NALCOMIS VE Sys Admin Spt SAP PWS 010726.docx

SECTION C DESCRIPTIONS AND SPECIFICATIONS

PERFORMANCE WORK STATEMENT

FOR

COMMANDER NAVAL AIR FORCE RESERVE CODE N41 AVIATION LOGISTICS DIRECTORATE, SAP NAVAL AVIATION LOGISTICS COMMAND MANAGEAMENT INFORMATION SYSTEM (NALCOMIS) VIRTUAL ENVIRONMENT (VE) SYSTEMS ADMINISTRATION SUPPORT

1.0 INTRODUCTION: The Commander, Naval Air Force Reserve (CNAFR) Code N41 Aviation Logistics Directorate requires Naval Aviation Logistics Command Management Information System (NALCOMIS) contractor support to CNAFR units located at Joint Reserve Base (JRB) Fort Worth, Texas, JRB New Orleans, New Orleans, LA, Joint Base (JB) McGuire-Dix-Lakehurst, New Jersey and Naval Air Facility (NAF) Washington, Andrews Air Force Base (AFB), Maryland.

Estimated Level of Effort

This order is FFP in nature. The proposed level of effort is provided for informational purposes only. The contractor is to fulfill the requirements of the PWS and achieve the desired results in accordance with their proposal (regardless of staffing levels and labor mix).

2.0 BACKGROUND

2.1 CNAFR

The mission of CNAFR is to maintain the Naval Air Force Reserve in a state of readiness to meet the Fleet Response Plan, conduct overseas contingency Operations, and support the Naval Aviation Enterprise throughout the entire spectrum of peace to war. CNAFR Codes N41 Aviation Logistics and Code N42 Aviation Maintenance Directorates require contractor support for the Naval Aviation Logistics Command Management Information System (NALCOMIS) support for system management, operations, administration, maintenance, training and overall technical expertise required to operate and maintain the NALCOMIS in a Virtual Environment (VE).

2.2 NALCOMIS

NALCOMIS is an automated information and management system designed to provide aviation maintenance, material and operations managers in Optimized Organizational Maintenance Activities (OOMA) with timely, accurate and complete information on which to base daily decisions. NALCOMIS provides a modern, real-time, responsive computer-based management information system (MIS) and is one of the three automated information systems that makes up the Naval Tactical Command Support System (NTCSS). NTCSS OOMA and NTCSS Optimized Intermediate Maintenance Activity (OIMA) provide an effective MIS capability to satisfy various function requirements of the Naval Aviation Maintenance Program (NAMP).

NALCOMIS was designed to provide organizational level (O-level), intermediate level (I-level), and supply support center activities with a modern, responsive, computer-based management information system. The three objectives of NALCOMIS are: 1) To increase aircraft readiness by providing local supply and maintenance managers with timely and accurate information that they require in their day-to-day management and decision-making process; 2) To reduce the administrative burden on the fleet; and 3) To improve the quality of up-line reported data. The NALCOMIS systems, OOMA and OIMA are deployed within a NTCSS Virtual Environment (NTCSS VE).

3.0 SCOPE: The contractor will provide NALCOMIS OOM, OIMA and NTCSS VE support to all CNAFR Aviation Support Departments (ASDs). The support will encompass virtual/remote NALCOMIS system management, operations, systems administration, systems maintenance, systems training and overall technical expertise required to operate and maintain NALCOMIS, which makes up the VE Logistical Management system used by the Navy reserve ASD, Fleet Readiness Centers (FRCs) and squadrons at the following four (4) locations:

· JRB New Orleans, New Orleans, Louisiana

· JB McGuire-Dix-Lakehurst, New Jersey

· JRB Fort Worth, Fort Worth, Texas

· NAF Washington, Andrews Air Force Base (AFB), Maryland

The NALCOMIS VE will be staffed at and managed from JRB Fort Worth, Fort Worth, Texas to provide support to all CNAFR units at the above four sites.

4.0 APPLICABLE DIRECTIVES AND ACRONYMS

4.1 APPLICABLE DIRECTIVES: Guidelines available to accomplish Section 5.0 Performance Requirements below include but are not limited to:

Additional guidelines include the existing information system policy, use and security Directives of CNAFR, Chief of Naval Operations (OPNAV), Secretary of the Navy (SECNAV), and Naval Network Warfare Command (NETWARCOM).

4.2 ACRONYMS AND ABBREVATIONS:

5.1 NALCOMIS SYSTEM ADMINISTRATION.

The contractor shall perform System Administrator (SA) duties and is responsible for managing the Virtual Environment (NTCSS VE), hosted Virtual Machines (VM) to include the NTCSS servers (Relational Supply Master (RSUPMAST) and NALCOMIS Slave to RSUPMAST Server (NALC) ) and OOMA servers (VM’s), ensuring system security, tracking system information and performing administrative tasks such as loading software updates, Information Assurance Vulnerability Alerts (IAVA) and virus definitions, and performing backups. The SA will manage and administer NALCOMIS OOMA and NALCOMIS OIMA within the VE by adhering to all SA requirements as set forth in the System Administrator Guides (SAG), Technical Manuals, other directives and local Standard Operating Procedures (SOP) to include the following:

5.1.1 SA Accounts. The contractor shall set up SA accounts for all Virtual OOMA/OIMA servers and assign accounts to the Administrators group, create and assign temporary passwords to SAs and end-user accounts. Perform password maintenance by following server Operating System rules and Defense Information Systems Agency (DISA) requirements and coordinate with Squadron OOMA SAs on the synchronization of passwords on OOMA servers and Network Attached Storage (NAS-1).

5.1.2 System Security. The contractor shall provide adequate controls to ensure system security and that systems access granted to users is consistent with their assigned duties.

5.1.3 Startup/Shutdown Procedures. The contractor shall perform routine, unscheduled and emergency startup/shutdown procedures.

5.1.4 Backups. Contractor shall monitor, manage and perform daily, weekly, monthly and yearly NTCSS Backups via the Veeam backup and replication program and conduct daily backups of the OOMA servers and weekly Veeam backups and full system backups of all OIMA/OOMA VM Servers. Additionally, contractor shall perform backup verification of VM data/system files and maintain copies of all backups on external storage devices- and kept at a designated, off-site building location.

5.1.5 Recovery. Following the SAG, the contractor shall coordinate and execute all system recovery processes.

5.1.6 Contingency processes. The contractor shall work with the supported sites to establish and follow local contingency SOPs for supported sites. Deliverable: The contractor shall provide NLT 15 days after the contract award and NLT the 10th calendar day of each new contract year thereafter, a copy of the latest local contingency SOPs.

5.1.7 Baseline Software Loads, Scans and Software Upgrades. The contractor shall provide and maintain technical hardware and software support for OOMA systems to include troubleshooting, preventative and corrective maintenance and by monitoring and updating the following:

a. Program of Record (POR) Baseline Software Load. Verify quarterly, the NTCSS VE and all hosted Production VM’s are updated with the latest POR Baseline Software Load.

b. Virus Definitions/Anti-Virus (AV) Scans. Maintain hosted VM’s cyber security posture to include daily monitoring the AV and other Host Based Security System (HBSS) Point Products are installed and functioning. Maintain the NTCSS VE AV versions and Signature data (dat) files. Update the AV program and AV signatures weekly and/or as required by the INFO SEC policy and install AV software.

c. Assured Compliance Assessment Solutions (ACAS) scans. Prepare all production VM servers and coordinate scheduled ACAS scans. Ensure all ACAS scan results are uploaded to Vulnerability Remediation Asset Manager (VRAM) and that site-owned vulnerabilities are mitigated.

d. Information Assurance Vulnerability Alert (IAVAs)/Data Alignment Program (DAP). Monthly, verify that the NTCSS VE and all hosted NTCSS VMs have the latest IAVAs and DAPS installed.

The contractor will utilize the Sailor 2.X website (https://sailor.navy.mil) to verify, obtain and download the latest versions of the above. Deliverable: The contractor will provide a monthly report, NLT the 10th calendar day of each month, verifying that the above items were checked, current versions, if any new versions available and if so, the download and installation status.

5.1.8 Hardware/Software/Database Updates Liaison. The contractor shall be the primary liaison between the supported site support activities and applicable agencies to coordinate and provide hardware and software releases and upgrades and database modifications of ASD logistics Automated Information Systems (AIS).

5.1.9 System Interfaces. The contractor shall operate, maintain and ensure the functionality of all interfaces between NALCOMIS Intermediate Maintenance Activity (IMA) systems, Mid-Tier Server, O&I Server, squadron OOMA servers, RSUPMAST servers, and Enterprise Resource Planning (ERP) server.

5.1.10 Accounts/Privileges and Audit Files. The contractor will perform monthly reviews of Accounts and Privileges, and reviews of Audit Files. Audit files will be backed up weekly and retained for one year. Deliverable: The contractor will provide a monthly report, NLT the 10th calendar day of each month, indicating that all reviews of Accounts and Privileges and reviews of Audit Files were completed per the SAG and will include any findings and corrective actions taken.

5.1.11 Replacement Parts. The contractor shall submit supply requests for NALCOMIS VE related replacement server parts to government personnel as needed.

5.1.12 Monitor Inter-system Connectivity and Interfaces. The contractor shall monitor inter-system connectivity, interfaces and system/database logs. The contractor will process batch programs/scripts, provide status of operations to the supervisor and other functional managers.

5.1.13 Scheduled Down Time. The contractor shall coordinate and schedule, for all assigned sites, system non-availability periods such as to accommodate aircraft transfers and detachment set-ups. Deliverable: The contractor shall provide NLT the 10th calendar day of each month with a projected schedule of system non-availability periods. Contractor will also provide non-availability information via email notification to all users including the Contracting Officer Representative (COR), designated Type Commander (TYCOM), Wing and FRC representatives, ASD Deputies, and squadron SAs NLT 24 hours before a scheduled non-availability period starts and will ensure impacted sites acknowledge receipt of announcement prior to the start of the scheduled down time.

5.1.14 SA Logbook. The contractor shall establish and maintain an SA logbook(s) to provide a history of NTCSS VE system changes and issues. The logbook shall include entries as per the applicable SAGs. Deliverable: The contractor shall provide a monthly report reflecting the above information NLT the 10th calendar day of each month.

5.1.15 Monitor Server Logs. The contractor shall maintain 24/7 systems availability for supported sites’ NALCOMIS-OIMA, NALCOMIS-OOMA and the NALCOMIS-ERP interfaces to maintain 99 percent uptime. The contractor should be available during non-duty hours within 2-hours of a reported system outage.

5.1.16 Inventory. The contractor shall maintain an accurate inventory of all assigned NTCSS VE and NALCOMIS hardware and ensure all hardware is functioning correctly. Deliverable: The contractor shall provide a 100 percent inventory of all NALCOMIS VE and hardware-related equipment and its operational status within 15 calendar days of contract award and semi-annually thereafter.

5.2 CUSTOMER AND TECHNICAL SUPPORT:

5.2.1 NTCSS SA. The contractor shall function as the remote NTCSS Systems Administrator and operator, providing end-user support to personnel, transitioning squadrons and associated commands.

5.2.2 Squadron OOMA SA/Database Administrator (DBA) Assistance. The contractor will provide assistance to Squadron OOMA SA/DBAs in preparation for deployment by coordinating hardware and software requirements with squadron OOMA SA and if necessary, provide a space to prepare the deployable NTCSS Laptop Server to host the OOMA Homeguard VM. The Contractor shall coordinate and perform tasks associated with upload and download of actual Homeguard OOMA VM’s prior to and following deployment to include coordination of reconnection with NGEN (NMCI). The Contractor shall assist supported squadrons with preparation of Detachment systems as needed.

5.2.3 Customer Support. The contractor shall provide customer support to OIMA/OOMA users for remote desktop access, connectivity, interface, and user account problems. Diagnose and resolve problems in response to customer reported incidents. Report incidents to Naval Warfare Information Command (NIWC) by creating and submitting a trouble call report via the Information Technology Service Management (ITSM) website if problems cannot be resolved locally.

5.2.4 Trouble Reports (TR)/Change Proposals (CP). The contractor shall identify and submit NALCOMIS TR/CP via the ITSM website or directly to NWIC Norfolk, Virginia per the Organizational Maintenance Activity-Systems Admin Menu (OMA-SAM) and other directives.

5.2.5 Database Integrity and Validity. The contractor shall provide remote and on-call systems administration/support and ensure the NALCOMIS system integrity and validity is maintained. Deliverable: The contractor shall provide NLT the 10th calendar day of each month, a status report on the NALCOMIS system database integrity and validity.

5.2.6 The contractor shall maintain and monitor supported NALCOMIS OOMA and OIMA interface requirements and assist supported squadrons and FRC’s as necessary to include, but not limited to item transfer, OMA/IMA interface, replication, Decision Knowledge Programming for Logistics Analyst and Technical Evaluation (DECKPLATE) and all other automated information issues.

5.2.7 Training. The contractor shall provide informal training and on-the-job training (OJT) to both Organizational and Intermediate (O&I) level maintenance personnel, Database Administrators and System Administrators on NALCOMIS operations, Microsoft Information Systems, security and aviation Maintenance and Material Management documentation.

5.2.8 Equipment Installations/Removals. The contractor shall coordinate and schedule required equipment installations and removals at the supported sites as required.

5.2.9 The contractor shall verify Organizational Maintenance Activity (OMA) interfaces have connectivity with squadrons.

5.2.10 Accounts. The contractor shall remotely maintain, create and delete user accounts, maintain the policies and standards in place and enforce information assurance security procedures by incorporating the POR Baseline IAVAs, Tech Advisories, and DAPs. The contractor shall report IAVA compliance and IAVA mitigation plan status via the Online Compliance Reporting System (OCRS).

5.3 MONTHLY CONTRACT STATUS REPORT (MCSR). The MCSR is prepared by the contractor in contractor format approved by the COR. The MCSR provides a comprehensive review and analysis of the schedule and technical performance for the contract. The MCSR report data is used by the Technical Point of Contact (TPOC), COR and other applicable parties to:

· Evaluate task performance and deliverables provided

· Identify the magnitude and impact of actual and potential problem areas

· Provide valid, timely and auditable task information.

The MCSR shall include at a minimum:

· A summary covering accomplishments during the reporting period and why the accomplishment was significant.

· Specific actions taken concerning any of the tasks listed in section 5.

· List of deliverables provided during the reporting period.

· Issues and actions taken to resolve those issues.

· Projection of accomplishments.

The MCSR shall be provided in a separate email.

Deliverable: The contractor shall provide NLT the 7th calendar day of each month, a Monthly Contract Status Report.

5.4 PERFORMANCE REQUIREMENTS SUMMARY (PRS): This section refers to deliverables produced by the contractor because of the work performed in Section 5 Requirements. Deliverables will be in contractor format approved by the COR, signed and delivered in electronic portable document format (.pdf) format via email to the COR and other designated TYCOM, Wing, ASD and FRC representatives located at all supported sites. The Performance Requirements Summary Table 5.1 is below.

Table 5.1 - Performance Requirements Summary

Frequency

contract/task order award & 10th calendar day of each new contract year thereafter.

contract/task order award & semi-annually thereafter

5.2.5 NALCOMIS

Validity & Integrity Rpt

5.7 Quality Control Plan

Contract/Task Order award.

5.5 PERSONNEL REQUIREMENTS

5.5.1 Key Personnel: There are no key personnel for this task order.

5.5.2 Special Qualifications: The contractor is responsible for ensuring all employees in designated DOD Information System Security Management (ISSM) and Cyber Security Work Force positions possess and maintain professional certification per DOD Directive 8570.1 and DOD 8570.01M Information Assurance Training during the execution of this contract.

5.5.3 The contractor is responsible for ensuring all employees are able to lift up to 50 pounds as required.

5.5.4 Identification of Contractor Employees: All contract personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as contractors to avoid creating an impression in the minds of members of the public that they are Government officials. They must also ensure that all documents or reports produced by contractors are suitably marked as contractor products (contractor determines format and labeling method) or that contractor participation is appropriately disclosed. All contractor personnel will be required to obtain and wear government issued Identification Card (ID) in the performance of this service.

5.6 MEETINGS AND BRIEFINGS. The Contractor shall attend, participate in and provide input during scheduled and unscheduled meetings, conferences and briefings that affect PWS functions and serve to provide effective communication.

5.7 QUALITY CONTROL/SURVEILLANCE AND PERFORMANCE STANDARDS:

5.7.1 Quality Control Plan (QCP): The contractor shall ensure quality service is performed in accordance with this performance work statement (PWS) throughout the life of the contract and that methods for improving the overall quality are employed. The contractor’s quality control program is the means to ensure that the contractor’s work complies with the requirement of the contract. The contractor’s QCP shall reflect the Contractor’s overall approach, internal controls and establishment of procedures for evaluating each of the major service areas (who, method, how often) for reporting to the Government, resolving deficiencies, and identifying documentation (as listed in the PWS Performance Requirement Section 4) reflecting quality control inspections and any corrective actions taken. The QCP shall include procedures the contractor will employ to identify, prevent, and ensure non-recurrence of defective services. The QCP shall be submitted with the proposal package on or before the Solicitation close date and shall be included in the evaluation process. Any proposed changes to the QCP after contract award, shall be submitted by contractor to Contracting Officer Representative (COR) for further forwarding and approval by the Contracting Officer. The Government may periodically require the contractor to update/revise the management/QCP to ensure quality service is maintained throughout the life of the contract.

5.7.2 Performance Standards/Quality Assurance Surveillance Plan. The contractor service requirements are summarized into performance objectives that relate directly to mission essential items. The performance threshold briefly describes the minimum acceptable levels of service required for each requirement. The government shall evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan is primarily focused on what the Government must do to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

5.7.3 Surveillance methods: The primary methods of surveillance used to monitor performance of this contract will include, but not be limited to, random or planned sampling, periodic scheduled and unscheduled inspections, and validated customer complaints. Performance will be measured in accordance with Table 5.2 below. If performance is within acceptable levels, it will be considered to be satisfactory. If not, overall performance may be considered unsatisfactory.

Table 5.2 – Performance Standards/Quality Assurance Surveillance Plan

The contractor will operate and manage NALCOMIS Computer systems.

System available during 100% of working hours per month.

100% inspection

100% inspection

Monthly rpts – provided NLT the 7th calendar day of each month.

Quarterly rpts – provided NLT the 7th calendar day of the new qtr month

Semi-Annual rpts – provided NLT the 10th calendar day of each semi-annual period.

Annual rpt – provided NLT the 10th calendar day of each contract year.

99% of all deliverables provided on time.

No more than three negative customer responses/ complaints every six months.

Customer Feedback

100% Review

Scheduled and unscheduled Gov’t inspection

5.7.4 Incentives/Disincentives: The COR makes an annual report on Contractor Performance Assessment Reporting System (CPARS). The contractor’s failure to achieve satisfactory performance under the contract/task order, reflected in the COR’s annual report, may result in termination of the contract/task order and may also result in the loss of future Government contracts/task orders. The contractor’s failure to achieve satisfactory performance under the contract/task order may result in the non-exercise of available options

For each item that does not meet acceptable levels, the Government may issue a Contract Discrepancy Report (CDR). CDRs will be forwarded to the Contracting Officer with a copy sent to the contractor. The contractor must reply in writing within 5 days of receipt identifying how future occurrences of the problem will be prevented. Based upon the contractor’s past performance and plan to solve the problem, the Contracting Officer will determine if any further action will be taken.

In accordance with the inspection of services provisions for Firm Fixed Price (FFP) contract, the contractor will be incentivized to provide quality products in a timely manner since the Government can require the Contractor, at no additional cost, to replace or correct work that fails to meet contract requirements.

6.0 SKILLS AND KNOWLEDGE AND LABOR CATEGORY REQUIRMENTS FOR THE POSITION

THE POSITION: Contractor personnel must be highly skilled and well-versed in system’s administrator for the NTCSS VE and NALCOMIS System. Must have experience and as a both a NALCOMIS Data Base Administrator (DBA) and Systems Administrator (SA). All contractor personnel shall be sufficiently competent in reading, writing, speaking and understanding English to perform the work.

NALCOMIS SYSTEMS ADMINISTRATOR LABOR CATEGORY DESCRIPTION: The NALCOMIS Systems Administrator shall possess 10 years of general experience in the information technology, information systems and computer field. Employees must have at least 6 years specialized experience as a systems or network administrator and experience working with local area networks, telecommunications and standard desktop hardware and software configurations; proficiency with Windows XP, Vista, and Windows 10 operating system environments and Microsoft Office Professional software applications, have experience as an E-6 level or above as a, with both Organizational and Intermediate level experience as an Aircraft Maintenance Administration Specialist, and have completed one of the NALCOMIS Aviation Information Systems Administrator/Analyst training tracks, NALCOMIS Aviation Maintenance System Administrator/Analyst or NALCOMIS Aviation Maintenance OMA System Administrator/Analyst. The NALCOMIS Systems Administrator shall have appropriate Department of Defense (DOD) Security clearance and IAT Contractor Training and Certification in accordance with Defense Federal Acquisition Regulation Supplement (DFARS) Case 2006-D023 and DOD 8570.01M.

7.0 PERFORMANCE/SUPPORT LOCATIONS

Support staff will be located at Naval Air Station (NAS) JRB Fort Worth, TX and support shall be provided virtually for all reserve ASDs, FRCs and squadrons located at the four sites below:

NAS JRB Fort Worth, TX Aviation Support Detachment 1251 Military Parkway NAS Fort Worth, TX 76127-1251

JRB New Orleans, New Orleans, LA Aviation Support Detachment 400 Russell Ave, Building 480 New Orleans, LA 70143

JB McGuire-Dix-Lakehurst, NJ Aviation Support Detachment 4390 Texas Avenue JB-McGuire Dix Lakehurst Fort Dix, NJ 08640-1009

NAF Washington, Andrews Air Force Base, MD Aviation Support Detachment 3086 E. Perimeter Rd Andrews AFB, MD 20762

7.1 HOURS OF OPERATION

7.1.1 WORKING HOURS: The contractor will be required to work 40 hours per week and be physically present at the worksite with an expected start time of 0500 CST (0600 EST), to accommodate the supported sites within the Eastern Standard Time Zone. However, the exact work hours are to be arranged and agreed on between the contractor and the COR. The contractor must remain flexible regarding work hours (not to exceed 40 hours per week) to accommodate time zone differences at the other supported sites, periodically required support outside of normal work hours and on weekends. The contractor is allowed a one-hour unpaid lunch break. If at all possible, the Contractor will be notified a minimum of 7 workdays prior to any schedule changes.

7.1.2 OVERTIME: No overtime, extended workweek or comp time is authorized or will be paid under this contract. If work outside the agreed work hours becomes necessary, it is the contractor’s responsibility to adjust the employees’ schedules as necessary to ensure that employees stay within allotted 40- hour workweek.

7.1.3 FEDERAL HOLIDAYS. Contactors are not required to show up for work that falls on Federal Holidays. The following Federal holidays are observed by DoN:

A. New Year’s Day (1 January) B. Martin Luther King’s Birthday (Third Monday in January) C. President’s Day (Third Monday in February) D. Memorial Day (Last Monday in May) E. Juneteenth (19 June) F. Independence Day (4 July) G. Labor Day (First Monday in September) H. Columbus Day (Second Monday in October) I. Veteran’s Day (11 November) J. Thanksgiving Day (Fourth Thursday in November) K. Christmas Day (25 December)

In the event that a Federal holiday falls on a Saturday, the holiday will be observed on the Friday immediately before the holiday; if the Federal holiday falls on a Sunday, the holiday will be observed on Monday immediately following the holiday. Other holidays are determined by Executive Order.

7.1.4 OTHER GOV’T CLOSINGS.

The contractor is not responsible to work when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. Contractor personnel are typically considered non-essential personnel for purposes of any instructions given regarding a Post/Base closure. However, the Contracting Officer (KO) may designate the contractor as a mission essential person if such designation and attendance on base is required to ensure continued support operation. If a decision to close all or part of the post/base is made during the normal duty hours and the decision is transmitted through official notification channels, and if the contractor employees are not designed mission essential, contractor employees follow all instructions given, promptly secure all Government Furnished Property (GFP) appropriately, and evacuate in an expedient but safe manner.

8.0 PERIOD OF PERFORMANCE:

Base Year: 19 January 2026 to 18 January 2027

9.0 TRAVEL: No reimbursable travel expenses are authorized under this PWS.

10.0 TRAINING REQUIREMENTS

CNAFR is responsible for conducting the training required for local mandates only, which will be at no cost to the contractor. The Contractor is responsible for any and all technical training required for assigned contractor personnel to accomplish the tasks outlined in Section 5.0 Performance Requirements.

11.0 SECURITY REQUIREMENTS

11.1 SECURITY CLEARANCE:

a. All contract personnel performing under this contract/task order must maintain a DOD Security Clearance with a minimum of a Tier 5 (T5) current within five years (5) years, based on administrative privileges associated with this contract in accordance with DoD 5220.22-M National Industrial Security Program Operating Manual (NISPOM), DoDI 8500.2 encl (3) table E3.T1, SECNAVINST 5510-3. All contractors must be citizens of the United States. Must have a minimum of an active Secret Clearance.

b. The contractor will provide the Navy's Security Manager and the COR with the name, title, address and phone number for the Contractor's Security Representative (CSR)/Facility Security Officer (FSO). The CSR/FSO shall be the primary point of contact on any security matter. The contractor shall provide a listing of contract personnel performing under this contract/task order within 15 days of contract award. The CSR/FSO is responsible for entering contract personnel information into the Defense Information System for Security (DISS), having an “Owning” role in DISS for contract personnel and submitting visit authorization letters (VAL) via DISS for contract personnel performing under this contract/task order. The command, Navy Security Manager will take a “Servicing” role in DISS for contract personnel for the duration of contract. Contract personnel shall in-process with the Navy Security Manager upon arrival to Navy command and shall out-process prior to the conclusion of the contract/task order or employment termination. The VAL shall be renewed annually for contract personnel performing under this contract/task order. Failure to submit VAL shall result in a delay in contract personnel start date.

c. Once the CSR/FSO has submitted the SF-86 in DISS and the initial background investigation is found to be favorable an interim clearance may be granted by Department of Defense Consolidated Adjunction Services (DOD CAS) through the CSR/FSO. The CSR/FSO can then issue an interim Clearance. The Navy Security Manager may then authorize issuance of a CAC and interim access to DON or DoD classified/unclassified computer/network, and/or have access to sensitive unclassified information. The contractor CSR/ FSO shall ensure that the individual employee has a current requisite background investigation for the duration of the contract/task order. The investigation must be submitted and results received prior to commencement of work. When the results of the investigation are received and a favorable determination is not made, the contract personnel working on the interim access shall be removed immediately.

Derogatory information (i.e. Medical Evaluations, Letters of Intent, Statement of Reasons) or “No Determination Made” decisions resulting from a personnel security investigation shall be addressed by the CSR/FSO. Contract personnel shall self-report any derogatory issue to their supervisor or the CSR/FSO in accordance with NISPOM. The CSR/FSO shall notify the Government Sponsor regarding issues that will impact a contract personnel’s ability to maintain access. No contract personnel shall have access to any DoD classified/unclassified or sensitive information/controlled unclassified Information (CUI) until completion of the adjudication process and/or resolution of issues. An unfavorable determination does not relieve the contractor from meeting any contractual obligation under this contract/task order.

d. The contractor shall ensure contract personnel requiring access to IT systems or networks are certified in accordance with DoD 8570.01-M and provide documentation. The contractor shall ensure contract personnel complete annual Information Assurance (IA) training and maintain a current requisite background investigation. The contractor shall ensure a System Authorization Access Request Navy (SAAR-N) is completed on contract personnel requiring access to IT systems. The contractor shall ensure a completed SAAR-N is forwarded to the Navy Command’s Security Manage at least five (5) days prior to the contract personnel’s start date. Failure to provide the required documentation in the prescribed timeframe shall result in a delay in contract personnel’s start date.

e. The contractor shall comply with Directive-Type Memorandum (DTM) 08-003, DoD 5200.2R, and SECNAVINST 5510-30 regarding Common Access Card (CAC) issuance, Personnel Security Program procedures for contract employees requiring: (1) Physical access to a federally controlled base, facility or activity and/or; (2) Access to DoD computers and networks (information technology and systems) to perform certain classified, unclassified, or non-critical sensitive duties under this contract/task order.

(1) The contractor shall immediately report a lost or stolen CAC to the Government Sponsor.

(2) Federal Acquisition Regulation (FAR) Clause, 52.204-9, “Personal Identity Verification of Contractor Personnel”, also included in this contract is applicable and provides further direction regarding the CAC.

(3) The contractor is responsible for the absence of contract personnel due to expired CACs/credentials.

(4) Contract personnel shall return CACs to the government Technical Point of Contact/Government Sponsor upon contractor change in status, expiration of the CAC, or completion or expiration of the contract.

11.2 INFORMATION ASSURANCE: The Contractor shall ensure that personnel accessing information systems have the proper and current information assurance certification to perform information assurance functions in accordance with the Information Assurance Workforce Improvement Program DOD 8570.01-M. The Contractor shall meet the applicable information assurance certification requirements, including:

a. DoD-approved information assurance workforce certifications appropriate for each category and level as listed in the current version of DOD 8570.01-M. It has been determined that contractors supporting this contract/task order must attain and hold Intermediate level proficiency for work role code 451 System Administrator in accordance with DoDI 8140.03 and 8570.01-M due to elevated computing level of privileged access required for systems connected to a DoN network. All system administrators performing these duties will sign and submit a Privileged Access Agreement form to the local N6 DH.

b. Appropriate operating system certification for information assurance technical positions is required by DOD 8570.01-M. All contractor Cyber Security Workforce (CSWF) certifications shall be provided to CNRFC N64 IA Director or local N6 DH upon arrival/check-in and start of contract/task order support.

c. Upon request by the Government, the Contractor shall provide documentation supporting the information assurance certification status of personnel performing information assurance functions.

d. Contractor personnel who do not have proper and current certifications shall be denied access to DoD information systems for the purpose of performing information assurance functions. The contractor shall provide a plan/schedule of certification attainment within 6 months of contract/task order award for those contractor personnel assigned who arrive without appropriate CSWF certification. The contractor shall provide the plan/schedule of certification attainment within 15 days of contract award. The contractor shall provide a plan/schedule of continuing education units for the maintenance of required certifications. The contractor shall provide the plan/schedule of continuing education units for the maintenance of required certifications within 15 days of contract award and the continuing education can be combined with plan/schedule of certification attainment plan. The contractor shall comply with all other requirements of DOD 8570.01-M for each respective Information Assurance System Architect and Engineer (IASAE) or IAT level. Guidance is located at: http://www.dtic.mil/whs/directives/corres/pdf/857001m.pdf.

11.3 OPERATIONS SECURITY (OPSEC) REQUIREMENTS

11.3.1 GENRAL CONTRACTOR OPSEC REQUIREMENTS: During the course of this contract/task order and in addition to those restrictions, instructions and guidelines delineated in the contract Performance Work Statement (PWS) and/or other references provided, the contractor will adhere to the following minimum requirements in support of Commander, Navy Reserve Forces Command (CNRFC) and Commander, Naval Air Force Reserve (CNAFR) OPSEC Programs:

a. Introduction of personnel electronic devices into government networks, government spaces, laptops, tablet PCs, cellular phones, cameras, recording devices, and data recording/storage devices is STRICTLY controlled and forbidden in most cases. Company issued equipment required for the performance of work at CNRFC/CNAFR sites must be approved by the government security officer. Photography and recording is not allowed except for official use and by permit only. (Unless otherwise stipulated in the contract, contact the CNRFC/CNAFR Security Officer for approval.)

b. Contractor personnel shall not discuss government operations in public or over unprotected or unencrypted communications. Official Business controlled unclassified information may only be transmitted as directed in the Performance Work Statement.

c. The Contractor shall not post to company websites, publications, newsletters or other media any images, data or information that reveal sensitive government operations, personnel, equipment, and/or classified or controlled unclassified information, refer to paragraph (d) below.

When in doubt, company press releases related to this contract should be coordinated through the Contracting Officer Representative (COR) and the CNRFC/CNAFR Public Affairs Officer

(PAO).

d. Contractor personnel shall not disclose to unauthorized third parties, post to unofficial sites (including Social Networking sites) any images, data or information that reveals sensitive government operations, personnel, equipment, including, but not limited to:

(1) Tactics, techniques and procedures, production or work schedules, any visible or concealed modifications, upgrades, additions to vessels, aircraft, or weapons or equipment; increases, change, or decreases in work/deployment frequency or government personnel, vehicle, vessel or aircraft movements; specialized equipment orders, deliveries, shipments, etc. (Unauthorized disclosure and transfer of National Security Information is punishable under 18 United States Code (USC) § 793.)

(2) Any Non-Disclosure requirements will remain in effect during the duration of this contract/task order and indefinitely thereafter.

(3) Unauthorized disclosures and attempts to solicit this type information by unauthorized third parties or others not affiliated with this contract shall be reported to the CNRFC/CNARF Security Office and the contract point of contact, and your company Facility Security Officer (FSO) and the Defense Security Service (DSS).

e. Government issued badges, identification shall be removed and/or concealed from plain sight when off station and shall not be left in vehicles or unprotected. Badges and Passes may not be duplicated or copied. Lost or stolen identification badges, vehicle passes etc., will be immediately reported to the CNRFC/CNAFR Security Office.

f. Practice OPSEC and implement countermeasures to protect Critical Information (CI) and other sensitive CUI and activities vigilance or degrade the planning and execution of military operations performed or supported by the contractor in support of the mission. Protection of CI will include the adherence to and execution of countermeasures, which the contractor initiates or as provided by CNRFC/CNARF Security Office, for CI on or related to this Performance Work Statement.

g. The contractor must mark and protect related internal production schedules, deliverables, inventories and shortages and identified vulnerabilities related to production of government material as For Official Use Only (FOUO) Information in accordance with guidance in paragraphs 11.4 and 11.5 below of this Performance Work Statement.

h. All government information must be destroyed at contract termination or returned to the government at the government’s discretion.

11.3.2 PERMANENT GOVERNMENT SITE CONTRACTOR: When a contract

includes permanent/embedded contract personnel performing at CNRFC/CNAFR or other government facilities, these additional requirements apply:

a. The contractor shall assign an OPSEC Point of Contact for this contract.

b. OPSEC Awareness Education and Training shall be provided by or coordinated through government channels (CNRFC/CNAFR OPSEC Program) at no cost to the contractor. All personnel supporting the contract shall receive initial OPSEC awareness training and Annual OPSEC Refresher training; verification of contractor personnel OPSEC training will be provided The contractor should contact CNRFC/CNAFR Operations Security Officer to assist with this requirement.

c. The CNRFC/CNAFR Command Critical Information List (CIL) or additional information identified by CNRFC/CNAFR or the COR including company-generated information whether in electronic or hardcopy form; e.g.; internal schedules, deficiency reports, and other internal documents, related to this project will be marked and handled appropriately as FOR OFFICIAL USE ONLY (FOUO) or other required marking in accordance with guidance in paragraphs 11.4 and 11.5 below (If applicable) of this Performance Work Statement. Government Critical Information includes but is not limited to:

· Known or probable vulnerabilities to any U.S. system and their direct support systems,

· Details of information about military operations, unit, vessel, aircraft movements/arrivals, missions and exercises,

· Specific TAD/TDY deployment data including personnel numbers, duration, location, etc.

· Specific details concerning TAD/TDY travel itineraries and purposes of travel by key personnel,

·…