OPMAS_E_PWS.docx

SECTION C PERFORMANCE WORK STATEMENT (PWS)

FOR THE OPERATION, MAINTENANCE, SUPPLY - EUROPE (OPMAS-E) COMMUNICATIONS CONTRACT Table of Contents

3.2 Operations and Maintenance (O&M) of Department of Defense Information Network (DODIN) Facility

3.5

RESERVED

3.6

RESERVED

3.7

RESERVED

3.9

RESERVED

3.10

RESERVED

Applicable Documents:

Technical Exhibit 1: TE1, Supported Locations Technical Exhibit 2: TE2, Government Furnished Property Listing

PERFORMANCE WORK STATEMENT (PWS)

FOR THE OPERATION, MAINTENANCE, SUPPLY - EUROPE (OPMAS-E) COMMUNICATIONS CONTRACT

1.0 SCOPE.

1.1 General. The Contractor shall provide information technology (IT) services to support the mission of the 2nd Theater Signal Brigade/U.S. Army Europe (USAREUR) G6 within the USAREUR, U.S. European Command (EUCOM), and U.S. Africa Command (AFRICOM) Areas of Responsibility (AORs). The Contractor shall provide operation, maintenance and supply support of communications and information systems under the purview of the 2nd Theater Signal Brigade, its subordinate units, other military services, and customers of the 2nd Theater Signal Brigade. Current locations and systems to be supported are specified in the appendices to this PWS. The Contractor shall provide all management, administration, personnel, services, overtime, travel, training, and equipment required to perform the operation, maintenance, and repair of communication facilities, systems, and equipment except for Government-furnished property (GFP), and Government-provided services as stated in this PWS. The Contractor shall also install and de-install equipment, perform supply functions, and provide logistics support. The Contractor shall use Government-provided transportation to move equipment.

1.2 The 2nd Theater Signal Brigade (2nd SIG BDE) is a forward-deployed theater signal brigade providing tactical and strategic communications across the full range of military operations within EUCOM’s and AFRICOM’s AOR. Due to changes in military missions and needs, the Government anticipates modifying the contract repeatedly IAW (IAW) the appropriate “Changes” clauses of FAR Part 52.243. Specific Contractor support includes: operation of the Area Maintenance and Supply Facility-Europe (AMSF-E); Operation and Maintenance (O&M) of Department of Defense Information Network (DODIN) systems and sites, to include Asynchronous Transfer Mode (ATM), Timeplex, Synchronous Optical Network (SONET) radios, and Technical Control Facilities (TCF); operation and maintenance (O&M) of the following activities: the Antenna Maintenance Activity (AMA), Defense Red Switch Networks (DRSN), Voice over Internet Protocol (VoIP),Voice over Secure Internet Protocol (VoSIP) Call Manager (CM) System Administration; Kosovo Communication Systems; O&M support for DISA and Army communications systems in forward deployed locations (Site K, Site Y, and Forward Operating Sites Romania and Bulgaria); support for Coalition Network Systems and SLAN Network Systems; COMSEC Management; maintenance of the following systems: Automatic Test Equipment (ATE), Test, Measurement, and Diagnostic Equipment (TMDE), Armed Forces Television, Air Traffic Control (ATC) Systems (ATSM), Tie Cable (Copper and Fiber Optic); Tie Cable repair, expansion and extension; maintenance, repair, relocation and replacement of environmental support equipment, heating ventilating, and air conditioning (HVAC), battery banks, Frequency Converters (FC), Uninterruptible Power Supplies (UPS), rectifiers, and other related power equipment and control cabinets. Additionally, the Contractor may be required to provide telephone network support, monitor network circuits and alarm functions of the facility infrastructure monitoring systems; maintain digital switching systems; and perform Help Desk functions and server administration. Currently, contract places of performance are Germany, Italy, Belgium, and Netherlands, but the Government anticipates requiring additional places of performance.

2.0 REFERENCE DOCUMENTS. Applicable documents and references are listed in Appendix 1A; acronyms used in the PWS are listed in Appendix 1B.

3.0 REQUIREMENTS.

3.1 General Requirements.

3.1.1 Phase-In/Out.

3.1.1.1 Phase-In. The Contractor shall conduct phase-in procedures beginning 60 calendar days prior to the performance date specified in Section F of the contract. The phase-in shall require coordination with the incumbent Contractor for acceptance of the program. The Contractor shall perform a joint inventory of GFP listed in TE2 with the incumbent Contractor and the designated Government Contracting Officer’s Representative (COR), Government Property Administrator (PA). All discrepancies and problems shall be noted and submitted to the Government PA for resolution.

3.1.1.2 Phase-Out. The services under this contract are considered vital to the Government and must be continued without interruption upon contract expiration. Therefore, the Contractor shall provide phase-out services IAW FAR 52.237-3.

3.1.1.3 Communication Security (COMSEC) Training and Inventory. Fourteen to thirty calendar days prior to contract completion, the COR will coordinate contractor maintenance COMSEC training with supporting COMSEC Account Managers (CAM) for all personnel the Contractor has identified as requiring access to, and control of COMSEC keying material. Not later than 24-72 hours prior to assumption of duties, the designated incoming Contractor HRH will conduct a joint inventory of all COMSEC keying material with the incumbent Contractor HRH and with the supporting COMSEC custodian for the receipt of COMSEC materials. The Contractor shall handle and safeguard Controlled Cryptographic Items (CCI) IAW: AR 380-40, Policy for Safeguarding and Controlling Communications Security (COMSEC) Material; DA PAM 25-380-2, Security Procedures for CCI; TB 380-41, Procedures for Safeguarding, Accounting and Supply Control of COMSEC materials.

3.1.2 Duty Hours and Overtime Hours. Unless otherwise specified in TE-1 Duty Hours, the Contractor’s normal duty hours shall be Monday through Friday, 0730 through 1630 hours. The Contractor shall provide overtime support during non-duty hours to meet operational demand. The Contracting Officer (KO) or the Contracting Officer’s Representative (COR) must approve and authorize overtime support in advance. The Government will reimburse overtime services in accordance with (IAW) Section B “Overtime” CLINs.

3.1.2.1 Alternate Work Location- Telecommuting/Telework. This type of work is an arrangement that allows the contract employee to perform work e.g. home, telework center, etc. during any part of regularly scheduled paid hours, at an approved alternative worksite other than the Contractor’s place of duty specified in the contracts TE-1 - Duty Hours.

3.1.2.2 Telecommuting/Telework to be performed under this contract will apply to contractor employees who have been identified as able to perform at alternate worksites by the contractor. Telecommuting/Telework will be utilized in this contract for situations due to emergency related conditions (e.g., inclement weather, building closures, or other agency announced emergencies). The access to classified information will be limited to Government work locations. Additionally, no classified information shall be discussed, processed, or stored in the Alternate Worksite of Contractors Facility.

3.1.2.3 The contractor shall submit to the Contracting Officer Representative (COR) and the Contracting Officer (KO) their telework policy, employee telework agreement, and documentation of compliance with government safety and property guidelines for employee’s’ requesting alternate work location consideration. Requests for alternate work location/telework shall be coordinated and submitted to COR, the COR will approve and provide the details of that approval to the KO for the contract file.

3.1.3 Project Management. The Contractor shall provide a Project Manager (PM) who shall have authority to make operational and contracting decisions on behalf of the Contractor. The PM shall be located in the Government provided administration building (currently located at McCully Barracks), and shall be the Contractor’s point of contact (POC) with the KO and COR. The PM, Key Personnel, and Site Managers or Site Lead Technicians, or their designated representative shall be able to be contacted by the COR at all times. The Site Managers or Site Leads shall report information to the local Government representative on outages and equipment status IAW Appendix 9G. The Contractor shall provide a Weekly Activity Report (WAR) containing a weekly summary of significant events and their impact IAW Appendix 9A. The Contractor shall conduct a weekly meeting with the COR and shall inform and update the Government on all major issues and concerns during this meeting. The Contractor shall take meeting minutes and provide them to the COR

3.1.4 Government-Furnished Property and Facilities. Government-furnished property and facilities and Contractor responsibilities for that property and facilities are indicated in PWS paragraph 4.0 and TE2.

3.1.5 Control Center and Facility Control Office (FCO) Support. See TE1 tab Duty Hours. The Contractor shall operate a FCO 24 hours a day, seven days a week, 365 days a year (hereafter referred to as 24x7) to receive and process requests for operations, maintenance, and supply support and services. The Army Europe-Facility Control Office (AE-FCO) is currently collocated with the Regional Cyber Center Europe (RCC-E) in the Information Processing Center (IPC), at Clay Kaserne, Wiesbaden, GE. The Contractor shall maintain an electronic chronological document (Remedy Trouble Ticket) for each maintenance request received IAW Appendix 9G, Section 12.0 “OPMAS-E Information Systems Reporting Procedures.” The Contractor shall manually track emergency supply requests.

3.1.5.1 AE-FCO functions. The Contractor shall assist the Government in performing centralized FCO functions for the theater IAW Defense Information Systems Agency (DISA) Circular 310- 70-1. The Contractor shall monitor alarms utilizing Government furnished network and facility infrastructure monitoring systems and notify the RCC-E of network or facility infrastructure anomalies.

3.1.5.2 Alternate AE-FCO functions. In the event of AE-FCO equipment monitoring malfunction or inability to monitor theater circuitry and alarms from the IPC AE-FCO location, the Contractor shall maintain both the Landstuhl and Vaihingen DODIN AE-FCO on a ready status condition and assume the AE-FCO functions until the IPC AE-FCO site is returned to operational conditions and able to resume the mission from that location.

3.1.5.3 The Contractor shall coordinate, maintain, and notify circuit, trunk, and link outages, impact of outages and provide data or present network status briefs to the 2nd Theater Signal Brigade COR, the 2nd Theater Signal Brigade Program Manager, and the RCC-E.

3.1.5.4 The Contractor shall perform annual visits to Technical Control Facilities, DODIN sites, DRSN hubs and all facilities identified in Appendix 4M. The Contractor shall submit an annual schedule to the COR for review and concurrence IAW Appendix 9A.

3.1.6 Communications Outages. The Contractor shall report all communications outages IAW Appendix 9G. If the outage is outside the Contractor operated systems but affects the voice or data networks within the Contractor's AOR, the Contractor shall report the event as an outage. Specific outage criteria applicable to systems and functional areas are contained in Appendix 9G and DISA Circular (DISAC) 310-55-1, Status Reporting.

3.1.6.1 Hazardous Conditions (HAZCON). The Contractor shall report any condition or impairment which left unattended will cause severe degradation of, or has the potential to cause the loss of information and information processing capabilities. Specific HAZCON criteria applicable to systems and functional areas are found in Appendix 9G and DISA Circular (DISAC) 310-55-1.

3.1.6.2 Outage and HAZCON Restoration. The Contractor shall restore telecommunications service to circuits, systems, components or sub-components experiencing an outage or HAZCON regardless of cause or fault. The Contractor shall provide continued service using specific methods and procedures, including the utilization of the remaining functional network assets to reestablish the degraded or interrupted service to its original operational level. The Contractor shall acknowledge, report and respond to outages or HAZCONs IAW Appendix 9G and DISAC 310- 55-1.

3.1.6.3 Response Times. The Contractor shall respond to all support requests within the stated times defined in each specific requirement section within the PWS. Response time is defined as the time from contractor notification to dispatch of Contractor staff if required. The Contractor shall respond to emergency requests as tasked by the COR after normal duty hours. The COR, DISA, and the RCC-E shall be notified whenever the Contractor cannot enter a partially manned or unmanned site outside normal duty hours or whenever the response time will not be met.

3.1.6.4 Network Support System (NSS). The NSS is a Government-provided automated program used to document, track, and coordinate all activities associated in resolving outages or HAZCON conditions and associated supply and maintenance support. The Contractor shall:

· Use the NSS process (commonly referred to as a trouble ticket) to document all disruptions of service, outages, or HAZCONs falling within the definition in PWS paragraphs 3.1.6.1 and

3.1.6.2 and associated restoration efforts.

· Prepare and complete NSS trouble tickets for reporting on to all systems and functional areas within the PWS.

· Prioritize NSS trouble ticket actions on a first-in/first-out basis, unless otherwise changed by the COR or specified within Appendix 9G.

· NSS Trouble Tickets shall be forwarded to the RCC-E IAW Appendix 9G and as tasked by the COR or KO.

3.1.7 Training. The Contractor shall ensure Contractor personnel maintain technical proficiency for the O&M of the systems and equipment listed in the PWS. The Contractor shall not charge the Government for the cost of training for existing equipment.

3.1.7.1 New Equipment or Systems Training. If during the term of this contract the Government installs new equipment or systems, the Government will provide one-time training for Contractor employees. If a Contractor employee who has received Government-provided training as described leaves contract performance for any reason, the Contractor shall provide replacement personnel who have been trained and certified as needed to complete the requirements of this contract. The Contractor shall train all new and replacement personnel at no cost to the Government. The Contractor shall substantiate and maintain records of employee training.

3.1.8 Special Taskings. The Contractor shall respond to taskings for special requirements considered to be within the scope of the contract, which are not otherwise specified in the PWS or Schedule B and are generally of a one- time nature, when tasked by the KO or COR. The Contractor shall be responsible for written confirmation of tasking completion by indicating tasking number, labor hours used, and any associated temporary duty costs in a format specified by the KO or COR.

3.1.9 Security and Safety.

3.1.9.1 Facility Clearance. The Contractor shall possess a final Top Secret facility clearance by the time of the contract’s period of performance start date or prior to being engaged (consider phase in period) in order to provide the full services identified in this contract. The Contractor shall have a trained Facility Security Officer (FSO) responsible for ensuring compliance with the Contract Security Classification Specification, DD Form 254, and implementation of the applicable provisions of the National Industrial Security Program Operating Manual (NISPOM), DOD 5220.22-M, including the special provisions of Chapter 10 governing performance outside the United States.

3.1.9.1.1 The senior security official of the User Agency (UA) is the 2nd Theater Signal Brigade Deputy Chief of Staff, G-2 (Intelligence). All OPMAS-E facilities and sites are subject to inspections by UA components in coordination with the COR. Security requirements will be supported by the local Signal Battalion S-2 Security Manager with oversight by the 2nd Theater Signal Brigade G2. The Contractor shall provide a list of personnel and security functions IAW PWS Section H.18 to the KO within fifteen working days after contract award and will update the list IAW Appendix9A.

3.1.9.1.2 The 2nd Theater Signal Brigade G-2, through the KO, will provide authority in writing for the Contractor to temporarily store classified material only in facilities under U.S. Government control.

3.1.9.2 Personnel Security Program. Contractor employees requiring access to classified material or unescorted access to areas that process classified material shall be U.S. citizens and have a final Personnel Clearance (PCL) equal to the highest level of classified material safeguarded, handled or processed.

3.1.9.2.1 Final TOP SECRET security clearance and indoctrination for access to Sensitive Compartmented Information (SCI) is required to perform at the DRSN Switch Facility. Should personnel who do not have the required clearances and SCI access indoctrination require access to Sensitive Compartmented Information Facilities (SCIF); the Contractor will sanitize the area and escort these personnel.

3.1.9.2.2 Security Requirements. Contractor personnel shall maintain an applicable level of security clearance for all PWS tasks. Additionally, the Contractor shall adhere to the provisions of AR 25-2, AE Supplement to AR 25-2, and Appendix 1A, Part 2, to include the requirements of providing all aspects of security in depth to the Army Information Infrastructure at all locations. Personnel whose official duties require continuing access to U.S. classified cryptographic information must be enrolled in the Department of the Army Cryptographic Access Program (DACAP) and must agree to be subject to a counterintelligence scope polygraph examination to be provided access to classified cryptographic information. Classified cryptographic information is defined as cryptographic keys and authenticators that are classified as secret crypto or top secret crypto. This is in accordance with DODI 5205.08 and AR 380-40, Chapter 7. This applies to personnel with cryptographic access that have duties as cryptographic maintenance, engineering, or installation technicians, individuals that secure telecommunications facilities located on the ground, on board ships, or on communications aircraft and whose duties require keying of cryptographic equipment, and individuals whose duties require keying of cryptographic equipment.

3.1.9.2.2.1 Tasks: The Contractor shall assist the Government in executing the IA program at each site. The Contractor shall support the Government Information Assurance Support Officer (IASO). The Contractor shall draft network accreditation and Risk Management Framework packages for Government approval. The Contractor shall maintain accreditation records for all system components and Information Systems (IS) operating on Government networks located in post/camp/station covered in paragraphs 1.1 and 1.2. The Contractor shall assist the Government in ensuring installations or expansions for network devices or computer systems comply with installation security requirements, including physical requirements, network IAW Appendix 1A, Part 2.

3.1.9.2.2.2 Qualifications: The Contractor shall meet Information Assurance/Computer Network Defense (IA/CND) Levels I and II certification, the technical certifications outlined in DOD 8750.1-M and the training requirements IAW Appendix 14. The Contractor shall be knowledgeable of the requirements of DoD Instruction 8510.01, Risk Management Framework (RMF) for DoD Information Technology (IT).

3.1.9.2.3 Entrance for work in North Atlantic Treaty Organization (NATO) facilities requires that the background investigation basis for any clearance, NATO SECRET or COSMIC TOP SECRET, be current within the past five

(5) years. Contract personnel with access to a classified network will receive a NATO Security Briefing and be indoctrinated to NATO SECRET level IAW United States Security Authority for NATO Affairs (USSAN) 1-07 Instructions. The NATO indoctrination must be annotated as such in the Joint Personnel Adjudication System (JPAS). Contractor personnel who do not meet the criteria for a NATO Security Briefing shall be given a general NATO awareness training brief by the Contractor FSO. The awareness training brief should be documented, but not entered in the JPAS.

3.1.9.2.4 The Contractor shall perform all functions in accordance with COMSEC regulations, AR 380-40Policy for Safeguarding and Controlling Communications Security- (COMSEC) Material, DA PAM 25-380-2 Security Procedures for Controlled Cryptographic Items (CCI), TB 380-41 Procedures for Safeguarding, accounting and supply control of COMSEC material, The Contractor shall immediately contact the COMSEC custodian if assistance is needed to resolve any problems.

3.1.9.3 Information Security Program. The Contractor shall provide all cleared employees with the security training and briefings required by NISPOM Chapters 3 and 10 before contract performance begins. The KO may direct Contractor employees to attend periodically scheduled security briefings.

3.1.9.3.1 Non-Government-owned computing systems or devices. The Contractor shall comply with AR 25-1 and AR 25-2. The Contractor shall not install or connect non-Government-owned computing systems or devices to Government networks without the COR’s coordinating and obtaining proper authorization from the appropriate Information Assurance Program Manager (IAPM), ensuring that all software has a Government Certificate of Networthiness. The non- Government-owned computing systems or devices include, but are not limited to, personal or Contractor-owned thumb drives (e.g., memory sticks, flash drives, Universal Serial Bus (USB) drives, jump drives, pen drives), removable or external hard drives, Personal Digital Assistants (PDA), PC Cards/Express Cards, MP3 players, cell phones, digital media, floppy disks, compact disc (CD)/digital video disk (DVD) burners, optical recordings, photo flash cards, laptops, or any devices that can store data.

3.1.9.3.2 Protection of Sensitive Unclassified Data. The Contractor shall ensure any sensitive information, including, but not limited to, Personally Identifiable Information (PII) and For Official Use Only (FOUO), proprietary, and Law Enforcement Sensitive information residing on Mobile Computing Devices (MCD) or other external media, is protected IAW current Data at Rest (DAR) guidelines and requirements. The Contractor shall use an authorized, approved, and prescribed DAR solution. MCDs include, but are not limited to, laptops, ultrabooks, netbooks, notebook, or tablet computers, and Blackberry or equivalent devices. External media include optical disk media such as CDs, DVDs, USB drives (also referred to as flash or thumb drives) (when authorization to use them is restored), floppy disks, and other portable digital storage devices. Guidance for protecting DAR information appears in DoD Policy Memorandum, 3 Jul 07, subject: Encryption of Sensitive Unclassified Data at Rest on Mobile Computing Devices and Removable Media and DoD Component implementing instructions. Contractor-generated reports will normally be unclassified. If later requirements dictate the need for classified reports, specific instructions will be issued by the KO through the COR for security matters.

3.1.9.3.3 Transmission. Cleared Contractor employees may be appointed in writing by the FSO (or his/her designee) as couriers for classified materials or information classified up to Collateral SECRET level IAW the provisions of AR 380-5, AR 380-40, TB 380-41, and NISPOM Chapter 3, but such personnel may not cross international boundaries. Appointment authorizations shall be written in both English and the language of the country in which traveling. Couriers shall be briefed on responsibilities for transporting and safeguarding the material in the event of accident, hijack, or other special threat conditions. When transporting electronic COMSEC key such as the Data Transfer Device (DTD) AN/CYZ-10, or Simple Key Loader (SKL) AN/PYQ-10 Crypto Ignition Key (CIK) will always be removed from the device during transport and two couriers will be designated to transport. Courier briefings will be performed by the local Battalion S2 or designated Government security representatives.

3.1.9.3.4 SCIF. The Contractor shall comply with TEMPEST directives IAWAR 380-27, CNSSAM TEMPEST/ 113, 7 January 2014NTISSAM 2/95, RED/BLACK Installation Guidelines (U), 12 Dec 95, amended by NTISSAM TEMPEST 2/95A, dated 3 Feb 2000, when maintaining a SCIF.

3.1.9.4. COMSEC Support. The Contractor shall handle and safeguard Controlled Cryptographic Items (CCI) IAW AR 190-51, 380-40 and 710-2, DA Pam 25-380-2 and TB 380-41. The Contractor shall coordinate receipt of COMSEC material from the supporting COMSEC Account Manager (CAM). These COMSEC hand-receipts shall maintain accountability of all COMSEC key, equipment items and material (including Government-approved Contractor-provided or leased equipment). The Contractor shall provide final approval of clearance status, access restrictions, and a need to know of the designated COMSEC hand-receipt holders (HRH) to the supporting COMSEC Account manager. The Contractor shall acknowledge to perform all physical protective requirements and employ all mandated COMSEC procedures IAW AR 380-40, AE Regulation 380-40, and TB 380-41.

3.1.9.4.1 The Contractor shall operate and troubleshoot COMSEC equipment (i.e., KG-95, KIV-7, KIV-19 and KG175).

3.1.9.4.2 The Contractor shall perform shift-to-shift inventories IAW TB 380-41 for all COMSEC- related encryption keys. The Contractor shall inventory 100 percent of COMSEC keying material prior to shift change, except the Contractor does not have to inventory keying material stored within safes or approved containers that were not opened or unlocked during the previous shift. During the inventory, the Contractor shall verify the presence of the key by short title, edition, register number, segment number (if applicable) and quantity; and that the use and destruction sheet or Electronic Key Management (EKM) worksheet verifies that all keying material is properly accounted for.

3.1.9.4.2.1 The Contractor shall record COMSEC inventories on DA Form 2653-R, COMSEC Accounting Daily Shift Inventory. The Contractor and the CAM shall correct errors found during the inventory shall before the shift going off-duty is relieved.

3.1.9.4.2.2 The Contractor shall immediately notify the CAM and the COR of any loss of COMSEC materials, discrepancies on the inventory and report all available facts surrounding the discrepancy IAW AR 380-40, TB- 38041 and submit a COMSEC Discrepancy Report. The Contractor shall also report information concerning possible incidents to the Contractor’s supporting security office, the Cognizant Security Authority (CSA) and the COR.

3.1.9.5 Physical Security Program. The Contractor shall comply with Appendix 1A, Part 1 The FSO shall appoint in writing a person responsible for coordinating security matters at all facilities through the COR to the local Signal Battalion S-2 Security Manager. This includes physical security inspections, waivers and exceptions, DPW work orders (produce/submit/monitor), key and lock control, and Mission Essential Vulnerable Areas (MEVA) lists.

3.1.9.5.1 Waivers and Exceptions. The Contractor shall submit requests for waiver or exception to any physical security requirements through the COR, KO, and local Signal Battalion S-2 Security Manager to: HQs 2nd Theater Signal Brigade, ATTN: NETC-SEC-IS, Unit 29623, Box 90, APO AE 09096-0090. The request shall include: (1) a copy of the most recent physical security inspection report as it relates to requests for waivers or exceptions; (2) a copy of the related work order to correct the problem; (3) a statement explaining the problem or deficiency that constitutes non-compliance with the regulations; and (4) an explanation of the measures currently in effect to compensate for the problem.

3.1.9.5.2 Key and Lock Control. The Contractor shall comply with AR 190-13, AER 190-13 and AR 190-51, at each OPMAS-E facility. The Contractor shall report lost keys within 30 minutes of discovery to the KO or COR. The Contractor shall not duplicate Government-issued keys or rekey locks without the KO’s written authorization. The Contractor shall prohibit and prevent the use of Government-issued keys by any persons other than authorized Contractor employees.

3.1.9.5.3 Physical Security Plan. The Contractor shall provide and maintain a Physical Security Plan (PSP) in accordance with AR 190-13, AER 190-13 of each OPMAS-E facility to the KO to be included in the installation Physical Security Plan. This plan shall include those physical security report requirements outlined in AR 380-5, AR 25-2 and AR 380-40. The Physical Security Plan shall be submitted to the KO within 30 working days after contract award and updated annually. Annual updates are due by the 10th of October of each contract year.

3.1.9.5.3.1 The Contractor shall be prepared to execute a Government-provided facility Basic Emergency Plan (BEP), upon receipt of proper authorization IAW AR 380-5 and European Command Directive ED 100-2. The Contractor shall perform or participate in rehearsals of the BEP on a quarterly basis.

3.1.9.5.4 FSO. The Contractor FSO shall inform the COR of all identified deficiencies. The Contractor shall recommend corrective actions and draft work orders.

3.1.9.5.4.1 The Contractor shall submit physical security-related work orders to the COR and KO for review and approval. After approval, the Contractor shall submit work orders to the local DPW, IAW local DPW processes, unless informed otherwise by the COR. The Contractor shall forward copies of all completed work orders to the 2nd Theater Signal Brigade Deputy Chief of Staff, S-4, ATTN: Engineer Division, local Signal Battalion S-2, G-2 2nd Theater Signal Brigade, and the COR.

3.1.9.5.4.2 The Contractor shall assist the Government in ensuring correction of security deficiencies and monitoring the status of active work orders until deficiencies are corrected.

3.1.9.5.5 The Contractor shall control access 24x7 at all facilities identified in Appendix 11B IAW AR 190-16, AR 25-2, AR 380-40, AER 190-13 and AER 25-2.

3.1.9.5.6 Visitors Register. The Contractor shall maintain a Restricted Area Visitor Register, DA Form 1999-R, for 2nd Theater Signal Brigade authorized/unannounced visitors. The Contractor shall use this form to sign-in and sign- out all visitors.

3.1.9.5.7 Safety. The Contractor shall perform in a manner that assures maximum safety and protection for their employees and all personnel while performing work for this contract. The Contractor shall exercise surveillance on a continuing basis and shall eliminate or otherwise control existing or potential safety hazards.

3.1.9.5.7.1 The Contractor shall participate in the Government’s safety program. Compliance with provisions pertaining to safety of site facilities and equipment is mandatory. The Contractor shall establish and implement a comprehensive Safety Program Plan for use by contractor and sub- contractor employees. This Plan shall incorporate appropriate elements of 29 CFR 1910 and 1926, AR 385-10, NETCOM Reg 385-1 and applicable OSHA regulatory guidance. The Contractor shall provide the COR and KO with its Safety Program Plan within 30 calendar days of contract award for acceptance. The COR and KO will approve all updates to the Safety Program Plan before implementation.

3.1.9.5.7.2 The Contractor shall comply with all federal, state and local policies, directives, laws and regulations. During the performance of tasks requiring protective equipment and clothing, contractor employees shall wear safety items required by OSHA and as specified in the applicable regulations. The Contractor shall be responsible for providing personal protective equipment, clothing and training.

3.1.9.5.7.3 The COR may require the Contractor to cease operations associated with the performance of this contract for safety violation reasons. The Contractor shall correct any safety violations, caused by a contractor employee, during non-duty hours at no additional cost to the Government.

3.1.9.5.7.4 The Contractor shall ensure all employees receive the safety training required by all federal, state and local laws and policies. The Contractor shall maintain the safety training records and make them available to the COR and KO upon request.

3.1.9.5.8 Protection

3.1.9.5.8.1 Antiterrorism Level I Training. The Contractor shall ensure that all contractor employees, including subcontractor employees, requiring access to Army installations, facilities, or controlled access areas complete Antiterrorism (AT) Level I awareness training within 30 calendar days after start of employee performance on this contract. Within 5 calendar days after completion of training, the contractor shall certify to the COR or KO that all employees performing work under this contract have completed the AT Level I awareness training. AT Level I awareness training is available at https://jkodirect.jten.mil, course #JS-US007-14.

3.1.9.5.8.2 Outside Continental United States (OCONUS) Travel. Contractor employees shall obtain KO or COR approval before travel. The Contractor employees shall contact the Government requiring activity Antiterrorism Office (ATO) to receive a specific theater AT/threat briefing prior to departing on OCONUS temporary duty travel.

3.1.9.5.8.3 iWATCH. The Contractor shall ensure that all employees and subcontractor employees performing work under this contract are trained on the local iWATCH program within 30 calendar days of start of employee performance on this contract/task order. The requiring activity ATO will provide the locally developed iWATCH training. The Contractor shall maintain all iWATCH training records and shall provide copies to the COR upon request.

3.1.9.5.8.4 Emergencies and Force Protection Conditions. During declare emergencies and/or elevated Force Protection Conditions (FPCONs) Charlie or Delta, contractor performance under this contract shall be determined by the COR or KO. All Contractor employees providing services under this contract are required to report for duty as scheduled and remain on duty during declared emergencies and/or elevated FPCON levels unless otherwise directed by the KO or COR. The Contractor Project Manager shall keep the COR apprised of all personnel whereabouts when in a temporary duty (TDY) location.

3.1.9.5.8.5 Operations Security (OPSEC). The Contractor shall comply with DoD Directive 5205.02, Army Regulation 530-1, and the requiring activity OPSEC program. Failure to comply with the OPSEC directives shall be deemed adequate cause for the removal of a Contractor employee from performance on this contract and could be considered for appropriate legal action. The Contractor shall ensure all contractor employees and subcontractors performing work under this contract complete Level I OPSEC training within 30 calendar days of start of employee performance on this contract and annually thereafter. The Contractor shall maintain all OPSEC training records and shall provide copies to the COR upon request.

3.1.9.5.8.6 TARP (Threat Awareness and Reporting Program) Training. All Contractors assigned to this contract shall be required to complete the TARP training annually. The COR will ensure Contractors are notified of available training opportunities. Completion of training will be reported to the COR. (Reference AR 381-12, Threat Awareness and Reporting Program (TARP)).

3.1.9.5.8.7 Access and general protection/security policy and procedures. Contractor and all associated subcontractors employees shall provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services or Security Office. Contractor workforce must comply with all personal identity verification requirements (FAR clause 52.2049, Personal Identity Verification of Contractor Personnel) as directed by DOD, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

3.1.9.5.8.8 Issuance of Common Access Cards (CAC). Before CAC issuance, the contractor requires, at a minimum, a favorably adjudicated National Agency Check with Inquiries (NACI) or an equivalent higher investigation in accordance with Army Directive 2014-05. The contractor employee will be issued a CAC only if duties involve one of the following: (1) Both physical access to a DoD facility and access, via logon, to DoD networks on-site or remotely; (2) Remote access, via logon, to a DoD network using DoD-approved remote access procedures; or (3) Physical access to multiple DoD facilities or multiple non-DoD federally controlled facilities on behalf of the DoD on a recurring basis for a period of 6 months or more. At the discretion of the sponsoring activity, an initial CAC may be issued based on a favorable review of the FBI fingerprint check and a successful NACI at the Office of Personnel Management. Polizei Fuhrungszeugnis will be used for all categories of LNs not required to maintain a security clearance regardless of citizenship status.

3.1.10 Information Assurance (IA).

3.1.10.1 Information Assurance (IA) Training. All Contractor personnel with access to Government information systems and networks shall successfully all required initial and annual IA awareness training as specified in AR 25-2 and as specified by the Government requiring activity. Training is available athttps://ia.signal.army.mil

3.1.10.2 Contractor employees and subcontractor employees performing work under this contract who have access to Government information systems and networks shall create a user account and profile in the Army Training and Certification Tracking System website (ATCTS) at https://atc.us.army.mil, in the unit container managed by the COR. Certificates of successful completion of IA training, Acceptable Use Policies (AUP), applicable baseline and computing environment certifications, and continuing professional education credits, IAW DoD 8570.01-M, shall be uploaded to the ATCTS and provided to the COR for continuous compliance monitoring and reporting.

3.1.10.3 Information Assurance Workforce Certification. DFARS clause 252.239-7001 (Information Assurance Contractor Training and Certification) applies to this contract. This contract is subject to the mandates of DoD 8570.01-M, which establishes baseline technical and management IA skills for personnel performing IA functions within DoD. Functions spanning multiple levels require certification of the highest level functions. Contractor personnel performing functions in multiple categories or specialties shall hold certifications appropriate to the functions performed in each category or specialty.

3.1.10.4 The Contractor shall ensure its IA workforce members have the baseline certifications corresponding to their IA functions, as defined in Chapters 3, 4, 5, 10, and 11, and Appendix 3 of

DoD 8570.01-M at work performance start date. Contractors will obtain all required Computing Environment (CE) certificates within 6 months of being engaged. The IAT Level I baseline certification is the minimum requirement for unsupervised privileged access. The Contractor shall ensure that all employee certifications remain active and are renewed prior to expiration.

3.1.10.5 The Contractor shall ensure that all employees IA certifications are released to the Department of Defense through the Defense Workforce Certification Application at https://www.dmdc.osd.mil/appj/dwc/index.jsp.

3.1.10.6 Appendix 14 reflects the Personnel Security (IT Level) and IA Workforce Specialty requirements, aligning the IA functional responsibilities and access levels to the contract tasks, IAW DoD 8570.01-M.

3.1.10.7 The Contractor shall have final SECRET security clearances, as a minimum, for all designated IA personnel assigned, IAW Appendix 10, by the time of the contract’s period of performance start date or prior to being engaged (consider phase in period). Work performance that requires access to classified COMSEC information will require a final security clearance at the requisite level. Positions designated as level IT-I or IT-II, IAW AR 25-2, IA, and Appendix K, AR 380-67, The Department of the Army Personnel Security Program. IT-I positions requires final adjudication of a Single Scope Background Investigation (SSBI). Each tasking will specify appropriate IT levels and security clearance requirements, IAW the attached DD Form 254, for the tasks performed. Individuals who have been barred or were previously barred from the installation pursuant to Title 18 U.S.C. Section 1382 shall not be allowed to enter or work on the installation.

3.1.10.8 Foreign National access to all data networks shall conform to standards outlined in AR 25-2 and AER 25-2. Foreign national employees occupying IT sensitive positions, as defined in AR 25-2 and AR 380-67, shall have appropriate investigation outlined in AER 604-1. IT position requirements for Foreign Nationals IAW AR 25-2. Foreign National Contractors are not allowed to be IT-I. Foreign Nationals filling Information Technology IT-II positions with DAA written approval, and documentation in the Certification and Accreditation (C&A) package, direct or indirect hires may continue as IA personnel until they are replaced, provided they serve under the immediate supervision of a U.S. citizen Information Assurance Manager (IAM), have no supervisory duties, and shall have a favorable adjudication through the Foreign National Screening Program. Foreign Nationals filling ITIII positions shall have a favorable adjudication through the Foreign National Screening Program.

3.1.10.9 The Contractor shall ensure all systems are configured to the minimum-security baseline IAW applicable DISA Security Requirements Guides (SRG), Security Technical Implementation Guides (STIG), AR 25-2 and AER 25-2. The Contractor shall build all systems using the European (EUR) Theater baseline image provided by the RCC-E Enterprise Control Center (ECC) Short Message Service (SMS) Team or the supporting Signal Battalion.

3.1.10.10 IAVM Compliance. The Contractor shall utilize automated compliance assessment and reporting tools, like DISA’s Vulnerability Management System (VMS) to conduct and report IAVM tracking and remediate all IAVM deficiencies for all networked assets in all areas of responsibility. The Contractor shall report security violations and incidents to the Signal Brigade

IAM, Government Technical Monitor (GTM) and the COR. The Contractor shall apply or comply with all applicable IA Vulnerability Alerts (IAVAs) before the suspense date and shall report actions taken through designated reporting channels. The Contractor shall comply with the IAVM plans, policies and procedures implemented by the IAPM for each theater of operation.

3.1.10.11 When directed by the COR or IAW changes in the network, the Contractor shall assist with preparing documentation required to accredit all information systems IAW AR 25-2 and AER 25-2, and shall submit that documentation to the Information Assurance Manager (IAM).

3.1.10.12 The Contractor shall install Department of Defense (DOD) approved anti-virus software on all information systems and ensure that all equipment is configured IAW USAREUR baselines. The antivirus software for use on Government computers is available via the Army Gold Master (AGM) program as part of the EUR Theater baseline image provided by the RCC-E/ECC/SMS Team or the supporting Signal Battalion.

3.1.10.13 The Contractor shall protect and defend Government information systems IAW USAREUR policies and procedures. The Contractor shall use the Government-directed software program, Assured Compliance Assessment Solution (ACA) to scan the network to support the IAVA program and the accreditation program. The Contractor shall use the Government- designated solution (currently Hercules or SCCM) to apply patches and IAVA fixes to computers attached to the network.

3.1.10.14 The Contractor shall not store sensitive information, as identified by the Government, on any medium that does not have authentication capability. The Contractor shall configure all systems to the USAREUR-mandated operating system baseline configuration posted on the IA Website. The Contractor shall implement all systems requiring an IAVA upgrade by the suspense established by USAREUR G6.

3.1.10.15 The Contractor shall ensure that the DoD computer-warning banner is installed on all information systems.

3.1.10.16 Non-Government-owned computing systems or devices. The Contractor shall comply with AR 25-1 and AR 25-2. The Contractor shall not install or connect non-Government-owned computing systems or devices to Government networks without the COR’s coordinating and obtaining proper authorization from the appropriate Information Assurance Program Manager (IAPM), ensuring that all software has a Government Certificate of Networthiness. The non- Government-owned computing systems or devices include, but are not limited to, personal or Contractor-owned thumb drives (e.g., memory sticks, flash drives, Universal Serial Bus (USB) drives, jump drives, pen drives), removable or external hard drives, Personal Digital Assistants (PDA), PC Cards/Express Cards, MP3 players, cell phones, digital media, floppy disks, compact disc (CD)/digital video disk (DVD) burners, optical recordings, photo flash cards, laptops, or any devices that can store data.

3.1.10.17 Protection of Sensitive Unclassified Data. The Contractor shall ensure any sensitive information, including, but not limited to, Personally Identifiable Information (PII) and For Official Use Only (FOUO), proprietary, and Law Enforcement Sensitive information residing on

Mobile Computing Devices (MCD) or other external media, is protected IAW current Data at Rest (DAR) guidelines and requirements. The Contractor shall use an authorized, approved, and prescribed DAR solution. The MCDs include, but are not limited to, laptop, netbook, notebook, or tablet computers, and Blackberry or equivalent devices. External media include optical disk media such as CDs, DVDs, USB drives (also referred to as flash or thumb drives) (when authorization to use them is restored), floppy disks, and other portable digital storage devices. Guidance for protecting DAR information appears in DoD Policy Memorandum, 3 Jul 07, subject: Encryption of Sensitive Unclassified Data at Rest on Mobile Computing Devices and Removable Media and in DoD Component implementing instructions.

3.1.11 Quality Control (QC). The Contractor shall establish and operate a QC program to assure quality services of the operation, maintenance and supply programs. The Contractor shall develop and submit a Quality Control Plan (QCP) for Government approval 30 calendar days after contract start date, and provide updates to the KO and each COR IAW DISAC 310-70-1 and Appendix 9A. The Contractor shall maintain records of inspections and tests and make them available for Government review.

3.1.11.1 Quality Assurance (QA). The Government will monitor the Contractor’s performance under this contract by the use of a Government Quality Assurance Surveillance Plan (QASP) and the Performance Metrics as in Appendix 13. The Government may evaluate the Contractor’s services based on the requirements contained with the PWS at any time of its choosing and at any place where contract performance occurs. If any aspect of performance is not in conformity with the requirements of this contract, the Government will have the right to notify the Contract PM via email or issue to the Contractor a Contract Discrepancy Report (CDR). The Contractor shall explain in writing why performance was not in conformity with the requirements of this contract, how performance will be returned to conformity, and how recurrence of the problem will be prevented in the future. The Contractor shall complete and return the CDR to the COR and KO within five (5) working days of receipt of the CDR. The Contractors shall maintain copies of all inspection lists, CDRs, and any evaluations reports.

3.1.12 Program Reviews. The Contractor shall submit reports, coordinates and conducts meetings/briefings, and conduct quarterly program reviews to review the Contractor’s progress in the support of the contract IAW Appendices 9A and 9C. The Contractor shall coordinate with the KO and COR to determine the logistics, e.g., date, time, and location for the Quarterly Program Review. At the program review, the Contractor shall report on technical progress, personnel, cost, and schedule of all work.