PWS--COMLCSRON ONE Support--06 FEB2026 (1).pdf

PERFORMANCE WORK STATEMENT (PWS)

C01SM/Security Management Program Mission and Readiness Support Services

In Support of

Commander, Littoral Combat Ship Squadron One

Naval Base, San Diego, CA

Part 1

General Information

1. GENERAL: This is a non-personal services contract to provide Security Management Program Mission Readiness to Commander, Littoral Combat Ship Squadron One N00SM Department Staff. The Government will not exercise any supervision or control over the contract service providers performing services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn, is responsible to the Government.

1.1 Description of Services/introduction: Contractor support is required to provide Security Management Program Mission Readiness to enhance warfighting readiness and increase the Security proficiency of Littoral Combat Ship Squadron One, to include afloat and ashore claimants and staff. The contractor shall provide support for in-port services.

1.2 Background: Security governed by the DoD and SECNAV requirements. The mission of COMLCSRON ONE Security is to provide support services for the overall operational and administrative objectives of Commander, Littoral Combat Ship Squadron One. This supports our ability to man, train, and equip COMLCSRON ONE in security management. LCSRON One security assets provide LCS Afloat Commanding Officers with credible security support and protection of information across the LCS platform.

1.3. Objectives: The Contractor shall provide Security Management Support and Services to include: Conducting training events, Subject Matter Expertise (SME) Support, Readiness Support, Meeting Support, Compliance Support, Curriculum Development, Instruction and Processes Development, Trends Analysis, Command and LCS Ship Security Support, Asset Support, Compliance Evaluation Support, Command Security Equipment Support, Modernization Support, Risk Management Support, Content Development and Communication Strategy Development.

1.4. Scope: In addition to contract Program Management functions, the following Mission Readiness Security Support Roles shall be included in the Scope of this contract:

1.4.1 SECURITY MANAGER SUPPORT. Providing administration support across a wide range of security disciplines to protect physical and information command assets.

1.4.2 LITTORAL COMBAT SHIP SQUADRON ONE SECURITY SUPPORT. Providing administration support across a wide range of security disciplines to protect physical and information support for LCS Ship assets.

1.5. Period of Performance: The base period of performance is one year with one option year.

1.6. General Information:

1.6.1. Quality Control: The Contractor shall develop and maintain an effective quality control program to ensure services are performed in accordance with this PWS. The contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The contractor’s quality control program is the means by which they assure themselves that work complies with the requirement of the contract. The contractor’s Quality Control Plan (QCP) will be part of the proposal submission and evaluation (see Section L). The contractor shall receive the Contracting Officer’s acceptance, in writing, of any proposed change to the submitted QCP.

1.6.2. Quality Assurance: The Government shall evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Program (QASP). This plan is primarily focused on what the Government must do to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable quality levels and defect rate(s).

1.6.3. Recognized Holidays: The contractor is not required to perform services on the following Holidays:

New Year’s Day Labor Day

Martin Luther King Jr.’s Birthday Columbus Day

President’s Day Veteran’s Day

Memorial Day Thanksgiving Day

Juneteenth

Independence Day

Christmas Day

1.6.4. Hours of Operation: The contractor is responsible for conducting the majority of work between the business hours of 0700 to 1630, referred to as “Core Hours,” Monday thru Friday, except for Federal Holidays, or when the Government facility is closed due to local or National emergencies, administrative closings, or similar Government-directed facility closings.

Adjustments to the working hours to meet mission requirements shall be coordinated through the TPOC and the supported Government personnel, and shall range from 0500 to 1800, as needed.

The contractor must, at all times, maintain an adequate workforce for the uninterrupted performance of all task defined within this PWS when the Government facility is not close for the above reasons. When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the workforce are essential.

1.6.5. Places of Performance: The work to be performed under this contract will be performed at the following locations:

Location 1: Commander, Littoral Combat Ship Squadron One, 2680 Woden St., Bldg. 3304B, Suite 2, San Diego, CA 92136

Location 2: Onboard various COMLCSRON ONE afloat platforms, Naval Base San Diego, San Diego, CA 92136

Location 3: Government may consider approving situational telework to support the contract during unforeseen health, security, natural events or other scenarios that may influence attendance. These periods will be approved in writing by the TPOC as required to meet the command mission as necessary.

1.6.6. Type of contract: Firm Fixed Price.

1.6.7. Security Requirements: The Contractor shall meet all requirements contained in the DD Form 254. Highest level of classification of the work to be performed is at the SECRET level.

1.6.7.1 Common Access Card (CAC) Issuance: The Government Contractor CAC serves as the primary method of identification for the Contractor employees, as well as providing the basis of Public Key Infrastructure (PKI) access to the Navy/Marine Corps Intranet (NMCI), and numerous Navy web sites, which may also require PKI access. The TPOC shall assist in providing the Contractor the appropriate documentation for obtaining a CAC .

Both physical and logical access is the requirement to qualify for CAC issuance for Contractors who need access to, or are stationed on, bases/facilities that use Navy Access Control System (NCACS). If both physical and logical access is deemed warranted, then the Government will sponsor the Contractor for the issuance of a CAC. Within 30 days of task order award, the Contractor shall identify those personnel to the Technical Point of Contact (TPOC) whom the Contractor can justify requiring physical and logical access. A CAC cannot be issued to personnel who do not have a favorably adjudicated National Agency Check with fingerprints or higher. The Contractor shall effectively manage their workforce to avoid delays resulting from personnel who do not have the necessary eligibility.

The Contractor shall be responsible for obtaining any government issued identification cards from the former employee and to turning those items over to the TPOC within five (5) days of the termination of the employment.

1.6.7.2. The nature of this task requires access up to SECRET information. The work performed by the contractor could include access up to SECRET, information, and spaces. The contractor could be required to attend meetings classified up to the SECRET level. Sufficient contractor personnel assigned to this effort shall possess a current Tier 3 or Tier 3 Re-investigation (T3/T3R), as delineated within Section 1.6.17. Personnel supporting the roles within this effort shall require security clearances and billets up to the SECRET level and shall require access to government offices and SECRET areas, data, and facilities to successfully accomplish the tasking identified within the PWS. Contractor personnel assigned to this effort who require access to SECRET data and spaces shall possess a current T3/T3R with Secret eligibility and Access reflected in Defense Information System for Security (DISS).

1.6.7.3. Communication Security (COMSEC): There are no COMSEC requirements anticipated in this contract.

1.6.7.4. Operations Security (OPSEC) Requirements: The Contractor shall apply Operations Security (OPSEC) to enhance protection for classified and unclassified critical information, pursuant to the National Security Decision Directive Number 298, DoDM 5205.2, OPNAV, and supplementary instructions. Service OPSEC guidance shall also apply if the contracted activity is performed in a Service-level operational environment. If a conflict is identified between Service and higher-level guidance, the Contractor shall contact the TPOC for clarification. The Contractor shall develop, implement and maintain an OPSEC program to enhance protection of classified and unclassified critical information that will be used at the Contractor’s location during the performance of this task order in accordance with this PWS and DD-254 Contract Security Classification Specification. The Contractor shall be in compliance with security requirements imposed by documents generated in response to DoDI 5200.39, Critical Program Information (CPI) Protection within the Department of Defense, May 28, 2015 Incorporating Change 3, Effective October 1, 2020. The Contractor shall be in compliance with OPSEC measures if imposed by programs supported or by documents generated by NAB Coronado. The Contractor shall be in compliance with DFARS 252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting. OPSEC Awareness Education and Training shall be provided or coordinated through Government channels as a cost management process. The TPOC can assist with this training coordination option. All personnel supporting the contract shall receive initial OPSEC awareness training and Annual OPSEC Refresher training. If the contractor has existing OPSEC awareness education, training, and planning processes in place to protect corporate information, these should be applied pending Government acceptance rather than creating a new program. The contractor shall have an OPSEC plan for this task order. The OPSEC plan shall be provided with and approved by COMLCSRON ONE TPOC after contract award and shall be imposed on subcontractors as appropriate. Program protection measures shall be applied and approved by COMLCSRON ONE at all locations where Critical Information is developed, produced, analyzed, maintained, transported, stored, tested, or used in training. The Contractor shall request guidance from the TPOC on any specific predetermined OPSEC critical information associated with the task order or any associated OPSEC plans that directly relate to the information provided by the Government. OPSEC protective measures shall be applied as directed by the Government. While performing on a Government site, the Contractor shall comply with the OPSEC guidance or plans specific to that location or program supported.

1.6.7.5. SECRET Justification: Due to the sensitive nature of operational information, which will be required to successfully execute the tasking identified in this PWS in support of COMLCSRON ONE, the contractor supporting this role shall require access to SECRET as directed by the government. The access must include SECRET spaces, documentation, and data which are relevant to the development of the deliverables and which satisfy the technical requirements of this task.

1.6.7.6. Physical Security: The contractor shall be responsible for the safeguarding of all Government equipment, (classified/unclassified) information, and property provided for contractor use. At the close of each work period, government facilities, equipment, and materials shall be secured.

1.6.8. Contractor Personnel. Contractor employees’ conduct shall be IAW 5 CFR Parts 2600- 2641 and DOD-5500 7-R (Joint Ethics Regulations). If a Contract employee is removed from the job site or dismissed from the premises by the Government for violations, the Contractor is not relieved of the requirement to provide sufficient personnel to perform the services as required by this PWS. IAW 18 USC 1382, the authority of the Government to control and deny a Contractor employee entry to all or part of Government facilities is absolute. The individual concerned has no right to appeal. The Contractor shall minimize delays in starting work because of issues with having insufficient cleared personnel. Contractor personnel accessing Government networks in the performance of contract work require a favorably adjudicated personnel security investigation, whether or not an actual security clearance is required.

Personnel whose duties meet the criteria for an Automated Information System (AIS) Level 1 designation require a favorably adjudicated Tier 5 (T5) or Tier 5 Reinvestigation (T5R). This applies to all IA and Cybersecurity tasks. The T5 or T5R must be updated every 5 years. A favorably adjudicated Tier 3 (T3) or Tier 3 Reinvestigation (T3R) for civilian personnel is required for AIS Levels 2 and 3. Additionally, Telecommunications Directive (NTD) 02-06, Information Assurance (IA) Training Requirement, DoDD 8570.01-M, Information Assurance Training, Certification, and Workforce Management Policy, and DoDI 8500.2 E3.3.7 require that all authorized users of DoD Information Systems receive initial IA awareness orientation as a condition of access and thereafter must complete annual IA refresher awareness training to maintain an active user account. Access requests to DoD IT systems shall utilize OPNAV 5239/14 (REV 9/2011) SAAR-N form. SECNAVMAN 5239.2 IA Workforce Management Manual provides additional amplifying policy and requirements.

1.6.9. When performing the tasks specified in this PWS whether in public or otherwise, through e-mail, phone calls, or meeting attendance, Contractor personnel shall make clear to all individuals they deal with that they are Contractor employees and not DoD employees. When participating and introducing themselves during official events wherein DoD, non-DoD or foreign officials are present, Contractor personnel shall identify themselves as employees of the

Contractor. Contractor personnel must clearly identify who their employer is in a visible area (i.e. clothing, company shirt/logo, pin, company ID, etc.).

1.6.10. The Contractor shall satisfactorily accomplish the work assigned on this task order with minimal Government assistance and oversight. The Contractor shall eliminate or minimize the amount of instances where they were unable to satisfactorily perform work without Government direction; avoid causing formal complaints to be generated. The TPOC will be soliciting and documenting Government customer feedback during the performance of the task order that shall be used in part to support the Performance Requirements Summary (PRS) and Contractor Performance Assessment Reporting System (CPARS) evaluations.

1.6.11. All requests for approval of substitutions of key personnel hereunder must be in writing and include a detailed explanation of the circumstances necessitating the proposed substitutions.

The request must contain a resume for the proposed substitute and any other information requested by the contracting officer (KO) or TPOC. Contractor’s replacement shall meet or exceed the qualification for the position and the KO or TPOC must concur in writing with the change. The Contractor shall notify the KO, in writing, if one or more of the key personnel, for any reason, becomes or is expected to become unavailable to provide services under this task order for a continuous period exceeding thirty (30) work days, or is expected to devote substantially less effort to the work than indicated in the proposal or that was initially anticipated. Notification shall be made within one (1) business day of the Contractor becoming aware of the change of a Contractor employee identified as “key”. The notification shall provide, at a minimum, the circumstances necessitating the change in key personnel, and the effective date of the change.

1.6.12. Post Award Conference / Periodic Progress Meetings: The Contractor agrees to attend any post-award conference convened by the Contracting Activity or Contract Administration Office in accordance with Federal Acquisition Regulation (FAR) Subpart 42.5. The Contracting Officer, TPOC, and other Government personnel, as appropriate, may meet periodically with the Contractor to review the Contractor’s performance. At these meetings, the Contracting Officer will apprise the Contractor of how the Government views the Contractor’s performance, and the Contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the Government.

1.6.13. Technical Point of Contact (TPOC): A TPOC will be assigned in executing routine administration and monitoring duties. TPOCs do not have the authority to provide any technical direction or clarification directly to the Contractor.

1.6.14. The Contractor shall communicate on a daily basis with the Government technical points of contact and/or TPOC as appropriate on the efforts regarding any issues that have arisen that have the potential to affect agreed upon delivery or accomplishment dates. These communications will be via phone and email. Holidays and weekends shall normally be excluded from this requirement. The Contractor shall avoid adversely impacting the Government by failing to timely disclose and remedy anticipated risks to schedule and performance. Regarding routine communications between the Contractor and the Government, the Contractor shall take less than one (1) business day to acknowledge communications with the Government and define the timeline required to answer any questions or actions.

1.6.15. The Contractor shall successfully integrate and coordinate all activity needed to execute the requirement. The Contractor shall manage the timeliness, completeness, and quality of problem identification. Subcontractors shall be managed to avoid adversely impacting cost, schedule, and performance requirements. The Contractor shall provide corrective action plans, proposal submittals, timely identification of issues, and effective management of subcontractors.

The Contractor shall seek to ensure customer satisfaction and professional and ethical behavior of all Contractor personnel. The Contractor shall be responsible for any subcontract management necessary to integrate work performed on this requirement and shall be responsible and accountable for subcontractor performance on this requirement. The prime Contractor shall manage work distribution to ensure there are no Organizational Conflict of Interest (OCI) considerations. Contractors may add subcontractors to their team after notification to the TPOC.

Cross teaming may or may not be permitted.

1.6.16. The Contractor shall establish clear organizational lines of authority and responsibility to ensure effective management of the resources assigned to the requirement. The Contractor shall maintain continuity between support operations and the Contractor's corporate offices. The Contractor shall establish processes and assign appropriate resources to effectively manage its personnel. The Contractor shall respond to Government requests for contractual actions in a timely fashion. The Contractor shall have a single point of contact between the Government and Contractor personnel assigned to support contracts or task orders. The Contractor shall assign work effort and maintain proper and accurate time keeping records of personnel assigned. The Contractor shall ensure there is sufficient depth of personnel available to complete all the assigned and projected work to avoid negative impacts to cost, schedule and performance.

1.6.17. Proprietary Information: No data provided to, or developed by, the Contractor shall be used for any purpose other than the tasks assigned. All information (data files and hard copy) becomes the property of the government and the Contractor shall return them at the completion of the task. The government will not be required to pay royalties, recurring license fees, use tax or similar additional payments for any contractor-developed product or associated software presentation.

1.6.18. Transition Periods: The government anticipates allowing a 30-day ‘transition-in’ period between contract award and the start of full performance. This period is intended to allow the awardee time to address security and administrative issues for contractor employees assigned to the contract effort.

Should the Contractor not be selected as the future follow-on Contractor, the Contractor shall participate in a transition-out phase to orderly and efficiently transition to a successor. The transition-out phase shall be considered the last fifteen (30) days prior to the end of the contract period of performance. The transition-out phase shall consist of phase-in period for the successor and transition of all in-work documentation relevant to the efforts performed and analysis begun but not completed.

The Contractor shall submit a Transition Support Plan to the TPOC not later than 30 days after the plan is requested. The Transition Support Plan must include, at a minimum, a staffing plan which ensures all tasks will continue to be met throughout the transition out phase.

1.6.19. Privacy Act Compliance: The Contractor may be in contact with data and information subject to the Privacy Act of 1974 (Title 5 of the U.S. Code Section 552a). The Contractor shall ensure that its employees assigned to this effort understand and adhere to the requirements of the Privacy Act and to Department of Defense (DoD) and Department of the Navy (DoN) regulations that implement the Privacy Act. Department of Navy policy and procedures implementing the Privacy Act are detailed in DoD Directive 5400.11 (DoD Privacy Program), available on-line at http://www.dtic.mil/whs/directives/ and in SECNAVINST 5211.5E (Department of the Navy Privacy Act (PA) Program). The Contractor shall identify and safeguard data, information and reports accordingly. In addition, the Contractor shall ensure that Contractor employees assigned to the contract are trained on properly identifying and handling data and information subject to the Privacy Act prior to commencing work.

1.6.20. Information Assurance/Information Security: The Contractor shall protect DoD sensitive unclassified data regardless of the location or ownership of the transport media, including, but not limited to mobile computing devices and removable storage media, whether government furnished or Contractor owned/leased. The Contractor shall comply with all current IA and information security policies, procedures, and statutes applicable to DoD IT, including the DoN Chief Information Security Officer Handbook.

1.6.21. Key Personnel (see definition): Following is a list of Contractor personnel, to include Wage Determination Labor Category, required Clearance, and key/non-key designation:

Personnel Requirement and Estimated Workload

PWS

Task

Contract Labor Category Title

Wage Determination

Code/Title

Clearance Level

Key Personnel

Estimated

FTE

5.1 SECURITY

SPECIALIST II N/A SECRET N 1.0

1.6.22 Service Contract Reporting: Services Contract Reporting (SCR) requirements apply to this contract. The contractor shall report required SCR data fields using the SCR section of the System for Award Management (SAM) at following web address: https://sam.gov/SAM/.

Reporting inputs will be for the labor executed during the period of performance during each Government fiscal year (FY), which runs October 1 through September 30. While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year. Contractors may direct questions to the help desk, linked at https://sam.gov/SAM/.”

1.6.23 Contractor Unclassified Access to Federally Controlled Facilities, Sensitive Information, Information Technology (IT) Systems or Protected Health Information (Jan 2017)

Homeland Security Presidential Directive (HSPD)-12, requires government agencies to develop and implement Federal security standards for Federal employees and contractors. The Deputy Secretary of Defense Directive-Type Memorandum (DTM) 08-006 – “DoD Implementation of Homeland Security Presidential Directive – 12 (HSPD-12)” dated November 26, 2008 (or its subsequent DoD instruction) directs implementation of HSPD-12. This clause is in accordance with HSPD-12 and its implementing directives.

APPLICABILITY

This clause applies to contractor employees requiring physical access to any area of a federally controlled base, facility or activity and/or requiring access to a DoN or DoD computer/network/system to perform certain unclassified sensitive duties. This clause also applies to contractor employees who access Privacy Act and Protected Health Information, provide support associated with fiduciary duties, or perform duties that have been identified by DON as National Security Position, as advised by the command security manager. It is the responsibility of the responsible security officer of the command/facility where the work is performed to ensure compliance.

https://sam.gov/SAM/ https://sam.gov/SAM/

Each contractor employee providing services at a Navy Command under this contract is required to obtain a Department of Defense Common Access Card (DoD CAC). Additionally, depending on the level of computer/network access, the contract employee will require a successful investigation as detailed below.

ACCESS TO FEDERAL FACILITIES

Per HSPD-12 and implementing guidance, all contractor employees working at a federally controlled base, facility or activity under this clause will require a DoD CAC. When access to a base, facility or activity is required contractor employees shall in-process with the Navy Command’s Security Manager upon arrival to the Command and shall out-process prior to their departure at the completion of the individual’s performance under the contract.

ACCESS TO DOD IT SYSTEMS

In accordance with SECNAV M-5510.30, contractor employees who require access to DoN or DoD networks are categorized as IT-I, IT-II, or IT-III. The IT-II level, defined in detail in SECNAV M-5510.30, includes positions which require access to information protected under the Privacy Act, to include Protected Health Information (PHI). All contractor employees under this contract who require access to Privacy Act protected information are therefore categorized no lower than IT-II. IT Levels are determined by the requiring activity’s Command Information Assurance Manager.

Contractor employees requiring privileged or IT-I level access, (when specified by the terms of the contract) require a Single Scope Background Investigation (SSBI) or T5 or T5R equivalent investigation, which is a higher level investigation than the National Agency Check with Law and Credit (NACLC) described below. Due to the privileged system access, an investigation suitable for High Risk national security positions is required. Individuals who have access to system control, monitoring, or administration functions (e.g. system administrator, database administrator) require training and certification to Information Assurance Technical Level 1, and must be trained and certified on the Operating System or Computing Environment they are required to maintain.

Access to sensitive IT systems is contingent upon a favorably adjudicated background investigation. When access to IT systems is required for performance of the contractor employee’s duties, such employees shall in-process with the Navy Command’s Security Manager and Information Assurance Manager upon arrival to the Navy command and shall out-process prior to their departure at the completion of the individual’s performance under the contract. Completion and approval of a System Authorization Access Request Navy (SAAR-N) form is required for all individuals accessing Navy Information Technology resources. The decision to authorize access to a government IT system/network is inherently governmental. The contractor supervisor is not authorized to sign the SAAR-N; therefore, the government employee with knowledge of the system/network access required or the TPOC shall sign the SAAR-N as the “supervisor.”

The SAAR-N shall be forwarded to the Command’s Security Manager at least 30 days prior to the individual’s start date. Failure to provide the required documentation at least 30 days prior to the individual’s start date may result in delaying the individual’s start date.

When required to maintain access to required IT systems or networks, the contractor shall ensure that all employees requiring access complete annual Information Assurance (IA) training, and maintain a current requisite background investigation. The Contractor’s Security Representative shall contact the Command Security Manager for guidance when reinvestigations are required.

INTERIM ACCESS

The Command's Security Manager may authorize issuance of a DoD CAC and interim access to a DoN or DoD unclassified computer/network upon a favorable review of the investigative questionnaire and advance favorable fingerprint results. When the results of the investigation are received and a favorable determination is not made, the contractor employee working on the contract under interim access will be denied access to the computer network and this denial will not relieve the contractor of his/her responsibility to perform.

DENIAL OR TERMINATION OF ACCESS

The potential consequences of any requirement under this clause including denial or termination of physical or system access in no way relieves the contractor from the requirement to execute performance under the contract within the timeframes specified in the contract. Contractors shall plan ahead in processing their employees and subcontractor employees. The contractor shall insert this clause in all subcontracts when the subcontractor is permitted to have unclassified access to a federally controlled facility, federally-controlled information system/network and/or to government information, meaning information not authorized for public release.

CONTRACTOR’S SECURITY REPRESENTATIVE

The contractor shall designate an employee to serve as the Contractor’s Security Representative.

Within three work days after contract award, the contractor shall provide to the requiring activity’s Security Manager and the Contracting Officer, in writing, the name, title, address and phone number for the Contractor’s Security Representative. The Contractor’s Security Representative shall be the primary point of contact on any security matter. The Contractor’s Security Representative shall not be replaced or removed without prior notice to the Contracting Officer and Command Security Manager.

BACKGROUND INVESTIGATION REQUIREMENTS AND SECURITY APPROVAL

PROCESS FOR CONTRACTORS ASSIGNED TO NATIONAL SECURITY POSITIONS

OR PERFORMING SENSITIVE DUTIES

Navy security policy requires that all positions be given a sensitivity value based on level of risk factors to ensure appropriate protective measures are applied. Contractor employees under this contract are recognized as Non-Critical Sensitive [ADP/IT-II] positions when the contract scope of work require physical access to a federally controlled base, facility or activity and/or requiring access to a DoD computer/network, to perform unclassified sensitive duties. This designation is also applied to contractor employees who access Privacy Act and Protected Health Information (PHI), provide support associated with fiduciary duties, or perform duties that have been identified as National Security Positions. At a minimum, each contractor employee must be a US citizen and have a favorably completed NACLC or T3 or T3R equivalent investigation to obtain a favorable determination for assignment to a non-critical sensitive or IT-II position. The investigation consists of a standard NAC and a FBI fingerprint check plus law enforcement checks and credit check. Each contractor employee filling a non-critical sensitive or IT-II position is required to complete:

• SF-86 Questionnaire for National Security Positions (or equivalent OPM investigative product)

• Two FD-258 Applicant Fingerprint Cards (or an electronic fingerprint submission)

• Original Signed Release Statements

Failure to provide the required documentation at least 30 days prior to the individual’s start date shall result in delaying the individual’s start date. Background investigations shall be reinitiated as required to ensure investigations remain current (not older than 10 years) throughout the contract performance period. The Contractor’s Security Representative shall contact the Command Security Manager for guidance when reinvestigations are required.

Regardless of their duties or IT access requirements ALL contractor employees shall in-process with the Command’s Security Manager upon arrival to the command and shall out-process prior to their departure at the completion of the individual’s performance under the contract.

Employees requiring IT access shall also check-in and check-out with the Navy Command’s Information Assurance Manager. Completion and approval of a System Authorization Access Request Navy (SAAR-N) form is required for all individuals accessing Navy Information Technology resources. The SAAR-N shall be forwarded to the Navy Command’s Security Manager at least 30 days prior to the individual’s start date. Failure to provide the required documentation at least 30 days prior to the individual’s start date shall result in delaying the individual’s start date.

The contractor shall ensure that each contract employee requiring access to IT systems or networks complete annual Information Assurance (IA) training, and maintain a current requisite background investigation. Contractor employees shall accurately complete the required investigative forms prior to submission to the Command Security Manager. The Command’s Security Manager will review the submitted documentation for completeness prior to submitting it to the Office of Personnel Management (OPM); Potential suitability or security issues identified may render the contractor employee ineligible for the assignment. An unfavorable determination is final (subject to SF-86 appeal procedures) and such a determination does not relieve the contractor from meeting any contractual obligation under the contract. The Command’s Security Manager will forward the required forms to OPM for processing. Once the investigation is complete, the results will be forwarded by OPM to the DoD Central Adjudication Facility (CAF) for a determination.

If the contractor employee already possesses a current favorably adjudicated investigation, the contractor shall submit a Visit Authorization Request (VAR) via the Joint Personnel Adjudication System (JPAS) or a hard copy VAR directly from the contractor’s Security Representative. Although the contractor will take JPAS “Owning” role over the contractor employee, the Navy Command will take JPAS "Servicing" role over the contractor employee during the hiring process and for the duration of assignment under that contract. The contractor shall include the IT Position Category per SECNAV M-5510.30 for each employee designated on a VAR. The VAR requires annual renewal for the duration of the employee’s performance under the contract.

BACKGROUND INVESTIGATION REQUIREMENTS AND SECURITY APPROVAL

PROCESS FOR CONTRACTORS ASSIGNED TO OR PERFORMING NON-

SENSITIVE DUTIES

Contractor employee whose work is unclassified and non-sensitive (e.g., performing certain duties such as lawn maintenance, vendor services, etc.) and who require physical access to publicly accessible areas to perform those duties shall meet the following minimum requirements:

• Must be either a US citizen or a US permanent resident with a minimum of 3 years legal residency in the United States (as required by The Deputy Secretary of Defense DTM 08-006 or its subsequent DoD instruction) and

• Must have a favorably completed National Agency Check with Written Inquiries (NACI) or T1 investigation equivalent including a FBI fingerprint check prior to installation access.

To be considered for a favorable trustworthiness determination, the Contractor’s Security Representative must submit for all employees each of the following:

• SF-85 Questionnaire for Non-Sensitive Positions

• Two FD-258 Applicant Fingerprint Cards (or an electronic fingerprint submission)

• Original Signed Release Statements

The contractor shall ensure each individual employee has a current favorably completed National Agency Check with Written Inquiries (NACI) or T1 equivalent investigation, or ensure successful FBI fingerprint results have been gained and investigation has been processed with

OPM.

Failure to provide the required documentation at least 30 days prior to the individual’s start date may result in delaying the individual’s start date.

* Consult with your Command Security Manager and Information Assurance Manager for local policy when IT-III (non-sensitive) access is required for non-US citizens outside the United States.

PART 2

DEFINITIONS & ACRONYMS

2. DEFINITIONS AND ACRONYMS

2.1. DEFINITIONS:

2.1.1. CONTRACTOR. A supplier or vendor awarded a contract to provide specific supplies or services to the Government. The term used in this contract refers to the Prime.

2.1.2. CONTRACTING OFFICER (KO). A person with authority to enter into, administer, and/or terminate contracts, and make related determinations and findings (D&Fs) on behalf of the Government. Note: The KO is the only individual who can legally bind the Government.

2.1.3. TECHNICAL POINT OF CONTACT (TPOC), An employee of the U.S. Government who provides technical guidance on the Contract. This individual has the authority to provide technical direction to the Contractor as long as that direction is within the Scope of the Contract, does not constitute a change, and has no funding implications. This individual does NOT have the authority to change Terms and Conditions (T&Cs) of the contract.

2.1.4. DEFECTIVE SERVICE. A service output that does not meet the standard of performance associated with the Performance Work Statement (PWS).

2.1.5. DELIVERABLE. Anything that can be physically delivered, but may include non-manufactured things such as meeting minutes.

2.1.6. KEY PERSONNEL. Contractor personnel that are evaluated in a source selection process, and that may be required to be used in the performance of a contract by the Key Personnel listed in the PWS. When Key Personnel are used as an evaluation factor in best value procurement, an offer can be rejected if it does not have a firm commitment from the persons that are listed in the proposal.

2.1.7. PHYSICAL SECURITY. Actions that prevent the loss or damage of Government property.

2.1.8. QUALITY ASSURANCE. The Government procedures to verify that services performed by the Contractor are performed according to acceptable standards.

2.1.9. QUALITY ASSURANCE SURVEILLANCE PLAN (QASP). An organized, written document specifying the surveillance methodology to be utilized for surveillance of contractor performance.

2.1.10. QUALITY CONTROL. All necessary measures taken by the Contractor to ensure that the quality of an end product or service shall meet contract requirements.

2.1.11. SUBCONTRACTOR. One that enters into a contract with a Prime Contractor. The Government does not have privacy of contract with a subcontractor.

2.1.12. WORK DAY. The number of hours per day the Contractor provides services in accordance with the Contract.

2.1.13. WORK WEEK. Monday through Friday, unless otherwise specified.

2.2 ACRONYMS:

A&A Authorization and Accreditation

ACOS Assistant Chief of Staff

AIS Automated Information System

AO Action Officer

AQL Acceptable Quality Level

ASM Assistant Security Manager

AT/FP Anti-Terrorism/Littoral Combat Ship Squadron One Protection

ATG Afloat Training Group

ATO Authority to Operate

C4I Command, Control, Communications, Computers, and Intelligence

C5I Command, Control, Communications, Computers, Combat Systems, and Intelligence

CAC Common Access Card

CASREP Casualty Reports

CMP Centrally Managed Program

COMLCSRON

ONE

Commander, Littoral Combat Ship Squadron One

COMSEC Communication Security

CPARS Contractor Performance Assessment Reporting System

CPI Critical Program Information

CRY Cryptology

CS Cyber Security

CSS Command Security Specialist

CYBERDORM Cyber Department Organization and Regulations Manual

D&Fs Determinations And Findings

DISS Defense Information System for Security

DLA Defense Logistics Agency

EAC Estimate at Completion

EW Electronic Warfare

FAM LCS Ship Advisory Message

FAR Federal Acquisition Regulation

IA Information Assurance

IAVM Information Assurance Vulnerability Management

IL Intel Link

IS Information Security

ISSE Information System Security Engineer

IT Information Technology

ITPR Information Technology Purchase Request

IW Information Warfare

IWTG Information Warfare Training Group

JDISS Joint Deployable Intelligence Support System

JWICS Joint Worldwide Intelligence Communications System

KO Contracting Officer

LAN Local Area Network

MAC Move, Add, and Change

MSU Mandatory Security Update

NAO Navy Approving Official

NCACS Navy Access Control System

NTD Naval Telecommunications Directive

OCI Organizational Conflict of Interest

ODC Other Direct Charges

OPSEC Operations Security

PHI Protected Health Information

PII Privacy Impact Information

PMR Program Management Review

POA&M Plan of Actions and Milestones

POM Program Objective Memorandum

POR Program of Record

PR Periodic Review

PRS Performance Requirements Summary

PS Personnel Security

PWS Performance Work Statement

QASP Quality Assurance Surveillance Plan

QCP Quality Control Plan

RAR Risk Assessment Report

RMF Risk Management Framework

SITREP Situation Report

SM Security Manager

SME Subject Matter Expertise

SOP Standard Operating Procedure

SPAWAR Space and Naval Warfare Command

SPOT Synchronized Pre-Deployment Operational Tracker

SSBI Single Scope Background Investigation

T&Cs Terms and Conditions

T3 Tier 3 Investigation

T3R Tier 3 Reinvestigation

T5 Tier 5

T5R Tier 5 Reinvestigation

TAV Training Assist Visit

TPOC Technical Point of Contact

TYCOM Type Commander

PART 3

GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICES

3. GOVERNMENT FURNISHED ITEMS AND SERVICES:

3.1. Facilities: The Government will provide the necessary workspace for the contractor to be able to perform in accordance with the PWS. This includes desk space, telephone, NMCI access (to include MobiKey and/or Electronic Virtual Desktop (EVD), as applicable), and other items necessary to maintain an office environment such as scanners, fax machines, and printers.

Sponsorship to Government websites that are required to conduct official duties within the PWS (i.e. VRAM, SAILOR 2.1, etc.) shall be coordinated.

The contractor must provide their employees a company-issued computer. NMCI NIPR assets will not be issued as part of this contract. SIPR and SCI assets for those which the mission requirement deem access necessary shall be provided by the Government.

3.2. Utilities: All utilities in the facility will be available for the contractor’s use in performance of tasks outlined in this PWS.

3.3. Government Furnished Information:

3.3.1. Current SYSCOM Installation, Configuration, and Quick Reference Guides for applicable systems

3.3.2. Current COMLCSRON ONET Policies, Procedures, and References

PART 4

CONTRACTOR FURNISHED PROPERTY, EQUIPMENT, AND SERVICES

4.1 GOVERNMENT FURNISHED MATERIAL: The Contractor shall ensure that personnel accessing NMCI and other Navy information systems have the proper and current IA certification to perform IA functions IAW DoD 8570.01-M, Information Assurance Workforce Improvement Program. The Contractor shall identify and notify the government of system documentation necessary for the proper performance of the assigned tasks. The Contractor will be furnished with documentation, task working papers, project descriptions, program briefing material and other pertinent information, and other documentation or material required to support performance of this effort. Information will be provided to the Contractor within a reasonable time commensurate with schedules and target completion dates for assigned tasks and activities.

In performance of these services, the Contractor may be required to perform operations on, have access to, or handle data and information that is sensitive or proprietary. The Contractor shall be responsible for safeguarding any information and data provided to it, used or created in the performance of the assigned tasks. The Contractor shall prevent this information and data from being compromised, damaged, lost, or improperly disseminated. Unless authorized by the government, information and data shall not be released outside COMLCSRON ONE. The Contractor and any employee are prohibited from using US Government facilities, equipment and/or information for any purpose except as specifically described within this PWS.

4.2. Reporting Requirements:

4.2.1. The contractor shall provide a Contract Monthly Status Report.

4.2.2. Milestones. The monthly report shall include a brief summary of activity during the reporting period and a brief summary of expected activity during the next reporting period by project. Milestones/deliverables completed and next milestones/deliverables to be completed shall be included. In particular, program package status shall be reported for any packages that are in progress during the reporting period.

4.2.3. Problems/Deficiencies. The monthly report shall provide a brief explanation of current or anticipated problems/deficiencies and recommended solutions.

4.3. The contractor shall provide Meeting Minutes after each meeting attended.

4.4. The contractor shall provide a Contract Completion Memo and a Generic 1921 Form upon completion of the Contract.

4.5. The contractor shall provide a Plan of Actions and Milestones (POA&M), detailing efforts and timelines for completion of actions within this PWS.

4.6. OTHER DIRECT COSTS:

4.6.1. Local travel in the San Diego area may be required in support of the performance and deliverables for this tasking.

4.6.2. Training. Contractor personnel are expected to meet basic qualifications and certifications of each position. The task order will not provide funds for contractor personnel to meet those basic requirements and certifications. Additional training specific to program needs may be provided. Each training request must receive pre-approval through the TPOC prior to scheduling training. Specific training requirements cannot be identified at this time.

Contractor Personnel may be required to complete mandatory training in areas such as Sexual Abuse Prevention, Sexual Harassment, Equal Opportunity, Combatting Trafficking in Persons, Personal Privacy, Personal Identifiable Information, Counter Intelligence, Safety, and computer security.

Contractor personnel supporting this contract who are performing as security assistants to perform administrative security functions under the direction of the activity security manager without regard for job series or title or for rank, rate, or grade as long as they have the clearance required for the access needed to perform their assigned duties and tasks IAW DoDM 5200.01.

(a) Activity security management shall ensure that contractors who are involved in security administration and support duties are clearly identified in their capacities, roles, and functions, to ensure there is no possible confusion regarding which security personnel may exercise inherently governmental authorities and which may not.

(b) Inherently governmental activities and functions include those that require either the exercise of substantial discretion in applying U.S. Government authority, or value judgments when making decisions for the U.S. Government. Inherently governmental security functions include, but are not limited to:

(1) Approving and issuing security policies and procedures.

(2) Making original classification decisions, or rendering classification determinations regarding classified information that is improperly or incompletely marked. (Correcting improper markings when the appropriate classification is not in question is not considered rendering a classification determination.)

(3) Deciding to downgrade or declassify information. (Adhering to security markings on information or to guidance stated in an appropriate security classification or declassification guide is not considered a downgrading or declassification decision.)

(4) Deciding challenges to classification and any appeals.

(5) Making foreign disclosure decisions.

(6) Making public release decisions.

(7) Committing to expenditure of U.S. Government funds.

(8) Conducting investigations of, or determining fault in, security incidents involving U.S.

Government or other contractor personnel. (Contractors may conduct preliminary inquiries to determine if a security incident is a violation or an infraction.)

(9) Giving final approval or executing documents for filing in litigation if documents assert an official position of the Department of Defense, any DoD Component, or any other Federal agency.

(c) Support Personnel Requirements. Personnel filling non-Key Personnel billets must meet the minimum requirements for access to Government cybersecurity assets in accordance with DoDM

5200.01 and OPNAV 5239/14.

Contractor personnel who do not have proper and current certifications shall be denied access to DoD information systems for the purpose of performing cybersecurity functions.

4.6.3 Secret Facility Clearance: The contractor shall possess and maintain a SECRET facility clearance from the Defense Counterintelligence and Security Agency.