NGB FOIA Support Services PWS.pdf

PERFORMANCE WORK STATEMENT (PWS)

National Guard Bureau-Office of Chief Counsel (NGB-JA) Freedom of Information Act (FOIA) Services

1.0 General:

The fundamental concept of this effort is to provide non-inherently governmental, non-personal service contractor support services to the National Guard Bureau (NGB) Office of Information, Privacy, and Civil Liberties (OIP).

The OIP mission is to administer and directs National Guard policy and training on all matters involving the Freedom of Information Act, Privacy Act, and Protection of Personal Identifiable Information. The OIP is also the final reviewer for all National Guard Privacy Impact Assessments; acts on behalf of the Chief, National Guard Bureau as the Initial Denial Authority on requests for information/records under the Freedom of Information Act and Privacy Act.

Due to a high volume of actions, Contractor-provided logistical and clerical support is needed to assist each office in completing their respective missions.

1.1 Scope: The Contractor shall provide all personnel, equipment, tools, materials, supervision, and quality control necessary, except as specified in Paragraph 3.0 as Government Furnished, to perform the service defined in this PWS.

1.2 Background: The services under this contract were previously procured under two separate contracts. The majority of the work under this effort was procured under 8(a) firm-fixed-price (FFP) contract W9133L16F0044.

1.3 Period of Performance (PoP): The PoP shall be one (1) base year and four (4) option years.

The specified PoP dates will be stated in the contract.

1.4 General Information: The following information is applicable to all services provided under this PWS.

1.4.1 Quality Control (QC): The Contractor shall develop and maintain a QC Plan (QCP) to ensure services are performed to the standards required in this PWS. The Contractor shall propose a DRAFT Quality Control Plan as part of their proposal. The Contractor shall implement procedures to identify, prevent, and ensure non-recurrence of defective services. The Contractor’s QCP is the means by which it assures itself that its work complies with the requirements of the contract. At a minimum, the Contractor shall develop QC procedures that address the areas identified in Technical Exhibit 1, Performance Requirements Summary. After acceptance of the QCP, the Contractor shall obtain the Contracting Officer’s (KO) acceptance in writing of any proposed changes to its QCP.

1.4.2 Quality Assurance (QA): The Government will evaluate the Contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan illustrates how the Government will evaluate the Contractor’s performance in accordance with the performance standards. The QASP defines how the performance standards will be applied, the frequency of surveillance, and acceptable quality levels.

1.4.3 Recognized Holidays: The following are recognized United States holidays. The Contractor shall not perform services on these days:

1.4.3.1 New Year’s Day: January 1st

1.4.3.2 Martin Luther King, Jr.’s Birthday

1.4.3.3 President’s Day

1.4.3.4 Memorial Day

1.4.3.5 Independence Day: July 4th

1.4.3.6 Labor Day

1.4.3.7 Columbus Day

1.4.3.8 Veteran’s Day: November 11th

1.4.3.9 Thanksgiving Day

1.4.3.10 Christmas Day

1.4.4 Place and Performance of Services: The Contractor is ultimately responsible for determining how and where the work will be performed, however, the proposal shall indicate whether contractor personnel will work on or off-site. As described in Section 3.0 below, the Government will provide necessary work space during business hours. The Government’s normal business hours are between the hours of 7:30 a.m. and 6:00 p.m., with “Core Hours” between 9:00 a.m. and 3:00 p.m., Monday through Friday; except on recognized US holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government-directed facility closings. The primary place of performance shall be Herbert R. Temple Jr. Army National Guard Readiness Center (TARC), 111 South George Mason Drive, Arlington, VA 22204. The Contractor shall at all times maintain an adequate work force for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons. When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the work force are essential.

1.4.4.1 Unscheduled Gate Closures: Unscheduled gate closures by the Security Police may occur at any time causing all personnel entering or exiting a closed installation to experience a delay. This cannot be predicted or prevented. Contractors are not compensated for unexpected closures or delays. Vehicles operated by Contractor personnel are subject to search pursuant to applicable regulations. Any moving violation of any applicable motor vehicle regulation may result in the termination of the Contractor employee’s installation driving privileges.

1.4.4.2 Facility Regulations: The Contractor’s employees shall become familiar with and obey the regulations of the installation; including fire, traffic, safety and security regulations while on the installation. Contractor employees should only enter restricted areas when required to do so and only upon prior approval. All Contractor employees shall carry proper identification with them at all times. The Contractor shall ensure compliance with all regulations and orders of the installation which may affect performance. The Contractor will not be provided parking at the Arlington Hall Station location, unless an exception is granted (e.g. handicap parking). Public transportation is available to and from Arlington Hall Station.

1.4.5 Security Requirements: Access and General Protections/Security Policy and Procedures.

The Contractor shall comply with all applicable facility access and local security policies and procedures, which may be obtained from the Contracting Officer’s Representative (COR). The Contractor shall also provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services or Security Office. The Contractor shall ensure compliance with all personal identity verification requirements by Department of Defense (DOD), HQDA and/or local policy. Should the Force Protection Condition (FPCON) change, the Government may require changes in Contractor security matters or processes.

1.4.5.1 COMSEC/IT Security: All communications with DOD organizations are subject to communications security (COMSEC) review. All telephone communications networks are continually subject to intercept by unfriendly intelligence organizations. DOD has authorized the military departments to conduct COMSEC monitoring and recording of telephone calls originating from, or terminating at, DOD organizations. Therefore, the Contractor is advised that any time Contractors place or receive a call they are subject to COMSEC procedures. The Contractor shall ensure wide and frequent dissemination of the above information to all employees dealing with DOD information. The Contractor shall abide by all Government regulations concerning the authorized use of the Government's computer network, including the restriction against using the network to recruit Government personnel or advertise job openings.

1.4.5.2 Government Information Systems (IS): Use of Government Information Systems (IS) and access to Government networks is a revocable privilege, not a right. Users are the foundation of the DoD strategy and their actions affect the most vulnerable portion of the Army Enterprise Infostructure (AEI). Contractor employees shall have a favorable background investigation (BI) or hold a security clearance and access approvals commensurate with the level of information processed or available on the system. Contractor employees shall:

a. Comply with the command's Acceptable Use Policy (AUP) for Government owned IS and sign an AUP prior to or upon account activation.

b. Complete initial and/or annual Information Assurance (IA) training as defined in the IA Best Business Practices (BBP) training (https://informationassurance.us.army.mil).

c. Mark and safeguard files, output products, and storage media per classification level and disseminate them only to individuals authorized to receive them with a valid need to know.

d. Protect IS and IS peripherals located in their respective areas in accordance with physical security and data protection requirements.

e. Practice safe network and Internet operating principles and take no actions that threaten the integrity of the system or network.

1.4.5.3 Protection of Personally Identifiable Information (PII): The Contractor shall protect all PII encountered in the performance of services in accordance with DFARS 224.103 and DoDD 5400.11, Department of Defense Privacy Program, and DoD 5400.11-R, DoDI 5400.11, DoD Privacy and Civil Liberties Programs, DoDM 5400.11v2, DOD Privacy and Civil Liberrties Programs: Breach Preparedness and Response Plan. If a PII breach results from the Contractor’s violation of the aforementioned policies, the Contractor shall bear all notification costs, call-center support costs, and credit monitoring service costs for all individuals who’s PII has been compromised.

1.4.5.4 Identification of Contractor Employees: All Contractor personnel attending meetings, answering Government telephones and working in other situations where their Contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression that they are Government employees. The Contractor shall ensure that all documents or reports produced by Contractor personnel are suitably marked as Contractor products or that Contractor participation is appropriately disclosed. The Contractor’s status as a “Contractor” shall be predominantly displayed in all correspondence types (to include signature blocks on e-mail) and dealings with Government or non-Government entities. Contractor personnel shall wear identification badges distinguishing themselves as such. The badges shall have the company name, employee name and the word “Contractor” displayed. The Contractor shall retrieve all identification media (including vehicle passes) from their employees who depart employment for any reason. All identification media (i.e., badges and vehicles passes) shall be returned to the COR within 14 days of an employee’s departure.

1.4.5.4.1 CAC Requirements: The Common Access Card (CAC) is the DOD Federal Personal Identity Verification (PIV) credential. In accordance with Directive Type Memorandum (DTM) 08-003, December 1, 2008, incorporating Change 5, October 8, 2013, Initial issuance of a CAC requires at a minimum, the completion of FBI fingerprint check with favorable results reflecting "No Record" and submission of a National Agency Check with Inquiries (NACI) to the Office of Personnel Management (OPM), or a DoD-determined equivalent investigation in accordance with Army Directive 2014-05. The issuance of a CAC will be based on four criteria; (a) eligibility for a CAC; (b) verification of DoD affiliation from an authoritative data source; (c) completion of background vetting requirements according to the Federal Information Processing Standards Publication 201-1, Personal Identity Verification (PIV) of Federal Employees and Contractors, March 2006, and DOD Regulation 5200.2-R, Department of Defense Personnel Security Program, January 1987, and (d) verification of a claimed identity. CAC eligible personnel must be registered in the Defense Enrollment Eligibility Reporting System (DEERS) through either an authoritative personnel data feed from the appropriate Service or Agency or Trusted Associate Sponsorship System (TASS).

a. HSPD-12 Background Investigation Requirements: The Contractor ensure Common

Access Cards (CACs) are obtained by all contract or subcontract personnel assigned to work on the Government site and by personnel requiring access to a DoD network (and other eligible populations as specified in DTM-08-003 Attachment 3, paragraph 3a.) are required to, at a minimum, have received a favorable FBI fingerprint check and must have submitted to the Office of Personnel Management (OPM) a National Agency Check with Inquiries (NACI) or equivalent/higher investigation . It is the responsibility of the Contractor to ensure that all employees requiring an initial background investigation complete a Personnel Security Investigation Portal (PSIP) form at the earliest possible date and that this form is forwarded to the COR immediately. The COR will review the form for completeness and accuracy and forward to the NGB Personnel Security manager who will initiate the investigation process via the PSIP. Contractor personnel will then receive two e-mail messages; the first will confirm that the request has been received by the Office of Personnel Management, and the second will provide instructions for the completion of the appropriate form via the Electronic Questionnaires for Investigations Processing (e-QIP) system. Upon completion of the e-QIP questionnaire and submittal of all required documents, including fingerprint card to the security manager, the BI will be initiated. The Contractor shall ensure all instructions regarding BI processing, including those provided verbally, by e-mail or via a Government system are complied with immediately.

The Contractor is cautioned that the entire process from submittal of the PSIP form to return of the FBI fingerprint check may routinely take from 2-6 weeks and shall factor this lead time into its hiring/placement process. The Contractor shall make all reasonable efforts to ensure that Contractor employees meet CAC eligibility standards upon assignment to the contract and shall be held responsible for delays, failure to meet performance requirements or decreases in efficiency in accordance with the applicable inspection clause.

b. Trusted Associate Sponsorship System (TASS): The Contractor is responsible for processing applications for Common Access Cards (CAC) for every Contractor employee who deploys with the military force OR who has need to access any government computer network in accordance with FAR 52.204-9, "Personal Identity Verification of Contractor Personnel."

(1) The Contractor is responsible for managing requests for new or renewal CAC cards in sufficient time to ensure that all Contractor employees have them when needed to perform work under this contract. The norm is at least ten (10) calendar days advance notice to the Trusted Agent (TA), unless there are extenuating circumstances approved by the Contracting Officer's Representative (COR) or Contracting Officer.

(2) The Contractor shall obtain an Army Knowledge Online (AKO) email address for each applicant, including subcontractors, who may be deployed or require logical access to a government computer network. This can be done by going to: http://www.us.army.mil and register as an "Army Guest," with the sponsor being the COR or a COR designated individual if the COR is ineligible to serve as an AKO Sponsor. Note: If an employee of a Contractor loses the Privilege to access AKO, they lose the ability to renew their CAC. Therefore it is critical that Contractor employees maintain their AKO accounts.

(3) It is recommend that a "Corporate Facility Security Officer" (FSO) be designated to serve as your firm's single point of contact for Background Investigation, the TASS application process and other CAC and security related matters. If a FSO is not established, each Contractor employee requiring a CAC will be required to process their own applications.

(4) CAC applications shall be processed through the TASS. The Contractor's FSO or

Contractor employee shall submit requests for a CAC via email to the designated TASS Trusted Agent (TA) before accessing the TASS website. The TASS TA for this requirement will be:

CW3 Miguel R. Flores, Senior Legal Administrator, National Guard Bureau, Office of the Chief Counsel, 111 South George Mason Drive, Arlington, VA 22204-1373; (703) 607-2611;

miguel.r.flores.mil@mail.mil.

(5) The government will establish a TASS application account for each CAC Request and will provide each Contractor employee a USER ID and Password, via email, to the FSO.

The FSO or Contractor employee shall access the TASS account and complete the CAC application (entering/editing Contractor information as applicable) at:

https://www.dmdc.osd.mil/tass/.

(6) The FSO or Contractor employee will submit completed applications in TASS and will follow up to ensure that the TA is processing the request.

(7) A CAC cannot be issued without evidence that the FSO has initiated a National Agency Check with Written Inquires (NACI).

(8) The government will inform the Contractor's applicant, via email, of one of the following:

a. Approved.* Upon approval, the information is transferred to the Defense Enrollment Eligibility Reporting System (DEERS) database and an email notification is sent to the Contractor with instructions on obtaining their CAC. The Contractor proceeds to a Real- Time Automated Personnel Identification System (RAPIDS) station (RAPIDS Site Locator:

http://www.dmdc.osd.mil/rsl/).

b. Rejected.* The Government, in separate correspondence, will provide reason(s) for rejection.

c. Returned. Additional information or correction to the application required by the Contractor employee.

d. *The Contractor shall maintain records of all approved and rejected applications.

(9) At the RAPIDS station, the RAPIDS Verification Officer will verify the Contractor by SSN and two forms of identification. Identity source Documents must come from the list of acceptable documents included in Form I-9, OMB No. 115-0136, "Employment Eligibility Verification." Consistent with applicable law, at least one document from the Form I- 9 list shall be a valid (unexpired) State or Federal Government-issued picture identification (ID).

The Identity documents will be inspected for authenticity and scanned and stored in the DEERS upon issuance of an ID. The photo ID requirement cannot be waived, consistent with applicable statutory requirements. The Verification Officer will capture primary and alternate fingerprints, picture, and updates to DEERS and will then issue a CAC.

(10) Issued CACs shall be for a period of performance not longer than three (3) years or the individual's contract end date (inclusive of any options), whichever is earlier.

(11) The Contractor shall return issued CAC's to the DEERS office upon departure or dismissal of each Contractor employee. Obtain a receipt for each card and provide to the

TA/COR.

1.4.5.5 AT Level 1 Awareness Training (AT): All Contractor employees requiring access to Army Installations, facilities, and controlled access areas shall complete Level 1 AT within 30 calendar days after contract start date and within 30 calendar days of new employees commencing performance. The Contractor shall submit certificates of completion for each affected Contractor and subcontractor employee, to the COR, or to the KO if a COR is not assigned, within 15 calendar days after completion of training. Level 1 AT is available at https://jkodirect.jten.mil/Atlas2/page/login/Login.jsf.

1.4.5.6 DoD Cyber Awareness Challenge Training: All Contractor employees shall complete the DoD Cyber Awareness Challenge Training before issuance of network access and annually thereafter. All Contractor employees performing services involving IT functions shall comply with DoD and Army training requirements in DoDD 8140.01 and AR 25-2 within six months of the start of contract performance. In accordance with DoDD 8140.01 DFARS 252.239.7001 and AR 25-2, Contractor employees performing services supporting IT functions shall be appropriately certified upon contract award. The baseline certification as stipulated in DoD 8570.01-M shall be completed upon contract award.

1.4.5.7 Information Awareness: All Contractor employees with access to a government information system must be registered in the Army Training Certification Tracking System (ATCTS) (https://atc.us.army.mil/iastar/index.php) at commencement of services, and shall successfully complete the DOD Information Assurance awareness training prior to access to the IS and then annually thereafter (https://ia.signal.army.mil/DoDIAA/).

1.4.5.8 iWATCH Training: The Contractor with an area of performance within an Army-controlled installation, facilities or area shall brief all employees on the local iWATCH program.

This local developed training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the COR or the KO. This training shall be completed within 30 calendar days of contract award and within 30 calendar days of new employees commencing performance. The Contractor shall report completion for each affected

Contractor employee and subcontractor employee, to the COR, or to the KO if a COR is not assigned, within 15 calendar days after completion of training.

1.4.5.9 OPSEC Training: In accordance with AR 530-1, Operations Security, new Contractor employees shall complete Level I OPSEC training within 30 calendar days of their reporting for duty and annually thereafter. The Contractor shall submit certificates of completion for each affected Contractor employee, to the COR, or to the KO if a COR is not assigned, within 15 calendar days after completion of training. Level 1 OPSEC training is available at http://cdsetrain.dtic.mil/opsec/.

1.4.5.10 Handling/Access to Classified Information: Not Applicable.

1.4.5.11 Threat Awareness Reporting Program: For all Contractors with security clearances.

Per AR 381-12 Threat Awareness and Reporting Program (TARP), Contractor employees must receive annual TARP training by a CI agent or other trainer as specified in 2-4b.

1.4.6 Physical Security: The Contractor shall safeguard all Government property provided for Contractor use. At the close of each work period, Government facilities, equipment and materials shall be secured.

1.4.6.2 Key Control: The Contractor shall establish and implement methods of ensuring all keys/key cards issued by the Government are not lost or misplaced and are not used by unauthorized persons. NOTE: All references to keys include key cards. No keys issued by the Government shall be duplicated. The Contractor shall include procedures covering key control in the QC Plan. Such procedures shall include turn-in of any issued keys by personnel who no longer require access to locked areas. The Contractor shall immediately report any occurrences of lost or duplicated keys/key cards to the Contracting Officer’s Representative (COR).

1.4.6.3 Lost Keys: In the event keys, other than master keys, are lost or duplicated the Contractor shall, upon direction by the KO, re-key or replace the affected lock or locks; however, the Government, at its option, may replace the affected lock or locks or perform re-keying.

When the replacement of locks or re-keying is performed by the Government, the total cost of re-keying or the replacement of the lock or locks shall be deducted from the monthly payment due the Contractor. In the event a master key is lost or duplicated, all locks and keys for that system shall be replaced by the Government and the total cost deducted from the monthly payment due the Contractor.

1.4.6.4 Safeguarding Access: The contactor shall prohibit the use of the Government issued keys/key cards by any persons other than the Contractor’s employees. The Contractor shall prohibit the opening of locked areas by Contractor employees to permit entrance of persons other than contactor employees engaged in the performance of services in those areas, or personnel authorized entrance by the KO.

1.4.6.5 Lock Combinations: The Contractor shall establish and implement methods of ensuring all lock combinations are not revealed to unauthorized persons. The Contractor shall ensure that lock combinations are changed when personnel having access to the combinations no longer have a need to know such combinations. These procedures shall be included in the Contractor’s QC Plan.

1.4.7 Special Qualifications: The Contractor shall be required to have NACI clearance, sign a non-disclosure, and comply with their OCI Mitigation Plan.

1.4.8 Post Award Conference/Periodic Progress Meetings: The Contractor agrees to attend any post award conference convened by the KO in accordance with Federal Acquisition Regulations Subpart 42.5. The KO, Contracting Officer’s Representative (COR), and other Government personnel, as appropriate, may meet periodically with the Contractor to review the contactor’s performance. At these meetings, the KO will apprise the Contractor of how the Government views the Contractor’s performance and the Contractor shall apprise the Government of problems, if any, being experienced The Contractor shall resolve outstanding issues raised by the Government. Contractor attendance at these meetings shall be at no additional cost to the Government.

1.4.9 Contract Manager (CM): The Contactor shall designate a CM (not to confuse with Program Manager if applicable) who shall ensure performance under this contract. The name of this person, and an alternate who shall act for the Contractor when the CM is absent, shall be designated in writing to the KO. The CM or alternate shall have full authority to act for the Contractor on all contract matters relating to daily operation of this contract. The CM shall ensure that Contractor employees do not perform any services outside the scope of the contract without an official modification issued by the KO. The CM shall ensure Contractor employees understand that services performed outside the scope of the contract are performed wholly at the expense of the Contractor.

1.4.10. Combating Trafficking in Persons: The United States Government has adopted a zero tolerance policy regarding trafficking in persons. Contractors and Contractor employees shall not engage in severe forms of trafficking in persons during the period of performance of the contract; procure commercial sex acts during the period of performance of the contract; or use forced labor in the performance of the contract. The Contractor shall notify its employees of the United States Government’s zero tolerance policy, the actions that will be taken against employees for violations of this policy. Such actions may include, but are not limited to, removal from the contract, reduction in benefits, or termination of employment. The Contractor shall take appropriate action, up to and including termination, against employees or subcontractors that violate the US Government policy as described at FAR 22.17.

1.4.11 Contractor Travel: Government Directed travel will not be required.

1.4.12 Data Rights: The Government has unlimited rights to all documents/material produced under this contract. All documents and materials, to include the source codes of any software, produced under this contract shall be Government owned and are the property of the Government with all rights and privileges of ownership/copyright belonging exclusively to the Government.

These documents and materials may not be used or sold by the Contractor without written permission from the KO. All materials supplied to the Government shall be the sole property of the Government and may not be used for any other purpose. This right does not abrogate any other Government rights.

1.4.13 Telecommuting: The Government may permit telecommuting, pursuant to FAR 7.108, by contractor employees when determined to be in the best interest of the Government in meeting work requirements. The Contractor shall have an established telecommuting program as part of their proposal. In furtherance of Continuity of Operations Planning (COOP), a telework program may be enacted to ensure the Government's mission-critical operations stay operational during times of National Emergency or incidents of National Significance. The COR(s) must identify to the Contracting Officer any tasks requiring continuity of critical supplies and services and at what level those supplies and services must be delivered. Telework shall be at no additional cost to the Government.

2.0 Definitions and Acronyms:

2.1 CONTRACTOR: A supplier or vendor awarded a contract to provide specific supplies or service to the government. The term used in this contract refers to the prime.

2.2 CONTRACTING OFFICER (KO): A person with authority to enter into, administer, and or terminate contracts, and make related determinations and findings on behalf of the government.

Note: The only individual who can legally bind the government.

2.3 CONTRACTING OFFICER'S REPRESENTATIVE (COR): An employee of the U.S.

Government designated by the KO to monitor Contractor performance. Such appointment shall be in writing and shall state the scope of authority and limitations. This individual has authority to provide technical direction to the Contractor as long as that direction is within the scope of the contract, does not constitute a change, and has no funding implications. This individual does NOT have authority to change the terms and conditions of the contract.

2.4 DEFECTIVE SERVICE: A service output that does not meet the standard of performance associated with the Performance Work Statement.

2.5 DELIVERABLE: Anything that can be physically delivered and includes non-manufactured things such as meeting minutes or reports.

2.6 KEY PERSONNEL: Contractor personnel that are evaluated in a source selection process and that may be required to be used in the performance of a contract by the Key Personnel listed in the PWS. When key personnel are used as an evaluation factor in best value procurement, an offer can be rejected if it does not have a firm commitment from the persons that are listed in the proposal.

2.7 PHYSICAL SECURITY: Actions that prevent the loss or damage of Government property.

2.8 QUALITY ASSURANCE: The government procedures to verify that services being performed by the Contractor are performed according to acceptable standards.

2.9 QUALITY ASSURANCE SURVEILLANCE PLAN (QASP): An organized written document specifying the surveillance methodology to be used for surveillance of Contractor performance.

2.10 QUALITY CONTROL: All necessary measures taken by the Contractor to assure that the quality of an end product or service shall meet contract requirements.

2.11 SUBCONTRACTOR: One that enters into a contract with a prime Contractor. The Government does not have privity of contract with the subcontractor.

2.12 WORK DAY: The number of hours per day the Contractor provides services in accordance with the contract.

2.13 WORK WEEK: Monday through Friday, unless specified otherwise.

2.14 ACRONYMS:

AEI .......................Army Enterprise Infostructure AFARS .................Army Federal Acquisition Regulation Supplement ANG .....................Air National Guard AR ........................Army Regulation ARNG ..................Army National Guard AT/OPSEC ...........Antiterrorism/Operational Security BI ..........................Background Investigation CID .......................Criminal Investigation Division CFR ......................Code of Federal Regulations CM .......................Contract Manager CNGBI ................ Chief National Guard Bureau Instructions CONUS ................Continental United States (excludes Alaska and Hawaii) COR ......................Contracting Officer Representative COTS ....................Commercial-Off-the-Shelf DA ........................Department of the Army DD250 ..................Department of Defense Form 250 (Receiving Report)

DD254 ..................Department of Defense Contract Security Requirement List DFARS .................Defense Federal Acquisition Regulation Supplement DOD .....................Department of Defense DoDD ...................Department of Defense Directive DoDIAA ...............DOD Information Assurance Awareness FAR ......................Federal Acquisition Regulation FDM .....................Financial Disclosure Management FOIA ....................Freedom of Information Act GFEBS ................ General Fund Enterprise Business Systems GFP/M/E/S ...........Government Furnished Property/Material/Equipment/Services IA .........................Information Assurance IS ..........................Information System(s) KO ........................Contracting Officer NG ........................National Guard NGB .....................National Guard Bureau NGB-JA ................Office of the Chief Counsel OCI .......................Organizational Conflict of Interest ODC .....................Other Direct Costs OI .........................Office of Complex Administrative Investigations OIP .......................Office of Information Privacy OPR ......................Office of Primary Responsibility PA .........................Privacy Act PAS ......................Privacy Act Statement PIA .......................Privacy Impact Assessment PII .........................Personally Identifiable Information PIPO .....................Phase In/Phase Out POC ......................Point of Contact PRS .......................Performance Requirements Summary PWS ......................Performance Work Statement QA ........................Quality Assurance QAP ......................Quality Assurance Program QASP ....................Quality Assurance Surveillance Plan QC ........................Quality Control QCP ......................Quality Control Program SORN ...................System of Records Notices STANFINS ...........Standard Finance System SVC ......................Special Victims’ Counsel TAG ......................The Adjutant General TE .........................Technical Exhibit

3.0 Government Furnished Property, Material, Equipment and Services (GFP/M/E/S):

3.1 The Government will provide the property, material, equipment, and/or services listed below solely for the purpose of on-site performance under this contract:

3.1.1 Facilities: The Government will furnish, incidental to services being provided, the necessary workspace for the Contractor to perform services outlined in this PWS to include desk space, telephones, computers and other items necessary to maintain an office environment.

3.1.2 Services: The Government will provide, incidental to services being provided, utilities, equipment, office furniture, and supplies to support Contractor operations in Government facilities on the same basis as made available to Government employees performing similar functions, including automated data processing equipment (computers) and telecommunications equipment. The materials and information provided to the Contractor by the Government or to which the Contractor had access in completing work under the contract, to include keys in accordance with Appendix D of AR 190-51, pagers, and access badges, are the exclusive property of the Government. The Government will also provide expendable supplies for use by the Contractor personnel at the work site.

3.1.3 Additional Equipment: The NGB-OIP may authorize the Contractor to use the provided equipment and furnishings as well as additional furnishings and equipment of a similar type if required. Any such additional acquisitions shall be requested by the Contractor and shall be approved in writing by the Contracting Officer prior to purchase or rental of such furnishings and/or equipment. At the discretion of the COR, any such furnishings and/or equipment may be withdrawn at any time. The Government will provide necessary periodic cleaning of floors, windows, furnishings and fixtures necessary to conform to applicable health, safety and sanitary requirements.

3.1.4 Contractor Equipment: Following the prior written approval of the COR, the Contractor may use its own items at no cost or liability to the Government for maintenance, service, repair and/or replacement provided the use of such equipment does not require additional, or result in overloading of existing utility resources. All such equipment shall conform to accepted safety standards.

3.1.5 Damaged Equipment: The Contractor shall assume both the responsibility and liability for loss or damage of equipment and/or facilities provided by the Government if the damage or loss is caused by other than normal operating usage or is attributable to negligence of Contractor’s employees and/or agents.

3.2 Utilities: All utilities in the facility will be available for the contactor’s use in the performance of this contract. The Contractor shall instruct employees in utilities conservation practices. The Contractor shall operate under conditions that preclude the waste of utilities, which include turning off the water faucets or valves after using the required amount.

4.0 Contractor Furnished Property, Materials, and Equipment (CFP/M/E):

4.1 General: Except for those items specifically stated to be Government-Furnished in Paragraph 3.0, the Contractor shall furnish everything required to perform these services as indicated in Paragraph 1.1.

4.2 Materials: The Contractor shall exercise responsibility and accountability for Government property dedicated to its employees’ use in performance of contract requirements. This responsibility includes the obligation to properly use, care for, and safeguard all Government property in their personal possession. Any property or resources so provided shall be used only for contract performance-related purposes. The Contractor shall instruct employees in utilities conservation practices. The Contractor shall be responsible for operating under conditions that preclude the waste of utilities, such as turning off the water faucets or valves after using the required amount.

5.0 Requirements:

The Contractor shall provide non-personal services to the six offices identified earlier in the PWS. While each office requires Contractor services for specific tasks in accomplishing mission, the following general requirements apply at the program level. Contractor shall identify personnel responsible for ensuring the performance/compliance in the proposal.

5.1 The Contractor shall create a Monthly Progress Report (MPR). The Contractor’s sample of the report shall be submitted to the COR and Contracting Officer for review and approval at the Post-Award meeting. The MPR shall be submitted to the COR via email by the fifth (5 th) calendar day of each Month. Contractor shall provide a Year-End Roll-up Report of submitted data/information to the COR via email within five (5) calendar days prior to the end of period of

5.2 Due to the highly sensitive material the Contractors may have access to, it is imperative the Contractor provides strict compliance and guidance regarding release of information mandates. Furthermore, all Contractor employees shall be required to sign and provide a Standard Form 312, Classified Information Nondisclosure Agreement to the COR prior to beginning work. A fillable Adobe Acrobat copy of the Standard Form 312 may be downloaded at http://www.gsa.gov/portal/getFormFormatPortalData.action?mediaId=65765.

5.3 Prohibition on Contractors providing legal advice. FAR Subpart 7.5, Inherently Governmental Functions, strictly prohibits “Contractors providing legal advice and interpretations of regulations and statutes to Government officials.” The work contained in this PWS may be determined “Closely Associated with Inherently Government Functions” and as a result, Contractor must be cognizant of the limitations on the services requested. Further, Contractor shall provide specific training on prohibited services prior to beginning work.

Contractor shall forward any questions that may be construed to warrant a legal or other inherently governmental response to the COR or closest available Government attorney.

5.4 Due to the high volume of draft documents/information submitted under this contract, the Contractor shall ensure all work products adhere to a high standard of accuracy based on the performance standards in the below table. The Government will assess the quality level of each provided document required throughout Section 5.0. The quality level for each document will receive a rating based on the matrix table below. At the end of each month, the ratings will be averaged to produce the Document’s Monthly Performance Report. The COR will email the Contractor a copy of the Document’s Monthly Performance Report. At the end of each period of performance, the COR will average the monthly ratings to provide the overall rating (See Technical Exhibit 1, Performance Requirements Summary). The Contractor will document the error(s) they received and provide an update in the MPR.

Draft Documents Submission Performance Standards Matrix

Unsatisfactory Marginal Satisfactory

(Acceptable Quality Level)

Very Good

(Performance Standard)

Exceptional

5 and higher found errors

4 found errors

3 found errors

2 found errors

1 and below found errors

5.5 FOIA and Privacy Act Request Processing Services:

The NGB processes approximately 350 FOIA Requests and 100 Privacy Act (PA) Requests each year. FOIA and Privacy Act procedures are governed by DoD 5400.7-R, NGB Standard Operating Procedure (SOP), 32 CFR Part 518, 5 USC 552, and 5 USC 552a. The process for executing a FOIA and Privacy Act request are similar and follow the below described tasks. All FOIA/PA requests will follow a basic process: (1) Logging all requests; (2) creation of an electronic and hard copy file; (3) tasking each request; (4) tracking the status of each request; (5) obtain relevant documentation; (6) process received documentation; (7) provide completed packet to Government for review and approval; and (8) send out and closeout each request. The Government will provide all templates used under this section at the Post-Award Meeting.

The NGB processes approximately 200 Privacy Breaches each year. Privacy breaches are subject to the Safeguarding Against and Responding to the Breach of Personally Information, June 5, 2009, policy memorandum (see https://www.rmda.army.mil/privacy/RMDA-PO- Infractions.html). Depending on the type of privacy breach requested, the Contractor shall either process according to the policy memorandum with Government approval or forwards a request to the Government’s System Manager for processing.

5.5.1 The Contractor shall check the Government’s “FOIA/PA Inbox” in Microsoft Outlook, Government fax machine, and Government processed mail on a daily basis. The Contractor shall log all new FOIA/PA requests (approximately 350 per year) into one of the following: (1) FOIAXpress; (2) Freedom of Information and Privacy Acts Case Tracking System (FACTS);

(3) Freedom of Information Reporting System (FOIRS). The Contractor shall also log requests into the Air Traffic Control (ATC) Log and Fiscal Year Log Excel Spreadsheets within one Business Day. The Government will provide access to these databases after confirmation of a

CAC.

5.5.2 The Contractor shall create an electronic FOIA/PA Case File in the Government share drive and also duplicate the file in hard copy form using (NGB Form 340) within one Business Day. The FOIA/PA Case File template will be provided by the Government at the Post-Award

Meeting. After creation of the FOIA/PA Case File, the Contractor shall update the case file upon completion of each document for tracking purposes.

5.5.3 After requests are logged in, the Contractor shall analyze each request for compliance with the aforementioned laws, regulations and policy and draft an Acknowledgement Letter.

The draft Acknowledgment Letter shall be provided to the COR or ACOR for approval within five (5) business days of request receipt. In the event the COR/ACOR finds errors during their review, the Contractor shall address all errors and resubmit the letter within one (1) business day.

5.5.4 The Contractor shall prepare a FOIA/PA Processing Checklist Packet (see Attachment 1), which is the official tasking to be sent to offices of record to search for records responsive to the FOIA & Privacy requests received by NGB-OIP. The Contractor shall forward the FOIA/PA Processing Checklist Packet to the COR and NGB- Section Chief for review and approval within fifteen (15) business days of receipt of request. After approval, the Contractor shall send the FOIA/PA Processing Checklist Packet to the Government designated Office of Primary Responsibility (OPR) via Microsoft Outlook email (Air National Guard) or Task Management Tool (TMT) (for NGB components).

5.5.5 The Contractor shall analyze approximately fifteen (15) Office of Primary Responsibility (OPR) Response Emails a week to ensure the four (4) following items are attached: (1) proper Search Certifications, (2) Release Recommendation Memorandum, (3) DD2086 cost calculations, and (4) the OPR initial redacted documents. If the four (4) items are properly attached, the Contractor shall transfer the files to the electronic and hard copy FOIA/PA Case.

Should an OPR Response Email not be properly submitted, the Contractor shall email the OPR to request needed documents.

5.5.6 The Contractor shall perform a Redaction Analysis on received records and documents (approximately 1000 pages a week) pursuant to 5 U.S.C. 552 and, for Privacy Act requests, 5 U.S.C. 552a exemptions. All Redaction Analysis shall be performed using Adobe Pro. The Contractor shall submit the completed analysis to the COR or ACOR via electronic copy for approval per NGB FOIA Request Processing Checklist.

5.5.7 The Contractor shall collect FOIA & Privacy Status Reports (Attachment 2) from each NGB component OPR (approximately 90). The Contractor shall notify the COR or ACOR of the Requestor Service Centers (RSC) failing to provide status reports in the FOIA & Privacy Status Reports as an attachment to MPR.

5.5.8 The Contactor shall analyze the FOIA/PA Backlogs for all FOIA RSCs for the NGB component. The Contractor shall contact each FOIA Monitor to inquire about the status of backlogged requests. The Government will provide a list of the FOIA Monitors at the Post- Award Meeting. The Contractor shall update the ATC Log with the current status provided by the FOIA Monitor per NGB FOIA Request Processing Checklist.

5.5.9 The Contractor shall prepare FOIA/PA Final Response for Releases in hard copy (up to 200 pages) or compact disc for mailing to requesters for submittal to the COR or ACOR for review and approval within three (3) business days of the Redaction Analysis approval stated in Section 5.2.7.

5.5.10 The Contractor personnel shall closeout and file FOIA/PA Case Files for all outgoing correspondence within one (1) business days of receiving the NGB-DMA Director or Deputy and/or NGB OIP Chief, signature and approval. Thereafter, the Contractor shall prepare and sanitize finalized, designated FOIA/Privacy records for upload to the FOIA Reading Room within two (2) Business Days of the COR or ACOR designation and comply with the Draft Documents Submission Performance Standards Matrix. The FOIA Reading Room is a website maintained on the National Guard (see http://www.nationalguard.mil/Resources/FOIA/Reading- Room).

5.5.11 The Contractor shall provide FOIA/PA Customer Services. The Contractor shall answer the Government Outlook inbox emails and toll free phone calls (approximately twenty (20) phones call per day). Any phone calls forwarded to the Government voicemail system (approximately twenty-five (25) shall be returned within one (1) business day. The Contractor shall provide general information (i.e. status/queue updates, estimated completion date) to requesters on the ATC Log.

5.5.12 The Contractor shall check the Government’s FOIA/Privacy Inbox in Microsoft Outlook daily to check for any reported breaches. Any new breaches will be emailed to the COR, Active Army, and the active Air Force accordingly within one (1) Business Days.

5.5.13 The Contractor shall maintain the Government provided PII Breach Tracking Summary Excel Spreadsheet (see Attachment 3) to document the number of both active and closed privacy breaches. The Contractor shall store and maintain the PII Breach Tracking Summary on the Government’s share drive.

5.5.14 The Contractor shall create a Breach Case File Folder in the Open PII Breaches folder in the Privacy Officer Organization box of the Government’s share drive for each breach case. A file saved in the folder shall follow the naming convention stated in the NGB PII Breaches SOP (provided at the Post-Award Meeting).

5.5.15 The Contractor shall respond to follow-up inquiries with Government approved training material within ten (10) business days of receiving the said inquiry. The Government will provide approved training material to the Contractor after award.

5.5.16 The Contractor shall transfer the file and all correspondence to the “Closed PII Breach” file in the Privacy Organization Box on the Government share drive within one (1) Business Day of the PII Breach being resolved.

6.0 Applicable Publications:

6.1 Laws, Regulations, Directives and Policies: The Contractor shall ensure that all policies and procedures for provided services are in compliance with DoD, Army, Air Force, National Guard and other federal and state laws and regulations and have a working knowledge of Air Force and Army Administrative Instructions and Regulations, NGB, ARNG and ANG policy letters, and office operating instruction. Publications applicable to this PWS are listed below.

Publication (Chapter/Page)

Pub.

Date

Mandatory/ Advisory

Website

Computer Security Act of 1987 Aug 1, Mandatory https://www.congress.gov/bill/10 0th-congress/house-bill/145

Federal Financial Management Improvement Act of 1996

Sep 30, Mandatory http://thomas.loc.gov/cgi-bin/bdquery/z?d104:HR03610:|T OM:/bss/d104query.html

Federal Managers Financial Integrity Act of 1982

Sep 8, Mandatory…