PERFORMANCE WORK STATEMENT Draft.docx

PERFORMANCE WORK STATEMENT

COUNTER-INSIDER THREAT PROGRAM AND ANALYSIS CENTER

1 BACKGROUND

This is a non-personal services requirement to provide support services for the United States Marine Corps (USMC), Insider Threat Program (MC InTP). The Security Branch, Information Intelligence Division (IID) operating under the Deputy Commandant, Information (DC I), is responsible for generating, implementing, and measuring the effectiveness of service policy governing the MC InTP and serves as the advocate. The MC InTP is responsible for the development, implementation, oversight of Service doctrine and policy, training, tactics, technologies, and coordination with other Department of Defense (DoD) and interagency partners to support mission area across all Marine Air Ground Task Force (MAGTF). The Marine Corps Counter Insider Threat section is responsible for coordinating the development and execution of service plans and policies related to Insider Threat capabilities directed by the National Insider Threat Task Force (NITTF) under Executive Order 13587.

Executive Order 13587, Structural Reforms to Improve the Security of Classified Networks and the Responsible Sharing and Safeguarding of Classified Information, requires the Marine Corps to develop a program to deter, detect, and mitigate insider threats. More specifically, the National Insider Threat Policy and Minimum Standards for Executive Branch Insider Threat Programs requires agency heads to establish an integrated capability to monitor and audit information for insider threat detection and mitigation that leverages counterintelligence, security, cybersecurity, human resources, law enforcement, and other relevant functions and resources to identify and counter the insider threat.

Marine Corps Order (MCO) 5510.21, Marine Corps Insider Threat Program, establishes the mission, objectives, and lines of effort in support of executing the counter-insider threat mission. The Marine Corps Insider Threat Program and its Analytical Hub: located in MCB Quantico, and the Pentagon are envisioned as performing multiple functions, ranging from identification of data and events to education and training. Unifying disparate monitoring capabilities, aggregating data from multiple sources while complying with relevant laws and privacy policies, analyzing data and interpreting the meaning of personnel actions (behavioral indicators) realistically and ethically, providing actionable information to leaders, and self-assessing performance are all examples. The role of the Program and the Hub, therefore, are to meet Executive Branch requirements by educating, training, informing, and supporting Marine Corps leaders.

2 SCOPE

The scope of this requirement is to provide behavioral, analytical, policy, and technical support along with the concepts, expectations, and performance requirements outlined within MCO 5510.21 to the HQMC, DC I, Security Branch, Insider Threat Section. The primary objective is to implement a MC InTP, to include an Analysis Hub that effectively detects, deters, and mitigates intentional and unintentional insider threats among uniformed, government, and contracted personnel. The Hub will leverage the experience of its analysts, alongside technical and non-technical controls, to mitigate insider threats and coordinate with appropriate Insider Threat enterprise representatives (Defense Insider Threat Management Analysis Center (DITMAC), National Insider Threat Task Force (NITTF), Carnegie Mellon University SEI CERT capabilities and other Services, etc.). In addition to the Hub, the MC InTP will support training and awareness across the Marine Corps to assist in mitigation strategies and command interaction.

3 APPLICABLE DOCUMENTS

The Contractor shall be familiar with and be able to reference the following documents, instructions, and manuals. All applicable documents in support of this effort will be made available by the Government.

· Executive Order 13587, Structural Reforms to Improve the Security of Classified Networks and the Responsible Sharing and Safeguarding of Classified Information, 07 October 2011

· Presidential Memorandum, National Insider Threat Policy and Minimum Standards for Executive Branch Insider Threat Programs, 21 November 2012

· Executive Order 10450, Security Requirements for Government Employment, 27 April 1953

· Executive Order 12829, National Industrial Security Program (as amended), 16 December 1993

· Executive Order 12968, Access to Classified Information, 02 August 1995

· Executive Order 13467, Reforming Processes Related to Suitability for Government Employment, Fitness for Contractor Employees and Eligibility for Access to Classified National Security Information (as amended), 29 September 2016

· Executive Order 13526, Classified National Security Information, 29 December 2009

· Executive Order 12333, United States Intelligence Activities (as amended), 04 August 2008

· DoD Instruction 1438.06, “DoD Workplace Violence Prevention and Response Policy,” January 16, 2014, as amended

· DoD Directive 3115.18, “DoD Access to and of Publicly Available Information (PAI),” June 11, 2019, as amended

· DoDI 5200.08, Security of DoD Installations and Resources and the DoD Physical Security Review Board (PSRB), W/Ch 1, September 18, 2020

· DoD 5200.08-R, Physical Security Program, W/CH 2, October 19, 2020

· DoDI 5205.16, The DoD Insider Threat Program, 20 December 2024

· DoDD 5240.02, Counterintelligence (CI), W/Ch 1, May 16, 2018

· DoDM 5240.01, Procedures Governing the Conduct of DoD Intelligence Activities, September 27, 2024

· DoDD 5240.06, Counterintelligence Awareness and Reporting (CIAR), W/Ch 3, August 31, 2020

· DoDM 5105.21-V3, Sensitive Compartmented Information (SCI) Administrative Security Manual: Administration of Personnel Security, Industrial Security, and Special Activities, W/Ch 3, September 14, 2020

· DoD Instruction 5400.11, “DoD Privacy and Civil Liberties Programs,” W/Ch 1 December 8, 2020

· DoD Instruction 6400.11, “DoD Integrated Primary Prevention Policy for Prevention Workforce and Leaders,” W/Ch 1, April 4, 2023

· SECNAVINST 5510.37A, Department of the Navy (DoN) Insider Threat Program, 28 October 2019

· SECNAV M-5510.30C, Department of the Navy Personnel Security Program, January 24, 2020

· OPNAVINST 5510.165B, Navy Insider Threat Program, June 14, 2024

· MCO 5530.14A, Marine Corps Physical Security Program Manual, 05 June 2009

· MCO 3302.1F, Marine Corps Antiterrorism Program, 15 April 2019

· MCO 3900.20, Marine Corps Capabilities Based Assessment, 27 September 2016

· MCBul 5100, Marine Corps Insider Threat Program (MCInTP), 29 September 2017

· OUSD(I) Memo, Department of the Defense Guidance for the Implementation of Measures to Reduce the Federal Government’s Background Investigation Inventory in FY 2018. 27 July 2018

· USECNAV Memo, Department of the Navy Guidance for the Implementation of Measures to Reduce the Federal Government’s Background Investigation Inventory in FY 2018. 10 August 2018.

· ALNAV 059/18, Department of the Navy Guidance for the Implementation of Measures to Reduce the Federal Government’s Background Investigation Inventory in FY 2018. 16 August 2018.

· MARADMIN 597/18, Submission of Requests for Periodic Reinvestigations (PR), 18 October 2018.

· Marine Corps Order 5510.21 Marine Corps Counter Insider Threat Program, 12 November 2020

4 SPECIFIC TASKS REQUIREMENTS

The Contractor shall assist the Marine Corps by maintaining, assessing, modifying, and effectively implementing the MC InTP and Hub to include:

4.1 Program Support

The Contractor shall:

a) Research, identify, and make recommendations on best practices utilized within DoD agencies, other government agencies, and corporate organizations, for implementing an insider threat program in line with the MCInTP strategic vision and Lines of Effort.

b) Provide support to the Marine Corps in further maturity of the MC InTP by assisting in the refinement of processes, information management, knowledge management, records management, insider threat response actions, in accordance with the NITTF criteria, and provide an Executive Summary on the status of the MC InTP to NITTF in accordance with Section 6 Delivery Schedule.

c) Provide Program Management support for the MC InTP to include review, and coordination of all policies, directives, instructions, and alignment of existing programs, as it relates to the insider threat, personnel security, physical security, information security, force protection, and mission assurance.

d) Provide support to the Government Program Lead with the execution of a comprehensive budgeting strategy, to include proposed funding levels for Program Objective Memorandum (POM) efforts over the five-year Future Years Defense Program (FYDP) as it relates to the InTP. Manage the capability to process relevant insider threat information from internal and external sources (User Activity Monitoring (UAM), Defense Insider Threat Analysis Center (DITMAC), law enforcement, physical security, personnel security, continuous evaluation, human resources) as part of InTP Analysis Center operations.

e) Monitor and support the implementation of MCO 5510.21, specifically the execution of the ‘Roles and Responsibilities’.

1. Assist the Program obtain regular, timely, and, if possible, electronic access to the information necessary to identify, analyze, and resolve insider threat matters involving both military and civilian employees.

2. Provide training to Prevention and Personnel Programs and Offices on the identification of warning signs/indicators of potential insider threat behaviors of concern.

3. Help facilitate the conduct of external and internal inspections, assessments, and audits of the Program for compliance, effectiveness, and adherence to higher authority guidance and policy.

4. Assist the Program Manager plan, program, budget and execute processes to ensure necessary resources are allocated for the Program’s execution and sustainment across the future year’s defense program.

5. Assist the Program employ monitoring and auditing capabilities to support counter insider threat detection and mitigation efforts in accordance with applicable laws, regulations, and policies.

6. Review, revise and publish formal policy as directed by the Program Manager.

7. Maintain daily oversight and coordinate with Government representative(s), with the execution of task tracking and coordination via the DoN Enterprise Task Management Solution System (ETMS2).

f) Maintain daily accountability of contractor personnel to include timecard adherence, coordination of leave, administrative requirements for onboarding/out-processing, and internal performance reviews.

g) Maintain a quality control process that meets contract requirements and program objectives while ensuring customer satisfaction. The contractor is responsible for quarterly quality control inspections necessary in the performance of the various requirements to ensure implementation of implied tasks, deliverables outlined in Section 6, and specific tasks/timelines associated with MCO 5510.21.

h) Conduct expert-level analysis of data obtained from a variety of sources to evaluate validity and accuracy of data provided and to identify project trends. Communicate program data findings and recommendations orally and in written reports.

i) Process, analyze, disseminate data (structured and unstructured), and incorporate results into usable products, typically finished intelligence and visual analysis or dashboards.

j) Assist in the development of performance metrics to support the obtainment of Program Goals.

1. Assist in the development of a data dashboard to track performance metrics.

2. Develop processes to maintain the validity and reliability of data to increase the accuracy of performance metrics.

k) Establish and promote an internal network site accessible to all cleared employees to provide insider threat reference material, including indicators of insider threat behavior, applicable reporting requirements and procedures, and provide a secure electronic means of reporting matters to the insider threat program.

l) Attend and participate in Operational Advisory Working Groups, Insider Threat Conferences, and DoD Security Conferences, in accordance with Section 7 Travel Schedule.

m) Develop and support strategic communications plans that includes stakeholder communication strategy, program integration strategy, enterprise communications strategy, and senior leadership engagement strategy.

n) Ensure the Program is prepared for external audits and inspections through the conduct of self-assessments to maintain compliance with National, DoD, and Service level insider threat requirements.

o) Assist the Government Program Lead’s effort to develop, implement, and maintain effective marketing strategies and awareness campaigns designed to increase insider threat awareness and promote program utilization among Marine Corps commanders.

p) Prepare Program reports as required by National and DoD policy.

q) Ensure all Insider Threat Hub analytic personnel achieve both CITP-Fundamentals and Certified Insider Threat Professional (CITP)-Analysis certifications or designated successor certifications within 2 years of entry on duty.

r) Employ Insider Threat Liaison Representatives at major Marine Corps installations to include Camp Lejeune, NC; Camp Pendleton, CA; Marine Forces, Reserve, New Orleans; and Marine Forces, Pacific area of operations. Duties associated with these Insider Threat Liaison Representatives are detailed in Tasks 4.3 and 4.4.

4.2 Policy and Training Support

The Contractor shall:

a) Assist in the maintenance of policy pertaining to InTP, ensuring compliance with higher (DoN, DoD) authority directives and in coordination with the MCO 5510.21.

b) Identify policy modifications or gaps in DoD, Navy, and Marine Corps policies and provide policy recommendations to ensure all necessary Marine Corps components and departments can integrate with the InTP. Provide revisions/recommendations to the MCO 5510.21 to reflect these policy recommendations.

c) Coordinate with Government representative(s) with the execution of task tracking and coordination via the DoN ETMS2.

d) Provide input to and assist with updating the InTP SharePoint collection site.

e) Assist in the execution of InTP records handling procedures; safeguarding; archives; and other NARA requirements in coordination with subordinate elements identified within MCO 5510.21.

f) In accordance with MCO 5510.21: maintain and update procedures for reporting actions; insider threat response, both internally and externally; procedures for documenting each matter reported; response action taken within the case management system.

g) Assist in the maintenance process for access to, control of, and the protection of classified and controlled unclassified sensitive information in accordance with National Archives and Records Administration (NARA), DoD Information Security Program, Navy Information Security Program, Marine Corps Information and Personnel Security Program.

h) Participate in meetings to support InTP integration initiatives with higher echelon requirements.

i) Support the ‘Execution’ of MCO 5510.21 and updates as required.

j) Develop policy, guidance, strategy, and plans to facilitate Service-level implementation of Insider Threat Liaison Representatives at designated regionally based installations.

k) Determine, identify, validate, and execute internal and external reporting requirements to DoD, Secretary of the Navy (SECNAV), DITMAC, leadership and commanders.

l) Coordinate and implement a continuing training program tailored to different training audiences (uniformed members, government civilians, and contracted personnel) in accordance with MCO 5510.21 and in coordination with Marine Corps Training Command, etc.

m) Assist in the development of the curriculum and media used for initial training, refresher training, and specialty training to promote awareness of insider threat policies, procedures and indicators of potential insider threat activities and behaviors.

n) Assist in the development of the Marine Corps’ curriculum and media for National Insider Threat Awareness Month, observed annually in September. Coordinate activities related to the observance with DoD and DON, as required.

o) Coordinate training opportunities with external Insider Threat experts and practitioners to support the professionalization of Program personnel.

p) Manage and maintain data associated with electronic training jackets, analyst certification, command engagements, virtual workshops, conferences and other training related events.

q) Assist in the development of the training curriculum and media for Program personnel assigned to the Hub. Training shall include insider threat awareness, analytical processes and procedures, counterintelligence fundamentals, personnel and information security fundamentals, records handing, safeguarding of sensitive information, civil liberties, privacy laws, and regulations, workplace violence, investigative referral procedures, insider threat analyst response actions and procedures.

r) Assist in the development of the curriculum and media for the Marine Corps enterprise. Training shall include insider threat awareness, counterintelligence fundamentals, personnel and information security fundamentals, records safeguarding of sensitive information, civil liberties, privacy laws, and regulations, workplace violence, reporting procedures.

s) Assist in the development of curriculum and media that is modular and tailorable for inclusion into professional military education courses, instructor led training events, and computer-based training.

t) Coordinate with Marine Corps wide training coordinators to ensure annual InTP timelines are met, training is provided and properly documented.

u) Coordinate attendance of Insider Threat Analyst Training Course, DOD Security Specialist Training Course and other additional training for all personnel, as required.

v) Develop behavioral indicators that help to deter, detect, prevent, and mitigate actions by malicious insiders who represent a threat to national security or DoD personnel, facilities, operations, and resources.

w) Provide training courses on specific behavioral indicators of insider threat, as required.

x) Assist with the development and refinement of assessment instruments used to identify potential risk behaviors indicative of an insider threat.

y) Conduct targeted research on different aspects of insider threat, both physical and logical (e.g., data exfiltration and workplace violence).

z) Produce reports and talking points resulting from targeted research on different aspects of insider threat, both physical and logical, as well as continuous education on behavioral issues.

aa) Conduct focused research on emerging trends and case studies related to insider threat, targeted violence, and workplace safety within military populations.

ab) Monitor evolving academic and operational literature to ensure alignment with best practices in insider threat management.

ac) Generate relevant metrics and reports to inform DON and Service leadership of reported and identified insider threats.

1. Produce accurate responses to NITTF, OUSD(I&S), DCSA, DUSN, and Marine Corps data calls.

2. Produce a Program Annual Report as directed by EO 13587 and NITTF Minimum Standards.

3. Conduct routine audits of InT records to ensure continuous compliance to National Archives and Records Administration (NARA) regulations.

4. Conduct audits of Program Personnel training jackets and report findings on a routine basis.

5. Provide routine reports on the status of the Program’s Outreach Strategy to include number of participants, locations, dates, etc.

6. Provide a monthly training report to include monthly refresher training, external virtual workshops, conferences, symposiums, and individual events.

7. Provide an annual report on the Marine Corps participation in National Insider Threat Awareness Month (NITAM).

4.3 Conduct Triage, Analysis, and Response

The Contractor shall:

a) Assist in the maintenance and further development of the Analytical Standard Operating Procedures (SOPs) and Concept of Operations (CONOPs) to assist with the implementation and operationalization of the program, per MCO 5510.21

b) Under direct government supervision, assist with the receipt and safeguarding of information and alerts from various reporting sources for security and insider threat; Continuous Evaluation Directorate’s Continuous Evaluation Validation Cell (CEVC), Threat Evaluation and Coordination Team (TECT), DoD's Defense Insider Threat Management and Analysis Center (DITMAC), Naval Criminal Investigative Service, other DoD Components, and Marine Corps commands.

c) Gather appropriate information from internal Marine Corps data sets and external data sources; DITMAC, counterintelligence, security, cybersecurity, human resources, law enforcement, publicly available information, and other relevant functions and resources.

d) Execute insider threat analytic workflow processes associated with case management, triage, security analysis, insider threat analysis, validation, and development of analytical reports within the DITMAC case management system, Department of Navy Insider Threat Hub, MCO 5510.21, various databases, and case management systems, as validated against DoD 13 Adjudicative Guidelines and DoD Insider Threat Thresholds.

e) Provide a risk assessment/scoring capability based on behavioral and workplace factors to assist with detection of anomalous activity and potential insider threats and in the application of tailored mitigation strategies.

f) Provide written threat management assessments on Insider Threat alerts on a regular and recurring basis that identify potential motivations and intentions associated with insider threat activities.

g) Ensure analytical reports of all potential insider threats are provided to the Insider Threat Program Manager within 24 hours of identification and validation.

h) Ensure analytical reports of all continuous evaluation security concerns are cataloged, tracked and reported to command Security Management Offices (SMO) within 48 hours of receipt.

i) Provide regionally based Insider Threat Liaison Representatives capable of conducting threat assessment and threat management support to local military and civilian leadership.

j) Apply Structured Professional Judgment methodologies to evaluate individual cases for targeted violence risk, workplace threats, and other concerning behaviors.

k) Provide written behavioral psychological assessments to Marine Corps Insider Threat Program cases on a regular and recurring basis.

l) Produce professionally written risk-based recommendations to mitigate or address risk behaviors.

m) Provide written psychological assessments, information, and advice on matters regarding behavioral motivations and intentions.

n) Present interaction strategies in support of Marine Corps Insider Threat Hub analytical findings/recommendations provided to Commanders and Directorates that may have significant national security implications.

o) Within 48 hours of receiving a referral, brief the initial findings of psychological assessments to Hub officials.

p) Provide actionable threat management advice and counsel to military and civilian leadership across the Marine Corps enterprise.

q) Present Insider Threat Risk Assessment findings and mitigation recommendations for received referrals in both written products and oral briefings tailored for Marine Corps leadership audiences.

r) Translate complex behavioral, intelligence, or law enforcement data into accessible terms for decision-makers.

4.4 Installation Insider Threat Liaison Support

The Contractor shall:

a) Provide Insider Threat Program support to the installations via regionally based liaisons.

b) Deliver in person and virtual training and facilitate educational opportunities to increase insider threat awareness at the local installations.

c) Participate in command risk mitigation related activities.

d) Provide direct support to commands on insider threat related matters occurring within their area of operation.

e) Serve as an Insider Threat Analyst within the Marine Corps Insider Threat Hub and tasks associated with section 4.2.

f) Coordinate with local installation security, law enforcement, counterintelligence, and other relevant offices in support of insider threat related matters.

5 CONTRACT DELIVERABLES

5.1 Monthly Meeting and Status Reports

The Contractor shall attend the reoccurring monthly meeting and provide a Monthly Status Report (MSR) in accordance with Section 6 Delivery Schedule. The first MSR shall be submitted on the first Friday following the first full month after the contract award date. A MSR shall be emailed to the COR no later than the 2nd Friday of each month thereafter. The report will include:

a) Contract Status and review of invoices

b) Current tasks assigned

c) Status of assigned tasks

d) Completion of assigned tasks

e) USMC InTP compliance to NITTF status and MCO 5510.21

f) Number of cases referred to Analysis Center (reference 4.5c)

· Number of referrals received

· Sources of referrals

· Number of cases entered into the DITMAC’s System of Systems (DSOS)

· Number of cases not accepted and rejected

· Number of Request for Information (RFI) entered into DSOS

· Number of cases opened for action in DSOS

· Number of cases closed in DSOS

· Number of cases remain open in DSOS

· Total number of cases analyzed

g) Trends and deviations recorded

5.2 Meeting Minutes

The Contractor shall take Meeting Minutes for each meeting attended. The report must include a list of attendees, action items, and other pertinent information discussed in the meeting and delivered in accordance with Section 6 Delivery Schedule.

5.3 Analytic Assessment Reports

The contractor shall provide professionally written, risk-based assessments that include a behavioral psychological assessment, threat assessment, and recommended mitigation and management strategies.

5.4 Trip Reports

The contractor shall provide a trip report for travel conducted. The report must include a summary of events, personnel visited/briefed, and recommendations and/or way forward.

6 DELIVERY SCHEDULE

The following deliverables shall be provided to the COR:

4.2.t

4.2.n 4.2.q 4.2.r 4.2.s

4.3.g 4.3.h

4.2.j

7 TRAVEL

7.1 Travel Schedule

The table below summarizes the anticipated travel requirements under this effort:

4.2.w

7.2 Travel Regulations

The Contractor shall adhere to the following travel regulations (see FAR 31.205-46):

a) Federal Travel Regulations (FTR) – Prescribed by the General Services Administration, for travel in the contiguous United States.

b) Joint Travel Regulations (JTR), Volume 2, DoD Civilian Personnel, Appendix A. Prescribed by the Department of Defense for travel in Alaska, Hawaii, and outlying areas of the United States.

c) Department of State Standardized Regulations (DSSR) (Government Civilians, Foreign Areas), Section 925, "Maximum Travel Per Diem Allowances for Foreign Areas," prescribed by the Department of State for travel in areas not covered in the FTR or JTR.

7.3 Travel Requirements

All travel shall be coordinated and approved by the COR prior to incurring any travel expense. Any travel under this contract must be specifically requested in writing by the Contractor and approved by the COR, prior to incurring any travel expense. The Contractor must submit the written request to the COR five (5) business days in advance. The travel request must include as a minimum, the following:

a) Contract number

b) Date, time, and place of proposed travel

c) Purpose of travel and how it relates to the contract

d) Contractor’s estimated cost of travel with a breakdown of the estimated costs of transportation, lodging, meals, and incidentals

e) Name(s) of individual(s) traveling

The Contractor shall use only the minimum number of travelers and rental cars needed to accomplish the task(s). Travel shall be scheduled during normal duty hours whenever possible.

Travel Reimbursement:

The Contractor must be reimbursed for the reasonable and allowable actual cost of transportation, lodging, meals and incidental expenses. However, actual costs are considered reasonable, allowable, and reimbursable only to the extent that they do not exceed on a daily basis the maximum per diem rate in effect at the time of travel as set forth in the DOD Joint Travel Regulations located at http://www.defensetravel.DoD.mil/. Actual cost does not include handling charges, general and administrative cost, overhead, profit or any other indirect cost.

The Contractor must use the allowable Government personnel rates for transportation and lodging. Reimbursement for airfare must not exceed the lowest customary standard, coach, or equivalent airfare quoted during normal business hours. The Contractor will not be reimbursed for travel expenses unless audited records for transportation contain evidence, such as original receipts, substantiating actual expenses incurred for travel. In no event will reimbursement exceed the published rates of common carriers. Expenses for lodging, meals and incidental expenses must be reimbursed to the Contractor, provided that the overnight stay was documented as necessary.

The contract includes a not-to-exceed funding limitation for travel costs. When the Contractor expects total funding expended for reimbursable travel to reach 85 percent of the total funds available on the travel CLIN, the Contractor must notify the Contracting Officer, the COR, and any other Government official identified by the Contracting Officer. The notice must state the estimated amount of additional funds required to continue performance for the period specified in the task order. The Contractor must not exceed or incur costs that exceed the amount of funding stated on the reimbursable travel CLIN. The Government is not obligated to reimburse the Contractor for otherwise reimbursable travel in excess of the funded amount stated on the reimbursable travel CLIN.

The Government is not obligated to reimburse the Contractor for otherwise reimbursable travel in excess of the funded amount stated on the reimbursable travel CLIN.

The Contractor is not obligated to continue performance of any reimbursable work under this Contract or otherwise incur costs for reimbursable travel in excess of the funded amount stated on the reimbursable travel CLIN unless the Contracting Officer notifies the Contractor in writing that the funded amount stated under the applicable reimbursable travel CLIN has been increased. In the event notification is made orally, such notification shall be followed up in writing within two (2) business days.

No notice, communication, or representation from any person other than the Contracting Officer shall affect the Government’s obligation to reimburse the Contractor.

8 OTHER DIRECT COSTS

In the event additional or specialized equipment, services, and/or supplies are required for work that has prior approval from the COR, the Government will reimburse the Contractor(s) only for the actual price paid for such services, equipment, or supplies that are expressly identified as reimbursable items by this contract or any order issued thereunder. “Actual Price” paid by the Contractor(s) includes tax paid, if any, and reduced by any and all credits and rebates, whether accrued or realized, associated with the supplies and services provided. “Actual Price” does not include material handling charges, overhead, general and administrative costs, profit, or any other indirect cost that is in any way associated with the Contractor(s)’s purchase or provision of additional or specialized equipment, services, and/or supplies.

The Contracting Officer may reduce the reimbursement by any amount above that the Contracting Officer finds, in his/her sole discretion, is greater than that which is fair and reasonable for the supplies or services provided, giving due consideration to the facts and circumstances prevailing at the time that the Contractor(s) procured the supplies and services. Disputes as to the amount by which any reimbursement is reduced shall be resolved in accordance with the “Disputes” clause of the contract. It shall be the Contractor(s)’s burden to demonstrate that the price it paid for reimbursable supplies and services were fair and reasonable.

Each order that requires additional or specialized equipment, services, and/or supplies will include an estimated funding limitation for ODCs. When the Contractor(s) expects total funding expended for reimbursable ODCs to reach 85 percent of the total funds available on the ODC CLIN, the Contractor(s) shall notify the Contracting Officer, the COR, and any other Government official identified by the Contracting Officer. The notice shall state the estimated amount of additional funds required to continue performance for the period specified in the order. The Contractor(s) shall not exceed or incur costs that exceed the amount of funding stated on an order’s reimbursable ODC CLIN.

The Contractor(s) is not obligated to continue performance of any reimbursable work under this Contract or otherwise incur costs for reimbursable travel in excess of the funded amount stated on the reimbursable travel CLIN unless the Contracting Officer notifies the Contractor(s) via Contract/Task Order modification that the funded amount stated under the applicable reimbursable travel CLIN has been increased. In the event notification is made orally such notification shall be followed up in writing within two (2) business days.

No notice, communication, or representation from any person other than the Contracting Officer shall affect the Government’s obligation to reimburse the Contractor.

8.1 Commercial Database Access

Component Insider Threat Programs often rely upon commercial tools to augment and validate information sourced from internal databases and information systems. As such, the Contractor, subject to COR approval, may be required to purchase licenses for commercial database access, to be reimbursed under the Other Direct Costs (ODC), cost-reimbursable line item, upon COR coordination and approval.

9 PERIOD OF PERFORMANCE

This requirement consists of a one (1) twelve (12) month Base Year and four (4) 12-month Option Periods.

10 PLACE OF PERFORMANCE

The primary place of performance will be at a Government facility or a Government Leased facility within the National Capital Region, with exception of those contractors specifically assigned to other geographical regions, as noted in section 4.1. In those instances, the contractor will perform their duties from a location within 50-miles of their assigned command, installation, or agency. Telework is authorized for Contractor personnel with the approval of the Contracting Officer Representative (COR).

11 HOURS OF OPERATION

The Contractor shall be made available and conduct business between the hours of 7:30am and 4:30pm (local time) Monday through Friday except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. The Contractor must, at all times, maintain an adequate workforce for uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons. When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the workforce are essential.

Note 1: If a federally observed holiday should fall on a Saturday, it will be observed on the preceding Friday; if it falls on a Sunday, it will be observed on the following Monday. Should this occur the Contractor is exempt from performing work under this contract on these days.

Note 2: Inauguration Day (for NCR only): NCR will be closed on this day with no access to Government facilities. Contractor personnel shall refer to company policy for further guidance on this day.

12 GOVERNMENT FURNISHED INFORMATION, EQUIPMENT, MATERIALS, RESOURCES, AND FACILITIES

Common Access Card (CAC). All personnel performing tasks under this contract must be eligible for, and obtain, a DoD Common Access Card (CAC) and associated DoD PKI certificates for identity verification and encryption of transmitted correspondence.

Government Furnished Facilities (GFF). Government furnished facilities and workspaces will be provided as a matter of routine. The Government will provide workspaces, administrative supplies, telephones, and copiers on an as needed basis for on-site personnel.

Government Furnished Information (GFI) / Materials. The Contractor shall protect GFI (technical data) provided by the Government from public disclosure in accordance with the marking contained thereon. The services performed under this contract involve access to and handling of material at the classified level. All materials developed by the Contractor during this contract shall become the property of the Headquarters, U.S. Marine Corps. The Contractor shall be required to abide by the disclosure standards set forth in DFARS 252.204-7000. The Contactor shall not release any information to regulators, media, or other parties. Any information release will come from USMC Government employees only.

Government Resources: In general, the Contractor will be provided access to Marine Corps owned hardware and software that is required to upgrade databases and extract files as necessary to conform to the specifications/requirements of this contract. Contractors will be given access to systems required NIPR, SIPR, JWICS accounts as required.

13 PERSONNEL REQUIREMENTS

It is the Contractor’s responsibility to provide and maintain a trained workforce capable of providing the services specified under this contract. All related training, continuing education, certification courses, and other similar events are the financial responsibility of the Contractor, except as otherwise specified in the contract. Task priorities, short-notice suspense, operational constraints, and other potential impacts shall be managed to maintain schedule requirements for all task areas. Further requirements for personnel qualifications are set forth in this PWS.

Contractor personnel shall attend all mandatory Headquarters Marine Corps training. Training topics include, but are not limited to, Sexual Harassment in the workplace, Safety, Security and Ethics. The Contractor may be required to attend DoD training prior to traveling and working at locations.

14 KEY PERSONNEL

The Government designates Tasks 4.1 Program Support (Contract Program Manager) as key personnel under this contract. This individual serves as the primary technical representative for all Insider Threat Program task areas.

The Contractor shall ensure that the key personnel position is staffed for the entire period of performance of the contract. The Contractor shall designate a minimum of one (1) individual to serve in this position, and the individual assigned must meet the minimum qualifications as defined below.

The Contractor shall provide a Contract Manager who shall be responsible for the overall performance of work under this contract. The name of the Contract Manager, along with an alternate who shall act in the Contract Manager’s absence, shall be provided in writing to the Contracting Officer.

While only the Contract Program Manager is formally designated as Key personnel, the Contractor shall ensure that all personnel assigned to perform work under this contract possess the required security clearances, education, skills, and experience necessary to successfully execute their assigned tasks.

15 SECURITY REQUIREMENTS

The minimum investigation required is a Single Scope Background Investigation (SSBI) or a Tier 5 investigation for all Contractor personnel supporting this contract. Security requirements applicable to this contract are described on the DoD Contract Security Classification Specification (DD254), Attachment 1.

Contractor personnel providing support under this contract will require background checks in order to obtain user account at the Information Technology (IT) level 2 (classified network access). An in-person visit with the HQMC Security Officer will be required for Contractor personnel to in-process. All Contractor personnel supporting this effort will be required to sign a Classified Non-Disclosure Agreement (SF312).

The Contractor shall perform in accordance with the National Industrial Security Program Operating Manual (NISPOM), DOD 5220.22M, and ensure that all classified material is handled in accordance with the NISPOM and the appropriate Security/Program Guides/Directives. The Contractor shall obtain appropriate security clearances for required personnel.

All Contractor personnel assigned to this effort will have access to information that may be subject to the Privacy Act of 1974. The Contractor is required to ensure the proper safeguarding of such information to prevent unauthorized release. All task requirements will be conducted in full compliance with DoD security regulations.

All Contractors supporting this contract must have a current a TOP SECRET (SCI eligible) clearance based on an SSBI/ SBPR/ PPR or Tier 5 investigation before beginning to support this work and must maintain the level of security and eligibility required for the life of the contract. The Contractor must hold an active TOP SECRET Facility Clearance at the time of proposal submission.

The Contractors that will be accessing security sensitive data will need a CAC and will need to complete a System Authorization Access Request-Navy (SAAR-N) and the DOD Information Assurance Awareness Training.

Access to Government buildings will be granted to Contractor staff, when needed. Contractor employees must be clearly identifiable while on Government property by wearing appropriate badges at all times. The Contractor shall provide each employee with an identification badge, which identifies, by photograph, the individual as an employee of the Contractor. These badges must be presented for examination upon request from the Contracting Officer, COR, Military Police, or any other Government Official with a need to see the badge. The Contractor and its employees shall be subject to all traffic, security, and registration regulations for personnel and vehicles.

All Contractor personnel attending meetings, answering Government telephones, in electronic messages or correspondence related to this contract, working on site, where their contractor status is not known to third parties, must identify themselves as Contractors. Contractor personnel shall also ensure that when logged onto Government equipment that their profile shows them as Contractor personnel.

Contractor-occupied facilities (on Government installations) such as offices, separate rooms, or cubicles must be clearly identified with Contractor supplied signs, name plates or other identification, showing that these are work areas for Contractor personnel.

16 SPECIAL CONSIDERATIONS

16.1 Marking Of Contractor Reports

All reports required under contracts for individual experts; studies, analyses, and evaluations; and management and professional support services should prominently show on the cover of the report:

a) Name and business address of the Contractor.

b) Contract number.

c) Contract dollar amount.

d) Whether the contract was competitively or non-competitively awarded.

e) Name of individual sponsor. The sponsor should be an individual from the requiring activity at the Program Manager or comparable level.

f) Name and address of requiring activity.

16.2 Data, Software, and Intellectual Property Rights

All reports, materials (including, but not limited to, all training and training-related materials including all evaluations and evaluation criteria, computer software applications and hardware, source code, interfaces, tools, works, and other related items) data, information, and all electronic/digital files and other items described herein, and any other items, (hereinafter referred to individually or collectively as the Work or Works), and all intellectual property rights in or to such Works, in whatever form, created, generated, or produced under, or as a result of, this PWS shall become the property of the U.S. Government/Marine Corps, i.e., the U.S. Government/Marine Corps shall be the owner of all of these Works and all intellectual property rights in or to these Works. Therefore, any restricted data rights, information, software, materials and/or other items including, the contractor’s or a Third- Party’s Proprietary data, information, software, materials and/or items must not be used under this contract without the specific written approval by the COR prior to start of any work.

The Contractor will provide the COR with a data rights assertion listing for all deliverables including both non- commercial and commercial technical data and computer software.

Moreover, except as provided in writing by the Contracting Officer, no Work, information, material and/or other item created, generated, produced or provided under, or as a result of, this PWS/effort shall be used by the Contractor or any of its employees/agents, subcontractors and/or representatives, for any purpose other than for the support and performance of this Contract. Therefore, the Contractor is obligated to protect the Works from unauthorized use and shall incorporate this paragraph in each of its contracts/subcontracts associated with the goods and/or services provided under this Contract.

16.3 Data Collection and Inventory for Service Contracts (formerly ECMRA)

The Contractor shall report Contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract for the Marine Corps via a secure data collection site. Contracted services excluded from reporting are based on Product Service Codes (PSCs). The excluded PSCs are:

The Contractor is required to completely fill in all required data fields using the following web address: https://www.sam.gov.

Reporting inputs will be for the labor executed during the period of performance during each Government fiscal year (FY), which runs October 1 through September 30. While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year. Contractors may direct questions to the help desk, linked at https://www.sam.gov.

16.4 Organization Conflicts of Interest

The Contractor acknowledges that it is familiar with FAR Subpart 9.5, Organizational and Consultant Conflicts of Interest, and agrees to avoid, neutralize or mitigate such conflicts of interest in accordance with the principles set forth in the FAR. If the performance requires the Contractor (to include subcontractors) to supply technical support related to systems or projects with which the Contractor is already directly concerned, either by prime or subcontract, the Contractor shall immediately inform the Contracting Officer. The PWS may be withdrawn if a conflict is found.