NBIS TE PWS Draft - 5 Nov 2025 Post-INDSEC Review.docx

Defense Counterintelligence and Security Agency (DCSA)

National Background Investigation Services (NBIS) Test and Evaluation (T&E) Services Performance Work Statement (PWS)

November 2025

Contents

Introduction This document describes DCSA’s contract requirements for the National Background Investigation Services (NBIS) Test and Evaluation (T&E) Services Acquisition. The NBIS Program is seeking independent test representatives to conduct NBIS Enterprise testing and provide product support. NBIS expects that the aforementioned test activities will be seamlessly integrated throughout the entire development process for NBIS subsystems. This integrated testing approach replaces traditional, separate testing phases with continuous, iterative evaluations that ensure requirements are consistently verified and the system’s operational suitability is validated. These ongoing evaluations will provide real-time insights into system performance and user readiness. Independent Test and Evaluation (T&E) representatives will play a pivotal role in this future state, acting as the essential link between development efforts and formal evaluation requirements, ensuring that testing is an integral part of the development lifecycle rather than a separate or final step.

Currently, vendors developing NBIS applications are responsible for creating automated functional and non-functional tests, as well as manual test cases. However, limited resources have made it difficult to thoroughly review these tests artifacts and integrate them into the T&E process. To overcome this challenge and enable faster software releases without sacrificing quality, NBIS will rely on independent test representatives to work closely with each product team to review existing test cases and developmental tests, assist in creating enterprise-level testing solutions, coordinate operational test activities and events, and foster trust in the testing process. By doing so, the test representatives will ensure that these tests are effectively incorporated into the automated software delivery process and user acceptance testing (UAT), ultimately delivering high-quality software that meets operational needs.

The NBIS Program currently leverages Tricentis, a comprehensive software testing platform designed for automated testing of enterprise applications.

Scope The scope of this contract includes NBIS Enterprise testing, encompassing both Product Support Testing and Specialized Testing services performed by independent test representatives in support of NBIS product teams.

These efforts collectively ensure comprehensive test coverage across NBIS applications – from embedded product-level functional and automation testing to specialized enterprise-level validation activities.

NBIS Testing supports the following product areas:

· Initial Vetting Management (IVM)

· Adjudications (ADJ)

· Continuous Vetting (CV)

· Individual Engagement (IE)

Each product team may oversee one or more systems described in Appendix E of this PWS.

Performance Requirements The Contractor shall provide NBIS Enterprise Testing services to support the NBIS Product Teams. NBIS Enterprise Testing is composed of two primary, integrated tasks:

Task 1 – Product Support Testing, which includes functional, manual and automated testing performed by Product T&E Rep Support staff working with NBIS SAFe Agile product teams and

Task 2 – Specialized Testing, which provides advanced, domain-specific testing capabilities- such as performance, security, data-quality and API/contract testing to validate NBIS applications across all defined environments.

Task 1: Product Support Testing

The Contractor shall:

· Provide embedded Product Support Testing within NBIS SAFe Agile teams. This also includes active participation in all sprint ceremonies.

· Participate as a member of the Test and Evaluation Working Integrated Product Team (i.e., T&E WIPT) to coordinate test activities and events.

· Ensure software requirements are properly implemented and all system

· components function as intended. This requirement includes conducting developmental testing such as Unit, API, Contract, End-to-End, Security, and Performance tests—along with reports confirming that all products have been thoroughly tested and results accurately documented.

· Develop and maintain test cases and test scripts based on approved acceptance criteria and user stories.

· Perform acceptance testing to validate that developed functionality meets defined acceptance criteria and user expectations.

· Identify gaps in test types, coverage, and reporting, and provide clear, actionable recommendations to product owners to address those issues—ensuring software meets NBIS code quality standards and allows stakeholders to quickly and effectively evaluate the software’s quality.

· Integrate test activities into Continuous Integration / Continuous Delivery (CI/CD) pipelines at Integration, MR, Pre-Production Promotion, and Pre-Production Validation stages.

Task 2: Specialized Testing The Contractor shall:

· Perform Specialized Testing to complement Product Support Testing and extend NBIS Testing coverage to enterprise-level and domain specific areas and ensure alignment with organizational goals.

· Execute testing activities across all defined environment progressions (i.e., DEV, INT, PRE-PROD, PROD) per playbook specifications.

· Develop and execute comprehensive Enterprise Tests using Tricentis Tosca to bridge developer-focused validation and operational readiness requirements.

· Maintain traceability between development testing activities and formal evaluation objectives, ensuring all testing aligns with DoDI 5000.89 T&E requirements and OTA OT&E processes.

· Provide support to the T&E Product Support Representative to ensure the comprehensive delivery of all required test data in accordance with established timelines and standards to support operational testing and certification of the NBIS system.

· Establish and maintain performance baselines and thresholds for automated pipeline gates.

· Coordinate post-deployment observation of system performance, user feedback collection, and operational effectiveness assessments.

· Design scenarios and workflows to support UAT and Operational Scenario Validation.

· Coordinate Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), dependency scanning, and Infrastructure-as-Code security scanning activities per playbook requirements.

· Document User Acceptance Test (UAT) cases and facilitate all aspects of UAT testing events, including planning, coordination, and execution.

While performing the requirements outlined in Tasks 1 and 2 above, the Contractor shall also comply with:

· All references identified in Appendix B.

· The Performance Requirements Summary (PRS) in Appendix C.

General Contract Information

Type of Contract This is a Time and Materials (T&M) (FAR 16.601) contract type.

Transition Activities The Contractor shall perform the transition-in and/or transition-out activities described below.

Transition-In The Contractor shall perform the tasks outlined below as part of its transition into the NBIS Program. The Government will provide an Onboarding Checklist identifying points of contact, system access requirements, documentation repositories, and reference materials to support these activities.

The Contractor shall:

· Develop and submit a Transition-In Plan to ensure full operating accountability and responsibility for contract execution.

· Coordinate all onboarding activities with the Government, including security clearance processing and personnel badging, in accordance with established security requirements.

· Obtain required access to all NBIS systems, tools, environments, and documentation repositories.

· Review and demonstrate familiarity with existing system implementations, processes, and Program documentation.

· Participate in Government-scheduled onboarding and coordination meetings.

· Validate and configure Contractor-furnished equipment to comply with Government cybersecurity and endpoint protection requirements.

· Ensure all personnel complete mandatory Government-provided security, privacy, and ethics training before accessing NBIS systems.

· Establish and maintain a transition-in tracker to document completion of onboarding actions for all Contractor personnel.

· Coordinate with the NBIS Test Platform Administrator to confirm appropriate role-based access

· Conduct initial knowledge transfer sessions with NBIS stakeholders to ensure alignment of tools, environments, and CI/CD pipelines (e.g., Tricentis Tosca, Jira, NeoLoad, GitLab, Jenkins).

· Identify onboarding dependencies, risks, or issues and provide recommended mitigations to the Government.

· Submit an Onboarding Status Summary within 30 calendar days of contract award identifying completion progress, pending items, and issues requiring Government attention.

Transition Out

The Contractor shall facilitate the orderly transition of all contracted activities and services to the Federal Government or to a follow-on Contractor by the end of the period of performance. Transition-out activities shall begin no later than 30 calendar days prior to contract completion to ensure continuity of operations and proper contract closeout.

The Contractor shall:

· Develop and submit a Transition-Out Plan and detailed schedule to the Contracting Officer’s Representative (COR) and Procuring Contracting Officer (PCO).

· Maintain full operational performance throughout the transition period without degradation of service.

· Participate in transition meetings with Government and successor Contractor personnel to coordinate the orderly transfer of responsibilities.

· Provide shadowing opportunities and technical exchange sessions to facilitate the handoff of knowledge, documentation, and processes.

· Reconcile and return all Government-Furnished Equipment (GFE) and Government-Furnished Information (GFI) in accordance with property management and security requirements.

· Revoke all user accounts, credentials, and system access for Contractor and subcontractor personnel upon offboarding.

· Deliver all final data, test artifacts, automation scripts, dashboards, and configuration files developed under the contract in Government-approved formats.

· Provide a final Knowledge Transfer Package summarizing procedures, lessons learned, and known issues to ensure continuity of service.

· Support validation of all repositories, CI/CD pipelines, and testing frameworks to confirm successful transfer or decommissioning.

· Submit a Transition-Out Completion Report within 10 business days of contract closure documenting final inventory, data delivery, and any outstanding items requiring Government action.

Management Requirements

Inherently Governmental Functions The Contractor shall advise and assist the Government, but the Contractor shall not make final decisions or certifications on behalf of the Government, nor shall the Contractor perform any inherently Governmental function, as that term is defined in Federal Acquisition Regulation (FAR) 2.101, and further described in FAR 7.503. The Contractor and its employees shall not represent the Government, nor appear to represent the Government, in performance of the contract services. Contractor personnel shall clearly identify themselves as Contractor employees in all interactions during contract performance. If the Contractor believes that any action constitutes an inherently Governmental function, or is perceived to constitute an inherently Governmental function, it shall be the Contractor’s responsibility to notify the PCO immediately.

Personnel

The Contractor shall provide the following personnel for this contract:

Product T&E Representative Support – This representative will be embedded within product teams and will be responsible for assessing test coverage, establishing criteria, and developing acceptance standards to ensure product quality. This role works with the product owner to define thresholds for automated pipeline gates, participates daily in agile ceremonies, and creates both Tricentis automated tests (or other software as directed by the Government) and manual test cases. Additionally, the representative coordinates defect status and reporting to ensure timely resolution and maintain high product standards throughout the development lifecycle.

Key Personnel

The roles outlined below are key personnel for this contract. Key Personnel shall remain assigned to the program for the duration of the contract. If an employee must be temporarily or permanently replaced for any reason, the Contractor shall notify the Procuring Contracting Officer (PCO), in writing, of the proposed substitute and their qualifications no later than ten (10) business days prior to the proposed replacement. The PCO will then approve or disapprove the proposed replacement, in writing, and notify the contractor. If Key Personnel must be temporarily or permanently replaced, the Contractor shall provide for an overlapping transition period of at least two (2) weeks between the outbound and inbound personnel, to the extent possible, to ensure continuity of services and information transfer.

NBIS Test Platform Administrator – This Administrator is responsible for configuring and maintaining the NBIS test platform, including managing pipeline integration, user access, and permissions. This role integrates the test platform with Jira, Tricentis, and other NBIS tools to ensure seamless workflow and data exchange. Key responsibilities include managing software licenses, optimizing tool performance, and overseeing upgrades, patches, and updates to maintain platform stability and security. The administrator also coordinates training for UAT teams on the Tricentis (or other software as directed by the Government), ensures environment readiness, and maintains comprehensive platform documentation to support testing operations and user enablement.

Security Testing Lead – The Security Testing Lead is responsible for coordinating dynamic security testing activities (e.g. SQL Injection, XSS, OWASP Top 10 vulnerabilities, and privilege escalation scenarios, etc.). This role supports penetration testing efforts and validates identified vulnerabilities to ensure robust application security. The Security Test Lead manages results from static and dynamic scans, dependency scanning, and licensing compliance checks, ensuring all findings are documented and addressed. Additionally, the role involves updating and maintaining security test plans, scenarios, and coverage reports, and providing consolidated security risk reporting through dashboards to inform stakeholders of the current security posture and risks.

Performance Testing Lead – The Performance Testing Lead is responsible for designing and executing performance and scalability testing using Tricentis Neoload (or other software as directed by the Government) to ensure applications meet required standards under various load conditions. This role develops, updates, and maintains performance test plans and scripts, configures test environments, agents, controllers, and monitoring tools, and simulates concurrent users across core workflows for load, stress, and endurance testing. The Performance Test Lead collects and analyzes system metrics such as CPU, memory, and database throughput, provides bottleneck analysis, and recommends tuning strategies. Additionally, the role contributes performance insights to CI/CD pipeline gates to support continuous delivery of high-performing applications. This role works to ensure that performance testing activities are scheduled and aligned to program milestones and in accordance with NBIS operational test needs.

API/Contract Test Specialist – The API/Contract Test Specialist is responsible for developing, updating, and maintaining comprehensive API test plans to ensure robust and reliable service integrations. This role implements automated API test cases using Tricentis API Testing (or other software as directed by the Government), manages cross-team integration testing scenarios, and validates API orchestration and dependency handling. The specialist provides detailed reporting on API test coverage, failures, and trends, and supports the continuous integration of API validation into pipeline workflows to maintain quality and consistency throughout the development lifecycle.

Data Quality Engineer – The Data Quality Engineer is responsible for ensuring the integrity and reliability of data across NBIS systems by validating databases and data flows using Tricentis Tosca Test Data Management (TDM) (or other software as directed by the Government). This role develops and maintains comprehensive Data Quality & Management Test Plans, validates ETL/ELT processes, data lineage, and transformation rules, and utilizes synthetic and masked data to support compliant testing practices. The Data Quality Engineer also provides dashboards and reports on data quality defects, trends, and exceptions, helping to identify and address issues that could impact NBIS operations and compliance.

All Key Personnel must possess a minimum of an Active Top-Secret security clearance at time of award and throughout the duration of the contract. Key Personnel shall remain assigned to the program for the duration of the contract. If an employee must be temporarily or permanently replaced for any reason, the Contractor shall notify the PCO, in writing, of the proposed substitute and their qualifications no later than ten (10) business days prior to the proposed replacement. The PCO will then approve or disapprove the proposed replacement, in writing, and notify the contractor. If Key Personnel must be temporarily or permanently replaced, the Contractor shall provide for an overlapping transition period of at least two (2) weeks between the outbound and inbound personnel, to the extent possible, to ensure continuity of services and information transfer.

The Contractor shall ensure its personnel and all subcontractor personnel have the appropriate security clearances. The security clearance level required will depend on the application. Additionally, the Contractor shall ensure its personnel and all subcontractor personnel have the appropriate certifications IAW DoD Directive (DoDD) 8140.01, Cyberspace Workforce Management, and DoD 8570.01-M, Information Assurance Workforce Improvement Program.

Risk Management The Contractor shall utilize its risk management procedures, techniques, controls, and metrics to provide early identification of program risks. The Contractor shall provide telemetry that helps to identify and quantify performance, schedule, and cost risks. The Contractor shall be responsible for recommending appropriate risk mitigations. Risks shall be a top item of discussion during program management reviews.

Quality Management The Contractor shall perform Quality Management activities. Quality Management activities include, but are not limited to, meeting Service Level Agreements; ensuring proper handling and safeguarding of sensitive data; identifying and mitigating risks; resolving issues; and adhering to required processes and procedures. The Contractor shall develop Quality Management Plans based on American Society for Quality (ASQ) and Information Technology Infrastructure Library (ITIL) standards. The Contractor may also be tasked to provide guidance on proper quality assurance methods for document control, records management, and/or information activities.

Government-Furnished Information/Equipment (GFI/GFE) The Government will furnish GFI/GFE, as necessary, including, but not limited to: cloud service offerings (e.g., services from AWS, etc.); software licenses; and IT Service Management (e.g., ServiceNow); email and collaboration accounts for Non-Secure Internet Protocol Router Network (NIPRNet); Virtual Desktop Infrastructure for NIPRNet; email accounts for Secret Internet Protocol Router Network (SIPRNet); and Common Access Cards (CACs).

To obtain CACs, the Contractor shall submit the following six (6) documents for each employee for whom a CAC is requested:

1. Mission Partner Identity, Credential, and Access Management (MP ICAM) Application

2. DoD Cyber Awareness Challenge Training

3. Operations Security (OPSEC) Level 1 Certificate

4. Controlled Unclassified Information (CUI) Certificate

5. Standard Form 312, Classified Information Nondisclosure Agreement

6. Visit Authorization Letter (VAL)

To obtain network access, the Contractor shall submit the following four (4) documents for each employee for whom network access is requested:

1. DD Form 2875, System Access Agreement Request

8. Joint Services Program User Agreement

9. DD Form 2842, DOD PKI Certificate of Acceptance and Acknowledgement of Responsibilities (For SIPRNet Access Only)

10. North Atlantic Treaty Organization Certificate (For SIPRNet Access Only)

The Contractor shall ensure that each onboarded employee who requires a CAC and network access submits the aforementioned documents to the Contracting Officer’s Representative (COR) as a package, with all documents maintained as separate portable document format files, within ten (10) calendar days of employment start.

GFI will be accessible through the Government network and paper copies, as needed. GFI, including SOPs, enterprise architecture standards, and other supplemental documentation will be provided to the contractor, as required, for contract performance.

1. Services The Government will provide access to Gitlab, JIRA, and the Tricentis software suite.

Period and Place of Performance The Period of Performance will be for five years from date of award, with no option periods and an option to extend services for a period of up to six (6) months under FAR 52.217-8. This option is to be exercised at the discretion of the Government. The final Period of Performance Dates will be reflected in the Contract Award Document.

The Place of Performance will be primarily in Contractor-provided facilities, with the expectation of regular meetings at Government facilities in the National Capital Region. There may be some requirements to travel to other DCSA facilities primarily at the Russel K. Knox Facility in Quantico, VA or other areas in the local commuting area. Therefore, contractors must be located within 50 miles of the Hanover, MD location. The Contractor shall be capable of Public Key Infrastructure client-side authentication to DoD private web servers.

Recognized/Government Holidays Performance in coordination with Government personnel shall not be required on the following Federal holidays, unless specifically identified.

· New Year’s Day

· Martin Luther King Jr’s Birthday

· President’s Day

· Memorial Day

· Juneteenth National Independence Day

· Independence Day

· Labor Day

· Columbus Day

· Veterans Day

· Thanksgiving Day

· Christmas Day

In addition to the days designated as holidays, the Government observes the following:

· Any other day designated by Federal Statute

· Any other day designated by Executive Order

· Any other day designated by Presidential Proclamation

It is understood and agreed between the Government and the Contractor that observance of such days by Government personnel shall not be a reason for an additional period of performance, or entitlement to compensation, except as set forth within the contract. If the Contractor believes that an unplanned absence has an impact on the period of performance or price, it should notify the PCO of the changed condition and submit a request for an equitable adjustment.

Nothing in this clause abrogates the rights and responsibilities of the parties relating to "stop work" provisions cited in other sections of this contract.

Hours of Operation The Contractor is responsible for conducting business, between the hours of 0900 and 1700 Eastern Standard Time. Monday through Friday, excluding Federal Holidays. Contractor personnel shall work eight (8) hours per day, exclusive of a 30-60 minute of unpaid lunch period, unless otherwise approved by the Government. Adjustments to daily start and end times may be coordinated with the Government to accommodate mission requirements or alternate work schedules.

General Requirements

Agile The Contractor shall include time for test planning, test execution, evaluation of results, and defect resolution in the Agile process.

The Contractor shall support the Government leadership team in addressing expectations, and identifying risks, issues, opportunities, and dependencies across the test and evaluation activities.

The Contractor shall elevate all test and evaluation-related cost, schedule, and performance decisions to the Government.

The Contractor shall adhere to the NBIS Agile Strategy dated 12 June 2025 (Attachment 02). It defines the Agile processes related to roles, responsibilities, and activities that support the creation of Epics, Capabilities, Features, and stories within NBIS. Key terms are defined in the NBIS Agile Strategy document, to ensure common understanding across all teams supporting NBIS.

a. Iteration Planning Contractor shall participate in Iteration Planning to review user stories and features for testability and clarity of acceptance criteria. Contractor shall estimate effort for test activities, plan required test cases, test data, and environments, and coordinate with developers to integrate testing tasks into the sprint backlog.

b. Daily Scrum Contractor shall attend daily scrum meetings to provide updates on test progress, blockers, and defects discovered. Contractor shall collaborate with team members to resolve issues, adjust test priorities as needed, and ensure alignment on test execution and coverage throughout the iteration.

c. Iteration Retrospective Contractor shall participate in Iteration Retrospective sessions to share insights on the effectiveness of testing processes, recommend process improvements, and collaborate with the team to address challenges and enhance overall quality practices.

d. Backlog Refinement Contractor shall participate in backlog refinement sessions to ensure user stories and features are testable, acceptance criteria are clear, and potential risks and dependencies related to testing and evaluation are identified and addressed. Contractor shall provide input on test effort estimation and recommend improvements to facilitate effective test and evaluation activities.

e. Iteration Review Contractor shall participate in Iteration Review sessions to present test results, including passed and failed test cases and identified defects. Contractor shall validate that completed stories and features meet acceptance criteria and quality standards, and provide feedback on product readiness and outstanding test concerns.

f. PI Planning Contractor shall participate in PI Planning sessions to define test objectives, acceptance criteria, and quality goals for the upcoming increment. Contractor shall identify risks, dependencies, and resource needs related to testing and evaluation, and ensure test activities and milestones are integrated into the team’s plans.

Management and Coordination The Government will designate a single point of contact to serve as the management interface for all Contractor activities performed under this PWS. The Contractor shall coordinate with this designated management representative on all contractual, technical, and administrative matters to ensure effective communication, integration, and execution of all requirements.

The Contractor shall:

· Coordinate with management to ensure all PWS requirements, deliverables, and milestones are planned, tracked, and completed in accordance with established timelines.

· Integrate and align all testing, engineering, and support activities to meet program objectives and maintain schedule adherence.

· Identify and communicate risks, dependencies, and issues impacting performance, providing recommended mitigation actions to management.

· Manage subcontractors and internal resources to ensure efficient collaboration and consistency in deliverable quality.

· Provide regular progress updates, reports, and performance summaries to management, highlighting accomplishments, challenges, and corrective actions.

· Ensure that all Contractor and subcontractor personnel perform their duties with professionalism, efficiency and ethical conduct consistent with Government standards and expectations

Contractor Cost and Software Data Reporting (CSDR)

The Contractor shall systematically collect and report to Cost Assessment Data Enterprise (CADE) and the United States Government (USG) the actual contract costs and technical information based on the Office of the Secretary of Defense (OSD) Deputy Director Cost Assessment (DDCA)-approved CSDR plan (Attachment X) in accordance with (IAW) the CSDR Manual, DoDM 5000.04. CSDRs shall be prepared in accordance with the instructions contained in the most recently approved versions of the Data Item Descriptions (DIDs), Cost and Hour Report (FlexFile) DI-FNCL-82162.

The Contractor shall submit electronically the Cost and Hour Report (FlexFile) Format IAW File Format Specification (FFS) and Data Exchange Instructions (DEI) (CDRL A019), using the CADE CSDR Submit-Review System. The required form and file type for each CSDR is specified in its Data Item DID.

Data submitters must register through the CADE website (https://cade.osd.mil/) and possess a DoD-approved External Certification Authorities (ECA) digital certificate or DoD-issued Common Access Card (CAC) to obtain a CADE Portal account and be authorized to upload CSDR content. Users can obtain access by submitting user information about themselves and their organizations to the CADE Portal and requesting a CSDR submitter user role.

Prime contractors are responsible for flowing down CSDR requirements contained in their prime contracts to all subcontractors who meet the reporting thresholds specified in DoDI 5000.73; subcontractors regardless of tier with a subcontract that exceeds $50 million, or subcontracts valued between $20 million and $49 million that are designated by the Government as being high interest.

In accordance with Statute 10 USC 3227, DoDI 5000.73, and DoDM 5000.04:

1. This solicitation includes:

a. The approved CSDR Plan for the contract, DD Form 2794

2. In the performance of this contract, the Contractor shall:

a. Implement a documented standard CSDR process that satisfies the guidelines contained in the DoDM 5000.04;

b. Manage procedures that provide for generation of timely and reliable information for the CSDR data items of this contract;

c. Utilize the approved CSDR Plan for this contract, DD Form 2794, and the related as the basis for reporting according to the required CSDR DIDs;

d. If subcontracts that exceed $50 million changes subcontractors or executes new subcontract awards, notify the Government as may require a subcontractor CSDR plan and electronic reporting directly to the CADE Portal using the CSDR Submit-Review System.

3. CSDR Readiness Review:

a. A CSDR Readiness Review Meeting will be held NLT 60 days after contract award to include a discussion of the CSDR process that satisfies the guidelines contained in the DoDM 5000.04 and the requirements in the approved CSDR Plan

4. The applicable required reports will be in the form of CDRLs listed below:

· CDRL A019 FlexFile Format outlined in File Format Specification (FFS)

5. The CSDR requirements are outlined per Attachment X, CSDR Plan (DD Form 2794).

Government-Contractor Relationship The Government and the Contractor understand and agree that the services to be delivered under the contract are non-personal services, and the parties understand and agree that no employer-employee relationship exists (or will exist) under the contract between the Government and the Contractor and/or between the Government and the contractor’s employees. It is, therefore, in the best interest of the Government to afford the parties a full and complete understanding of their respective obligations.

Contractor personnel under the contract shall not:

· Be placed in a position where they are appointed or employed by a Government officer or employee, or are under the supervision, direction, or evaluation of a Government officer or employee.

· Be placed in a staff or policy making position.

· Be placed in a position of command, supervision, administration, or control over a Government officer or employee, or the personnel of other contractors.

· Be a part of the Government organization.

· Be used for the purpose of avoiding manpower ceilings or other personnel rules and regulations applicable to Government officers or employees.

· Be used in the administration or supervision of Government procurement activities.

Employee Relationships The services to be performed under the contract do not require the Contractor or its employees to exercise personal judgment or discretion on behalf of the Government. Instead, the contractor’s employees shall act and exercise personal judgment and discretion only on behalf of the contractor. Rules, regulations, directions, and requirements that are issued by command authorities under their responsibility for good order, administration, and security are applicable to all personnel who enter any Government installation, or who travel on Government transportation. Such rules, regulations, directions, and requirements shall not be construed or interpreted to establish any degree of Government control that is inconsistent with a non-personal services contract.

Identification of Contractor Personnel The Contractor shall require all employees to identify themselves as Contractor personnel by wearing badges at all times when they are performing work at Government facilities or performing work for the Government under the scope of the contract at non-Government sites, to include attendance at meetings, seminars, etc. The badges may either be affixed to clothing or displayed from a chain or other mechanism worn around the neck. The badges must include the contractor’s company name and employee's name. No other items may be placed on the badge.

The Contractor shall manage workspace assigned to the Contractor in a manner that does not create the appearance that Contractor employees working in the space are Government employees.

Contractor employees shall initially identify themselves by name and company affiliation when answering the telephone, presenting briefings, conducting or attending meetings/seminars, or participating in any other activity where their Contractor status is not obvious.

Official Contractor correspondence (written, facsimile, and email display) shall include the contractor’s company name. Any other documents or reports produced by the Contractor shall be identified as Contractor products or otherwise disclose the contractor’s participation in the production of the document.

Service Contract Reporting (SCR) The Office of the Secretary of Defense (OSD) mandates reporting of manpower data with regard to the performance of DoD services contracts consistent with the requirements of title 10, U.S.C., section 235 and 2330a, as amended. Contractors are to report manpower data relating to the performance of services contracts into SAM, consistent with existing Service Contract Reporting (SCR) requirements under the FAR Subpart 4.17 - Service Contracts Inventory (SCI). When reporting on Call Orders issued under an indefinite-delivery contract or agreement, reports are completed at the order level. No reports are collected at the contract or agreement level. Contractors are required to report data in SAM on an annual basis when awarded a DoD contract or Call Order valued in excess of $3 million in obligations. The Contractor shall completely fill in all the information in the format using the following web address: http://sam.gov. SCI reporters are required to report the following information: Total Amount Invoiced, Prime Contractor Hours Expended, and, if applicable, Tier 1 subcontractor information. The reporting period for Contractors in SAM is open from mid-October through mid- December for reporting against the prior Government fiscal year. Contractors shall complete the SCR before the reporting period closes against the prior Government.

Safety The performer shall adhere to all Federal, State and local laws and regulations required to maintain a safe and non-hazardous occupational environment applicable to both the performer facilities and the Government locations defined in section.

The performer shall report immediately, within twenty-four (24) hours, to the Contracting Officer and Contracting Officer’s Representative (COR) any major accident/incident (including fire) resulting in any one or more of the following: causing one or more fatalities or one or more disabling injuries; damage of Government property exceeding $10,000; affecting program planning or production schedules; degrading the safety of equipment under contract, such as personnel injury or property damage may be involved; identifying a potential hazard requiring corrective action which are related to this project agreement. The performer shall prepare an Accident/Incident report (using DI-SAFT-81563 as reference) for each incident.

Environmental The performer shall adhere with Federal, State and local environmental laws and regulations, Executive Orders, treaties and agreements. The performer shall consider alternate materials and processes in order to eliminate, reduce or minimize the generation of hazardous waste while minimizing item cost and risk to system performance.

1.1.3. Information Subject to Export Control Laws/International Traffic in Arms Regulation (ITAR)

Public Law 90-629, “Arms Export Control Act,” dated 26 Dec 2013, as amended (22 U.S.C 2751 et. Seq.) requires that all unclassified technical data with military application may not be exported lawfully without an approval, authorization, or license under EO 12470 or the Arms Export Control Act, Continuation of Export Control Regulations, dated 30 Mar 1984, and that such data required an approval, authorization, or license for export under EO 12470 or Arms Export Control Act. For purposes of making this determination, the Militarily Critical Technologies List (MCTL) shall be used as general guidance. All documents determined to contain export controlled technical data will be marked with the DD254 notice indicated below.

Travel/Temporary Duty/Other Direct Costs (ODCs)

Travel/Temporary Duty Contractor personnel may be required to travel in the performance of this contract. It is the contractor’s responsibility to obtain all necessary travel documents to execute the required travel. All Contractor travel/temporary duty must be approved, in advance, by the COR. Contractor may be required to travel CONUS and within the Northern Capital Region (NCR) during the performance of this contract to attend meetings, conferences, and training. The Contractor may be required to travel to off-site training locations and to ship training aids to these locations in support of this performance work statement. Reimbursement of transportation, lodging, meals and incidental expenses are allowable subject to the limitations contained in Federal Acquisition Regulation (FAR) 31.205-46 and the limitation of funds specified in this contract. All travel requires Government approval/authorization and notification to the COR.

All travel within 100 miles of the National Capital Region is included in the price of this contract. When movement of contractor personnel is required locally (i.e., Metro) costs will be borne by the contractor. The Government will reimburse the contractor for all other travel outside the 100-mile limitation that was authorized in advance by the PCO, for reasonable travel related expenses.

The contractor shall be reimbursed for actual allowable, allocable, and reasonable travel costs incurred during performance of this effort in accordance with the FAR 31.205-46 "Travel Costs." Requests for approval of costs in excess of maximum per diem rates in accordance with the procedures contained in FAR 31.205-46(a)(3) must be submitted to the PCO for final approval prior to commencement of travel. The number of trips and types of personnel traveling shall be limited to the minimum required to accomplish the work requirements. Travel will be on FFP not-to-exceed (NTE) Contract Line-Item Number and shall comply with the requirements in FAR 31.205-46 and the Joint Travel Regulation (JTR). The NTE Travel CLIN will be established in Section B of the contract.

If any travel arrangements cause additional costs that exceed those previously authorized, written approval from the PCO is required prior to undertaking the travel or incurring the additional costs.

The contractor’s travel invoice must be submitted for reimbursement, along with supporting documentation, within sixty (60) calendar days after the completion of each approved travel incident.

Organizational Conflict of Interest (OCI) The Contractor shall be responsible for any subcontract management necessary to integrate the work performed on this contract and shall be responsible for subcontractor performance. The prime Contractor shall manage work to ensure no OCI exists and shall immediately report any potential OCIs for itself or any of its subcontractors to the PCO.

The Government considers it a conflict of interest for a Contractor engaged in NBIS software development efforts to bid on or participate in the provision of the T&E services outlined in this PWS. Refer to Federal Acquisition Regulation Subpart 9.5 – Organizational and Consultant Conflicts of Interest.

Data Storage, Data Ownership and Data Rights Requirements

Data Storage IAW Defense Federal Acquisition Regulation Supplement (DFARS) 239.7602-2, the Contractor must physically maintain all Government data that is not physically located on DoD premises solely on equipment located within the 50 states, the District of Columbia, or outlying areas of the United States, unless otherwise authorized by the authorizing official (AO), as described in DoDI 8510.01, in accordance with the DoD Cloud Computing SRG.

IAW with the DoD Cloud Computing SRG, to protect against seizure and improper use by non-U.S. persons and Government entities, all data stored and processed by/for the DoD must reside in a facility under the exclusive legal jurisdiction of the U.S. This may include DoD bases on foreign soil depending upon Status of Forces Agreements (SOFAs). CSPs will maintain all Government data, that is not physically located on DoD premises, within the 50 States, the District of Columbia, and outlying areas of the U.S. (as defined at FAR 2.101), unless otherwise authorized by the responsible AO as described in DoDI 8510.01. The PCO shall provide written notification to the Contractor when the Contractor is permitted to maintain Government data at a location outside the 50 States, the District of Columbia, and outlying areas of the United States. CSPs will provide the agency a list of the physical locations where the data could be stored at any given time and update that list as new physical locations are added. Additionally, the mission owner and/or PCO must review CSP terms and conditions to ensure data stored and processed in U.S. datacenters does not fall under the legal jurisdiction of another country.”

Data Ownership All DoD information/data placed or created by DoD users in a CSP’s CSO or provided to the Contractor as GFE/GFI is owned by the DoD, the mission owner, and/or their information owner. The Contractor has no rights to the DoD’s information/data. DoD information/data includes logs and monitoring data created within and by a mission owner’s system/application implemented in IaaS/PaaS CSOs as well as logs created for and provided to the mission owner related to their usage and management of the CSO. See DFARS 252.227-7020 Rights in Special Works.

Data Rights This requirement includes, but is not limited to, all development and automation activities performed, and all data, Information as Code (IaC), Configuration as Code (CaC), or processes created, exclusively with Government funds issued pursuant to this contract. This requirement does not, include code, processes, or automation that: (1) were funded exclusively with private funds, and for which the Government obtained only limited rights; (2) funded with mixed funds, and for which the Government obtained Government purpose rights; and (3) are commercial items, commercial software, or commercial software documentation that the Government acquired under the license customarily provided to the public.

The Data Rights clauses apply to all data generated in the performance of this contract. For non-commercial scripts, automation and technical data deliverables created exclusively with Government funds, unlimited rights are required. See clauses DFARS 252.227-7013, 252.227-7014, 252.227-7015, 252.227-7026 and 252.227-7027.

Cybersecurity Requirements The Contractor shall maintain administrative, technical, and physical safeguards and controls required for the security level and services being provided IAW DFARS 252.239-7010, Cloud Computing Services and the Department of Defense Cloud Computing Security Requirements Guide (DoD CC SRG). The architecture and all related application components shall comply with the security standards and controls specified in DoDI 8500.01, Cybersecurity, DoDI 8510.01, Risk Management Framework for DoD Systems, and NIST SP 800-53, Revision 5 (Rev. 5), Security and Privacy Controls for Information Systems and Organizations. The Contractor shall utilize all security controls available at time of order issuance and pursue modernization to the maximum extent possible.

· The Contractor shall generate and provide to the USG ISSO and/or ISSM required RMF authorization documentation and artifacts.

· The Contractor shall perform Cybersecurity vulnerability scans and address all findings in accordance with DoD directives and policies

· The Contractor shall conduct Information Assurance Vulnerability Management monitoring and response activities, to include the development and production of all necessary documentation to support these activities

· The Contractor shall ensure that all data-at-rest and data in-transit is encrypted utilizing NSA-approved encryption

· The Contractor shall comply with the DoD SCCA Functional Requirements, STIGs, and DoD Cloud Computing SRG

· The Contractor shall provide updates to required RMF authorization documentation, as required, on an annual, quarterly, or monthly basis, or when a significant change occurs to the technical or operational environment.

CUI

The Contractor shall comply with the requirements in DoDI 5200.48, Controlled Unclassified Information (CUI), for the identification, creation, sharing, marking, safeguarding, storage, dissemination, decontrol, disposition, destruction, and records management of CUI documents and material. The Contractor shall protect non-DoD information systems processing, storing, or transmitting CUI IAW DoDI 8582.01, Security of Non-DoD Information Systems Processing of Unclassified Nonpublic DoD Information, and DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting.

The Contractor shall distribute CUI IAW Department of Defense Manual (DoDM) 3200-14, Volume 1, Principles and Operational Parameters of the DoD Scientific and Technical Information Program (STIP): General…