, and non-data deliverables who will report findings to the Contracting Officer.

15.0 OTHER CONDITIONS/REQUIREMENTS

No other conditions or requirements are applicable.

16.0 APPLICABLE DOCUMENTS (AND DEFINITIONS)

The contractor shall ensure all work accomplished utilizes the latest, relevant industry practices and standards when applicable unless otherwise indicated by text. In accordance with Defense Acquisition Policy, maximum utilization of non-Government standards will be made wherever practical.

16.1 REQUIRED DOCUMENTS

The contractor shall utilize the following mandatory documents in support of this contract. The documents referenced in this section list the minimum version dates; however, the contractor shall meet requirements for any referenced document including subsequent updates applicable at time the contract request for proposal is posted.

Document Number Title

a. DoDM 5200.01 DoD Manual – Information Security Program Manual dtd 24 Feb 12

b. DoDD 5205.02E DoD Directive – Operations Security (OPSEC) Program dtd 20 Jun 12

c. DoD 5205.02-M DoD Manual – Operations Security (OPSEC) Program Manual dtd 3 Nov 08

d. DoD 5220.22-M DoD Manual – National Industrial Security Program Operating Manual (NISPOM) dtd 28 Feb 06

e. DoDI 5220.22 DoD Instruction – National Industrial Security Program (NISP) dtd 18 Mar 11

f. DoD 8570.01-M DoD Manual – Information Assurance Workforce Improvement Program dtd 19 Dec 05 with Change 3 dtd 24 Jan 12 and Change 4 dtd 10 Nov 15 (and

[Ver dtd 31 Aug 17] 14 of 15 subsequent revisions)

g. SECNAV M-5510.30 Secretary of the Navy Manual – DoN Personnel Security Program dtd Jun 2006

h. SPAWARINST 3432.1 Space and Naval Warfare Instruction – Operations Security (OPSEC) Policy dtd 2 Feb 05

i. SPAWARSYSCENLANT

INST 3070.1B

Space and Naval Warfare Systems Center Atlantic Instruction – Operations Security Policy dtd 20 Jan 17

j. Privacy Act of 1974 United States federal law, Pub.L. 93–579, 88 Stat.

1896, dtd December 31, 1974, 5 U.S.C. § 552a

16.2 GUIDANCE DOCUMENTS

The contractor shall utilize the following guidance documents in support of this contract. The documents referenced in this section list the minimum version dates; however, the document’s effective date of issue is the contract’s request for proposal issue date.

a. DoDM 1000.13-V1 DoD Manual – DoD Identification Cards: ID card Life-Cycle, Volume 1, dtd 23 Jan 14

b. DoDD 5000.01 DoD Directive – The Defense Acquisition System

c. DoDI 5000.02 DoD Instruction – Operation of the Defense Acquisition System

d. HSPD-12 Homeland Security Presidential Directive – Policy for a Common Identification Standard for Federal Employees and Contractors dtd 27 Aug 04

e. FIPS PUB 201-2 Federal Information Processing Standards Publication 201-2 – Personal Identity Verification (PIV) of Federal Employees and Contractors, August 2013 f.

Form I-9, OMB No. 115-

US Department of Justice, Immigration and Naturalization Services, Form I-9, OMB No. 115- 0136 – Employment Eligibility Verification

g. N/A

SPAWARSYSCEN Atlantic Contractor Check-in portal – https://wiki.spawar.navy.mil/confluence/display/SSC ACOG/Contractor+Checkin

16.3 SOURCE OF DOCUMENTS

The contractor shall obtain all applicable documents necessary for performance on this contract. Many documents are available from online sources. Specifications and commercial/industrial documents may be obtained from the following sources:

Copies of Federal Specifications may be obtained from General Services Administration Offices in Washington, DC, Seattle, San Francisco, Denver, Kansas City, MO., Chicago, Atlanta, New York, Boston, Dallas and Los Angeles.

Copies of military specifications may be obtained from the Commanding Officer, Naval Supply Depot, 3801 Tabor Avenue, Philadelphia, PA 19120-5099. Application for copies of other Military Documents should be addressed to Commanding Officer, Naval Publications and Forms Center, 5801 Tabor Ave., Philadelphia, PA 19120-5099.

https://wiki.spawar.navy.mil/confluence/display/SSCACOG/Contractor+Checkin https://wiki.spawar.navy.mil/confluence/display/SSCACOG/Contractor+Checkin

[Ver dtd 31 Aug 17] 15 of 15

All other commercial and industrial documents can be obtained through the respective organization’s website.