PWS.docx

CUI

PERFORMANCE WORK STATEMENT (PWS)

1. Contracting Officer’s Representative (COR).

a. Primary COR. See DITCO Additional Text G1 - Points of Contact

b. Alternate COR. See DITCO Additional Text G1 - Points of Contact

c. Property Administrator See DITCO Additional Text G1 - Points of Contact

2. Contract or Task Order Title. Unisys OS 2200 System Services

3. Background. The Defense Information System Agency (DISA) Hosting and Compute (HaC) is a provider of information technology solutions for the Department of Defense (DoD). DISA HaC must continue to have the ability to provide Unisys OS 2200 software support for the current mission partner base, utilizing Unisys OS 2200 applications that provide critical support to the war fighter. DISA provides Unisys OS 2200 capabilities and application support to mission partners on a 24-hour per day, 7- day a week basis.

4. Objectives: The objectives of this contract are to obtain reliable, responsive, and cost-effective capacity services for DISA HaC Unisys OS 2200 environments at DISA and/or DISA-approved processing locations. The objective of these capacity services is to provide flexibility and services capable to meet current and future Unisys OS 2200 workload, security, availability, scalability, and modernization requirements, while ensuring DISA mission partners receive uninterrupted, continuous access to their applications and data. UNISYS OS2200 provides a critical and secure host platform to support high-volume DFAS transaction processing for key Air Force and Army accounting applications. DISA’s goal is to obtain and provide the necessary Unisys OS 2200 Operating Systems capable of supporting unique processing requirements. These capacity services will:

4.1 Be responsive to mission partner requirements by providing agile, flexible, and scalable Unisys Operating Systems.

4.2 Require minimal time to add or modify capabilities contained within the operating systems provided.

4.3 Establish long term, consistent and granular pricing models for the Unisys Operating Systems environments to include unclassified and classified production and unclassified test and development.

4.4 The contractor will acquire and provide Unisys Operating Systems. The contractor will provide software updates to Operating Systems. Support to the existing and any new ‘third-party’ software products is required on a recurring basis for the duration of the contract. The Government will retain operational control over the provided environments.

4.5 In addition to the stated objectives, the intent is to create a DISA/contractor “partnership”. Within the context of the DISA/contractor relationship, “partnership” is not used as a legal term. The partnership will reflect the attributes of an open, collaborative, and customer-oriented professional relationship. DISA will not turn the processing environment control over to the contractor.

5. Scope. The scope of this contract will encompass:

5.1 All Unisys OS 2200 environments will be located in a DISA facility and/or DISA-approved processing location as well as any DISA or DISA-approved locations in which DISA HaC may acquire operational responsibility. The supported environment will consist of all Unisys OS 2200 software and third-party software products/capabilities.

5.2 Unclassified and Classified Environments. All locations may require an independent Non-classified Internet Protocol Router (NIPR) and Secure Internet Protocol Router (SIPR) environment. Where required under this contract, the Contractor shall provide engineering and maintenance support personnel with the appropriate clearance for DISA’s classified and unclassified environments. (See para 13 for individual personnel security requirements). The Contractor shall deploy separate instances for classified and unclassified environments and will provide all assets needed for the solution infrastructure regardless of environment (classified or unclassified).

6. Performance Requirements.

For all tasks: Secret, NIPRNet, and SIPRNet access is required to support: The Contractor will provide engineering and maintenance support personnel with the appropriate clearance for DISA’s classified and unclassified environments. SIPRNet access is required for all personnel that will be supporting current and future customer workloads that reside on the SECRET/SIPRNet network.

6.1 Task 1 – Provide Unisys OS 2200

6.1.1 Production/Development/Test. The contractor shall provide and maintain the operating systems used to support processing applications.

6.1.2. Integrate OS environment management and oversight solutions with DISA’s chosen enterprise systems management (ESM) architecture. The contractor will not be responsible for providing this architecture or software.

6.1.3 Must include the necessary internal communications software components to enable communication over new network technologies.

6.1.4 Provides 24x7x365 problem escalation/resolution support processes.

6.1.5 Ensures the operating system(s) provided are moveable and fully licensed for the duration of this contract.

6.1.6 Operating System must deliver 99.95% system availability per orderable system with options to provide up to 99.999 % availability per orderable system.

Deliverable/s: System availability report in accordance with Contract Data Requirements List (CDRL) A001.

Deliverable(s):

6.2 Task 2 – Additional Domains. The contractor shall make provisions to allow the Government to request additional domains and to determine if these additional domains will require data replication.

6.3 Task 3 – Technical Support. The contractor shall provide a technical support structure capable of supporting software components of the Unisys OS 2200 environment. The following subtasks detail the specific areas to be addressed by the contractor.

6.3.1 The contractor shall provide 24 x 7 on-call support for all problems reported with Unisys OS 2200 and 3rd party software products. Note: Priorities 1 – 4 software support is defined in the QASP (“Note2 – Software Support Services”).

6.3.2 Unisys and 3rd Party Software Support. Provide technical support of all Unisys OS 2200 and 3rd party software products required to support the Unisys OS 2200 environment. This includes:

6.3.2.1 The contractor shall provide problem analysis support, security vulnerability patches, and system/application patches to the DISA Unisys Support group for all Unisys OS and 3rd Party software.

6.3.2.2 The contractor shall be responsible for all Unisys OS and 3rd Party Security Technical Implementation Guidelines (STIGs) on all products/software.

6.3.2.3 The contractor shall perform integration and regression testing on all Unisys OS 2200 and 3rd party software prior to release to DISA.

6.3.2.4 The contractor shall provide all licensed software releases, updates, revisions, and fixes, including updates to product documentation as they become generally available (GA) from the contractor.

6.4 Task 4 – Software Maintenance.

6.4.1 The contractor will ensure that the extent of contract initiation is limited to re-licensing existing Operating System and third-part software products. Under no circumstance shall successful initiation of this contract be reliant on the modification of the existing processing environments.

6.4.2 The contractor shall be responsible for providing all technical services related to the effective and efficient operation of the Unisys 2200 Operating System and relative third-party products obtained as part of this contract. The contractor will be the sole intermediary between the Government and external software providers. As such, the contractor will ensure initial and sustained inter-operability of all software products regardless of source.

6.4.3 The contractor shall provide training/familiarization to DISA System Administrators for provided Operating System(s) and software; all training requirements shall be included in the utility price. The contractor’s training plan shall provide all or a combination of the following elements: OEM documentation guides, Computer Based Training (CBT) manuals, training hours and in-person/virtual classroom training at Government and/or contractor facilities. Technical/training support will be recurring as updates are introduced to the processing environment. Technical/training support shall be provided as part of the total managed service. To minimize risk, a contractor-facilitated plan for training Government personnel on new technologies shall be required.

6.5 Task 5 – DISA Unisys/E-ICAM Web API Integration. The contractor shall develop, test, and implement a software package for DISA Unisys partitions hosting DFAS FM applications to automate identity and access management actions with E-ICAM via a Web API.

6.5.1 The contractor shall develop a 2-way Web API interface to receive authorization data from E-ICAM and transmit confirmation actions back to E-ICAM. The contractor will create an OS2200 interface to the API process to all OS2200 partitions based on role table links. The contractor shall provide a System Integration Design Document and Deployed Software Package Verification to DISA in accordance with Contract Data Requirements List (CDRL) A002 and A004.

6.5.2 The contractor shall configure the software to query- E-ICAM on a recurring schedule and automatically create, modify, delete Unisys OS2200 security records based on SAAR approvals/removals, reconciliation activities, and disabled status changes. The contractor shall provide a System Integration Design Document and Deployed Software Package Verification to DISA in accordance with Contract Data Requirements List (CDRL) A002 and A004.

6.5.3 The contractor shall engineer the software to create Unisys OS2200 security records based on application requirements table defined. After security record creation, modification, deletion produce an application file for use by each application. Transaction Interface Processes (TIP) applications need to generate a position id (PID) and update to info screen within the security record. The contractor shall provide a Deployed Software Package Verification to DISA in accordance with Contract Data Requirements List (CDRL) A004.

6.5.4 The contractor shall develop automated daily jobs to transmit "Daily All Permissions Write" (UC14) and the user's "Last Logon Date" (UC6) to E-ICAM. The contractor shall provide a System Integration Design Document and Deployed Software Package Verification to DISA in accordance with Contract Data Requirements List (CDRL) A002 and A004.

6.5.5 The contractor shall conduct unit, integration, and security testing in accordance with the provided "API Use Case" documentation prior to production deployment. Implementation process needs confirmation for already provisioned accounts current state response until reconciliation completed. The contractor shall provide a Test Plan & Results Report to DISA in accordance with Contract Data Requirements List (CDRL) A003.

6.6 Task 6 – Supply Chain Risk Management (SCRM) Plan. See section 6.19.1 SCRM requirements and deliverables.

6.6.1 Subcontractors: The contractor shall provide a definitive list of all known or proposed subcontractors and suppliers as part of their proposal for review and approval by the Government. The Government reserves the right to approve or disapprove the use of prospective subcontractors or suppliers. In the event the Government disapproves a prospective subcontractor or supplier due to supply chain risk, security concerns, or non-compliance with Supply Chain Risk Management (SCRM) requirements, the contractor shall have fifteen (15) calendar days from the date of written notification of disapproval to propose an alternative, authorized subcontractor or supplier at no additional cost to the Government. Government disapproval of a subcontractor or supplier shall not relieve the contractor of its obligation to meet established contract delivery schedules, performance milestones, or technical requirements. Failure by the contractor to propose an acceptable, authorized alternative within this designated timeframe may be deemed a failure to make progress, exposing the contractor to cure procedures and potential default actions in accordance with FAR Part 49 (Termination for Default).

The contractor shall notify the Government within five (5) business days whenever there is a change in subcontractors and/or suppliers at any point. The contractor shall take steps to ensure that products purchased or obtained shall not be identified as being destined for inclusion in a Government system.

6.6.2 Authorized Resellers: The contractor shall ensure all purchases are made through authorized resellers or provide justification why authorized resellers are not able to be used. The Government reserves the right to disapprove the use of prospective subcontractors or suppliers. Requests shall include the following information:

· The actual manufacturer or producer of the IT software to be leased or purchased;

· The item’s national stock number (if there is one);

· The item identification number used by –

(1) The actual manufacturer or producer of the item (e.g., model number); OR

(2) The full item description.

· Justification for use of non- authorized resellers.

6.6.3 Contractor-Manufacturer Relationship:

To assist the Government in assessing the security and risks associated with supply chain management, the contractor must supply the following information monthly, or with submission of quote for supplies: The contractor must indicate the relationship between the contractor and the manufacturer as one of the following:

The contractor is the manufacturer (OEM)

The contractor is an authorized reseller (i.e. the manufacturer has a direct relationship with the contractor and is officially identified as a reseller for that manufacturer) for all items produced by that manufacturer

The contractor is an authorized reseller (i.e. the manufacturer has a direct relationship with the contractor and is officially identified as a reseller for that manufacturer) for a subset of items produced by that manufacturer. The product lines the contractor is an authorized reseller for must be identified

The contractor obtains the manufacturer’s items through either an authorized partner or distributor. The authorized partner/distributor must be identified

The contractor obtains the items through an unknown/unidentified source

When the contractor states that they are an authorized reseller for a manufacturer, they must provide a point of contact (POC) at that manufacturer who will verify that statement

6.6.4 Critical Technologies (CT): The contractor shall conduct a crosswalk of their system specifications with their critical program information (CPI) and other DoD tools in conjunction with the Government at initial planning and throughout the acquisition life cycle. The crosswalk may or may not trigger parameters which cause a technology to be designated as CPI (Critical Program Information) or Critical Technologies (CT). Should the assessment result in identification of CPI and/or CT then the contractor will be required to assess methods of protection and, in conjunction with the Government, develop and implement an Anti Tamper (AT) Plan. If an AT is required, it will be added as an annex to the Program Protection Implementation Plan (PPIP).

6.6.5 Critical Program Information (CPI) Protection:

The contractor shall do all of the following:

6.6.5.1. Perform a Criticality Analysis (CA) to identify critical functions and components (hardware, software, and firmware) in accordance with both DoDI 5200.44 “Protection of Mission critical Functions to Achieve Trusted Systems and Networks (TSN)”. Criticality levels that support the CA are defined in the document “Office of the Under Secretary of War program Protection Plan Outline and Guidance Version 2.0”October 28,2025.

6.6.5.2. Identify and disclose the detailed supply chain for all critical software components and material included in products that could potentially reduce the trustworthiness of contractor’s products or services design, configuration, provisioning, manufacture, maintenance or deployment.

6.6.6 Program Protection Implementation Plan (PPIP) Requirements:

The contractor shall develop, utilize, and maintain the Program PPIP based on the Government provided PPIP requirements. The PPIP shall include demonstration of visibility into supply chain and Software Assurance for critical components. The information used to create this CDRL PPIP shall be available to the Government and discussed at IPT meetings as well as design reviews. The PPIP must address integration of all security disciplines, the PPP, System Security Engineering (SSE), counterintelligence, and OPSEC, and provide for no cost inspections and program protection surveys of the contractor’s acquisition program protection. The PPIP must explain how acquisition program protection ensures coordination of systems, data, and products during the acquisition process with SSE efforts to build life- cycle security features into acquisition systems and products covered by this contract. The contractor shall support the attainment of the objective of ensuring all personnel meet contract clearance and access requirements by defining how they will integrate security into their overall systems engineering process.

6.6.7 Program Protection Working Group (PPWG):

The contractor shall host a PPWG within three months after contract award and on an annual basis throughout period of performance of the contract. Each PPWG will be chaired by the Government security manager and co-chaired by the contractor security manager. The co-chair shall develop the agenda. The agenda shall include critical functional analysis (CFA), and Supply Chain Risk Management (SCRM). It is expected that each of the PPWGs will be a one-day event.

6.6.8 Anti-Tamper (AT) Plan:

If Anti-Tamper is identified as a solution for hardware and software containing CT, the contractor shall design, develop and integrate an AT solution to deter/prevent/detect the reverse engineering of those systems using the probability of an unplanned loss or for international sales across the program's life cycle. The contractor shall take the AT solutions through verification and testing to include any prototypes. The contractor shall utilize reverse engineering countermeasures that are commensurate with the exposure levels and consequence of critical program information loss using the analysis process identified within the DoD AT Guidelines.

6.6.9 AT Program:

The contractor shall develop and implement an AT Program to protect CT. The contractor shall develop, utilize, and maintain an AT Plan Annex to address protection of CT from reverse engineering in the case of unplanned loss or international sale. The contractor shall develop an AT Plan Annex to the PPIP for documenting countermeasure designs. The contractor shall consider AT in system engineering activities across the program’s life cycle to include science and technology efforts, research, design, development, implementation, testing, maintenance, upgrade and disposal of the system.

6.6.10 Law Enforcement/Counterintelligence:

In the event of a known or potential intrusion, the contractor shall consent to responding counterintelligence or law enforcement investigative agency requests to apply forensic analysis tools to contractor information systems affected by the intrusion, including monitoring tools, imaging tools, and any other techniques that the agency seeks to apply to effectively analyze the intrusion. The contractor shall allow the responding counterintelligence and/or law enforcement investigative agency to image affected systems, including systems containing proprietary information. Nothing in this contract shall limit the ability to conduct law enforcement or counterintelligence activities, or other activities in the interest of the Government.

6.6.11 Information Sharing:

The Government may use and disclose reported information (e.g., information regarding threats, vulnerabilities, incidents, or best practices) that does not include attribution information at its discretion to assist entities in protecting information or information systems (e.g. threat information products, threat assessment reports); provided that such use or disclosure is otherwise authorized in accordance with applicable statutes, regulations, and policies.

6.6.12 Malicious Code Warranty:

The contractor represents and warrants that the software shall be free from all computer viruses, worms, time-outs, time bombs, back doors, disabling devices and other harmful or malicious code intended to or which may damage, disrupt, inconvenience or permit access to the software user's or another's software, hardware, networks, data or information.

6.6.13 Source Code Configuration Control (Versioning):

The contractor shall utilize a strict version control process for software development and provide two copies of source code for all software versions developed under this contract. The source code will be provided on optical removable media (burned for read only) or another mutually agreed type of media. This program is executing a planned sunset with a retirement target of 30 November 2031. Because the system lifecycle is capped, purchasing broad, long-term government data rights is not economically justifiable. The program’s IP Strategy will focus exclusively on securing the minimal restricted rights necessary to sustain baseline operations and cyber-compliance through the transition period. The primary IP objective of this acquisition is securing absolute data portability, ensuring the government retains the unrestricted right to export, migrate, and transition all operational data to the follow-on system without proprietary format constraints or vendor licensing barriers.

6.6.14 Source Code Analysis:

To minimize both SCRM and IA related threats, the contractor shall use appropriate automated vulnerability analysis tools capable of analyzing the computer software code during the entire lifecycle of a covered system; including during development (source code analysis), operational testing (run-time analysis/vulnerability testing), and ongoing operations and sustainment phase (vulnerability testing). The actions will be used to identify and prioritize security vulnerabilities and, based on risk, determine appropriate remediation strategies for identified vulnerabilities.

6.6.15 Non-Secure Software:

If the Government determines, after a security audit (e.g. ST&E), that software delivered under this task order is non-secure, the Government will provide written notice to the contractor of each non-conformity. Software shall be "non-secure" under this task order if it contains a programming error listed on the current approved version of the CWE/SANS TOP 25 (which can be located at http://www.sans.org/top25- programming-errors) or a web application security flaw listed on the current approved version of the OWASP Top Ten (which can be located at http: //www.owasp.org/index.php/Category: OWASP Top Ten Project). The contractor shall have thirty (30) days after receipt of such notice (Remedy Period) to remedy each non-conformity by modifying/replacing and redelivering the software to the Government; or shall notify the Government within 15 days as to why the remedy cannot be implemented in 30 days, and propose a timeline for correction. If the Government determines, after a security audit following a Remedy Period, that the redelivered software is non-secure, and thus non-conforming, the Government may reject the delivery, provide notice of the non-conformance, and document the contractor's performance record. Alternatively, the Government may accept non-conforming software, receive appropriate consideration (equitable price reduction on a fixed price contract, reimbursement for costs of security audit, reimbursement for costs to correct the non-compliances, etc.), and document the contractor's performance record.

6.6.16 Periodic Government Inspections:

The contractor shall authorize Government inspections and reviews to assure compliance with both DISA and DoD Supply Chain Risk Management (SCRM) requirements throughout the contract performance period. The contractor shall be responsible for taking corrective action based upon the impact and severity of identified weaknesses.

6.6.17 Supply Chain Risk and Basic Protections Development:

The contractor shall establish basic protection requirements unless not establishing such requirements is justified by a cost-benefit analysis approved by the Government. Supply Chain and Development basic protections shall include:

An Anonymity Plan that:

6.6.18 Foreign Ownership, Control or Influence (FOCI):

FOCI is the U.S. Government’s program that ensures companies with foreign ownership, working in the United States, will not compromise the security or integrity of sensitive Government agencies and materials. The contractor must demonstrate that neither they nor their subcontractors/suppliers have any Foreign Ownership, Control, or Influence (FOCI) issues (A SF 328 “Certificate Pertaining to Foreign Interests” is used to determine whether or not a company is under FOCI).

Contractor is responsible to support and comply with all requirements of the Form 7 processes as reflected in the ESD Policy Letter of Instruction CSD 06-17 (amended) May 10, 2006. All repairs will utilize OEM new or OEM like new certified parts purchased from the OEM or authorized OEM reseller.

6.6.19 SCRM Plan:

This contract and its associated delivery/task orders are subject to the Federal SCRM policies and regulations including the Defense Federal Acquisition Regulation Supplement (DFARS) 252.239-7017 Notice of Supply Chain Risk, DFARS 252.239-7018 Supply Chain Risk, DoD Instruction 5200.44 Protection of Mission Critical Functions to Achieve Trusted Systems and Networks, Section 806 of theFY2011 NDAA Requirements for Information Relating to Supply Chain Risk, and internal DISA SCRM Processes and Procedures.

6.6.19.1 The contractor shall submit a SCRM plan as part of its technical proposal that describes how the contractor will reduce and mitigate Supply Chain Risk using the security controls outlined below (further described in CNSSI 1253, Appendix D and NIST SP 800-53), as applicable to your contract.

Control Enhancement Name

*Not required if there will be no procurement of hardware, firmware, or software systems.

Deliverable/s: Supply Chain Risk Management (SCRM) Plan submitted as part of the initial proposal to the Government in accordance with Contract Data Requirements List (CDRL) A002.

Deliverables:

6.6.19.2 Supply Chain Risk Management Plan Update: SUPPLY CHAIN RISK MANAGEMENT PLAN UPDATE: The contractor shall provide an updated SCRM Plan to the COR and Program Manager within five (5) business days whenever there is a change that affects one or more security controls as described in the Committee on National Security Systems Instructions (CNSSI) 1253 Appendix D (companion publication to National Institute of Standards and Technology (NIST) Special Publication (SP)). At a minimum, the following events will require a SCRM Update: changes in company ownership, changes in senior company leadership, supplier changes, subcontractor changes, and Information and Communications Technology (ICT) supply chain compromises.

Deliverable/s: Supply Chain Risk Management (SCRM) Plan updates within five (5) business days whenever there is a change that affects one or more CNSSI 1253 security controls in accordance with Contract Data Requirements List (CDRL) A003.

7. Performance Standards.

6.1 Task 1- Provide Unisys OS 2200

Task 1- 6.1.1 Production/Development/Test Operating System must deliver 99.95% system availability per orderable system with options to provide up to 99.999 % availability per orderable system.

6.3 Task 3- Technical Support

Task 3- 6.3.1 Provides 24x7.365 On-call support 24x7x365 Coverage Priority 1 – 1 Hour Response/ 8 Hour Restore Priority 2 – 4 Hour Response/8 Hour Restore Priority 3 – 8 Hour Response/Next Business Day Priority 4 - Routine

Task 3- 6.3.2 Unisys and 3rd party software support

6.4 Task 4- Software Maintenance

Task 4- 6.4 Software Maintenance Form 7

6.5 Task 5- DISA Unisys / E-ICAM Web API Integration

6.6 Task 6- Supply Chain Risk Management (SCRM) Plan

Task 6- 6.6 Supply Chain Risk Management (SCRM) Plan

8. Incentives. No Delivery Incentives/Disincentives are associated with work performed under this PWS.

9. Place of Performance. The solutions shall be designed, delivered, installed, and supported in concert with the Government at any of the current DISA data centers. Travel in and around the primary place of performance may be required throughout the period of performance. Additional travel within CONUS or OCONUS (if applicable) may be required to support the requirements of this PWS.

· Unclassified work may be performed at the contractor locations.

· Classified or unclassified work may be performed at the Government locations.

DISA ISC Columbus, 3990 East Broad Street, Bldg. 23, Columbus, OH 43213

DISA Computing Services Operations-Denver, 5775 DTC Blvd., Suite 350, Greenwood Village, CO 80111-3209

DISA, 6906 Cooper Avenue Fort Meade, MD 20755

DISA SMC Mechanicsburg, Bldg. 308 North End, 5450 Carlisle Pike, Mechanicsburg, PA 17050-0975

DISA SMC Montgomery, 401 East Moore Drive, Bldg. 857, Maxwell AFB/Gunter Annex, Montgomery, AL 36114-3001

DISA SMC Ogden, 7879 Wardleigh Road, Bldg. 891, Hill AFB, UT 84056-5996

DISA SMC Oklahoma City, Gate 33, SE59 and Air Depot Rd, 8705 Industrial Blvd., Bldg. 3900 Tinker AFB, Oklahoma City, OK 73145-3064

DISA ISC San Antonio, 3326 General Hudnell Drive, San Antonio, TX 78226-2023 DECC Europe, Room 157, Bldg 2340, Patch Barracks, Stuttgart, GE 70569 DISA CENT Field Office NSA Bahrain, PSC 451 Box 200, FPO, AE 09834

Alternate Place of Performance - Contingency Only. As determined by the Contracting Officer’s Representative (COR), contractor employees may be required to work at an alternate place of performance (e.g., home, the contractor's facility, or another approved activity within the local travel area) in cases of unforeseen conditions or contingencies (e.g., pandemic conditions, exercises, Government closure due to inclement weather, etc.). Additionally, the contractor may be required to account for the whereabouts of their personnel should this information be requested by the COR. Non-emergency/non- essential contractors should not report to a closed Government facility. Contractor shall prepare all deliverables and other contract documentation utilizing contractor resources. To the extent possible, the contractor shall use best efforts to provide the same level of support as stated in the PWS. In the event the services are impacted, reduced, compromised, etc., the Contracting Officer or the contractor may request an equitable adjustment pursuant to the Changes clause of the contract.

10. Period of Performance.

The period of performance for this Indefinite-Delivery, Indefinite-Quantity (IDIQ) contract will be a 1-year base period and four 1-year option periods:

PoP: December 1, 2026 through November 30, 2031 Base Year: December 1, 2026 – November 30, 2027 Option Year 1: December 1, 2027 – November 30, 2028 Option Year 2: December 1, 2028 – November 30, 2029 Option Year 3: December 1, 2029 – November 30, 2030 Option Year 4: December 1, 2030 – November 30, 2031

11. Security Requirements.

This section supplements Block 13 of the Government provided DD Form 254, Contract Security Classification Specification. The following security requirements shall apply to this effort.

NOTE: This Indefinite Delivery Contract’s security requirements/DD254 will cover all future Tasks Orders; DD254s will not be required for individual task orders.

The contractor shall coordinate visits with site Point of Contract (POC)s providing at least a 72-hour notice (or according to each site security requirements) prior to any site access. Contractor personnel without security clearances performing any task under this PWS must be escorted by cleared DISA personnel (civilian, military, or contractor).

References:

a. DISA End User Access Agreement

b. DISA Instruction 240-240-01, External Peripheral Devices Authorized for Network Connectivity

c. DISA Instruction 240-110-8, Information Security

d. DISA Instruction 240-110-34, Controlled Unclassified Information (CUI)

e. DISA Instruction 240-110-36, Personnel Security

f. DISA Instruction 240-110-38, Industrial Security

g. DISA Instruction 240-110-43, Counterintelligence

h. DISA Instruction 240-110-43, Insider Threat Program

i. DISA Instruction 630-230-19, Cybersecurity

j. DoD Manual 5200.01, Vol. 1 and 3, DoD Information Security Program, 17 January 2025

k. DoD Manual 5200.01, Vol. 2, DoD Information Security Program, 28 July 2020

l. DoD Instruction 5200.48, Controlled Unclassified Information (CUI), 6 March 2020

m. DoD Manual 5200.02, Procedures for the DoD Personnel Security Program (PSP), 3 April 2017, Change 1, 29 October 2020

n. 32 CFR Part 117, National Industrial Security Program Operating Manual (NISPOM), 24 February 2021

o. DoD Directive 5240.06, Counterintelligence Awareness and Reporting (CIAR), 17 May 2011, Change 3, 31 August 2020

p. DoD Instruction O-5240.24, Counterintelligence (CI) Activities Supporting Research, Development, and Acquisition (RDA), 8 June 2011, Change 2, 15 July 2020

q. DoD Instruction 5205.16, “The DoD Insider Threat Program,” December 20, 2024

r. DoD Instruction 5230.24, Distribution Statements for DoD Technical Information, 10 January 2023

s. DoD Instruction 8510.01, Risk Management Framework for DoD Systems, 19 July 2022

t. DoD Manuel 5400.07, DoD Freedom of Information Act (FOIA) Program, 25 January 2017

u. Security Executive Agent Directive 3 (SEAD 3) Reporting Requirements for Personnel With Access To Classified Information or Who Hold Sensitive Position, 12 June 2017

v. Security Executive Agent Directive 4 (SEAD 4), National Security Adjudicative Guidelines, 8 June 2017

11.1 Facility Security Clearance. Work performed under this contract/order is up to the Secret level. Therefore, the company must have an interim or final Secret Facility Clearance from the Defense Counterintelligence and Security Agency (DCSA) Facility Clearance Branch.

11.1.2 Invalidated Facility Clearance. Companies with invalidated facility clearances (including those in partnerships, subcontracts, and Joint Ventures) are not eligible to bid on or be awarded any new or additional DISA classified contracts, subcontracts, or receive additional classified information except for information necessary for the completion of your current classified contracts. In addition, those companies with invalidated facility clearances will not be permitted access to all DISA networks. Performance on any DISA classified contracts, at any location, will not be authorized until it has been granted a Facility Security Clearance (FCL) at the appropriate level by DCSA.

11.2 Security Clearance. All personnel performing on or supporting a DISA contract/order in any way shall be U.S. citizens. The personnel security requirements for this contract/order cover the individuals supporting the Task Areas delineated in the table below. Contractor personnel must possess the interim or final security clearance eligibility delineated in the table below when performance starts.

NOTE: 11.2 Justification for Access to Classified must be listed in Section 6.

11.3 Investigation Requirements.

11.3.1 All personnel requiring Secret access under this contract/order shall undergo a favorably adjudicated Tier 3 (T3) Investigation formerly known as a National Agency Check, Local Agency Check and Credit Check or Access National Agency Check and Inquiries as a minimum investigation. Enrollment into Continuous Evaluation current within 5 years and, reflected in DISS, would meet the requirement for a current PR.

11.3.2 The contractor is required to have personnel cleared with an interim or final Secret (as specified in the table located in section 11.2) at contract start date. If contractor personnel are replaced during performance of the contract, replacement personnel should also have interim or final clearance Secret (as specified in the table located in section 11.2).

11.4 Visit Authorization . Visit requests shall be processed and verified through the DISS to the Security Management Office (SMO) DKABAA10. DISS visits for contracts/orders are identified as “Other” or “Temporary Additional Duty (TAD)/Temporary Duty (TDY)” and will include the Contract/Order Number of the contract/order in the Additional Information section. Contractors that do not have access to DISS may submit visit authorizations by e-mail in a password protected portable document format file (.pdf) to the COR/ACOR specified in PWS/SOW Section 1.0.

*Prior coordination with the DISA COR should be made via email to ensure the Visit Authorization Letter (VAL)/ Visit Authorization Request (VAR)/ Visit Termination Notification (VTN) process is agreed upon and properly secure.

11.4.1 VAR Package. VAR Centers must receive VAR packages from the Security Manager (via email and require pre-approval from the assigned DISA COR) at a minimum of five business days in advance of the initial report date or renewal. For option years, VARs should be renewed 30-90 days prior to the expiration date unless modified sooner for changes such as name, COR/sponsor, contract modification, etc. As an option, a VAR can be approved for up to a maximum of three (3) years within the POP for contractors. The VAL/VAR/VTN should be sent via email to the appropriate COR. The VAL/VAR/VTN should be sent using in a locked “Zip” file in one e-mail and then followed up by another e-mail with the password to unlock the Zipped file, because it contains sensitive information covered by the Privacy Act.

Documents to include in the VAR Package (DISA Field Sites may have site specific VAR requirements):

1. Inter-office Memorandum (IOM)

2. DD Form 254 Prime and/or Sub (Good Standing approval emails for current option year)

3. PWS/SOW/Sub Memo

4. DISS verification of Visit Authorization by Security Manager

5. (Optional: see NOTE below) Contractor VAL signed by the Contractor Facility Security Officer (FSO)

NOTE: If DISS is not available, the VAL must contain the following information on company letterhead:

· Company name, address, telephone number, facility security clearance

· Commercial and Government Entity Code (CAGE CODE)

· Contract/Order Number

· Name, Social Security Number (SSN), date and place of birth, and citizenship of the employee intending to visit, email address, and phone number

· Certification of personnel security clearance and any special access authorizations required for the visit (type of investigation & date and adjudication date & agency)

· Name of COR/Alt COR

· Dates or period the VAL is to be valid (i.e., Start date / End date)

11.4.2 VTN Package. The contractor FSO will forward a VTN letter to the DISA COR identified in the PWS/TO/Sub for all employees leaving the contract/task order/subcontract.

11.4.2.1 In addition, the DISA CORs and security managers shall inform the DISA Security Office when contractor personnel are removed for cause from a contract supporting DISA. This step is being added to prevent contractor personnel removed for security related issues from returning to DISA without appropriate vetting. This step will also provide security with pertinent information to make an informed decision regarding potential contractor employees’ access to secure facilities and sensitive information. “For Cause” is information regarding an individual that falls into one or more of the actions or incidents that are within one of the 13 adjudicative guidelines as cited in the Security Executive Agent Directive (SEAD) 4:

1. Allegiance to the United States

1. Foreign Influence

1. Foreign Preference

1. Sexual Behavior

1. Personal Conduct

1. Financial Considerations

1. Alcohol Consumption

1. Drug Involvement and Substance Misuse

1. Psychological Conditions

1. Criminal Conduct

1. Handling Protected Information

1. Outside Activities

1. Use of Information Technology Other actions:

• Incidents involving violence in the workplace or harassment.

• Misuse of time.

• Inspector General or General Counsel related inquiries.

• Failure to comply with security policies and procedures.

• Other reasons that prompted removal of a contractor.

The VTN must contain the following information on company letterhead

· Company name, address, telephone number, facility security clearance

· CAGE CODE

· Contract/Order Number

· Name, SSN, date and place of birth, and citizenship of the employee, email address, phone number

· Date contractor Common Access Card (CAC) was collected

· Name of COR/Alt COR

· Termination Date

· Reason for Termination: <insert reason from the 13 adjudicative guidelines, other actions, or type “No longer working on contract”>

*Any VAL/VAR submitted without the above information will be denied.*

11.5 Security Contacts. DISA Security Personnel can be contacted for Industrial or Personnel Security related issues at the following:

Defense Information Systems Agency

Defense Information Systems Agency

ATTN: J-16, Industrial Security

ATTN: J-16, Personnel Security

Command Building

Command Building

6910 Cooper Ave.

6910 Cooper Ave.

Fort Meade, MD 20755-7088

Fort Meade, MD 20755-7088 disa.meade.j1.mbx.mp6-industrial-security@mail.mil disa.meade.j-1.list.mp6-personnel-security@mail.mil

For Center or Directorate-specific security related matters, contact the Directorate or Center Security Manager at:

Name: Kimberly Siler-Smith Phone Number: (667) 890-9583 Email: Kimberly.J.Siler-Smith.civ@mail.mil Defense Information Systems Agency ATTN: J-16, Industrial Security Command Building

11.6 Information Security and other miscellaneous requirements.

11.6.1 Contractor personnel shall comply with all local security requirements including entry and exit control for personnel and property at the Government facility.

11.6.2 Contractor employees shall be required to comply with all Government security regulations and requirements. Initial and periodic safety and security training and briefings will be provided by Government security personnel. Failure to comply with Government security regulations and requirements shall require the company to provide the Government with a written remediation/corrective action plan; furthermore, failure to comply with such requirements can be cause for removal and the contractor will not be able to provide service on this contract/order.

11.6.3. Contractor employees with an incident report in DISS who have had their access to classified suspended will not be permitted to fill positions requiring access to classified information on a DISA contract/order.

11.6.4 The contractor shall not divulge any information, classified or unclassified, about DoD files, data processing activities or…