Performance Work Statement IGEA 1.6.2026.docx

Performance Work Statement

1.0 Introduction/Description of Services

This Performance-Based Work Statement (PWS) details the work that is to be accomplished for the US Army Intelligence and Security Command (INSCOM) Integrated Geospatial Intelligence (GEOINT) Enterprise Architecture (IGEA) herein referred to as Client.

1.1 Background

Integrated GEOINT Divisions (IGDs), assigned to each of INSCOM’s Military Intelligence Brigades, Theater (MIB-Ts) are part of the Army’s National to Theater Program (NTT). The NTT’s mission is to leverage national GEOINT assets to conduct Processing, Exploitation and Dissemination (PED) of GEOINT products supporting the Army Service Component Command (ASCC) assigned to each Geographical Combatant Command (GCC). The Integrated GEOINT Enterprise Architecture (IGEA) is delivered as a capability on the Army enterprise and is managed by the Army GEOINT Office. IGEA standardizes the hardware, software, storage and network connectivity to support Continuity of Operations (COOP) and collaborative capabilities thus enabling nodes to rapidly and efficiently federate analysis requirements amongst each other. The AGO, through IGEA, also integrates new capabilities and supports capability innovation efforts. The enterprise provides centralized software license management of costly GEOINT analysis platforms such as SOCET GXP and ArcGIS as well as many other tools for GEOINT production.

1.2 Contract Type: Time and Material

1.3 Objective : The client agency seeks professional Information Technology (IT) support for software, hardware, storage and network connectivity to all IGEA sites This includes network administration, system administration, Field Service Representatives, accreditation, compliance documentation and direct end-user support for a variety of operational initiatives which include highly sensitive intelligence functions.

2.0 Scope: The client requires the Contractor, under the guidance of the Army GEOINT Office (AGO) and the AGO Technical Director to provide holistic Information Technology (IT) services and related logistic, programmatic, training, and management support for GEOINT operations. The contractor shall leverage IGEA hardware to support sustainment and development of GEOINT production capabilities as specified by the customer.

2.1 Hardware: Current IGEA operations leverage Cisco Unified Computing System (UCS) virtual servers and Storage Area Network (SAN) switches, Cisco NEXUS 9000 and below series switches, EMC Unity, Isilon, and ExtremeIO storage devices (used as both SAN and NAS), Dell/EMC Data Domain backup solutions, and Dell or Hewlett Packard workstations. Hardware operations support includes but is not limited to integration, design, programming/configuring, maintenance and updates, and custom software applications. Contractor may be required to support additional hardware of various types throughout the duration of this Contract.

2.2 Software: Current and projected software used (vendor latest versions): VMWare ESXi Hypervisor, Red Hat Enterprise Linux (RHEL), Microsoft Windows, Microsoft Windows Server, Microsoft SQL, SolarWinds Orion, SOCET GXP, ENVI, QT Modeler, ArcGIS Enterprise (server and client), ServiceNow and Sketchup Pro. Software also includes numerous other GEOINT specific tools necessary for production. Client will require contractor to support additional software of various types throughout the duration of this Contract.

2.3 Telecommunications: Current and planned network configurations require expertise in configuration, deployment, security hardening, maintenance and accreditation processes of the following equipment/technology: Local (LAN and wide area (WAN) management with Cisco devices, virtual machine management with Cisco Unified Computing System (UCS), storage with EMC hardware, and general setup, connectivity, configuration and troubleshooting of hardware stacks in a datacenter environment. As technology and system architecture evolve, client may acquire new technologies that require support from the Contractor.

2.4 Software and Tool Development: The Contractor shall develop, modernize, maintain and build new software solutions through standard DevSecOps procedures. The contractor must be able to effectively package and execute container-based solutions such as Docker and Kubernetes.

3.0 Performance Requirements: The contractor shall perform all tasks below and incorporate security throughout. The contractor shall develop certification test procedures, evaluate and implement security configurations as required through security checklists and vulnerability scanning, and ensure audit integration and appropriate change management.

3.1 Systems Operation: The contractor shall holistically operate all local and remote hardware and software supporting IGEA and other client IT systems. New requirements are integrated into the change management process weekly and reported monthly at the Configuration Control Board (CCB) meetings outlined in PWS 3.4.1.

3.1.1 The contractor shall monitor all systems to identify and resolve system issues and reduce the impact issues have on the overall health of the system. All issues should be identified within two (2) hours of occurrence.

3.1.2 The contractor shall leverage virtualization solutions to provide standardized operating system platforms for required software. Contractor shall integrate current and future security requirements for virtualization implementation as required and document implementations.

3.1.3 The contractor shall create and evolve secure operating system installations of Microsoft Windows, Windows Server, and RHEL as required by published guides and certification and accreditation authorities (e.g. Information Assurance Vulnerability Message (IAVM), Security Technical Implementation Guides (STIG), etc.). Contractor shall identify security and configuration (STIGs) and guidance that conflicts with mission goals of efficiency and availability, articulate the conflict, formulate a plan to resolve and develop a Plan of Action and Milestones (POA&M). If unable to comply with security requirements, the contractor will request waivers from the Authorizing Official under the guidance of the Government. The contractor will develop and maintain automated methods of displaying and conveying this information through dashboards, automated reports etc.

3.1.4 The contractor shall install, manage, configure, troubleshoot and ensure availability of IGEA Active Directory (AD) services.

3.1.5 The contractor shall integrate appliances in the hardware stack with software to optimize availability while preserving security and simplicity. The contractor shall identify and implement technology to enhance simplicity of applications and external integrations. The contractor shall maintain and troubleshoot systems and networks in the IGEA, recommend solutions, and implement accepted resolutions.

3.1.6 The contractor shall maintain Commercial Off the Shelf (COTS) network devices and topology congruent with Army, DISA, DoDIIS, and NIST security guides and applicable manufacturer best practices. The contractor shall configure network devices and components as required by operational considerations, published guides and certification and accreditation authorities. The contractor shall support enterprise endpoint security systems such as Tanium, Trellix, McAfee Host Based Security System (HBSS), Army Endpoint Security System (AESS based on HBSS) as well as log management requirements with Splunk.

3.1.7 The contractor shall continuously evaluate Army, DISA, DoDIIS, and NIST security guides, implement recommendations to the fullest extent possible, and identify guidance incongruent with mission goals of efficiency and availability. The contractor shall advise and assist client to prosecute waivers for offending guidelines. Shortcomings in meeting mandated security requirements will be identified and tracked to completion on a Plan of Action and Milestones (POA&M).

3.1.8 The contractor shall continuously implement and maintain automated enterprise configuration management solutions (e.g. MECM, Puppet, Salt, Ansible, etc) for all possible IT functions while identifying limitations and manual steps for this approach. shall continually evolve solutions to increase efficiency of installation and configuration management of databases, web servers, and custom applications.

3.1.9 The contractor shall operate SAN, NAS and virtual solutions to support enterprise applications alongside direct client user access. The contractor shall provision, install, configure, and manage logical and block storage for servers and data shares. The contractor shall implement distributed file sharing technology. The contractor shall ensure storage solutions are configured for failover as appropriate. The contractor shall install devices and work with vendors to ensure best security and availability for storage solutions and document storage solution installations as required. The contractor shall troubleshoot storage devices as required. The contractor shall manage backup and data retention requirements.

3.1.10 The contractor shall configure, implement, maintain and monitor multiple local networks and communications links between NTT nodes. This includes “black side” routing and cryptography (COMSEC) support. The contractor shall incorporate appropriate redundancy and resilience to systems in design and engineering and identify shortcomings to architecture.

3.1.11 The contractor shall maintain firmware, updates and documentation of all IGEA network devices and architecture. License servers for software will be maintained with redundancy to ensure high availability across the enterprise.

3.1.12 The contractor shall continually assess, improve, design, and document secure optical disk writing processes for cross domain transfers. Techniques require expertise correctly implementing multiple encryption standards, fully secured RHEL automation, antivirus checking, diagnostic checks, auditing and certificate-based authentication through Public Key Infrastructure (PKI).

3.1.13 The contractor shall evaluate, make recommendations and be prepared to support transition of IGEA architecture (parts or whole) to DoD cloud-based infrastructures such as AWS GovCloud and C2S. Engineers must implement industry best practice, comply with all mandated security requirements and support application and infrastructure development on hybrid and fully cloud-based environments.

3.2 Software Operation: The contractor shall install and operate all Government Off the Shelf (GOTS), COTS and Open-Source Software (OSS) required and integrate solutions with AD and/or PKI as appropriate. For new software solutions, a timeline for integration will be agreed upon between the contractor and the client.

3.2.1 The contractor shall install, configure, optimize and maintain Esri's ArcGIS Platform to include multiple ArcGIS Enterprise sites. The contractor shall demonstrate a practical understanding of ArcGIS Platform architectural best practices from both networking and resource allocation perspectives. The contractor shall be fluent in the automation of administrative actions using Python, Powershell, Bash, or other industry-standard scripting/automation approaches. The contractor shall possess an understanding of advanced authentication and access principles to implement SAML and/or PKCS12 access (both client and server) to the Enterprise.

3.2.2 The contractor shall install, secure, configure, integrate, document, operate, and manage Geoserver software suite, ArcGIS Enterprise, PostgreSQL and other software solutions as required to support Geographic Information Systems (GIS) in the IGEA.

3.2.3 The contractor shall be familiar with current policy regarding Secure Development Operations (DevSecOps) and implement and maintain a DevSecOps environment as policy changes and the Government’s requirements evolve. The contractor will provide necessary development oversight for a DevSecOps pipeline.

3.2.4 The contractor shall develop and maintain data visualization capabilities that enable greater insight into the IGEA’s performance across the enterprise. Using best practices of data visualization, the capability will enable users to: perform fast analytics; retrieve information from databases and export to spreadsheets; automatically update; perform queries with no scripting knowledge; and share visualizations within seconds to consumers.

3.3 Configuration Management and Compliance: The contractor shall perform configuration/change management procedures IAW NIST SP 800-53 rev 5 Security Controls, maintain and enforce configurable items list (CI), manage software baseline (COTS, GOTS, open source), track software licensing requirements, and produce and maintain current, detailed architectural/functional drawings for all production capabilities. All changes to the IGEA system are tracked in a serialized ticketing system. The contractor must be proficient using the ServiceNow platform.

3.3.1 The contractor shall interface with IGEA team members to ensure change management process adherence and compliance. The contractor shall host and document Configuration Control Board (CCB) and Engineering Review Board (ERB) meetings and develop reports and templates as required. CCB and ERB meetings will be held at least monthly.

3.3.2 The contractor team shall be responsible for achieving and maintaining applicable Risk Management Framework (RMF) security accreditations on all IGEA systems. The contractor is responsible for ensuring approval for all changes is prosecuted through the appropriate channels dependent upon the impact to the system, this includes but is not limited to, meeting all IC, DoD and Army network security and administrative requirements. The contractor shall participate during inspections. The contractor shall discover, document, and ensure security gaps are properly accounted for, mitigated, or resolved.

3.3.3 The contractor shall provide an Assistant Information System Security Manager (ISSM) for IGEA. The contractor will provide Information System Security Officers (ISSOs) to support Information Assurance and system accreditation requirements.

3.4 Helpdesk: The contractor shall provide timely helpdesk support to IGEA users throughout the enterprise and operate as an on-call entity for analyst support 24/7, 365 days a year. Timely support is defined as being provided within two (2) hours of the user’s request.

3.4.1 The contractor shall respond to and coordinate with organizations that use IGEA to ensure their system requirements are appropriately reflected in the IGEA priorities. The contractor shall provide customer support through telephone, chat and email responses within 24 hours of notification. The contractor shall accurately describe customer needs through JIRA ticketing systems and track status of requests on the appropriate network. The contractor shall holistically identify support trends to recommend overarching system changes to the client.

3.4.2 The contractor shall coordinate repairs of IT equipment with client and hardware vendors and other actors as required. The contractor shall install physical cabling (Fiber and Copper) and configure network connections in local areas and remote data centers directly and through patch panels.

3.4.3 The contractor shall be responsible for maintaining accountability of IGEA assigned equipment and disposing of end-of-life or non-functional equipment through the Army supply system. IT equipment will be tracked by location and serial number to ensure accountability of Government property.

3.4.4 The contractor will provide full-time Field Service Representatives (FSR) at IGEA CONUS and OCONUS locations. FSR personnel will be responsible for break/fix type repairs of local systems and will facilitate customer interaction with the central Help Desk located on Fort Gordon, Georgia. FSRs must be capable of performing advanced troubleshooting of desktop systems and applications, including GEOINT specific tools such as SOCET GXP. On site FSRs will be responsible for ensuring that IGEA equipment at their location is properly configured, accounted for and operated in accordance with security requirements.

3.5 Surge and Telework Requirements: Surge requirements are unanticipated demands for accelerated delivery of services within existing capabilities during wartime and during peacetime emergencies. This includes the ability of the the contractor to react quickly and meet early requirements and sustain the increased pace throughout the requirements surge. Telework shall be approved in advance by the customer and must consist of activities that directly support the mission. Training or other developmental opportunities may be authorized if they support the mission. Detailed records will be kept to account for the time spent in telework status.

3.6 Mission Partner Support: The IGEA performance covered under this PWS will require the support of other entities and mission partners, to include Application Service Providers(s) (ASPs). To ensure a cohesive response to operating and maintaining the IGEA to support GEOINT production requirements, the contractor shall collaborate with external providers and mission partners, which shall include, but not limited to, GEOINT Enterprise TPED Services (GETS) ASP the contractors. The collaboration shall include communication and coordination of the following: planned changes (to the earliest extent known), change deployments, accreditation plans/changes, projected hardware/software recap needs and future infrastructure needs for the sustained operations, and responses to mission impacting incidents/problems. The contractor shall support the mission partner’s application of specific hardware, software, development environment requirements and accreditation of such until those responsibilities are transitioned officially to mission partners. The contractor shall implement appropriate policy and controls to enable mission partner software development and operation of the application/service.

4.0 Systems Security Requirements

4.1 The contractor shall ensure that its employees performing under this contract receive annual Information Technology security training IAW DoD regulations.

4.2 The contractor shall immediately notify the Contracting Officer’s Representative (COR) when an employee that has access to Government information systems or data terminates employment. The contractor shall ensure all common access cards and tokens, fobs or any other authentication device issued to employees are returned to the Government upon termination of employment. The released employee names are to be removed from facility and system access rosters.

4.3 Antiterrorism considerations. In accordance with DFARS, 22 December 2016, 207.105(d), and DoD Instruction O-2000.16, Volume 1, DoD Antiterrorism Standards, the contractor is hereby advised that it shall comply with the policies and procedures of the U.S. Antiterrorism Officer (ATO) at each installation where work is being performed. DoD Instruction O-2000.16, Volume 1 is available at the Washington Headquarters Services website at http://www.esd.whs.mil/Directives/issuances/dodi/. Information with regard to the INSCOM procedures and policies will be provided at a later date. A modification to the contract will be the instrument of notification for this action. The contractor may submit a request for an equitable adjustment for any directly incurred costs for compliance with these policies and procedures, following the modification incorporating the policy and procedures guidance. Equitable adjustment requests shall be in compliance with clauses.

4.3.1 Antiterrorism and Force Protection (AT/FP): AR 350-1, 19 August 2014, Army Training and Leadership Development, Section II, G-3/5/7, Antiterrorism and Force Protection. Specific Army standards for AT/FP training are listed in chapter 5, AR 525-13, 17 February 2017. Individual AT/FP training is mandatory for all soldiers, Department of the Army civilians, and DOD contractors and is strongly recommended for family members prior to travelling outside the 50 United States and its territories and possessions for any reason, including mobilization, temporary duty, permanent change of station, and leave. There is also an AT/FP training requirement for personnel stationed outside the United States. Individual AT/FP training is valid for one (1) year and must be documented.

4.3.2 AT Level I Training: All contractor employees, to include subcontractor employees, requiring access to Army installations, facilities and controlled access areas shall complete AT Level 1 awareness training within 30 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee to the COR/ACOR or to the contracting officer, if a COR/ACOR is not assigned, within 15 calendar days after completion of training by all employees and subcontractor personnel. AT Level 1 awareness training is available at the following website: https://jkodirect.jten.mil/Atlas2/page/login/Login.jsf

4.3.3 AT Awareness Training for Contractor Personnel Traveling Overseas: This requires US based contractor employees and associated sub-contractor employees to make available and to receive government provided area of responsibility (AOR) specific AT awareness training as directed by AR 525-13. Specific AOR training content is directed by the combatant commander with the unit ATO being the local point of contact.

4.4 Access and General Protection/Security Policy and Procedures. The contractor and all associated subcontractor employees shall comply with applicable installation, facility, and area commander installation/facility access and local security policies and procedures (provided by Government representative). The contractor shall also provide all information required for background checks to meet installation access requirements to be accomplished by the Installation Provost Marshal Office, Director of Emergency Services or Security Office. The contractor workforce must comply with all personal identity verification requirements as directed by DOD, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in The contractor security matters or processes.

4.5 iWATCH Training: The contractor and all associated sub-contractors shall brief all employees on the local iWATCH program (training standards provided by the requiring activity Authorization to Operate (ATO). This local developed training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the COR/ACOR. This training shall be completed within 30 calendar days of contract award and within 30 calendar days of new employee’s commencing performance. iWATCH training results shall be reported to the COR/ACOR not later than 45 calendar days after contract award

4.6 For Contracts that Require an OPSEC Standing Operating Procedure/Plan. The contractor shall develop an OPSEC Standing Operating Procedure (SOP)/Plan within 90 calendar days of contract award, to be reviewed and approved by the responsible Government OPSEC officer, per AR 530-1, Operations Security. This SOP/Plan will include the government's critical information, why it needs to be protected, where it is located, who is responsible for it, and how to protect it. In addition, the contractor shall identify an individual who will be an OPSEC Coordinator. The contractor will ensure this individual becomes OPSEC Level II certified per AR 530-1.

4.6.1 Operations Security (OPSEC): AR 530-1, 26 Sep 2014, Training Programs. The Contractor shall provide OPSEC training to all employees regarding the safeguarding of sensitive information prior to employees being allowed access to such information. Chapter 4 of AR 530-1, Training, requires that newly arrived personnel receive an OPSEC orientation briefing within the first 30 days of arrival at the organization. The AR further requires that all personnel receive an annual OPSEC briefing. Contractor personnel may utilize the OPSEC briefings presented by the INSCOM OPSEC Program Manager/Coordinator. The Contractor will submit certificates of completion or sign in rosters all initial and annual OPSEC training to the COR. The above requirements will flow down to all subcontractors working on or providing support to the contract. The Contractor shall not release sensitive information to the general public without prior written approval from the Contracting Officer. All contractor requests to release sensitive information shall be in writing and clearly explain the necessity for release of the information and consequences if approval is not granted.

4.6.2 All material produced by the contractor which will be released to the general public will be subject to OPSEC and Security reviews from INSCOM OPSEC Officer, Security Officer and INSCOM Public Affairs Office prior to release.

4.6.3 The Contractor shall destroy all sensitive program material at the completion of the contract so as to ensure the information cannot be accessed or utilized for any purpose. The Contractor will also notify the Contracting Officer in writing of its destruction. These same requirements will flow down to all subcontractors working on or provided any sensitive information related to the contract.

4.6.4 For Contracts that Require an Operations Security (OPSEC) Program: The contractor shall develop an OPSEC Standing Operating Procedure (SOP)/Plan within 90 calendar days of contract award, to be reviewed and approved by the responsible Government OPSEC officer, per AR 530-1, Operations Security. This SOP/Plan will include the government's critical information, why it needs to be protected, where it is located, who is responsible for it, and how to protect it. In addition, the contractor shall identify an individual who will be an OPSEC Coordinator. The contractor will ensure this individual becomes OPSEC Level II certified per AR 530-1.

4.7 Cybersecurity /Information Technology Training: All contractor employees and associated sub-contractor employees must complete the DoD Cyber Awareness Challenge training and exam before issuance of network access and annually thereafter. All contractor employees which require an appointed ATCTS position performing CS/IT functions must comply with DoD and Army training and certification requirements in DoD Directive 8140.01 Change 1, 31 July 2017, DoD 8570.01-M Change 4, 10 Nov 15, and AR 25-2 prior to first day of work and prior to having privileged access to Government systems. All contractor employees working CS/IT functions must comply with DoD and Army training requirements in DoD Directive 8140.01 Change 1, 31 July 2017, DoD 8570.01-M Change 4, 10 Nov 15, , DoD 8140 Cyber Workforce Qualification and Management Program, February 15,2023, and AR 25-2.

4.7.1 Cybersecurity/Information Technology Certification: Per DoDM 8140.03, published on February 15, 2023, DFARS 252.239-7001 and AR 25-2, the contractor employees supporting CS/IT functions shall be appropriately certified upon beginning performance on this task order. The baseline certification as stipulated in DoDM 8140.03 must be completed upon beginning performance on this task order. Along with the baseline certification, the contractor must have a computing environment (CE) certification or a certificate of training prior to having privileged access to Government systems. Personnel in Level I and Level II positions must have a certificate of training completion in the relevant technology. The contractor shall submit completion certificates to the COR to confirm compliance prior to entry on duty (EOD). Initially, non-CAC access is required to complete CS training. However, contractor personnel must obtain a CAC prior to EOD.

4.8 Personal Identity Verification (PIV) of the contractor Personnel

a) Contract requires the contractor personnel and/or subcontract personnel to have routine physical access to a Federally controlled facility and/or routine access to a Federally controlled information system as identified in the Performance Work Statement.

b) The contractor hereby understands its responsibility of complying with the agency’s personal identity verification procedures applicable to the installation where performance will occur. The contractor shall account for all forms of Government-provided identification issued to the contractor employees and/or subcontractor employees in connection with performance under this contract/order.

c) The contractor shall provide a report to the COR of the total number of PIVs issued under this contract/order no later than the following:

· 10 calendar days after contract/order performance begins

· 10 calendar days after exercise of each option period

· 10 calendar days after Contracting Officer’s notice/request

d) Each report shall include the following information, at a minimum:

· The individual’s name;

· Title;

· Date the PIV credential/security badge is required under the contract;

· Date the PIV credential is issued;

· Unique PIV credential number;

· Date PIV credential is no longer needed;

· Date PIV credential is returned

e) In addition to the above, The contractor shall return such identification to the issuing agency at the earliest of any of the following:

(1) When the PIV is no longer needed for contract performance.

(2) Upon completion of the contractor employee and/or subcontractor employee’s employment. (3) Upon contract completion or termination of contract/order.

f) The contractor shall deliver a written report to the Contracting Officer addressing the requirements in paragraphs c-e above. A copy of each written report shall be delivered to the Contracting Officer via upload to the designated Government electronic contract management system. The contractor shall also ensure the COR is included in the distribution. The contractor understands the Contracting Officer may delay final payment under the contract/order if the contractor fails to comply with these requirements.

4.9 Security: Security for this project is CLASSIFIED Top Secret/Sensitive Compartmented Information (TS/SCI). All documentation (i.e. DD 254, Attachment a) required for security certification will be the responsibility of the Contractor and the client organization. The contractor personnel performing on this Contract shall have a “FINAL TOP SECRET” clearance at the start of the Contract. The following clause is incorporated.

52.204-9 Personal Identity Verification of Contractor Personnel (Jan 2011)

(a) The Contractor shall comply with agency personal identity verification procedures identified in the contract that implement Homeland Security Presidential Directive-12 (HSPD-12), Office of Management and Budget (OMB) guidance M-05-24, and Federal Information Processing Standards Publication (FIPS PUB) Number 201.

(b) The Contractor shall insert this clause in all subcontracts when the subcontractor is required to have physical access to a federally controlled facility or access to a federally controlled information system.

4.9.1 Contractor shall comply with FAR 52.204-2, Security Requirements. This clause involves access to information classified “Confidential,” “Secret,” or “Top Secret” and requires contractors to comply with— (1) The Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (DoD 5220.22-M Change 4); any revisions to DOD 5220.22-M Change 4, notice of which has been furnished to the contractor.

4.10 All Contractor employees with access to a government information system must be registered in the Army Training Certification Tracking System (ATCTS) at the commencement of services. All Contractor employees and associated subcontractor employees must complete the DOD IA Awareness Training before issuance of network access and annually thereafter. Contractors who are Privileged Users of Government IT systems must meet all training and certification requirements outlined below.

4.11 Per DODD 8140.01, DOD 8570.01-M, DFARS 252.239.7001, and AR 25-2, Contractor employees supporting IA/IT functions shall be baseline certified to at least IAT Level 2 upon contract award and have six months to complete all other certification requirements. All newly hired or appointed personnel shall be baseline certified to at least IAT Level 2 on hire and have six months to complete all other certification requirements

4.12 Contractor shall comply with FAR 52.204-2, Security Requirements. This clause involves access to information classified "(Con)fidential," "(Sec)ret", or "Top (Sec) ret", and requires contractors to comply with - (1) The Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (DOD 5220.22-M); any revisions to DOD 5220.22-M, notice of which has been furnished to the contractor.

4.13 Security Incidents and Violations

Any security violation or unauthorized entry noted by the Contractor shall be reported to the COR within one hour of discovery. The Contractor shall dial 911 in the event of an emergency. The Contractor shall follow through with a written report to the COR within one workday of any security violation or unauthorized entry. The Contractor shall immediately notify the unit’s security manager of any actual security violation, security incident, or of any indication of a potential unauthorized disclosure or compromise of classified or sensitive but unclassified information. There shall be zero security violations during the contract period of performance due to the negligence of a Contractor employee.

5.0 Performance Matrix

Performance of a service will be evaluated to determine whether or not it meets the performance threshold. Re-performance is the preferred method of correcting any unacceptable performance. The Contractor shall provide the COR a written response as to why the performance threshold was not met, how performance will be returned to acceptable levels, and how recurrence of the cause will be prevented in the future.

Deliverable or Required Services

PWS 8.1

6.0 Task Management

Management of this task will be performed by the Government through the COR. The COR will participate in project meetings and receive Contract deliverables. The COR will provide technical assistance and clarification required for the performance of this task. Deliverables must be submitted through the Government's designated Web-Based Order Processing System for client approval.

6.1 Contracting Officer’s Representative (COR) Designation

Upon Contract award, the Contracting Officer will appoint a COR and issue a COR Designation Letter stating the authority of the COR. The Contractor will receive a copy of the written designation. The following clause is incorporated by reference.

DFARS 252-201-7000 Contracting Officer’s Representative (Dec 1991)

(a) Definition. “Contracting officer's representative” means an individual designated in accordance with subsection 201.602-2 of the Defense Federal Acquisition Regulation Supplement and authorized in writing by the Contracting Officer to perform specific technical or administrative functions.

(b) If the Contracting Officer designates a Contracting Officer’s Representative (COR), the contractor will receive a copy of the written designation. It will specify the extent of the COR’s authority to act on behalf of the Contracting Officer. The COR is not authorized to make any commitments or changes that will affect price, quality, quantity, delivery, or any other term or condition of the contract.

7.0 Deliverables and Acceptance

7.1 Inspection and Acceptance

Inspection and acceptance will occur in accordance with FAR 52.212-4 (a), Contract Terms and Conditions - Inspection/Acceptance. In the absence of other agreements negotiated with respect to time provided for Government review, deliverables will be inspected and the Contractor notified of the COR’s findings within five (5) workdays of normally scheduled review. If the deliverables are not acceptable, the COR will notify the Contractor immediately. Acceptance of invoices shall constitute acceptance of performance.

Unsatisfactory Work: Unless otherwise negotiated, the Contractor shall correct or replace all non-conforming services or deliverables no later than five (5) workdays after notification of non-conformance.

7.2 Quality Control

The Contractor shall develop and maintain a Quality Control Plan (QCP) (CDRL A003, Attachment d) that contains, at a minimum, the items listed below. The Contractor shall submit the initial QCP through the Government's designated Web-Based Order Processing System for acceptance no later than ten (10) calendar days after award. The CS will notify the Contractor of acceptance or required modifications to the plan. The Contractor shall make appropriate modifications and obtain acceptance of the plan within thirty (30) calendar days from the date of award. The QCP shall include the following minimum requirements:

7.2.1 A description of the inspection system to cover all major services and deliverables. The description shall include specifics as to the areas to be inspected on both a scheduled and unscheduled basis, frequency of inspections, and the title of inspectors.

7.2.2 A description of the methods to be used for identifying and preventing defects in the quality of service performed.

7.2.3 A description of the records to be kept to document inspections and corrective or preventative actions taken.

7.2.4 All records of inspections performed shall be retained and made available to the Government upon request throughout the Contract performance period, and for the period after Contract completion through final settlement of any claims under this Contract.

7.3 Quality Assurance

The Government will evaluate the Contractor’s performance of this Contract. For those tasks listed in the Performance Matrix, the COR or other designated evaluator will follow the method of surveillance specified in this Contract. Government personnel will record all surveillance observations. When an observation indicates defective performance, the COR or other designated evaluator will require the Contractor manager or representative at the site to initial the observation. The initialing of the observation does not necessarily constitute concurrence with the observation. It acknowledges that the Contractor has been made aware of the non-compliance. Government surveillance of tasks not listed in the Performance Matrix or by methods other than those listed in the Performance Matrix (such as provided in the Inspection clause) may occur during the performance period of this Contract. Such surveillance will be done according to standard inspection procedures or other Contract provisions. Any action taken by the CO as a result of surveillance will be according to the terms of the Contract.

7.4 Transition Management Plan

7.4.1 To ensure a smooth changeover from an incumbent contractor to a new contractor, a transition plan is required for this Contract. The Contractor shall develop and provide a Transition Plan to ensure a seamless phase-in and phase-out transition. The Transition Plan shall be submitted 2 days after award to include at a minimum proposed approach, schedule, and validation. The Contractor shall ensure services can be supported with minimal impact to cost, schedule and performance during phase-in and phase-out transition. Contractor shall provide all equipment or software acquired, developed, or licensed to facilitate processes or meet production requirements to the Government at contract termination or completion. The Contractor shall be cooperative to ensure a smooth changeover is accomplished during the phase-in and phase-out periods.

7.4.2 Contractor Phase-in Requirements: During the phase-in period, the new contractor shall hire a staff to assure satisfactory performance beginning on the contract start date. The incumbent contractor, after coordination with COR, shall allow the new contractor to conduct on-site interviews with employees. The new contractor shall obtain security clearance(s) for Common Access Card(s) (CAC) or contractor badge(s) for the newly hired employee(s). The Contractor shall ensure that all training requirements for the newly hired employee(s) are completed before the contract start date. During this phase-in transition period and thirty days after Contract award, the Contractor shall submit a Staffing Plan (i.e. Personnel Roster) (CDRL A004, Attachment e). This Staffing Plan should include a listing of all employees that are hired at the time or will be hired before or at the end of the transition period to support this requirement. This Staffing Plan should indicate whether the employee is currently employed with the contractor or the date in which the employee will be hired by the Contractor. If the employee is not yet hired by the contractor a Letter of Commitment should be provided (signed by the employee and an appropriate Contractor representative), which states the position the employee will fill and the start date of the employment. If this future employee is currently working with the incumbent contractor, the Staffing Plan should indicate such. The Staffing Plan should identify the title of the position the employee is/will be fulfilling and the associated Labor Category (including level, if applicable) and Labor ID # of that position. The Staffing Plan should also provide the currently held Security Clearances for each current or future employee. This Staffing Plan/Personnel Roster shall be updated and kept current for the entire duration of the Contract, submitted monthly with the invoice and/or monthly report. The Government may request a copy of this roster at any time.

7.4.3 Contractor Phase-out Requirements: During the phase-out period, the incumbent contractor shall be fully responsible for all work performed. The incumbent contractor shall cooperate fully to permit an orderly changeover of workload to the new contractor. The incumbent contractor shall allow the new contractor and Government personnel access on a non-interference basis, to observe the day-to-day operations and to become familiar with the work requirements and procedures. All production and process documentation used in the execution of this Contract shall be provided and briefed to the Government during this period. During the transition period, the incumbent contractor shall provide the assistance and support required to ensure the orderly transition of all support, and transitional planning necessary to commence uninterrupted transition to the new contractor.

8.0 Initial Business and Technical Meeting: Within ten (10) business days following the task award date, the Contractor shall meet with the COR to review goals and objectives of this Contract, and to discuss technical requirements.

8.1 Monthly Reports: Each report shall be due on the twentieth (20th) day of each month. Each report shall be submitted in the Government's designated electronic Web-Based Order Processing System.

8.1.1 Monthly Status Report (MSR) (CDRL A001, Attachment b): The MSR shall include, but not be limited to, the following information:

· Brief description of requirements

· Summary of accomplishments during the reporting period and significant events regarding the Contract

· Deliverables submitted or progress on deliverable products

· Description of any event that required an after-hours response from the contract to resolve, or required a contractor employee to come on site to resolve (include costs associated with each event)

· Any current or anticipated problems; and,

· Brief summary of activity planned for the next reporting period.

8.1.2 Task Summary Report (TSR) (CDRL A002, Attachment 0002): The TSR shall include labor charges for actual hours worked and Support Items, which are authorized in the task (e.g. travel, training, etc.). Charges shall not exceed the authorized cost limits established for labor and Support Items. The Government will not pay any unauthorized charges. Original receipts, travel vouchers, etc. completed in accordance with Government Travel Regulations shall be maintained by the Contractor to support charges other than labor hours and made available to Government auditors upon request. The TSR will include, but not be limited to, the following information:

· Labor hours for each skill level (SL) category (specify the contractor employee name and SL);

· Total labor charges for each skill category;

· Support Items. (Support Items must be individually itemized and specified by each individual category). (i.e. travel and per diem, training, security check fees, commodities, etc);

· Total Support Item charges (G&A included - if allowed); and,

· Total monthly charges.

Note: Travel charges must include the traveler’s name, dates of travel, destination, purpose of travel and cost for each trip.

The Contractor shall provide the deliverables and reports as detailed in the Deliverable Schedule table section below. All deliverables shall be provided in electronic format to the COR. Contractor provided format for these documents shall be acceptable. Unless otherwise advised by the COR, all deliverables shall be uploaded to the Government's designated business application/portal. The contractor shall follow the procedures of the designated system for submitting reports and deliverables. Failure to comply with this requirement may result in rejection of invoices and/or non-payment.

The Contractor shall comply with all reporting requirements in accordance with this Contract. Each deliverable shall be due as indicated in the table below, or as provided within an approved event requisition. The Government has five (5) business days to review deliverable for content. If deliverable is unacceptable, the Government will return to the Contractor within two (2) days and the Contractor shall provide a revised report within two (2) days that is acceptable to the Government.