PWS - DoD Cyber Awareness Challenge Training_09092025.docx

PERFORMANCE WORK STATEMENT (PWS)

Contract Number:

Task Order Number:

Contractor Name

1. Contracting Officer’s Representative (COR)

a. Primary COR. See DITCO Additional Text G1 - Points of Contact

b. Alternate COR. See DITCO Additional Text G1 - Points of Contact

c. Property Administrator See DITCO Additional Text G1 - Points of Contact

2. Contract or Task Order Title: Department of Defense (DoD) Cyber Awareness Challenge Training.

3. Background: This contract will support the DoD Cyber Awareness Challenge Training (DCT) program with the development of the DoD CIO Cyber Awareness Challenge training. The training in the DCT program described in this PWS was previously being conducted under contract # GS35F007BA/HC1028-20-F-0730. This contract ended on July 14, 2025. DISA is mandated to support the development and maintenance of the Cyber Awareness Challenge training in accordance with DoDI8500.01.

4. Objectives: This contract will provide labor to develop to update the DoD Cyber Awareness Challenge annual mandatory training.

5. Scope: This contract will provide labor for the DCT program. Contract labor for the DCT program shall provide the following functions: Update/redesign the DoD CIO Cyber Awareness Challenge training and deliver training in all the downloadable and SCORM formats for an LMS.

The Government may require surge support during the base or any option period. Surge modifications will be within the scope of the contract and provide increased support for the defined task areas of this PWS. Surge support over the life of the contract will not exceed 50% of the contractor’s total proposed cost/price for the base and all option periods, excluding any six-month extension of services pursuant to FAR 52.217-8.

6. Performance Requirements

6.1 Task 1 - Program and Task Order Management

6.1.1 Subtask 1 - Integration Management Control Planning The contractor shall provide the technical and functional activities at the task order level needed for program management. The contractor shall include productivity and management methods such as quality assurance, progress/status reporting, and program reviews at the task order/subtask level. The contractor shall provide a monthly status report (MSR) monitoring the quality assurance, progress/status reporting, status of Government furnished property, and program reviews applied to the task order (as appropriate to the specific nature of the PWS). The contractor shall provide a monthly Contractor Strength Report which will include a roster of personnel supporting the contract, employees that are issued Common Access Cards, percent of FTE support for the task order, employees designated on or off site, labor category from proposal, and position. The contractor shall provide a monthly Expenditure Report which will include a roster of personnel supporting the contract. The contractor will notify the Contracting Officer Representative (COR) within 48 hours, when the contractor believes there is an issue that impacts performance, schedule, or cost.

Deliverables:

*Standard Distribution: 1 copy of the deliverable on the Deliverables SharePoint portal.

6.1.2 Subtask 2 - Task Order Management Plan, Transition Strategy, and Transition Plan (Area 1)

a. Task Order Management Plan The contractor shall prepare the task order management plan (TOMP) describing the technical approach, organizational resources and management controls planned to meet the cost, schedule, and performance requirements throughout contract execution. The contractor shall include the description of management controls, key activity milestones, deliverables, schedules, assumptions, issues and other relevant information. The TOMP is a living document. As such, the contractor shall review and resubmit the TOMP annually at the start of the base year and each option year if exercised. The initial management plan to be developed and approved by the Government with annual updates. The Integrated Management Schedule (IMS) will be created and provided monthly status updates on performance regarding quality assurance, progress/status of project regarding cost, schedule and performance.

b. Transition Strategy & Transition Plan The purpose of having a transition plan is to layout the tasks and activities required to move efficiently from the incumbent contractor to a contractor awarded to the follow-on contract. The contractor shall include an introduction or scope statement addressing background information on the project. The contractor shall include the relationship of the project to other projects and/or organizations or agencies, address maintenance resources required, identify the transition team's organization and responsibilities, as well as the tools, techniques, and methodologies needed to perform an efficient and effective transition. The contractor shall include deployment schedules, resource estimates, identification of special resources and staffing. The contractor shall also define management controls and reporting procedures, as well as the risks and contingencies. The contractor shall give special attention to minimizing operational risks. The contractor shall include an impact statement outlining the potential impact of the transition to the existing infrastructure, operations, and sustainment staff and to the user community. The contractor shall adhere to the following onboarding requirements from the date of award: Key Personnel shall be on-boarded per section 13, sub-section: g Transitioning.

c. Constraints

1. Contractor may work any days or hours it deems necessary to complete tasks in the PWS with a minimum work schedule that includes Monday-Friday 0800-1600 Eastern Time Zone. During these times the contractor shall be available and reachable by phone, Government email DISA instant messaging or the current collaboration platform (currently MS Teams).

2. Contractor shall obtain/maintain a Common Access Card (CAC) to access network on GFE.

3. All contractor personnel performing cybersecurity tasks listed on the PWS must complete all training required for system access as directed by the Government. Training must be completed as soon as possible but no later than within 5 business days of onboarding.

4. Contractor personnel required to perform tasks listed in the PWS which require privileged access to JKO will need to complete the JKO Training Coordinator training and sign the Non-Disclosure Agreement (NDA) with JKO within 5 business days of onboarding.

5. All employees receiving a CAC are required to complete training to obtain the CAC and complete mandatory annual training as listed in DISA’s Corporate Management Information System (CMIS) by the due date for the training.

6. All personnel on the contractor strength report shall obtain and maintain a CAC and will be issued Government furnished equipment (GFE) in the form of a DISA Laptop to conduct official business and communication with DISA. With Government approval this requirement may be waived on an individual basis if the contractor presents an acceptable use case outlining why a CAC and a GFE are not required for a specific position/person to perform tasks on the PWS. In addition to utilizing the GFE, the contractor is permitted to utilize their own assets hardware and software to develop the cyber awareness challenge training product or complete other tasks listed in the PWS. Once developed the contractor shall test them to ensure they meet the Government requirements to safely and effectively function on the DoD network as outlined in this PWS.

Deliverables:

*Standard Distribution: 1 copy of the deliverable on the Deliverables SharePoint portal.

6.1.3 Subtask 3- Technical Interchange Meeting (TIM)

The contractor shall host a TIM to ensure common understanding between the contractor and the Government on contract requirements. The contractor shall describe the technical approach, the organizational resources, and management controls to meet the cost, performance, resourcing, and schedule requirements throughout the period of performance.

Deliverables:

/Copies Frequency & Remarks

*Standard Distribution: 1 copy of the deliverable on the Deliverables SharePoint portal.

NTE-Not to Exceed, NLT-No Later Than

6.1.4 Subtask 4 - Quarterly Progress Reviews (QPR)

The contractor shall prepare and conduct QPR briefs following each quarter. Appropriate members of the contractor’s technical team will meet within 15 calendar days of the end of each quarter with the appointed Government COR, either in person or via teleconference or a combination of both. The purpose of these meetings will be to discuss progress, request assistance, and address issues raised during the execution of the task.

The contractor shall include in the QPR presentation:

· A list of change in personnel, with corresponding dates of arrival/departure.

· Task order financials and invoice history.

· Reports on task deliverables, projects with start and end dates, reporting across quarters, website statistical trend charts and statistics, summary of content requests, service desk statistics, and the quarterly broken link report.

The contractor will document proceedings in Quarterly Review Notes and report their occurrence.

Deliverables:

*Standard Distribution: 1 copy of the deliverable on the Deliverables SharePoint portal.

6.2 Task 2 - Cyber Awareness Challenge

Cyber Awareness Challenge is the DoD’s baseline cybersecurity awareness training required to be taken annually by all military, civilian and contractor personnel utilizing the DoD networks and is approximately one hour in length for the average student. The annual training updates must be delivered and approved by the Government NLT Sept 1st each year. This allows 30 days to obtain DISA PAO, OPSEC, FDO review and approval, JKO LMS testing, and launch training on cyber.mil and JKO on Oct 1st each year for use across the DoD.

Content updates are reviewed and approved at the DoD CIO level through the Cyber Workforce Advisory Group (CWAG) meetings. For planning purposes, the Cyber Awareness Challenge training is updated annually NTE 40% change to the overall training content except in the year where the course is completely redesigned.

Case studies will be revised and updated or replaced annually as requested. The training contains a randomized “Test Out Option”. The questions and answers for this Test Out Option will be revised annually. In addition, the contractor will update the training to incorporate any changes in policy, technology, and section 508 relevant to the training.

The contractor shall make updates to improve the look and feel of the training or to improve student navigation of the training. The contractor shall make updates to improve student engagement, to improve the overall organization or flow of training topics. The contractor shall make updates to add additional or improve existing, professional narration or voiceover, knowledge checks, interactive exercises or labs, numerous custom embedded videos or vignettes, and training surveys. The contractor shall make updates to provide an interactive experience IMI levels 2 and 3 for the student. This will include demonstrations of key concepts, demonstration exercises, practice exercises for students, and knowledge checks. The contractor shall determine and use their development tools and software as needed, software that is generally accepted or utilized in the training development community to make robust annual improvements to each training. The contractor shall use a combination of still photography, text, animation, custom video, audio, narration, interactive exercises, knowledge checks, and contemporary development software such as Adobe Creative Cloud, HTML, CSS, and JavaScript, or similar software to develop the annual training updates. A basic eLearning training developed using Articulate or Captivate will not meet this requirement.

The contractor shall prepare the presentation for the annual CWAG meeting (normally Jan-Feb of the new year) with feedback collected from the services and components, information from the surveys, content reviewed and marked for future updates and conduct the presentation during the annual CWAG Cyber Awareness Challenge requirements meeting.

The contractor shall deliver the training in the following formats: online version in a web format and both SCORM 1.2 and 2004 formats for hosting on multiple DoD learning management systems (LMS), two versions of a supplemental group facilitator guide document, one guide allows an instructor to facilitate using the WBT product to a group of learners. The other guide is a PowerPoint presentation used in the place of the WBT for a group of learners. The contractor shall update these two documents to match any content updates made to the WBT. These documents must be Section 508 compliant.

A downloadable format to run offline directly from an end user PC, and a downloadable format suitable to burn to a CD/DVD disc. All versions will include an option with a DoD Certificate of completion at the end of the training and another version with the ability for the service or component to use their organization specific certificate of completion (in place of the DoD Certificate of Completion) at the end of the training. The current online version of the training is located on the publicly facing DoD Cyber Exchange website cyber.mil.

The contractor shall update the training and provide the same current options and downloads available for the training to include:

a. Launch directly from the DoD Cyber Exchange-Public and through JKO NIPR

b. Disc downloads for hosting on an individual’s computer-NIPR

c. Shareable Content Object Reference Model (SCORM) download for hosting on a Learning Management System (LMS)-NIPR

d. A SCORM version compatible with JKO’s LMS

e. A link to JKO on DoD Cyber Exchange SIPR

f. Facilitator Guide, briefing download, and handouts option for download to accompany the eLearning version on DoD Cyber Exchange NIPR *An example of the current 2025 download options are available on DoD Cyber Exchange-NIPR at www.cyber.mil The contractor shall provide a PMP certified program manager, instructional designer, curriculum development experts, a trusted tester, and a cybersecurity subject matter expert (SME) to develop new training or provide updates to existing training. The contractor shall provide personnel with technical expertise in developing student self-paced online training and have demonstrated experience and deep expertise in the subject matter for the training they are developing. A minimum of one member of the development team shall have a degree in instructional design, or hold commercial certifications related to instructional design and online student self-paced training.

The contractor will ensure the training is compatible with the current DoDNet Microsoft Windows baseline, Linux, current release of Apple Mac OS X, and current release of iOS and Android OS for mobile devices. The training shall be compatible with all major web browsers (currently Chrome, Edge, Safari & Firefox) as defined by the Government prior to the start of the development. The Government shall approve all product design. The final products will undergo functionality and compatibility testing and shall be fully compliant with Section 508 requirements so that the learner can use accessibility software to complete the training. A separate or embedded text alternative will not meet this requirement.

The learning objectives & requirements for this training are gathered annually during several (1-3) DoD working group meetings chaired by the DoD CIO with representatives from the services and components. The contractor shall attend and provide SME support and guidance during all requirements gathering meetings. The contractor shall provide technical experts to address DoD mission partners issues relating to the installation and use of the Cyber Awareness Challenge on an organization’s LMS. The contractor shall provide support for up to fifteen (15) Government organizations (can include the DoD, White House, or any federal Government organization utilizing the training) for LMS implementation and troubleshooting of Cyber Awareness Challenge as requested by the Government. Based on past experience, this type of LMS trouble shooting involves assisting the organization with instructions on settings for their specific LMS to allow the training to operate, or developing custom code to create a custom version of the training to allow the training to correctly operate on the organization’s LMS. The contractor shall provide an after-action report to the Government on the resolution.

All training products shall comply with Section 508 of the Rehabilitation Act (keyboard accessible, closed captioning, audio narration, transcript, etc.), and be tested using the latest version of the Job Access with Speech (JAWS) screen reader, unless exempted from compliance with this Act by appropriate waiver. JAWS is a commercial proprietary screen reader software product from Freedom Scientific that enables a blind or visually impaired user to read the text that is displayed on the computer screen with a speech synthesizer or braille display. The contractor shall ensure all products developed or updated shall relate to Federal standards such as the National Institute of Standards and Technology (NIST) Special Publication 800-16 and the Committee on National Security Systems (CNSS) Training Standards. The contractor shall provide technical experts to address issues relating to the installation and use of Web Basted Training (WBT) products on LMSs. The products shall be browser-based and conform to the requirements of the Federal Desktop Core Configuration (FDCC)/Standard Desktop Configuration (SDC). The LMS products shall be in the SCORM or the Experience Application Programming Interface (xAPI) format, based on the requirements identified by the Government. For more information on Sharable Content Object Reference Model (SCORM) and Experience API, view this website (https://www.adlnet.gov/news/scorm-and-experience api-roadmap).

The contractor shall maintain these training products for the lifetime of the contract.

Deliverables:

PWS

Task #

Determined Format

Determined Format

Determined Format

minutes

Download, CD-ROM ISO image, SCORM1.2 and 2004, Web Artwork/ thumbnails, video trailer.

*Standard Distribution: 1 copy of the deliverable on the Deliverables SharePoint portal.

Beta training launched on hidden link on DoD Cyber Exchange. Final Delivery tested on JKO’s Nemesis sandbox and formally launched on JKO LMS.

6.2.1 Subtask 1 - Cyber Awareness Challenge Redesign

The contractor shall complete a redesign of the entire training (100%) every 5 years or once during the contract lifecycle. This includes a redesign of the underlying theme, redesign of the training navigation and any other improvements required to make the training function better along with the normal annual content updates delivered each year as described in 6.2.5 Subtask 5. The contractor will provide up to 3 design concepts for government selection which will result in a completely new training designed and developed from scratch with no reuse and not just an update of the current training. The Government will determine the year of the redesign. The training must launch at the beginning of the fiscal year on October 1. The training was completely redesigned in 2023 (FY24 version).

Deliverables:

PWS

Task #

Determined Format

Determined Format

minutes

Download, CD-ROM ISO image, SCORM 1.2 and 2004, Web Artwork/ thumbnails, video trailer.

*Standard Distribution: 1 copy of the deliverable on the Deliverables SharePoint portal.

Beta training launched on hidden link on DoD Cyber Exchange. Final Delivery tested on JKO’s Nemesis sandbox and formally launched on JKO LMS.

7. Performance Standards

/Surveillance

prior to Government acceptance

acceptance

acceptance

prior to Government acceptance

acceptance

prior to Government acceptance

prior to Government acceptance

prior to Government acceptance

8. Incentives Both outstanding and negative performances, rating will be recorded in the Contractor Performance Assessment Reporting System (CPARS).

9. Place of Performance

Mission Location: DISA Headquarters located at Ft. Meade MD

Place of Performance: The contractor shall perform the work (which is unclassified) for this effort at the contractor’s facility or via telework.

Key personnel are:

a) Training & Development Specialist Key personnel listed above must be onboard within 14 days of contract award.

Alternative work sites allow for regular telework or remote work flexibilities. Regardless of where work is performed, the Contractor shall ensure that work is completed effectively and that mission needs and requirements are met, without degradation of services. Also, the contractor may be required to account for the physical location of their personnel should this information be requested by the COR. The Contractor shall propose on-site rates for all work performed at an alternative work site. Incidental charges incurred while working at an alternative work site (e.g., electricity, internet) are not reimbursable to the contract and shall not be billed to the Government.

Travel & Travel Reimbursement:

a. No travel required

Secondary Place of Performance:

Contingency Only. As determined by the Contracting Officer’s Representative (COR), contractor employees may be required to work at a secondary place of performance (e.g., home, the contractor's facility, or another approved activity within the local travel area) in cases of unforeseen conditions or contingencies (e.g., pandemic conditions, exercises, Government closure due to inclement weather). Additionally, the contractor may be required to account for the physical location of their personnel should this information be requested by the COR. Non-emergency/non-essential contractors should not report to a closed Government facility. Contractor shall prepare all deliverables and other contract documentation utilizing contractor resources. To the extent possible, the contractor shall use best efforts to provide the same level of support as stated in the PWS. In the event the services are impacted, reduced, compromised, etc., the Contracting Officer or the contractor may request an equitable adjustment pursuant to the Changes clause of the contract.

10. Period of Performance. The task order will consist of a one (1) twelve-month base year with four (4) one- year option periods. The option periods may be exercised upon a favorable review of the contractor’s performance, validation of continued need and a review of negotiated prices compared to recently awarded contacts similar in scope and nature to ensure prices are neither too high nor too low.

One six-month extension, if exercised per FAR 52.217-8 dates: from June 16, 2030, to December 16, 2030, advised by the COR, the contractor shall continue performance in emergency or mission essential conditions. Additionally, the contractor may be required to account for the whereabouts of their personnel should this information be requested by the COR.

Recognized Federal Holidays: The contractor is not required to perform services on Federal Holidays (as specified on the U.S. Office of Personnel Management website), unless otherwise specified by the COR.

Unplanned Federal Government Closure: In the event an authorized official, by either executive or legislative order, declares Federal offices closed (treated as a holiday for pay and leave purposes), the order only applies to Federal employees (unless otherwise stated in the order).

11. Security Requirements. The work will be UNCLASSIFIED. The following security requirements shall apply to this effort.

The contractor shall coordinate visits with site Point of Contract (POC)s providing at least a 72-hour notice (or according to each site security requirements) prior to any site access. Contractor personnel without security clearances performing any task under this PWS must be escorted by cleared Defense Information Systems Agency (DISA) personnel (civilian, military, or contractor).

References:

a. DISA End User Access Agreement, 11 February 2021

b. DISA Policy Letter, Unauthorized Connections to Network Devices, 11 September 2013

c. DISA Instruction 240-110-8, Information Security

d. DISA Instruction 240-110-36, Personnel Security

e. DISA Instruction 240-110-38, Industrial Security

f. DISA Instruction 240-110-43, Insider Threat Program

g. DISA Instruction 630-230-19, Cybersecurity

h. DoD Manual 5200.01, Vol 1-3 Information Security Program, 24 February 2012

i. DoD Manual 5200.02, Procedures for the DoD Personnel Security Program, 3 April 2017

j. DoD Instruction 5200.48, Controlled Unclassified Information (CUI), 6 March 2020

k. 32 CFR Part 117, “National Industrial Security Program Operating Manual (NISPOM)”, 24 February 2021

l. Security Executive Agent Directive 4, National Security Adjudicative Guidelines, 8 June 2017

m. DoDM 5400.07, Freedom of Information Act Program

n. DoDI 5230.24, “Distribution Statements for DoD Technical Information,” January 10, 2023

o. DoD Instruction 8510.01, “Risk Management Framework for DoD Systems,” July 19, 2022

11.1 Background Investigation. All personnel performing on or supporting a DISA contract/order in any way shall be U.S. citizens. The personnel security requirements for this contract/order cover the individuals supporting the Task Areas delineated in the table below. Contractor personnel must possess the interim or final background investigation eligibility delineated in the table below when performance starts.

11.2 Investigation Requirements. All personnel requiring NIPRNet access under this contract/order shall undergo a favorably adjudicated Tier 1 (T1) investigation as a minimum requirement. Enrollment into Continuous Evaluation current within 5 years and reflected in Defense Information System for Security (DISS), would meet the requirement for a current Periodic Reinvestigation (PR).

11.2.1 The contractor is required to have personnel with an interim or final background investigation Tier 1 (T1) (as specified in the table located in section 11.2) at contract start date. If contractor personnel are replaced during performance of the contract, replacement personnel should also have interim or final background investigation Tier 1 (T1) (as specified in the table located in section 11.2).

11.3 Visit Authorization Visit requests shall be processed and verified through the DISS to Security Management Office (SMO) DKABAA10. DISS visits for contracts/orders are identified as “Other” or “TAD/TDY” and will include the Contract/Order Number of the contract/order in the Additional Information section. Contractors that do not have access to DISS may submit visit authorizations by e-mail in a password protected .pdf to the COR/ACOR specified in PWS/SOW Section 1.0.

*Prior coordination with the DISA COR should be made via email to ensure the Visit Authorization Letter (VAL)/ Visit Authorization Request (VAR)/ Visit Termination Notification (VTN) process is agreed upon and properly secure.

11.3.1 VAR Package VARs must be received via email and require pre-approval from the assigned DISA COR five business days in advance of the report date. The VAL/VAR/VTN should be sent via email to the appropriate COR. The VAL/VAR/VTN should be sent using in a locked “Zip” file in one e-mail and then followed up by another e-mail with the password to unlock the Zipped file, because it contains sensitive information covered by the Privacy Act.

Documents to include in the VAR Package:

1. Inter-office Memorandum (IOM)

2. DISS verification of Visit Authorization by Security Manager (if available)

3. Contractor VAL signed by the Contractor Facility Security Officer (FSO)

NOTE: If DISS is not available, the VAL must contain the following information on company letterhead

· Company name, address, telephone number, facility security clearance

· CAGE CODE

· Contract/Order Number

· Name, SSN, date and place of birth, and citizenship of the employee intending to visit, email address, and phone number

· Certification of personnel security clearance and any special access authorizations required for the visit (type of investigation & date and adjudication date & agency)

· Name of COR/Alt COR

· Dates or period the VAL is to be valid (i.e., Start date / End date)

11.3.2 VTN Package. The Contractor FSO or PM will forward a VTN letter to the DISA COR identified in the PWS/TO/Sub for all employees leaving the contract/task order/subcontract.

11.3.2.1 In addition, the DISA CORs and security managers shall inform the DISA Security Office when contractor personnel are removed for cause from a contract supporting DISA. This step is being added to prevent contractor personnel removed for security related issues from returning to DISA without appropriate vetting. This step will also provide security with pertinent information to make an informed decision regarding potential contractor employees’ access to secure facilities and sensitive information. “For Cause” is information regarding an individual that falls into one or more of the actions or incidents that are within one of the 13 adjudicative guidelines as cited in the Security Executive Agent Directive (SEAD) 4:

a. Allegiance to the United States

b. Foreign Influence

c. Foreign Preference

d. Sexual Behavior

e. Personal Conduct

f. Financial Considerations

g. Alcohol Consumption

h. Drug Involvement and Substance Misuse

i. Psychological Conditions

j. Criminal Conduct

k. Handling Protected Information

l. Outside Activities

m. Use of Information Technology

Other actions:

• Incidents involving violence in the workplace or harassment.

• Misuse of time.

• Inspector General or General Counsel related inquiries.

• Failure to comply with security policies and procedures.

• Other reasons that prompted removal of a contractor.

The VTN must contain the following information on company letterhead

· Company name, address, telephone number, facility security clearance

· CAGE CODE

· Contract/Order Number

· Name, SSN, date and place of birth, and citizenship of the employee, email address, phone number

· Date contractor CAC was collected

· Name of COR/Alt COR

· Termination Date

· Reason for Termination: “No longer working on contract”

*Any VAL/VAR submitted without the above information will be denied. *

11.4 Security Contacts. DISA Security Personnel can be contacted for Industrial or Personnel Security related issues at (301) 225-4039 or via mail at:

For Center or Directorate-specific security related matters, contact the Directorate or Center Security Manager at:

Name: Charles J. Franco (Joe) Phone Number: 301-225-1525 E-mail: charles.j.franco.civ@mail.mil

11.5 Information Security and other miscellaneous requirements

11.5.1 Contractor personnel shall comply with all local security requirements including entry and exit control for personnel and property at the Government facility.

11.5.2 Contractor employees shall be required to comply with all Government security regulations and requirements. Initial and periodic safety and security training and briefings will be provided by Government security personnel. Failure to comply with Government security regulations and requirements shall require the company to provide the Government with a written remediation/corrective action plan; furthermore, failure to comply with such requirements can be cause for removal and the contractor will not be able to provide service on this contract/order.

11.5.3. Contractor employees with an incident report in DISS who have had their access to classified suspended will not be permitted to fill positions requiring access to classified information on a DISA contract/order.

11.5.4 The Contractor shall not divulge any information, classified or unclassified, about DoD files, data processing activities or functions, user identifications, passwords, or any other knowledge that may be gained, to anyone who is not authorized to have access to such information. The Contractor shall observe and comply with the security provisions in effect at the DoD facility. Identification shall be worn and displayed as required.

11.5.5 The authority for the contractor personnel to regain access must be granted by DISA Chief of Security.

11.5.5.1 DISA retains the right to request removal of contractor personnel regardless of prior clearance or adjudication status, whose actions, while assigned to this contract, clearly conflict with the interest of the Government.

11.5.5.2 DISA retains the right to revoke contractor personnel access to DISA facilities and networks, who violates one or more Security Personnel Adjudicative guidelines, harassment or violence in the workplace while assigned to a contract clearly conflict with the interest of the Government.

11.5.5.3 If contractor employee is accused of violating state or federal laws and/or Government professional conduct policies or regulations, then the Government may require that such contractor employee be removed from Government premises and/or that such contractor employee be removed from supporting this contract, pending the duration and outcome of a Government investigation if the Contracting Officer finds that the conduct or violation alleged has the potential to negatively interfere with contract performance or operations at a Government facility. Only the Contracting Officer can make such a request on behalf of the Government. Removal of contractor employees shall not negatively impact contract performance.

11.5.6 Contractor personnel will have access to, generate, and handle UNCLASSIFIED at the contractor location(s) and listed in the place of performance section of this document. All contractor deliverables shall be marked in accordance with DoDM 5200.01, Vol. 1, DoD Information Security Program: Overview, Classification, and Declassification; DoDM 5200.01, Vol. 2, DoD Information Security Program: Marking of Information; DoDI 5200.48, Controlled Unclassified Information (CUI) and DoDM 5400.07, Freedom of Information Act Program, unless otherwise directed by the Government. The contractor shall comply with the provisions of the DoD Industrial Security Manual for handling classified material and producing deliverables. The contractor shall comply with DISA Instruction 630-230-19, Cybersecurity.

11.5.7 The Contractor shall afford the Government access to the contractor’s facilities, installations, operations, documentation, databases, and personnel used in performance of the contract/order. Access shall be provided to the extent required to carry out a program of IT inspection (to include vulnerability testing), investigation and audit to safeguard against threats and hazards to the integrity, availability, and confidentiality of data or to the function of information technology systems operated on behalf of DISA or DoD, and to preserve evidence of computer crime.

12. Government Furnished Property (GFP)/Government-Furnished Equipment (GFE)/ Government-Furnished Information (GFI)

A. GFP will be provided for this contract as indicated in the GFP attachment included at solicitation, distributed at award, and incorporated via the GFP Module in PIEE. GFP shall be managed IAW the terms of FAR 52.245-1, corresponding GFP DFARS clauses and additional DITCO Instructions incorporated in the award.

Contractors shall accept and/or report provided GFP via the Shipping and Receiving document in the GFP module upon acceptance and/or IAW Additional DITCO Instruction H9. Serially managed items are provided to the contractor by DoD and require all events identified in DFARS 252.245-7005 (and/or any subsequent DFARS or Agency GFP reporting requirements) to be reported by the contractor.

Contractors in possession of GFP shall provide the COR or PA an annual report of all GFP in its possession to include the item description, make, model, serial number, IUID, and last inventory date; the report should be minimally provided on an annual basis and 30 days prior to the expiration of any performance period (base and options) IAW with Additional DITCO Instruction H9.

Deliverable:

*Standard Distribution: 1 copy of the transmittal letter with the deliverable to the Primary COR.

13. Other Pertinent Information or Special Considerations

a. Identification of Possible Follow-on Work.

b. Identification of Potential Conflicts of Interest (COI).

c. Identification of Non-Disclosure Requirements. The contractor shall obtain and maintain Non-Disclosure Agreements (NDA) for each employee assigned to the contract/TO. Initial NDAs shall be signed within one week of contract/TO award, and NDAs shall be kept current through the entirety of the period of performance as employee turnover occurs. The contractor shall ensure that all employees assigned to the contract have executed NDAs on file as of the date of the Monthly NDA Status Report, which shall include names and NDA status of all current employees assigned to the contract.

Deliverable:

*Standard Distribution: 1 copy of the transmittal letter with the deliverable to the Primary COR.

f. Property Accountability The contractor shall submit the Consolidated Product Listing for IGCE/RFQ/EPL/MI&RR (see below) in addition to complying with all requirements of DFARS 252.211-7003. See DITCO Additional Text H2, Requirement to Submit an Electronic Product List for additional information.

g. Transitioning.

1. Transition-In (Phase In) All key personnel/key positions must be onboard within 14 days of contract award. 50 percent total staffing must be complete within two weeks of the start of the PoP and 100 percent within 30 days.

2. Transition-Out (Phase Out) You will need to collaborate with the MP at least 120 days or sooner, prior to the end of the contract, to develop a transition-out plan IAW FAR 52.237-3.

h. Supply Chain Risk Management (SCRM)

This contract and its associated delivery/task orders are subject to the Federal SCRM policies and regulations including the Defense Federal Acquisition Regulation Supplement (DFARS) 252.239-7017 Notice of Supply Chain Risk, DFARS 252.239-7018 Supply Chain Risk, DoD Instruction 5200.44 Protection of Mission Critical Functions to Achieve Trusted Systems and Networks, Section 806 of the FY2011 NDAA Requirements for Information Relating to Supply Chain Risk, and internal DISA SCRM Processes and Procedures.

The contractor shall submit a SCRM plan as part of its technical proposal that describes how the contractor will reduce and mitigate Supply Chain Risk using the security controls outlined below (further described in CNSSI 1253, Appendix D and NIST SP 800-53), as applicable to your contract.

Control Enhancement Name

DELIVERABLES:

SUPPLY CHAIN RISK MANAGEMENT PLAN UPDATE: The contractor shall provide an updated SCRM Plan to the COR and Program Manager within five (5) business…