PWS_05 Jan 2026_RACER SOC 1 Type II - notice.pdf

Performance Work Statement (PWS)

Remedial Action Cost Engineering and Requirements (RACER™)

System and Organization Controls (SOC) 1 Type II report under the Attestation

Standards established by the American Institute of Certified Public Accountants

(AICPA)

05 January 2026

1. Background

The Chief Financial Officer’s Act of 1990 (P.L. 101-576), as amended, requires agencies to prepare and have audited financial statements. On an annual basis, the Government is required to obtain and document an understanding of the design and operating effectiveness of the internal controls in place at AECOM (the Service Provider) and assess whether the key controls are designed and operating effectively. This understanding can be achieved most efficiently by reviewing a System and Organization Controls (SOC) 1 examination report. The American Institute of Certified Public Accountants (AICPA) provides guidance, using a SOC 1 Report, for independent auditors to examine service providers’ control objectives and control activities as a means to provide information to their customers and their customers’ financial statement auditors about controls that may be relevant to their customers’ financial reporting information system. Consistent with AICPA requirements, the Office of Management and Budget Bulletin No. 24-02, Section 6 “Using a Service Organization,” as amended, requires Chief Financial Officers to ensure compliance with this requirement. To meet its audit responsibility to user entities, the Service Provider shall contract with an Independent Public Accounting (IPA) firm to prepare a SOC 1 Type II report on the RACER and Estimate Documentation Report (EDR)/Post Processor (PP) Utility programs in accordance with AICPA guidance. The Service Provider will be responsible for managing the IPA’s performance and ensure compliance with contract requirements. The Service Provider will be responsible for providing status reports to the Government on a regular basis and keeping the Government up to date on all relevant and important information regarding this Task Order. The AICPA Attestation Standards, as applicable, have been adopted into Generally Accepted Government Auditing Standards (GAGAS). AICPA AT-C Sections 105, 205, and 320, standard intent is to reduce the number of auditors viewing the processes for a service provider.

AECOM is designated as the Department of Defense’s (DoD’s) service provider with respect to the RACER and EDR/PP Utility programs development and maintenance. If the Service Provider provides services that could influence DoD agency financial statements, the DoD can require an audit/examination of the Service Provider. The AICPA sets out clear standards for Certified Public Accountants to follow when performing attestation engagements. A SOC 1 examination is an examination of the Service Provider’s internal controls that may affect their client’s (e.g. DoD) internal control over financial reporting.

The SOC 1 allows the DoD auditor to use the work of the Service Provider’s IPA, presented in a SOC 1 report, if the IPA audited the processes that the Government uses. This enables the Government auditor to reduce the amount of time spent evaluating the internal controls of the Service Provider. The Government auditor would still have to develop the appropriate tests of the Government’s transactions that are processed by the Service Provider. This attestation will provide for the broad general controls evaluation over the entire RACER and EDR/PP Utility programs that will be used by the Government auditors in their evaluation of DoD environmental and disposal liabilities estimated using RACER and reported using DoD business systems.

A SOC 1 examination is performed when a service provider provides transaction processing or other data processing services to a customer. A SOC 1 engagement is designed to provide the customer and their auditors with information about the service provider’s internal controls environment. The SOC 1 attestation engagement is a detailed examination of a service provider’s description of its system applicable to the services that it provides to its customers.

AICPA standards define a service provider’s system as the policies and procedures designed, implemented, and documented by management to provide user entities with the services addressed by the service auditor’s report. SOC 1 is applicable to controls that are likely to be relevant to a customer’s internal control over financial reporting.

The SOC 1 report will include RACER management’s assertion, management’s description of the RACER and EDR/PP Utility programs, the IPA’s report, control objectives, and other information provided by the Service Provider such as Complementary User Entity Controls (CUECs) from subservice providers and acronym definitions.

2. Objectives

To perform a SOC 1 examination, following all AICPA standards and mandates, for RACER and the EDR/PP Utility and to provide the appropriate reports and deliverables associated with the audit.

All deliverables from the IPA will be provided to the Service Provider for review and approval. The Service Provider will provide the Government with monthly status reports that provide sufficient detail which allows the Government to measure Task Order progress and performance. The Service Provider will provide the final SOC 1 report to the Government and at the request of Government auditors.

The delineation of roles and execution of PWS responsibilities is outlined, in general, below :

Service Provider Responsibilities:

a. Manage the IPA’s activities and performance to ensure compliance with all contractual requirements

b. Review and approve all deliverables submitted by the IPA

c. Provide the Government with monthly status reports as certification that work is being completed per this PWS

d. Submit the final SOC 1 report to the Government by the end of the ordering period

e. Assist Government auditors with obtaining the SOC 1 documentation at any time when requested

f. Ensure coordination between the IPA, the Government, and other stakeholders as necessary

IPA Responsibilities:

a. Perform a SOC 1 Type II examination on RACER and the EDR/PP Utility following all AICPA standards and mandates

b. Provide detailed reports and deliverables to the Service Provider as specified in the PWS

c. Coordinate with the Service Provider to align on project timelines, methodologies, and deliverable expectations

Government Responsibilities:

a. Review all deliverables submitted by the Service Provider

b. Provide feedback and recommendations for any requests or required changes coordinated through the Service Provider

3. Scope

One SOC 1, Type II report shall be required. The report will examine Information Technology (IT) general controls and business process controls applicable to RACER and the EDR/PP Utility. The IPA will perform the SOC 1 examination and submit the SOC 1 Type II Report to the Service Provider.

The SOC 1 Type II report shall be in accordance with AICPA Attestation Standards, including AT- C Section 320 Paragraph .41 and include, but shall not be limited to, a list of controls tested.

As an attachment to this PWS, the Government will provide to the Service Provider, a recommended potential RACER Control Determination Matrix which will include Government recommended control objectives, potential control areas, and potential Complementary User Entity Controls (CUECs). It will be the responsibility between the Service Provider and the IPA to determine the actual control objectives to be tested.

In performing the SOC 1 examination, the IPA shall report on its examination of the Service Provider’s description of its system (RACER and the EDR/PP Utility) in accordance with AICPA standards and mandates.

The IPA’s examination will also report on the suitability of the design of controls to achieve the related control objectives stated in the description and on the implementation and operating effectiveness of those controls during the entire development period (October 2024 to October 2025) for RACER version 11.11 and the EDR/PP Utility version 11.11. A report on management’s description of its system and the suitability of the design, implementation, and operating effectiveness of controls is referred to as a SOC 1, Type II report.

The IPA’s examination shall include procedures to obtain reasonable assurance, in all material respects and based on suitable criteria, as to whether:

a. Management’s description of its system fairly presents the system that was designed and implemented throughout the entire development period (October 2024 to October 2025) for RACER version 11.11 and the EDR/PP Utility version 11.11

b. The controls related to the control objectives stated in the aforementioned description were suitably designed throughout the entire development period (October 2024 to October 2025) for RACER version 11.11 and the EDR/PP Utility version 11.11

c. The controls selected by the IPA for testing operated effectively to provide reasonable assurance that the control objectives stated in the management’s description of its system were achieved throughout the entire development period (October 2024 to October 2025) for RACER version 11.11 and the EDR/PP Utility version 11.11

4. Performance Requirements

a. The IPA shall perform the SOC 1 examination in accordance with standards established by the AICPA. The IPA shall use AICPA standards to develop the methodology and detailed attestation steps for the SOC 1 examination. The IPA shall test the design, implementation, and effectiveness of controls throughout the specified period in time for the SOC 1 examination.

b. The Service Provider shall work with the IPA to develop a detailed deliverable schedule showing baseline start and finish dates and provide to the Government within fourteen (14) calendar days after the contract award. The schedule must detail the progression of the SOC 1 evaluation and evidence that the SOC 1 report can be reasonably completed before the end of the period of performance.

Throughout the period of performance for this task order, the Service Provider shall update the schedule monthly to include actual start and finish dates. The updated schedule shall be provided to the Government as part of the monthly status report and will be used to evaluate performance. The monthly status report shall be submitted to the Government No Later Than (NLT) the 10th calendar day of each month and should also include a brief narrative of task order status, explanation as to the reason for being behind schedule (if applicable), and any other important explanation/documentation to help convey project status.

c. In support of the SOC 1 examination, the IPA shall perform general control tests.

For the controls testing supporting the SOC 1examination, the IPA shall select item samples in accordance with AICPA standards.

d. The Service Provider shall ensure all necessary requirements are included in their contract with the IPA to complete all necessary components of the SOC 1 per AICPA standards and deliver the SOC 1 report including, but not limited to, all applicable coordination, support, personnel, security requirements, materials, documentation, equipment, access, hardware, software, meetings, etc.

e. In its role as the IPA, the IPA is responsible for conducting the SOC 1 examination in accordance with relevant AICPA standards, the IPA shall have final authority and approval rights regarding the following aspects of the SOC 1 examination:

1) Strategic and tactical decisions associated with the planning the SOC 1 examination including the form and content of SOC 1 attestation audit plans and detailed test plans.

2) Decisions associated with the conduct of SOC 1 examination test procedures, including the selection testing approaches, evaluations of the sufficiency of evidence, evaluations of exceptions, weaknesses, and instances of potential non- compliance; development of conclusions; and form and content of IPA prepared audit documentation.

3) Conclusions and the opinions included in the SOC 1 Report

4) The form and content of the SOC 1 Report, with the exception of content provided by the Service Provider.

4.1 Task 1 PLANNING PHASE (Basic Task, Non-Severable)

The following deliverables shall be completed during the planning phase:

4.1.1 Subtask 1 – SOC 1 ATTESTATION PLAN FOR RACER and EDR/PP Utility (Basic Task, Non-Severable)

The Service Provider shall develop an attestation plan in accordance with the approved deliverable schedule. The attestation plan shall be developed in coordination with the IPA and the IPA must concur with the final attestation plan.

The attestation plan shall include the plan to evaluate the fairness of the presentation of management’s description of the Service Provider’s system, and the suitability of the design, implementation, and operating effectiveness of controls to achieve management’s control objectives included in the description throughout the specified period. The attestation plan must also include the assessment approach, scope, methodology, nature and type of testing, qualitative measurement standards, and reporting requirements that achieve the assessment objectives in a cost effective and timely manner. The Service Provider is responsible for coordinating with the IPA regarding specific review and versions timelines. The Service Provider shall include the status of this subtask in their monthly status reports to the Government.

4.1.2 Subtask 2 – SOC 1 TEST PLAN FOR RACER and EDR/PP Utility (Basic Task, Non-Severable)

A SOC 1 test plan shall be developed in coordination with the IPA and the IPA must concur with the final test plan. The test plan will include the sampling methodology to be used during the testing phase. The SOC 1 test plan shall also include test procedures to assist the user auditors in determining the extent that the internal controls can be relied upon, as well as the general sampling approach. Testing procedures will include Service Provider’s controls as well as procedures to assess fairness of presentation and suitability of design, implementation, and operating effectiveness for each control description. The Service Provider is responsible for reviewing the SOC 1 test plans. The Service Provider is responsible for coordinating with the IPA regarding specific review and versions timelines. The SOC 1 test plan must be documented, kept current, and made available to the Service Provider. The Service Provider shall include the status of this subtask in their monthly status reports to the Government.

4.1.3 Subtask 3 - KICKOFF/ENTRANCE CONFERENCE (Basic Task, Non- Severable)

The Service Provider shall hold a kickoff/entrance conference meeting with the Government and IPA after the Task Order award per the Service Provider approved schedule. The kickoff/entrance conference meeting will provide the IPA an opportunity to discuss contractual requirements and security requirements with the Service Provider and will provide the opportunity to discuss requirements for the SOC 1 examination, and to plan site visits. The Service Provider shall include the status of this subtask in their monthly status reports to the Government.

4.1.4 Subtask 4 – PLANNING SUMMARY WORKPAPERS (Basic Task, Non- Severable)

The Service Provider shall include the status of the planning-related activities, including test plans and preliminary observations as part of their monthly status reports to the Government.

4.1.5 Subtask 5 – CONTROL-SPECIFIC PLANNING WORK PAPERS (Basic Task, Non-Severable)

The Service Provider shall include the status of control-specific planning, including changes to the design of controls and expected site visits as part of their monthly status reports to the Government.

4.1.6 Subtask 6 – SENIOR In Process Review (IPR)- PLANNING (Basic Task, Non-Severable)

The Service Provider shall include the results of planning in their monthly status reports to the Government.

4.1.7 Subtask 7 – AUDIT STAFF (Basic Task, Non-Severable)

The IPA shall provide a mix of labor categories to meet the requirements of the PWS tasks of the assigned audit staff. The Service Provider will evaluate the IPA’s ability to ensure initial and continuing availability of the required expertise, skills, and capacity to meet all the audit requirements and provide appropriate oversight of the work that will be completed under this order. In addition to the technical quotation and un-sanitized price quotation, a sanitized price quotation including only the number of full-time equivalents, labor categories, and number of labor hours, broken out by task area, shall be submitted with the quote and will be considered under this subfactor. The IPA shall provide generic resumes for key personnel identified in Reference PWS Language. Generic resumes shall include years of employment; experience in chronological order including narrative description of duties and responsibilities; education, degree or certification earned, and year for all degrees or certifications earned; and the current level of security clearance and status (final, interim, or pending). Generic resumes, without names, shall be provided for each labor category for key personnel reflected in Reference PWS Language. Individual's names shall not be included within the technical quote nor on the generic resumes.

In addition to addressing the expertise as described for each position defined in Section 7 of this PWS, the IPA shall address in sufficient detail key personnel as a task lead to correspond to every task identified in Reference PWS. The IPA shall highlight the resume portions that indicate recent, relevant (within the last five years) technical and operational work experience and expertise with list Audit specific information that is directly transferrable.

The IPA personnel who are used to meet the requirements of this PWS shall not include/be independent of IPA personnel that are currently engaged in other aspects of the DoD audits.

The Service Provider shall include the status of this subtask in their monthly status reports to the Government.

4.1.8 Subtask 8 – AUDIT DOCUMENTATION (Basic Task, Non-Severable)

Upon task order/option award, the IPA must provide to the Service Provider, for distribution to the Government, the latest copy of the firm’s peer review report and associated documentation, if applicable IAW DoDM 7600.07- M, “DoD Audit Manual,” Enclosure 14, Para 5b(2). The IPA shall provide a statement prior to contract award to the Service

Provider, for distribution to the Government, that the firm is not currently doing work for the DoD Component that would impair its independence IAW DoDM 7600.07-M, “DoD Audit Manual,” Enclosure 14, Para 5b(3). The Service Provider shall include the status of this subtask in their monthly status reports to the Government.

The Service Provider shall provide the following deliverables:

4.2 Task 2 TESTING PHASE (Basic Task, Non-Severable)

The following deliverables shall be completed during the testing phase:

4.2.1 Subtask 1 – CONTROL SPECIFIC TESTING WORK PAPERS

(Basic Task, Non-Severable)

The Service Provider shall include the status of the testing in their monthly status reports to the Government.

4.2.2 Subtask 2 - CONTROL OBJECTIVE SUMMARY WORK PAPERS

(Basic Task, Non-Severable)

The Service Provider shall include the status of the testing in their monthly status reports to the Government.

4.2.3 Subtask 3 - SENIOR IPR-TESTING (Basic Task, Non-Severable)

The Service Provider shall include the status of the testing in their monthly status reports to the Government.

4.2.4 Subtask 4 - EXIT CONFERENCE (Basic Task, Non-Severable)

The Service Provider shall hold a formal exit conference for the SOC 1 examination with the Government.

PWS Deliverable Format Due Date Distribution Frequency and Remarks

Task Title

4.1.1 –

4.1.6

Monthly Status Reports

MS Office Compatible

Monthly status reports to the Government NLT the 10th calendar day of each month

**Government Distribution

Service Provider to provide monthly status reports to the Government NLT the 10th calendar day of each month

**Government Distribution: 1 copy of the transmittal letter without the deliverable; 1 copy of the transmittal letter with the deliverable from the Service Provider to the Government.

PWS Deliverable Format D u e

D a t e

Distribution Frequency Task Title and Remarks

4.2.1 – 4.2.4

Monthly Status Reports

MS Office Compatible

M o n t h l y s t a

*Government Distribution

Service Provider to provides monthly status reports to the Government NLT the 10th calendar day each month

*Government Distribution: 1 copy of the transmittal letter without the deliverable; 1 copy of the transmittal letter with the deliverable from the Service Provider to the Government.

4.3 Task 3 REPORTING PHASE (Basic Task, Non-Severable)

The following deliverables shall be completed during the reporting phase:

4.3.1 Subtask 1 - SOC 1, TYPE II REPORT FOR RACER and EDR/PP

Utility (Basic Task, Non-Severable)

The IPA shall prepare a SOC 1, Type II report. In the Type II report in accordance with AICPA Attestation Standards, including AT-C Section 320 Paragraph .41, the IPA shall provide an opinion for the entire development period (October 2024 to October 2025) for RACER version 11.11 and the EDR/PP Utility version 11.11. The IPA shall provide an opinion in accordance with AICPA Attestation Standards based on the examination procedures and results. The Service Provider is responsible for reviewing and making recommendations/requests on the draft SOC 1 report and will provide recommendations/requests to the IPA in accordance with the final deliverable schedule. The IPA shall provide the final attestation report to the Service Provider in accordance with the final deliverable schedule. The Service Provider shall provide the final attestation report to the Government per the approved deliverable schedule, but no later than the end of the period of performance. Additionally, the Service Provider shall provide the final attestation report to Government auditors at any time when requested. Report distribution shall be limited to intended users per AICPA standards. The Service Provider shall include the status of this subtask in their monthly status reports to the Government.

5. Performance Standards

The Government will measure, review and approve the Service Provider’s performance for this Task Order using provided monthly status reports, by the on-time delivery of the final attestation report, and by reviewing the final attestation report to ensure it is in accordance with AICPA standards for performing the SOC 1 examination. It is the

PWS Deliverable Format Due Date Distribution Frequency

Task Title and

Remarks

4.3.1 Attestation

Report/

SOC 1,

Type II Report for

RACER

and

EDR/PP

Utility

Secure Portable Document Format (PDF)

Final report due in accordance with the approved deliverable schedule and NLT the end of the period of performance

Final *Standard Distribution and **Government

Distribution

Service Provider Review in accordance with the approved deliverable schedule

4.3.1 Monthly

Status Reports

MS Office Compatible

Monthly status reports to the Government NLT the 10th calendar day of each month

**Government Distribution

Service Provider to provide monthly status reports to the Government NLT the 10th calendar day of each month

*Standard Distribution: 1 copy of the transmittal letter without the deliverable; 1 copy of the transmittal letter with the deliverable from the Service Provider.

**Government Distribution: 1 copy of the transmittal letter without the deliverable; 1 copy of the transmittal letter with the deliverable from the Service Provider to the Government.

Service Provider’s responsibility to ensure acceptable quality and performance of the IPA’s work. The following areas will be focal points for the performance metrics under this task order:

a. Monthly status reports - The Government will review the Service Provider’s monthly status reports and compare against the approved delivery schedule to assess if tasks in the Task Order are on or ahead of schedule.

b. Final Attestation/SOC 1 Report – The Government will review the final attestation report provided by the Service Provider that includes the Final SOC 1 Type II report and assess that the SOC 1 was performed in accordance with AICPA standards and that the report was delivered in accordance with the approved schedule, but no later than the end of the period of performance.

6. Delivery Schedule

Within this PWS, the term ‘audit documentation’ is used in connection with the description of various project deliverables, as well as general documentation requirements associated with the SOC 1 examination.

The Service Provider shall submit deliverables in Microsoft (MS) Office compatible electronic format, as well as any hard copy documents not included in the electronic files, except for the finalized SOC 1 report, which will be provided in secure Portable Document Format (PDF) files. All deliverables are subject to the Service Provider review and will be reviewed in accordance with the approved deliverable schedule. For all deliverables, the Service Provider shall possess final authority related to the manner of presentation, organization, and content, with the exception of the SOC 1 report provided by the IPA.

7. Key Personnel

All personnel assigned to this task order must be U.S. citizens. Key personnel are those individuals whom the Government considers essential to the work being performed under this task order to include Partner(s), Project Manager(s), Director, Managers/Supervisors, senior auditors and Team Lead(s). All personnel assigned to this task order must not be currently engaged in other aspects of the DoD Audits.

8. Government Furnished Property (GFP)/Government-Furnished Equipment (GFE)/ Government- Furnished Information (GFI).

None.

Performance

Standard

Acceptable Quality Level

(AQL)

Methods of Surveillance

Subtasks 4.1.1 –

4.3.1 Planning

through Final Attestation/SOC1 Report

Performance, as indicated in the monthly status reports, occurs in accordance with the approved schedule with no issues and no schedule delays at least 90% of the time.

Problems that occur are communicated to the Government, are minor, and are resolved in a satisfactory manner.

Routine inspection of monthly status reports.

Subtask 4.3.1 Final Attestation/ SOC 1 Report

The Final Attestation/SOC 1 Type II Report is delivered to the Government within the period of performance and has been completed in accordance with AICPA standards.

Review of Final Attestation/SOC 1 Type II Report

9. Other Pertinent Information or Special Considerations.

In association with the IPA’s completion of the SOC 1 examination, the following additional terms are set forth:

9.1 Notification

The IPA is required to notify the Service Provider immediately if any equipment and/or Service Provider data is lost, misplaced, or stolen. The Service Provider will include this information in the monthly status reports to the Government.

9.2 Report

The IPA’s report will be addressed to the Service Provider. The final report will be distributed to the Government by the Service Provider per AICPA guidelines.

9.3 Management’s Responsibilities

The Service Provider acknowledges and accepts its responsibility for:

a. Preparing its description of its system and its assertion, including the completeness, accuracy, and method of presentation of the description and assertion

b. Having a reasonable basis for its assertion

c. Selecting the criteria to be used and stating them in the assertion

d. Specifying the control objectives and stating them in the description

e. Identifying the risks that threaten the achievement of the control objectives

f. Designing, implementing, and documenting controls that are suitably designed and operating effectively to provide reasonable assurance that the controls objectives stated in the description will be achieved

g. Providing a written assertion that will be included in, or attached to its description of its system, and provided to user entities

The Service Provider agrees to provide the IPA with access to all information, such as records and documentation, of which management is aware that is relevant to the description of its system and assertion; additional information that the IPA may request from management for the purpose of the IPA’s examination; and unrestricted access to personnel within the organization from whom the IPA determines it is necessary to obtain evidence relevant to this engagement. At the conclusion of the engagement, the Service Provider will provide the IPA with a representation letter that, among other things, will confirm management’s responsibility for its assertion and the description of its system, and that all records, documentation, and information relevant to the description have been made available to the IPA including disclosure of any of the following of which it is aware:

a. Instances of noncompliance with laws and regulations or uncorrected errors that may affect one or more user entities.

b. Knowledge of any actual, suspected, or alleged intentional acts by the Service Provider’s management or employees, that could adversely affect the fairness of the presentation of management’s description of its system or the completeness or achievement of the control objectives stated in the description.

Management’s responses to the IPA’s inquiries, written representations, and the results of the IPA’s other examination procedures comprise the evidential matter the IPA will rely upon in forming the IPA’s opinion. The Service Provider is responsible for the implementation, effectiveness, and reliability of information systems, processes, and controls described in the description of its system.

9.4 Release to Third Parties

The Service Provider is responsible for distributing the report to its user entities and to the independent auditors of such user entities per AICPA guidelines.

9.5 Other Communication & Reporting

All communications between the IPA and the Government will be facilitated by the Service Provider.

9.6 Assistance to Contractor

In addition to the duties described elsewhere in this task order, Service Provider personnel will be available to attend meetings, provide technical assistance, and assist in obtaining requested data or access. In addition, the Service Provider must be included on all e-mail transmissions between the IPA and the Government pertaining to matters associated with this Task Order.

Service provider assistance shall be requested in advance of any actions necessary on their part to assist the IPA in obtaining documentation, establishing meeting times, and coordinating site visits.

9.7 Immediate Notification

a. Identification of Possible Follow-on Work. This contract may need to be re-competed for similar services in the future.

b. Identification of Non-Disclosure Requirements. The IPA shall hold all material and information gained from the Service Provider or other DoD activities in connection with this task order in strict confidence and not make use thereof, other than for the performance of this task order. The IPA shall release such material and information only to its employees requiring such information in the

“need-to-know,” discharge of their duties under this task order and to the Service Provider, and not release or disclose the same to any other party, unless requested to do so, or unless law or legal process requires disclosure. If required by the Service Provider, those members of the engagement team with a “need-to-know” discharge must sign a Non-Disclosure Agreement.

c. Packaging, Packing and Shipping Instructions. N/A

d. Inspection and Acceptance Criteria. N/A

e. Property Accountability. N/A

9.8 Period of Performance and Performance Based Payments

The anticipated period of performance for all tasks is beginning when an agreement is in place between the Service Provider and IPA, but NLT 06 March 2026 to 01 September

2026.

The Service Provider shall continue its agreement with the IPA in emergency or mission essential conditions. In the event of a Government shutdown, the Service Provider shall continue its agreement with the IPA.

No changes to this PWS will be authorized except via the Government Contracting Officer. The Service Provider must notify the Government Contracting Officer of any recommended changes, which are not authorized by the current PWS. Any work outside of this PWS performed by the Service Provider and not authorized by the Government Contracting Officer is performed at the Service Provider’s own risk and may require removal from the final deliverable. The Service Provider is responsible for a ll work performed by the IPA and the Service Provider is responsible for paying all invoices from the IPA. The Government is only responsible for paying invoices based on the negotiated contract amount for this PWS and any changes that are authorized by the Government Contracting Officer.

The Service Provider shall submit a deliverable payment schedule to the Government for the subject task order. The schedule shall include deliverables and dates that the Service Provider should develop and propose. The Government shall pay the Service Provider based on performance within terms and conditions of the contract.

9.9 General Security Requirements and Guidance

The security requirements described below apply to all contract personnel (including employees of the prime Contractor (“Contractor”) and all subcontractor employees) supporting the performance requirements of this contract. The Contractor is responsible for compliance with these security requirements. Questions regarding security matters shall be addressed to the designated Government representative (e.g., Contracting Officer

Representative (COR), Requiring Activity (RA) representative, or Contracting Officer (if a COR or other RA representative is not appointed)). Contract personnel are critical to the overall security and safety of US Army Corps of Engineers (USACE) installations, facilities and activities, and security awareness training contributes to those efforts. The

Department of Defense (DoD) and Army security training requirements specified below, if applicable, are performance requirements; all applicable contract personnel shall complete initial training within 30 days of contract award or the date new contract personnel begin performance on the contract. Within five business days from the completion of training, the

Contractor shall provide written documentation (e.g., email or memorandum) to the Government representative. The documentation shall include the names of contract personnel trained and which training they completed; the Contractor shall maintain training records as part of their contract files and be prepared to provide copies of training certificates to the Government representative. Contractor personnel and vehicles are subject to search when entering federal installations. Additionally, all contract personnel shall comply with Force Protection Condition (FPCON) measures, Random Antiterrorism Measures (commonly referred to as “RAMs”), and Health Protection Condition (HPCON) measures. The Contractor is responsible for meeting performance requirements during elevated FPCON and/or HPCON levels in accordance with applicable RA plans and procedures—this includes identifying mission essential and non-mission essential personnel. In addition to the changes otherwise authorized by the changes clause of this contract, should the FPCON or HPCON levels at any individual facility or installation change, the Government may implement security changes that affect contract personnel.

The Contractor shall ensure all contract personnel are aware of their security responsibilities, including any site-specific requirements identified in local policies or procedures.

9.10 Pre-screen Candidates Using E-Verify Program

Contractors shall comply with the requirements set forth in FAR clause 52.222 -54 Employment Eligibility Verification and FAR Subpart 22.18 in using the E-Verify Program at (https://www.e-verify.gov/)(website subject to change) to meet the contract employment eligibility requirements. Contractors are encouraged to cooperate with Federal and State agencies responsible for enforcing labor requirements to include eligibility for employment under United States immigration laws in accordance with FAR 22.102-1(i). An initial list of verified/eligible candidates shall be provided to the COR no later than three business days after the initial contract award. When contracts are with individuals, the individuals will be required to complete a Form I-9, Employment Eligibility Verification, and submit it to the Contracting Officer to become part of the official contract file.

10. Invoicing

The Service Provider shall provide invoices to the Government in accordance with FAR 32.905(b). The POP for each invoice shall be for one calendar month. The Service Provider shall submit only one invoice per month per order/contract. The appropriate USACE office will receive the invoice by the 25th calendar day of the month after either:

a. The end of the invoiced month (for services) or

b. The end of the month in which the products (commodities) or deliverables (fixed-priced services) were delivered and accepted by the Government.

Any invoices submitted by the IPA are between the IPA and the Service Provider and will solely be the responsibility of the Service Provider.

10.1Posting Invoice Documents

The Service Provider shall submit all invoices via email to the following locations for processing: **Invoices not submitted to the below E-Mail addresses will be rejected.

The Service Provider shall NOT submit invoices via Wide Area Workflow (WAWF).

All invoices submitted to WAWF will be rejected.

10.2Content of Invoice

The Service Provider’s invoice shall be submitted to the Government monthly for work performed the prior month. The invoice shall be submitted on official letterhead in Adobe’s Portable Document Format (PDF) and shall include the following information at a minimum:

a. Name and address of the Service Provider (Note: Differences between the remittance address on the invoice and the data on record in the System for

Award Management (SAM) can potentially cause delays in payment. Please verify these data agree exactly.)

b. Invoice date and number mailto:ITS_CIS_INVOICES@usace.army.mil mailto:Joshua.M.Cavanaugh@usace.army.mil mailto:Cheryl.M.Churchman@usace.army.mil

c. Entire contract number, contract line item (CLIN) number, the order number and modification number as applicable.

d. Description, quantity, unit of measure, unit price and extended price of the item delivered. Item description must match those contained in the purchase order/contract description.

e. Delivery tracking information to include tracking number and name of the person accepting delivery.

f. In cases where there is no physical delivery, please include all email correspondence to the electronic delivery POC (the customer) when the product becomes available for download or is renewed in accordance with the statement of work. Read receipts may help substantiate electronic delivery.

g. Name and address of official to whom payment will be sent.

10.3Final Invoice

Invoices for final payment must be so identified and submitted within 60 days from task completion and no further charges are to be billed. A copy of the written acceptance of task completion must be attached to final invoices.

10.4Release of Claims

The vendor shall include a Release of Claims (ROC) with final payment request. Final invoices submitted without a ROC will be rejected and returned to vendor, with request to resubmit. The ROC shall be signed, include the final Purchase Order/Contract/Task Order amount, vendor address, and company stamp/seal. The Release of Claims template is attached in Appendix A and is available upon request from the Acquisition PM.

Appendix B

Release of Claims Template

RELEASE OF CLAIMS

Contract No: _____________________________________

Delivery/Task No: _____________________________________

Project Description/Name: _____________________________________

Contractor Name: _____________________________________

Pursuant to the terms of subject Obligation No. and/or Task No. and in consideration of enclosed of final payment request for Invoice No. _________________ in the amount of

$____________________________, Dated ________________. The Contractor agrees oblig ation No. has been paid in full for total obligation amount of $_________________________ , to (Company Name)

___________________________________________, (Address)

Hereinafter called (“contractor”) or assignees, if any, the contractor upon full payment of said sum by the

United States of America (hereinafter called (“the Government”) does remise, release, and discharge the

Government, its officers, agents, and employees, of and from all liabilities, obligations, claims, and demands whatsoever under or arising from the said contract/task order.

**Vendor has been made aware that if certified payment for the above-mentioned invoice number is not received per payment terms of subject contract this ROC is void and shall be resubmitted upon receipt of certified payment. **

IN WITNESS WHEREOF, this release has been executed on the (date).

By: _____________________________ (signature), Date: _________________

Name: _____________________________

Title: _____________________________

WITNESS: _________________________ (signature), Date: _________________

Name: _____________________________

Title: _____________________________

Company Seal: ___________________________