PWS Cybersecurity Support Services RFI 14NOV2022.pdf

1.3 PERIOD OF PERFORMANCE/PLACE OF PERFORMANCE

The period of performance of Task Order contract shall not exceed a 180 day period.

The primary places of performance will be at the PM IS&A PMO locations at Aberdeen Proving Ground, MD, and Fort Belvoir, VA. The contractor and its subcontractors will also be required to support Temporary Duty (TDY) assignments to, units, and contractor facilities, located in Continental United States (CONUS) and OCONUS support for NORTHCOM, SOUTHCOM, EUCOM, CENTCOM, AFRICOM, and PACOM, as required.

Due to the classified nature of work, all situational / ad-hoc teleworking must be approved by Contracting Officer Representative (COR) on a case-by-case basis. The government has the right cancel or change telework agreements at any time.

1.4 GOVERNMENT FURNISHED EQUIPMENT

The government provides Government Furnished Equipment (GFE) at the primary places of performance.

During national emergencies; the government may issue GFE to support the emergency; however, the government has the right to make determinations based on mission impact.

1.5 SECURITY REQUIREMENTS

1.5.1 Security Classification

Obtaining the requisite security clearances for all contractor personnel shall be solely the responsibility of the contractor. The contractor shall be required to have a TOP SECRET facility clearance requirement to access TS/SCI information at the Government facility. The contractor is not required to store and safeguard classified information at any levels at the contractor facility.

The contractor will require access to Communication Security (COMSEC) information, Sensitive Compartmented Information (SCI), Non-SCI information, NATO information, and For Official Use Only (FOUO) information. The contractor will also require access to the DCGS-A Security Classification Guide dated 8 December 2019. The contractor will require access to Joint Worldwide Intelligence Communication System (JWICS), National Security Agency Network (NSANet), Secret Internet Protocol Router Network (SIPRNet), and Non-secure Internet Protocol Router Network (NIPRNet) at government facilities, APG MD, Fort Belvoir VA, and other government facilities as directed by the Contracting Officer (KO) or COR, using government issued equipment. Contractors and suppliers requiring access to NSANet will require a Counter Intelligence (CI) polygraph.

All contractor personnel requiring a Computer Access Card (CAC) shall adhere to established DOD, U.S. Army and PEO IEW&S, PM DCGS-A policies and procedures for obtaining and use of the CAC. Performance of some activities defined in this PWS may require access to classified data and restricted areas and Government Automated Information Systems (AIS). It is anticipated that all contractor personnel providing the PWS support services will be required to possess TOP SECRET/Sensitive Compartmented Information (TS/SCI) clearances. It should be noted that personnel should not be nominated for, or be required to have TS/SCI clearances except as a bona-fide security requirement, and not solely to meet the anticipated contract TS/SCI staffing level. Security requirements will be identified on DD Form 254, Contract Security Classification Specification. The contractor will perform Automated Information System processing up to and including TS/SCI at the government facilities. The contractor requires to have access to U.S.

classified information outside the U.S. Puerto Rico, U.S. possessions and trust territories.

Contractor personnel performing Enterprise Information System (EIS) sensitive duties are subject to investigative and assignment requirements.

All contractors performing Automated Information System (AIS) work on this contract shall meet the requirements in Army Regulation (AR) 25-2 and AR 380-67 and affiliated regulations and shall, at a minimum, be cleared for access to TOP SECRET information.

Foreign supplier participation will be handled in accordance with AR 380-10 (Technology Transfer, Disclosure of Information & Contacts with Foreign Representatives); Communications- Electronics Command (CECOM) Regulation 380-16 (Industrial Security Program Requirements);

DTM 09-019 [Policy Guidance for Foreign Ownership, Control, or Influence (FOCI)]; National Disclosure Policy, and affiliated regulations and supplements. Any contractors/suppliers owned by Foreign Companies and that have a clearance issued by the Defense Security Service under a Special Security Agreement need to have a National Interest Determination (NID) approved if access is required to: Top Secret; COMSEC; Restricted Data; SCI and Special Access Programs.

NID requirements and justification must be sent through CECOM G2 to be forwarded to the approving agencies. Only after a NID approval is received will a FOCI contracting firm be authorized to work on the program.

Contractor personnel shall provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services or Security Office. Contractor workforce must comply with all personal identity verification requirements (FAR clause 52.204-9, Personal Identity Verification of Contractor Personnel) as directed by DOD, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

Before CAC issuance, the contractor personnel or subcontractor personnel requires, at a minimum, a favorably adjudicated National Agency Check with Inquiries (NACI) or an equivalent or higher investigation in accordance with Army Directive 2014-05. The contractor and subcontractor personnel will be issued a CAC only if duties involve one of the following: (1) Both physical access to a DoD facility and access, via logon, to DoD networks on-site or remotely; (2) Remote access, via logon, to a DoD network using DoD-approved remote access procedures; or (3) Physical access to multiple DoD facilities or multiple non-DoD federally controlled facilities on behalf of the DoD on a recurring basis for a period of 6 months or more. At the discretion of the sponsoring activity, an initial CAC may be issued based on a favorable review of the FBI fingerprint check and a successfully scheduled NACI at the Office of Personnel Management.

Government issued security badges and Common Access Cards (CAC) will be turned in at the completion of this contract.

1.5.2 Anti-Terrorism/Information Security/Operations Security/Cybersecurity/Information Technology

The following training will be provided by the government for contractor personnel assigned to the DCGS-A project.

1.5.2.1 Anti-Terrorism

a. Anti-Terrorism (AT) Level I Training. This provision/contract text is for contractor personnel with an area of performance within an Army controlled installation, facility or area. All contractor personnel, to include subcontractor personnel, requiring access to government installations, facilities and controlled access areas shall complete AT Level I awareness training within 30 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable. The contractor shall submit certificates of completion for each affected contractor and subcontractor personnel, to the COR or to the contracting officer, if a COR is not assigned, within 30 calendar days after completion of training by all contractor and subcontractor personnel.

AT level I awareness training is available at the following website: https://jko.jten.mil/.

b. AT Awareness Training for contractor personnel traveling overseas. This standard language text requires US based contractor personnel and associated subcontractor personnel to make available and to receive government provided Area of Responsibility (AOR) specific AT awareness training as directed by AR 525-13. Specific AOR training content is directed by the combatant commander with the unit Anti-Terrorism Officer (ATO) being the local point of contact. US based contractor personnel and associated subcontractor personnel will submit an Isolated Personnel Report (ISOPREP) prior to deployment, in accordance with AR 525-28, Personnel Recovery. The contractor is required to fill out the survey on NIPRNET at https://prmsglobal.prms.af.mil/prmsconv/Profile/Survey/start.aspx prior to deployment.

c. iWATCH Training. This standard language is for contractor and subcontractor personnel with an area of performance within an Army controlled installation, facility or area. The contractor and/or subcontractor shall brief all personnel on the local iWATCH program (training standards provided by the requiring activity Anti Terrorism Officer). This local developed training will be used to inform contract and subcontractor personnel of the types of behavior to watch for and instruct contract and subcontractor personnel to report suspicious activity to installation security. This training shall be completed within 30 calendar days of contract award and within 30 calendar days of new contractor or subcontractor personnel commencing performance with the results reported to the COR no later than 30 calendar days after contract award.

http://www.myarmyonesource.com/familyprogramsandservices/iwatchprogram/default.asp x

d. Threat Awareness and Reporting Program (TARP) training. Per AR 381-12 Threat Awareness and Reporting Program (TARP), all contractor and subcontractor personnel with a clearance must receive annual TARP training by a CI agent or other trainer.

Contractors will report threat-related incidents, behavioral indicators, and other matters of CI interest specified in chapter 4, to the facility security officer, the nearest military CI office, the Federal Bureau of Investigation, or the Defense Security Service.

e. Theatre Specific Training. Some OCONUS locations may require Theatre specific clearance. The contractor shall coordinate with the COR to obtain appropriate theatre clearances. All contractor personnel travelling OCONUS shall be required to take appropriate OCONUS security/terrorism training.

1.5.2.2 Information Security

a. Access and General Protection/Security Policy and Procedures. Contractor personnel shall comply with applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by government representative). The contractor shall also provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services or Security Office. Contractor workforce must comply with all personal identity verification requirements as directed by DoD, Headquarters Department of the Army (HQDA) and local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the government may require changes in contractor security matters or processes.

b. Handling or Access to Classified Information. Contractor shall comply with FAR 52.204-2, Security Requirements. This clause involves access to information classified “Confidential,” “Secret,” or “Top Secret” and requires contractors to comply with the Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (DoD 5220.22-M); any revisions to DoD 5220.22-M, notice of which has been furnished to the contractor.

c. Insider Threats. The contractor shall protect classified IT systems and information from insider threats with the required comprehensive managerial, operational, and technical security controls. The contractor shall address insider threats in accordance with policy and procedures in DODD 5205.16 and AR 381–12.

1.5.2.3 Operations Security

a. Operations Security (OPSEC) Standing Operating Procedure (SOP)/Plan. The contractor shall develop, or update, the OPSEC SOP/Plan within 90 calendar days of contract award, to be reviewed and approved by the responsible government OPSEC officer, per AR 530-1, Operations Security. This SOP/Plan will include the government’s critical information, why it needs to be protected, where it is located, who is responsible for it, and how to protect it. The OPSEC Plan/SOP shall be submitted IAW CDRL DI-MGMT-80934C, B001.

b. OPSEC Training. Per AR 530-1, Operations Security, new contractor and subcontractor personnel must complete Level I OPSEC training within 30 calendar days of their reporting for duty. All contractor personnel must complete annual OPSEC awareness training.

1.5.2.4 Cybersecurity/Information Technology

a. Contractor Personnel Access to government Information Systems. All contractor personnel with access to a government information system must be registered in the Army Training Certification Tracking System (ATCTS)) at https://atc.us.army.mil at commencement of services, and must successfully complete the DoD Cyber Awareness Challenge as a condition of access to DoD Information Technology (IT) and then annually thereafter.

b. Cybersecurity /Information Technology (IT) Training. All contractor personnel must complete the DoD Cyber awareness training before issuance of network access and annually thereafter. All contractor personnel performing cyberspace workforce functions must comply with DoD and Army certification and training requirements in DoDD 8140.01, DoD 8570.01-M, AR 25-2, and Defense Federal Acquisition Regulations (DFARS) 252.239.7001 must be appropriately certified prior to contractor personnel being engaged. The contractor shall ensure that cybersecurity and cyberspace IT personnel maintain required certifications.

c. Enclave specific training. Each network enclave requires specific training to gain initial access and generally annually thereafter. The contractor shall complete required network enclave specific training to maintain enclave required account(s).

1.5.3 Personnel Security

DFARS Contract Clauses shall be in full force and effect:

1. 252.225-7995 Contractor Personnel Performing In The United States Central Command Area Of Responsibility

2. 252.225-7043 Antiterrorism/Force Protection for Defense Contractors Outside the United States (JUN 2015)

These clauses can be located in their entirety at http://farsite.hill.af.mil/vfdfara.htm.

2.0 APPLICABLE DOCUMENTS

2.1 GOVERNMENT DOCUMENTS

The following documents are applicable to this PWS to the extent specified herein. In the event of a conflict between the text of this document and the references cited herein, the text of this document shall take precedence. Nothing in this document, however, supersedes applicable laws and regulations unless a specific exemption has been obtained.

Number Title Date

DoDM 5105.21 Sensitive Compartmented Information (SCI) Administrative Security Manual:

Administration of Personnel Security, Industrial Security, and Special Activities

October 19, 2012 (Incorporating Change 1, April 5, DODD 5205.16 The DoD Insider Threat Program September 30, 2014 (Incorporating Change 2, August 28, DoD 5220.22-M National Industrial Security Program Operating Manual

February 2006 (Incorporating Change 2, May 18, 2016)

DoDD 8140.01 Cyberspace Workforce Management August 11, 2015 (Change 1, July 31, 2017)

DoDI 8500.01 Cybersecurity 14 March 2014 (Change 1, Effective 7, 2019

DoDI 8510.01 Risk Management Framework (RMF) for DoD Information Technology (IT)

12 March 2014 (Change 2, July 28, 2017)

DoD 8570.01-M Information Assurance Workforce Improvement Program

December 19, 2005 (Incorporating Change 4, 11/10/2015)

Intelligence Community Directive (ICD) 503

Intelligence Community Information Technology Systems Risk Management, Certification and Accreditation

15 September 2008

NIST Special Publication 800-53A Rev 4

Assessing Security and Privacy Controls in Federal Information Systems and Organizations

December 2014 (Incorporating Updates, December 18, 2014)

CNSS Instruction No.

SECURITY CATEGORIZATION AND

CONTROL SELECTION FOR NATIONAL

SECURITY SYSTEMS

March 27, 2014

SEAD-3 Security Executive Agent Directive 3 12 June 2017

Table 2-1: Government Documents

Number Title Date

25-1 Army Information Technology 15 July 2019

25-2 Army Cybersecurity 4 April 2019

380-5 Army Information Security Program 22 October 2019

380-10 Foreign Disclosure and Contacts with Foreign Representatives 14 July 2015

380-67 Personnel Security Program 24 January 2014

380-27 Control of Compromising Emanations 22 July 2014

381–12 Threat Awareness and Reporting Program 1 June 2016

525-13 Antiterrorism 3 December 2019

525-15 Software Reprogramming for Cyber Electromagnetic Activities 19 February 2016

525-28 Personnel Recovery 5 March 2010

530-1 Operations Security 26 September 2014

715-9 Operational Contract Support Planning and Management 24 March 2017

AER 715-9 Army in European Region (AER) 715-9 Effective 20 July

CECOM 380-16 Communications-Electronics Command (CECOM) Regulation

Table 2-2: Army Regulations (AR) and Command Specific Guidance

3.0 REQUIREMENTS

The contractor shall provide DCGS-A Cybersecurity support and services for System Security Engineering, Assessment and Authorization (A&A), and Configuration Support. The contractor shall provide support in coordination with government personnel for the efforts described within the following sections. Cybersecurity support and services include, but are not limited to, analyze, access, integrate, document, enhance, improve, modernize, implement, test, monitor, sustain, and maintain DCGS-A cybersecurity posture and capabilities. It includes all cyber domain activities in order to ensure process efficiencies, standard compliance, and interoperability. Contractor support will be across all network enclaves that DCGS-A systems support: JWICS, NSANet, SIPRNet, other special or specific Coalition Networks as dictated by the specific Theater Operations requirements and NIPRNet.

3.1 DCGS-A Cybersecurity System Security Engineering

The contractor shall provide experienced Cybersecurity system security architecture, design, development, configuration, testing and documentation for the DCGS-A Family of System’s (FoS). The DCGS-A FoS consists of current fielded and deployed systems, as well as, Capability Drops (CD) and Cross Domain Solutions (CDS).

The contractor shall perform engineering analysis, design, implementation, development of interoperability artifacts, documentation updates and evaluation of system designs and implementations that are consistent and compliant with the DoD and Army policies, requirements, and directives. The contract shall develop and recommend action plans to address system security issues, audit readiness, and compliance requirements and issues.

The contractor shall analyze and evaluate the DCGS-A baseline for compliance with security requirements, such as, the National Institute of Standards & Technology (NIST) special publication guidelines (800 Series, FIPS., etc.), Defense Information Systems Agency (DISA) Security Technical Implementation Guidance (STIG), DODI 8500.01, DODI 8510.01, DoDI 8540.01, CNSSI policies for specific network enclaves, CJCSI 6211.02d, DA Pam 25–2–1, and NSA Raise-the-Bar (RTB) requirements, and Security Requirements Guides (SRG).

The contractor shall provide experienced security engineering support for the current and future Cross Domain Solution (CDS) systems, for both enterprise and tactical employment, within the DCGS-A FoS overall security posture. The contractor shall be knowable of the National Cross Domain Strategy and Management Office (NCDSMO) current and future plans, approved products baselines and proactively identify gaps and potential mitigations in the DCGS-A employment of

CDS. The contractor shall develop engineering solutions to support the DCGS-A CDS which are Top Secret and Below Interoperability (TSABI) and Secret and Below Interoperability (SABI).

The contracts shall assist with the development and definition of data types and concept of operations that are supported by the respective DCGS-A systems, to include CDS, and operational architectures. Per DAMI-IM Assessment and Authorization (A&A) Guidance for Army Non- Cryptologic Sensitive Compartmented Information (SCI) Systems policy, all cross domain solution systems must be TSABI accredited, Raise the Bar Compliant and listed in the National Cross Domain Solution Management Office (NCDSMO) baseline list prior to DAMI-IM SCA assessment.The contractor shall assist with the development and/or review of Body of Evidence (BoE) artifacts to support A&A efforts. BoE artifacts could include the System Security Plan (SSP), Security Controls Traceability Matrix (SCTM), Test Plans, Self-Assessment Worksheet, Risk Assessment Questionnaire (RAQ), Risk Assessment Report (RAR), Plan of Action and Milestones (POA&M) and any additional items pertinent to the control, configuration, and security of the system.

The contract shall perform the daily execution of technical cybersecurity operations for the various network domain environments and production baselines in order to ensure operational readiness.

This shall include, but not limited to, assessing cybersecurity impacts for proposed changes;

assessing conformance and compliance with cybersecurity requirements for the new release capabilities; and ensuring the infrastructure will support all DCGS-A cybersecurity implementations.

The contractor shall collaborate with the DCGS-A engineering teams for design and implementation to ensure that DCGS-A FoS comply with the Federal Information Security Management Act (FISMA), IC IE Cybersecurity Performance Evaluation Model (CPEM), DoD, IC, and Army policies for operational readiness and reporting.

The contractor shall support the DCGS-A Systems engineering team to remediate existing issues and/or to develop compensating controls that minimize the impact, likelihood, and/or risk.

3.2 DCGS-A Cybersecurity Assessment and Authorization (A&A)

The contractor shall provide experienced cybersecurity personnel to support Risk Management Framework (RMF) requirements defined by the Intelligence Community (IC), DoD and/or Army for the DCGS-A FoS and associated network enclaves. The DCGS-A FoS consists of current fielded and deployed systems, as well as, Capability Drops (CD) and Cross Domain Solutions

(CDS).

The contractor shall perform tasks in coordination with government personnel to provide support and execution activities for the RMF process to include categorize system; select security controls;

implement security controls; assess security controls; authorize system; and monitor security controls in accordance with ICD 503, DODI 8500.01, DODI 8510.01, CNSSI 1253, NIST Special Publications (800 Series), AR 25-2, DA PAM 25-2-14, applicable overlays and associated network specific authorization requirements. Per DAMI-IM A&A Guidance for Army Non-Cryptologic SCI Systems policy, all cross domain solution systems must be TSABI accredited, Raise the Bar Compliant and listed in the National Cross Domain Solution Management Office (NCDSMO) baseline list prior to DAMI-IM SCA assessment.

The contractor shall follow the established RMF A&A for each network enclaves’ Authorizing Official(s) defined process and Tactics, Techniques and Procedures (TTPs) to successfully obtain

Authority To Operate (ATO) recommendations for the DCGS-A FoS baselines. This includes registration of systems in eMASS or XACTA.

The contractor shall provide cybersecurity support services and solutions necessary to analyze, assess, evaluate, integrate, improve, implement, document, test, sustain, and monitor the DCGS-A cybersecurity posture and compliance required to meet A&A requirements and network enclaves, as applicable. The contractor shall prepare and/or review the required body of evidence to document the system authorization boundary, security design, applicable security controls or supporting artifacts, and conduct security control assessments, and security test and evaluation required by the respective network authorities and assessment and authorization processes.

The contractor shall perform all necessary network enclave activities to verify and validate that the DCGS-A baselines are in compliance with the respective network enclave and AO mandated standards, and authorization to connect requirements and issued ATO(s). The contractor shall perform or assist with the periodic vulnerability scanning, secure configuration assessments, vulnerability analysis, and penetration testing on DCGS-A FoS baselines.

The contractor shall assist with the development and/or review of Body of Evidence (BoE) artifacts to support A&A efforts. BoE artifacts could include the System Security Plan (SSP), Security Controls Traceability Matrix (SCTM), SCIF and TEMPEST letters, Appointment Orders, Self-Assessment Worksheet, Risk Assessment Questionnaire (RAQ), Risk Assessment Report (RAR), Plan of Action and Milestones (POA&M) and any additional items pertinent to the control, configuration, and security of the system.

The contractor shall prepare and maintain the risks, mitigations, and plan resolutions in the Plan of Action and Milestones (POA&M) as required by the individual network domain Authorizing Official (AO).

The contractor shall support or perform the security assessments of the DCGS-A systems in the fielded environment to assess the security posture of the systems and the technical compliance with the requirements and validating security relevant configurations of the systems. The contractor shall document results in appropriate reports. The Contractor shall provide on-site authorization testing support at CONUS and OCONUS locations, as directed by the Government.

The contractor shall collaborate with the DCGS-A engineering teams for design and implementation to ensure that DCGS-A FoS comply with the Federal Information Security Management Act (FISMA), IC IE Cybersecurity Performance Evaluation Model (CPEM), DoD, IC, and Army policies for operational readiness and reporting.

3.3 DCGS-A Cybersecurity Configuration Support

The contractor shall provide support to configuring DCGS-A systems on network enclaves in accordance with authorized baseline configuration. The contractor shall configure and update systems as appropriate to ensure conformance to the approved baseline(s).

4.0 CONTRACT MANAGEMENT

4.1.1 Information Assurance and Cybersecurity Certifications

The contractor shall ensure all personnel performing cyberspace workforce functions must comply with DoD and Army certification and training requirements in DoDD 8140.01, DoD 8570.01-M, AR 25-2, and Defense Federal Acquisition Regulations (DFARS)

252.239.7001. The contractor personnel must be appropriately certified prior to contractor personnel being engaged. The contractor shall ensure that personnel maintain required DoD 8570.01M certifications.

4.1.2 Conflict of Interest (OCI) Plan

The contractor shall perform the contract efforts in the roles of Systems Engineering and Technical Assistance (SETA) in support the DCGS-A PMO. The contractor and subcontractor personnel may receive, or have access to program information and program documents, or perform evaluation services which may create a current or subsequent Organizational Conflict of Interest (OCI) as defined in Federal Acquisition Regulation (FAR) Subpart 9.5. The contractor shall manage the assigned personnel to ensure that there are no OCI issues. The contractor shall perform an OCI self-assessment using the contractor established control processes to identify and analyze the extent to which program performance by the contractor personnel supporting the PMO would give rise to an actual or potential OCI. The Contractor shall notify the PMO immediately whenever it becomes aware that such access or participation may result in any actual or potential OCI.

The contractor shall submit an OCI mitigation plan IAW CDRL DI-MISC-80048, D001, to the government 30 days after contract award to specify the contractor mitigation measures for any OCI situations. Contractor format is acceptable. The PMO will determine whether the contractor mitigation plan is satisfactory or not. The PMO may affect other remedy measures as deemed necessary for the contract.

4.1.3 Quality Surveillance

The contractor shall provide a Quality Assurance Surveillance Plan (QASP) IAW CDRL DI-QCIC-81794, A001, to the government 30 days after contract award, to outline how the contractor shall monitor, evaluate, track and report the contractor’s and the sub-contractors’ performance throughout this support service contract. In addition, the contractor shall also address the support personnel qualifications and selection criteria and individual training and certification requirements for the various contract task requirements. The contractor shall conduct a performance review via an In-Process Review (IPR) with the Contracting Officer, Contractor Officer Representative (COR) and PM DCGS-A to discuss the contract performance, resolve issues, discuss customer feedback, both negative and positive, and feedback to all parties.

4.1.4 Travel and Other Direct Costs

4.1.4.1 Travel

The contractor and its subcontractors shall be required to support CONUS and OCONUS travel during the performance of this contract for performance, attend meetings and support mission requirements, as directed by the government.

The contractor and its subcontractors shall submit Travel Authorization Request (TAR) to the COR for approval at least fifteen (15) days prior to CONUS travel and forty-five (45) days for OCONUS travel. TAR must include travel details and estimated costs to include backup data to the source of the estimated costs. COR or KO must approve travel prior to commencement of travel.

Costs for transportation may be based upon mileage rates, actual costs incurred, or a combination thereof, provided the method used results in a reasonable charge. Reimbursement for the cost of lodging and incidental expenses will be actual costs incurred and shall be considered reasonable and allowable provided that the actual cost does not exceed the amounts allowed in accordance with the law and Joint Travel Regulation (JTR). Maximum use is to be made of the lowest available customary standard coach or equivalent airfare accommodations available during normal business hours. There will be no reimbursement for local travel in and around a contractor or subcontractor sites or facilities. No profit shall be allowed on travel costs.

All travel shall be in accordance with applicable command policies as well as the Joint Travel Regulation (JTR) and AR 715-9. The JTR, while not wholly applicable to contractors, shall provide the basis for the determination as to whether travel costs are reasonable. This information can be found at the JTR web site: https://www.defensetravel.dod.mil/site/perdiem.cfm.

The contractor shall submit a trip report within five (5) working days of the conclusion of a trip to the COR IAW DI-ADMN-81308A, A001.

OCONUS locations, may require contract personnel to adhere to theatre clearance(s), country clearance(s), and OCONUS required trainings.

During wartime this may require travel within hostile war zones for providing systems support.

The government shall authorize all mission related travel in advance.

4.1.4.2 Other Direct Costs

In the course of performance pursuant to this contract, the Contractor shall be required to purchase incidental items at the request of the Government. The Contractor shall acquire necessary items of other direct costs associated with the services on the contract with written, advanced, approval of the COR.

4.1.5 TRAVEL ARRANGEMENTS

The number of trips and types of personnel required for trips shall be limited to the minimum required to accomplish work requirements. The contractor and its subcontractors will be responsible for arranging all contractor personnel travel requirements at the lowest cost, considering the mode of transportation with mission requirements.

Air travel will be accomplished on regularly scheduled commercial flights in the most economical manner consistent with the successful accomplishment of the mission.

4.1.5.1 Travel Special Requirements

IAW DoDM 5105.21-V3, para 17 a.(1) and AR 380-67 (Personnel Security), personnel holding a security clearance (Military, Civilian, Contractor) are required to report foreign travel, for personal or official, which must be properly tracked and documented in JPAS/DISS by their respective Special Security Office(SSO)/AT officer. Please note that failure to report all foreign travel, regardless if it’s for personal or official, can be reported as a security incident which could affect your security clearance.

All OCONUS travel shall be approved forty-five (45) days in advance by the COR. Some OCONUS locations may require Theatre specific clearance. The contractor shall coordinate with the COR to obtain appropriate theatre clearances. All contractor personnel travelling OCONUS shall be required to take appropriate OCONUS security/terrorism training.

OCONUS Travel shall be submitted into the Synchronized Pre-deployment and Operational Tracker (SPOT) application https://spot.dmdc.mil/ in accordance with DoDI 3020.41, Contractor

Personnel Authorized to Accompany the U.S. Armed Forces and OSD Memo 25 January 2007.

Additionally, the contractor shall ensure that all personnel have a current DD Form 93, Record of Emergency Data Card, on file with both the contractor and the COR or KO.

In addition, the contractor personnel shall enroll in the Department of State’s Smart Traveler Program - https://step.state.gov/step/.

4.1.5.1.1 GERMANY - Technical Expert Status Accreditation

Under this task order travel to Germany for 90 days or less will be required to utilize TESA/ASSA-TDY and FAX-BACK processes. Contractor travel in excess of 90 days requires the utilization of Technical Expert (TE) personnel and/or Troop Care (TC). In accordance with Army in European Region (AER) 715-9. For Technical Expert Status Accreditation, or Troop Care Positions, the DoD will coordinate approvals with the applicable OCONUS authorities. For travel to Germany for 90 days or less, the contractor shall ensure all contract personnel have their TESA applications and resumes approved by the DoD Contractor Personnel Office Program Office before deploying. Accredited TE’s will be authorized to use government facilities in accordance with the Status of Forces Agreement (SOFA) policies.

Authorized logistics support items include: Commissary, to include rationed items; Army and Air Force Exchange Service (AAFES) to include rationed items and purchase of Policy on line (POL);

military postal service; children are authorized to attend DoD overseas schools; local government transportation for official government business (non-tactical); emergency medical/dental services;

local Morale Welfare and Recreation (MWR) services; Class VI, to include rationed items;

military banking facilities; Customs Exception; Mortuary Service; legal assistance; credit unions;

and North Atlantic Treaty Organization (NATO) Status of Forces Agreement Letter and/or Stamp.

The contractor shall promptly notify the Contracting Officer Representative (COR) if a TESA if contractor personnel once accredited is no longer performing duties requiring accreditation. Short term TDY may be performed in accordance with Army Regulation: AER715-9 (effective 20 July 2011).

4.1.5.1.2 INVITED CONTRACTOR OR TECHNICAL REPRESENTATIVE STATUS

UNDER U.S. - REPUBLIC OF KOREA (ROK)

The Status of Forces Agreement (SOFA) between the United States and Korea governs the rights and obligations of the United States armed forces in Korea. Only those individual contractors who are United States nationals; not ordinarily a resident in Korea; present in Korea at the invitation of and solely for the purpose of executing contracts with the United States for the benefit of the United States armed forces; and, not present in Korea under any other SOFA status may be issued a Letter of Identification by the Contracting Officer (KO). If required a Letter of Identification shall be issued by the Contracting Officer, and is provided for contractor personnel status identification when entering or departing Korea. The Contracting Officer is the only individual authorized to issue a Letter of Identification. The contractor and subcontractor personnel shall comply with the ROK SOFA as implemented by United States Forces Korea (USFK) Regulation 700-19, which can be found under the publications tab on the US Forces Korea homepage http://www.usfk.mil. The contractor shall submit 700-19 forms 60-days in advance of required travel.

4.1.5.1.3 Personal Foreign Travel Reporting

In accordance with Security Executive Agent Directive 3, DoDM 5105.21, Army Regulation (AR) 381-12, and AR 380-67, requires all personnel holding a security clearance to report all personal foreign travel to their security office in advance of the travel. Contractor Facility Security Officer (FSO) is required to submit written notification and copy of traveler’s full itinerary for the trip, including flight numbers and arrival/departure times, the country (or countries) to be visited and the dates of travelto the Government COR forty-five (45) days in advance of required travel date.

Contractor FSO is responsible maintaining reporting records in accordance to associated policies.

4.2 Project Management

The contractor shall provide the necessary cost control, cost reporting, technical status reporting, program reviews, and other ancillary support such as quality assurance and data management to support all of the efforts set forth within this contract/task contract. The contractor shall perform project management activities utilizing industry best project management practices while conducting the services contained within this PWS. The contractor shall provide accurate accounting of obligated funds received by the contractor as defined in the CDRL. Required data item deliverables are as specified in the CDRLs. The Progress, Status and Management Reports shall be submitted IAW CDRL DI-MGMT-80227, B002. Contract Invoicing and Payment Report shall be submitted IAW DI-MGMT-81651, B003. Performance and Cost Reports shall be provided

IAW CDRL DI-FNCL-80912, C001.

4.2.1 Contractor Personnel

In discharging its responsibility under the contract, the contractor shall only use fully-trained, experienced, appropriately-certified, and technically proficient personnel consistent with DoDD 8570.01, DoD 8570.01-M, DODI 8510.01, and AR 25-2.

In accordance with DFARS 252.239-7001, Information Assurance Contractor Training and Certification, the contractor shall ensure that personnel accessing information systems have the proper and current information assurance certification to perform information assurance functions in accordance with DoD 8570.01-M, Information Assurance Workforce Improvement Program.

The Contractor shall meet the applicable IA certification requirements, including—

• (1) DoD-approved information assurance workforce certifications appropriate for each category and level as listed in the current version of DoD 8570.01–M; and

• (2) Appropriate operating system certification for information assurance technical positions as required by DoD 8570.01–M.

Upon request by the Government, the Contractor shall provide documentation supporting the information assurance certification status of personnel performing information assurance functions.

Contractor personnel who do not have proper and current certifications shall be denied access to DoD information systems for the purpose of performing information assurance functions.

The Army’s implementation of the above requirements for IA Training, Certification, and Workforce Management are found in AR 25-2, Army Cybersecurity, and the associated Army DA Pam 25-2-6 Cybersecurity Training and Certification Program.

4.2.2 Work Hours

The contractor shall provide personnel to support the PWS requirements. Contractor personnel are expected to work during “normal duty” hours, 8 hours a day, 40 hours a week Monday through Friday, with core hours 0900 - 1500. Overtime, defined as hours worked that are in excess of 40 hours per week, is not authorized unless prior written approval authorization is obtained from the COR or KO.

In order to meet scheduling constraints contractor personnel periodically may be required to work other than a ”normal duty”. During training exercises or deployments the contractor work hours shall normally be set at 7 days a week, 12 hours a day, 84 hours per work week, or as otherwise directed by the government. Contractor personnel shall not be compensated with Field Differential pay when supporting 24 hour exercises and operations. The COR may modify the work schedule to ensure the government's ability to continue to execute its mission. Any modification to the contractor's work schedule shall be approved by the Contracting Officer or COR as authorized by the KO, in writing and sufficient notice given to the contractor, normally a minimum of two weeks prior to the new work schedule, for the contractor to have ample time to make changes.

The contractor shall submit extended hours for projected fourteen (14) days in advance of expended work. An Extended Work Week (EWW) request must be submitted and approval by the Contracting Officer or COR as authorized by the KO.

Should situations arise in which the above specified advance notice cannot be met, government support of contractor extended hours or overtime shall be handled on a case-by-case basis.

4.2.3 Training of Personnel

The training of contractor personnel shall be accomplished by the contractor at his expense, except when the KO gives prior approval for training to meet the requirements that are specific to a particular task. Training at government expense shall not be authorized solely for the purpose of keeping contractor personnel abreast of the state-of-the-art. Upon request by the government, the contractor shall provide documentation supporting the applicable certification status of personnel performing support functions.

4.2.4 Relocation Costs

Costs to physically relocate contractor’s personnel or subcontractor personnel shall be accomplished at the expense of the contractor, except when the government has given advance prior approval for any such costs to be charged to the government.

4.2.5 Contract Cost Containment

In executing the tasks contained within this PWS, the contractor shall be required to utilize best practices and principles of cost management, examples of which include Cost as an Independent Variable (CAIV). In addition, the contractor is encouraged to offer/propose innovative approaches to reduce cost and introduce efficiencies consistent with acceptable quality standards.

4.2.6 Formal Reviews

4.2.6.1 Post Award Orientation Meeting

A post award orientation meeting shall be held at the contractor’s facility nearest APG, Maryland within fifteen (15) working days after award of contract or as directed by the government. This provision shall in no way constitute grounds for excusable delay by the contractor in performance under any provisions of the contract.

4.2.6.2 Management and Cost Reviews

In-Process Review shall be held annually or as necessary at the government's request to inform the government of problems, schedule, and incurred costs on this contract. These reviews shall be held at the government facility or as directed by the government. The government also reserves the right to call for informal management and cost status reviews as needed. These formal and informal reviews do not relieve the contractor from its ongoing responsibility to promptly inform the government of problematic issues that affect or may affect performance, cost or schedule.

4.2.7 Personnel Qualifications

The contractor shall staff with experienced engineers or subject matter experts in meeting the support requirements for Cybersecurity and cyberspace IT (system security engineering) workforce. The cybersecurity support qualification shall reflect a minimum of five (5) years of working experience directly related to IC or DoD Cybersecurity Assessment and Authorization, cybersecurity engineering, or configuration support activities. The cybersecurity experience shall include awareness and understanding with applicable IC, DoD and Army Cybersecurity Polices and Regulations, and RMF process to include the provisions that include but are not limited to ICD 503, DoDI 8510.01, CNSS Instruction No. 1253, NIST 800-53, and able to execute the RMF steps.

As defined in DoDD 8140.01, cyberspace IT workforce. Personnel who design, build, configure, operate, and maintain IT, networks, and capabilities. This includes actions to prioritize portfolio investments; architect, engineer, acquire, implement, evaluate, and dispose of IT as well as information resource management; and the management, storage, transmission, and display of data and information. Contractor personnel performing these functions shall meet DoD 8570.01M requirements for IASAE II or IASAE III or IAT III.

As defined in DoDD 8140.01, Cybersecurity workforce include personnel who secure, defend, and preserve data, networks, net-centric capabilities, and other designated systems by ensuring appropriate security controls and measures are in place, and taking internal defense actions. This includes access to system controls, monitoring, administration, and integration of cybersecurity into all aspects of engineering and acquisition of cyberspace capabilities. Contractor personnel performing these functions shall meet DoD 8570-01M requirements for IAM II, IAM III, IAT II or IAT III. In accordance with DoD 8570.01M section C3.2.4.8.3, all contractor personnel performing functions in multiple categories (i.e, IAM and IAT) or specialties must hold certifications appropriate to the functions performed in each category or specialty. In addition to the IA baseline certification requirement for their level, IATs with privileged access must obtain appropriate Computing Environment (CE) certifications for the operating system(s) and/or security related tools/devices they support as required by their employing organization.

Certification waiver shall be reviewed and approved by the government on a case by case basis.

5.0 DELIVERABLES

The contractor shall submit all deliverables IAW the provisions of this PWS or as otherwise designated by the government. Unless otherwise designated, all deliverable documents shall be delivered to the government via electronic means as a Microsoft Office or Adobe Portable

Document (PDF) format. Documents shall be prepared IAW appropriate government authority per CDRLs, or in a government approved contractor format.

See Attachment A, Contract Data Requirements List (CDRL).

Access to Defense and Federal specifications and standards are available in the official DoD repository: https://assist.dla.mil

5.1 Delivery Address

The address for all Monthly Status Reports, Briefing Materials, Meeting Minutes, Trip Reports, and Product Deliverables unless otherwise specified is:

Mr. Rene Villarreal

ATTN: SFAE-IEW-ISA

6580 Surveillance Loop, Bldg 6006 Aberdeen Proving Ground, MD 21005 443-861-2386 Rene.a.villarreal.civ@mail.mil

5.2 CONTRACTOR MANPOWER REPORTING

The Office of the Assistant Secretary of the Army (Manpower & Reserve Affairs) operates and maintains a secure Army data collection site where the contractor will report ALL contractor manpower (including supplier manpower) required for performance of this contract. The contractor is required to completely fill in all the information in the format using the following web address: https://cmra.army.mil. Contractors may direct questions to the Contractor Manpower Reporting (CMR) Help Desk at 703-377-6199, or contractormanpower@hqda.army.mil.

The required information includes:

(1) Contracting Office, Contracting Officer, Contracting Officer’s Technical Representative;

(2) Contract number, including task and delivery order number;

(3) Beginning and ending dates covered by reporting period;

(4) Contractor name, address, phone number, e-mail address, identity of contractor employee entering data;

(5) Estimated direct labor hours (including sub-contractors);

(6) Estimated direct labor dollars paid this reporting period (including sub-contractors);

(7) Total payments (including sub-contractors);

(8) Predominant Federal Service Code (FSC) reflecting services provided by contractor (and separate predominant FSC for each sub-contractor if different);

(9) Estimated data collection cost;

(10) Organizational title associated with the Unit Identification Code (UIC) for the Army Requiring Activity (the Army Requiring Activity is responsible for providing the contractor with its UIC for the purposes of reporting this information);

(11) Locations where contractor and sub-contractors perform the work (specified by zip code in the United States and nearest city, country, when in an overseas location, using standardized nomenclature provided on website);

(12) Presence of deployment or contingency contract language; and

(13) Number of contractor and subcontractor employees deployed in theater this reporting period (by country).

As part of its submission, the contractor will also provide the estimated total cost (if any) incurred to comply with this reporting requirement. Reporting period will be the period of performance not to exceed 12 months ending 30 September of each government fiscal year and must be reported by 31 October of each calendar year. Contractors may use a direct XML data transfer to the database server or fill in the fields on the website. The XML direct transfer is a format for transferring files from a contractor’s systems to the secure web site without the need for separate data entries for each required data element at the web site.