PWS_DoWEA_ITSS_031026_DRAFT.pdf

CONTROLLED UNCLASSIFIED INFORMATION (CUI)

SOURCE SELECTION INFORMATION – SEE FAR 2.101 AND 3.104

CONTROLLED UNCLASSIFIED INFORMATION (CUI)

DRAFT

DEPARTMENT OF WAR EDUCATION ACTIVITY (DoWEA)

PERFORMANCE WORK STATEMENT (PWS)

FOR

DoWEA Information Technology Support Services (ITSS)

1.0 Introduction

The Department of War Education Activity (DoWEA) operates 161 accredited schools across Europe, the Pacific, the Americas, and Headquarters, serving more than 71,000 students with approximately 15,000 employees. DoWEA requires comprehensive Information Technology Support Services (ITSS) to support end user computing, classroom technology, cybersecurity, and enterprise systems to ensure instructional continuity and global operational readiness.

This contract delivers enterprise-wide, standardized IT support aligned with DoWEA’s mission to provide a worldclass education for military connected students.

1.1 Background

DoWEA operates as a field activity under the Office of the Secretary of Defense (Personnel & Readiness) and supports globally distributed schools and offices spanning 11 foreign countries, seven U.S. states, Guam, and Puerto Rico. DOWEA broad geographic footprint requires a standardized, reliable, and secure IT support infrastructure to ensure consistent operations across all locations.

This Performance Work Statement (PWS) defines performance based requirements for enterprise IT support services, including helpdesk operations, onsite technical support, endpoint and account management, cybersecurity compliance, instructional technology support, and enterprise collaboration tools.

1.2 Scope

The contractor shall provide all personnel, management, supervision, tools, equipment, and services necessary to deliver enterprise Information Technology Support Services (ITSS) in support of the Department of War Education Activity (DoWEA). The scope of this requirement includes the full range of enterprise and end-user IT services required to ensure the availability, reliability, security, and continuity of DoWEA’s global technology environment.

CONTROLLED UNCLASSIFIED INFORMATION (CUI)

DoWEA requires IT contractor support to provide reliable, secure, and responsive enterprise IT services that sustain the mission and operational readiness of DoWEA by ensuring all schools, districts, regions, and headquarters offices receive consistent, timely, and high-quality support;

maintaining secure, compliant, and fully operational end-user, network, and enterprise systems across the global environment; enabling uninterrupted instruction, student assessments, and mission-critical business operations through dependable technology services; providing a scalable surge capability to address changing workload demands and emergent Government requirements; and delivering essential operational support functions, including service desk operations, assessment readiness, warranty coordination, cybersecurity compliance, endpoint deployment, directory and identity management, and K–12 Zero Trust activities.

The contractor shall provide surge support as required to address increases in workload associated with technology modernization, cyber compliance activities, emergent directives, or other mission critical initiatives.-aligned IT services that enable uninterrupted daily operations, classroom instruction, enterprise collaboration, and the secure handling of information. -critical initiatives.

1.3 Task Orders and IDIQ Structure

This is a single-award Indefinite Delivery/Indefinite Quantity (IDIQ) contract. The Government will issue task orders under this IDIQ to define specific locations, quantities, schedules, and additional or emergent IT support requirements. Task orders may include surge support, expanded staffing, special events, technology deployments, or other mission-critical needs.

Each task order will specify applicable PWS objectives, supporting tasks, performance standards, and deliverables. Task orders may also define additional metrics or AQLs unique to the work being ordered.

The contractor is expected to respond to task orders in a timely manner, integrating personnel and resources as needed, while maintaining compliance with all PWS objectives, performance metrics, and Government technical and security standards. Surge task orders are optional, and the Government reserves the right to exercise surge or additional task orders unilaterally to meet mission requirements without disrupting ongoing operations.

All work performed under this contract shall comply with applicable DoW, DISA, and DoWEA policies, cybersecurity requirements, technical standards, and operational procedures.

2.0 Requirement Objectives and Tasks

2.1 Enterprise-Wide Multi-Capable IT Support Services-Wide (Objective #1)

The objective of this IT support contract is to provide enterprise wide IT support through centralized service desk and localized onsite technical support to ensure all DoWEA schools, districts, regions, and headquarters offices receive consistent, timely, and high quality IT

CONTROLLED UNCLASSIFIED INFORMATION (CUI)

services, enabling uninterrupted daily operations and classroom activities while maintaining high levels of customer satisfaction and SLA compliance.

Task Order Applicability: Specific locations, coverage, staffing levels, or special events for IT service desk and onsite support will be defined in task orders. Each task order will apply the PWS objectives, supporting tasks, and performance standards, while allowing for adjustments in scope, volume, or scheduling to meet mission needs.

The following listed tasks help the contractor understand the requirements to meet the objective but are not exhaustive. The contractor must develop a complete solution using a performance-based approach:

Supporting Tasks for Objective # 1:

The contractor shall:

1. IT Service Resolution: Resolve IT service requests, incidents, and problems across all regions, districts, schools, and headquarters, including the Mark Center, promptly to maintain uninterrupted daily operations.

2. Service Desk Operations: Operate a centralized Service Desk/Call Center that logs and addresses all user requests within 15 minutes, ensuring high responsiveness and SLA compliance.

3. Staffing and Coverage: Maintain ≥95% staffing for Region Project Managers, Region Leads, and Service Desk Technicians each month, ensuring continuous and consistent support coverage.

4. Remote and Onsite Support: Provide remote and onsite technical assistance that meets or exceeds SLA closure metrics, maximizing system uptime and end-user productivity.

5. Special Event Support: Deliver after-hours and weekend IT support for conferences, open houses, vendor demonstrations, and VIP visits, ensuring seamless operations.

6. Testing Support: Facilitate ACT/SAT Saturday testing and base escort/sign-on processes, ensuring secure and uninterrupted testing operations.

7. Service Acceleration: Operate a Service Acceleration Group to quickly resolve recurring issues and escalate systemic problems, minimizing widespread IT disruptions.

8. Off-Site Conference Support: Ensure successful operation of off-site conferences (2–4 events per region annually) through setup, testing, and technical support for IT and AV systems.

9. Technology Implementation Surge Support: Provide surge support for new technology deployments (e.g., MILCON, DCAP, infrastructure lifecycle upgrades, CTO-directed initiatives, cyber compliance events), ensuring timely deployment and operational readiness.

Performance Standards and AQLs

• Standard 1.1 – Ticket Responsiveness o Standard: All IT service requests are acknowledged and entered in ITSM within required timelines.

CONTROLLED UNCLASSIFIED INFORMATION (CUI)

o Measure: Time to create ticket from user contact.

o AQL: 95% of tickets created within 15 minutes.

• Standard 1.2 – Timely Resolution o Standard: Incidents and requests are resolved within Government defined resolution targets for each priority level.-defined resolution targets for each priority level.

o Measure: Percent of tickets resolved within SLA window.

o AQL: 95% monthly SLA compliance.

• Standard 1.3 – Staffing Availability o Standard: Contractor maintains staffing levels required to sustain consistent operations.

o Measure: Monthly staffing percentage versus contract requirement.

o AQL: 95% of positions staffed; no vacancy exceeding 15 consecutive workdays.

• Standard 1.4 – Special Event Support o Standard: On-site support for ACT/SAT testing, VIP visits, Esports and demonstrations is delivered as scheduled.

o Measure: Support provided per Government schedule.

• AQL: 100% support for scheduled events

2.2 Device, Hardware, Peripherals & Software Support (Objective #2)

The objective of this requirement is to ensure all end user devices, peripherals, and classroom technologies operate reliably and meet DoWEA standards, supporting uninterrupted instruction and daily operations, achieving minimal downtime and timely remediation of hardware and software issues.

Task Order Applicability: Task orders may specify quantities, deployment locations, or timing for device, hardware, or software support. Contractors must execute all PWS tasks and performance standards while accommodating task order-specific requirements.

The following listed tasks help the contractor understand the requirements to meet the objective but are not exhaustive. The contractor must develop a complete solution using a

Supporting Tasks for Objective #2:

CONTROLLED UNCLASSIFIED INFORMATION (CUI)

1. Hardware Reliability: Maintain fully functional desktops, laptops, printers, interactive flat panels, document cameras, scanners, webcams, docking stations, and encrypted USB devices by diagnosing, repairing, replacing, installing, configuring, testing, tracking, and upgrading hardware with minimal disruption.

2. Classroom Technology Readiness: Configure and integrate classroom and visual display technologies to ensure seamless instructional operations and uninterrupted learning.

3. Warranty Management: Initiate warranty actions within 2 working days and coordinate with the Government-designated provider, ensuring rapid resolution of device issues.

4. Software Management: Install, uninstall, configure, and update approved software on Windows, Apple, and ChromeOS devices using Government-specified tools, maintaining operational readiness and compliance with security standards.

5. Moves, Adds, and Changes (MAC): Execute MAC tasks for hardware and software in coordination with regional and district liaisons, minimizing operational impact.

6. Preventative Maintenance: Conduct proactive maintenance (e.g., disk optimization, profile cleanup, decommissioning retiring equipment) to sustain device performance and extend lifecycle.

• Standard 2.1 – Hardware Functionality o Standard: Hardware is repaired, replaced, configured, or validated to ensure full operational readiness.

o Measure: Percentage of serviced devices meeting functional standards.

o AQL: 95% of devices fully functional after service.

• Standard 2.2 – Warranty Processing o Standard: Warranty actions are initiated within required timeframes.

o Measure: Time from issue identification to warranty initiation.

o AQL: 95% initiated within 2 business days.

• Standard 2.3 – Software Deployment o Standard: Software deployments are accurate, successful, and compliant with configuration baselines.

o Measure: Installation success and rework rates.

o AQL: 95% success on first attempt.

CONTROLLED UNCLASSIFIED INFORMATION (CUI)

• Standard 2.4 – Preventative Maintenance o Standard: Preventative maintenance is completed within scheduled windows.

o Measure: Completion rate vs scheduled PM tasks.

o AQL: 100% of PM tasks completed; ≤10% schedule slip as approved by COR.

2.3 Cybersecurity, IAVM & Zero Trust Support (Objective #3)

The objective of this requirement is to ensure secure and compliant operations of DoWEA IT systems through timely execution of cybersecurity directives, adhering to IAVM notices, and enforcing K–12 Zero Trust controls to maintain uninterrupted, reliable IT services.

Task Order Applicability: Task orders may define specific systems, assessment schedules, or emergent cybersecurity directives. Contractors must implement all PWS tasks and performance standards while incorporating task order-specific timelines and scope.

The following listed tasks help the contractor understand the requirements to meet the objective but are not exhaustive. The contractor must develop a complete solution using a performance-based approach:

Supporting Tasks for Objective #3

1. IAVM Compliance: Ensure all applicable systems and assets comply with IAVM notices, maintaining security posture and reducing risk exposure.

2. Environment Assessment: Assess the operating environment for each IAVM and report results to DoDEA Cybersecurity within 3 business days, enabling timely risk management decisions.

3. Vulnerability Mitigation: Mitigate identified vulnerabilities or submit POA&Ms within 90 days for Government review and approval, minimizing exposure and ensuring compliance.

4. Zero Trust Support: Provide frontline support for K–12 Zero Trust operations, including enforcement of identity, device, and network access controls, MFA troubleshooting, device compliance verification, and secure network onboarding, ensuring secure access and operational continuity.

5. Security Monitoring & Escalation: Monitor security alerts related to user access and endpoint posture, escalating anomalies promptly to senior administrators or Government personnel to prevent security incidents.

• Standard 3.1 – IAVM Compliance

CONTROLLED UNCLASSIFIED INFORMATION (CUI)

o Standard: All IAVM actions are completed within Government-defined reporting timelines.

o Measure: Time to submit assessments; IAVM patch compliance rate.

o AQL: 100% assessment submission within 3 business days.

• Standard 3.2 – Vulnerability Mitigation o Standard: Findings are mitigated or POA&Ms submitted within required timelines.

o Measure: Time to mitigation or POA&M submission.

o AQL: 100% within 90 days.

• Standard 3.3 – Zero Trust Enforcement o Standard: Identity, device, and network access controls are applied consistently.

o Measure: Number/percentage of misconfigured or non-compliant devices.

o AQL: ≥98% Zero Trust compliance.

2.4 Directory, Identity & Account Management (Objective # 4)

The objective of this requirement is to ensure accurate, timely, and secure provisioning and lifecycle management of staff and student accounts to provide reliable access to DoWEA systems maintain strong identity governance and minimize access related incidents.

Task Order Applicability: Task orders may define account volumes, system locations, or special provisioning needs. Contractors must execute all PWS tasks and performance standards while incorporating task order-specific requirements.

The following listed tasks help the contractor understand the requirements to meet the objective but are not exhaustive. The contractor must develop a complete solution using a performance-based approach:

Supporting Tasks for Objective #4

1. Account Lifecycle Management: Create, modify, disable, and manage staff and student user accounts and mailboxes in Microsoft Entra ID, on-premises Active Directory, and related directory services, ensuring accurate and secure access.

2. Timely Account Provisioning: Provision new accounts and mailboxes within 1 business day of validated requests, enabling rapid access for staff and students.

3. Password & Access Support: Reset or unlock passwords within 1 hour during normal

CONTROLLED UNCLASSIFIED INFORMATION (CUI)

operating hours, minimizing downtime and maintaining productivity.

4. Device & Configuration Management: Manage computer objects (join, move, rename, delete), DHCP reservations, and related configuration items to ensure proper network and device functionality.

5. Quarterly Cleanup: Perform quarterly cleanup of stale accounts and device objects in AD, Entra, Intune, and Google environments, maintaining system integrity, security, and compliance.

• Standard 4.1 – Account Provisioning o Standard: User accounts and mailboxes are created within the required timeframe.

o Measure: Time from validated request to account creation.

o AQL: 98% created within 1 business day.

• Standard 4.2 – Password Resets o Standard: Password resets and unlocks are completed promptly.

o Measure: Time to complete reset/unlock.

o AQL: 98% completed within 1 hour.

• Standard 4.3 – Directory Hygiene o Standard: Quarterly cleanup of stale objects is completed and documented.

o Measure: Percentage of stale accounts/objects resolved per quarter.

o AQL: 100% cleanup each quarter.

2.5 Classroom Technology & Assessment Support (Objective #5)

The objective of this requirement is to ensure classroom technologies and assessment environments are fully prepared, configured, and supported to enable uninterrupted teaching, learning, and student testing, minimizing delays or failures attributable to contractor performance.

Task Order Applicability: Task orders may specify assessment periods, classrooms, or esports events. Contractors must meet all PWS tasks and performance standards while accommodating task order-specific schedules and requirements.

The following listed tasks help the contractor understand the requirements to meet the

CONTROLLED UNCLASSIFIED INFORMATION (CUI)

Supporting Tasks for Objectives #5

1. Assessment Device Readiness: Prepare and validate student assessment devices, confirming operational readiness with Government representatives at least one week prior to testing to ensure uninterrupted, secure assessments.

2. Onsite Assessment Support: Provide onsite technical support during student assessments and high-stakes testing events, minimizing disruptions and ensuring accurate, timely testing.

3. Classroom Technology Reliability: Support classroom technologies (interactive boards, projectors, multimedia systems, etc.) to maintain full functionality for daily instruction and learning continuity.

4. Technology Training & Demonstrations: Deliver one-on-one or small group demonstrations of new enterprise hardware and software within Government-specified timelines, ensuring staff and students are proficient and productive.

5. Esports Environment Management: Plan, configure, deploy, operate, and troubleshoot esports environments (labs, arenas, classrooms, multi-purpose spaces) to support authorized DoDEA esports activities with reliable performance.

Performance Standards (Objective #5)

• Standard 5.1 – Assessment Readiness o Standard: Devices are fully prepared for student assessments one week before test day.

o Measure: Confirmation of readiness by district assessment/IT leads.

o AQL: 100% readiness validation for scheduled assessments.

• Standard 5.2 – Classroom Technology Availability o Standard: Classroom technologies required for daily instruction remain operational.

o Measure: Percentage of functional classroom devices.

o AQL: 95% operational availability.

• Standard 5.3 – Training & Demonstrations o Standard: Demonstrations and training on new technologies are provided within required timeframes.

o Measure: Time from user request or deployment to delivery of demo.

o AQL: 95% within 3 business days.

CONTROLLED UNCLASSIFIED INFORMATION (CUI)

• Standard 5.4 – Esports Support o Standard: Esports labs and equipment are fully functional for scheduled sessions and events.

o Measure: Successful operation during events.

AQL: 100% functionality during scheduled use.

2.6 Network, Telephony, and System Administration (Objectives #6) The objective of this requirement is to provide reliable network, telephony, and system administration support to sustain availability, performance, and compliance of IT infrastructure, ensuring stable services that enable end user operations and meet Government technical and security baselines.

Task Order Applicability: Task orders may define network segments, telephony systems, maintenance windows, or system administration coverage. Contractors must meet all PWS tasks and performance standards while incorporating task order-specific requirements.

The following listed tasks help the contractor understand the requirements to meet the objective but are not exhaustive. The contractor must develop a complete solution using a performance-based approach:

Supporting Tasks for Objective #6

1. Network Hardware Maintenance: Replace, cable, power, and validate network hardware, monitor performance dashboards, and assist with SD-WAN troubleshooting to ensure reliable network operations and minimal downtime.

2. Wireless Infrastructure Support: Install, replace, cable, and validate access points to maintain comprehensive wireless coverage and consistent connectivity across all locations.

3. System Administration: Perform OS and patch updates, conduct system compliance checks, execute approved scripts, perform routine maintenance during scheduled downtimes, and execute basic backup/restore actions to ensure secure, fully operational systems.

4. Voice & VoIP Support: Support voice and VoIP services, including CUCM and mobile device configurations, and assist with local telephone services as required, ensuring uninterrupted communication capabilities.

Performance Standards (Objective #6)

• Standard 6.1 – Network Hardware Serviceability o Standard: Network hardware and wireless access points are serviced and validated within required timeframes.

CONTROLLED UNCLASSIFIED INFORMATION (CUI)

o Measure: Time to complete network hardware actions.

o AQL: 95% completed within SLA timelines.

• Standard 6.2 – System Compliance o Standard: Workstations and systems maintain required patch and configuration compliance.

o Measure: Percentage of compliant systems.

o AQL: 98% device compliance.

• Standard 6.3 – Telephony Support o Standard: VoIP, CUCM, and mobile services are restored and maintained per SLA requirements.

o Measure: Time to resolve telephony issues.

o AQL: 95% telephony issues resolved within SLA timelines.

2.7 Program Management, Quality, Reporting, and Deliverables (Objective #7)

The objective of this requirement is to provide effective program management, quality control, and reporting to ensure transparent performance oversight and continuous service improvement, delivering timely and accurate contract information to support Government oversight, performance management, and quality assurance.

Task Order Applicability: Task orders may require additional reporting, deliverable formats, or oversight metrics. Contractors must maintain all PWS supporting tasks and performance standards while incorporating task order-specific reporting requirements.

The following listed tasks help the contractor understand the requirements to meet the objective but are not exhaustive. The contractor must develop a complete solution using a performance-based approach:

Supporting Tasks for Objective #7

1. Quality Control & Performance Improvement: Develop, maintain, and update the Quality Control Plan (QCP) and Performance Improvement Plan (PIP) to ensure contract performance meets or exceeds Government standards.

2. Contract Staffing Oversight: Maintain an accurate contract roster, including vacancy, clearance, and CAC status, and submit roster reports at Government-specified intervals to ensure staffing accountability and readiness.

CONTROLLED UNCLASSIFIED INFORMATION (CUI)

3. Reporting & Deliverables: Produce and deliver IAVM Assessment Reports, POA&Ms, performance metrics, and other contract data deliverables in required formats and on schedule, supporting timely Government oversight and decision-making.

4. SOPs & Knowledge Management: Create and maintain SOPs and knowledge content (e.g., CANs and FANs) on Government-designated platforms, ensuring staff have access to up-to-date guidance and procedures to support consistent operations.

Performance Standards (Objective #7)

• Standard 7.1 – Quality Control Plan o Standard: Contractor maintains an effective QC program and updates the QCP as required.

o Measure: Timeliness and completeness of QCP submissions.

o AQL: 100% on-time QCP submissions.

• Standard 7.2 – Reporting Accuracy o Standard: Required contract deliverables are accurate and submitted on time.

o Measure: Deliverable timeliness and correction rate.

o AQL: 100% on time; ≥98% accuracy.

• Standard 7.3 – SOP & Knowledge Management o Standard: SOPs and knowledge content are kept current with operational changes and Government guidance.

o Measure: Time to update content after change.

o AQL: 100% updated within 5 business days of Government-directed change.

2.8 Surge Support (Objective #8)

The Government may require surge support during the base or any option period to provide increased support for the defined task areas of the PWS. Surge support is OPTIONAL and is not guarantee. If the Government determines additional support is in the PWS, the Government reserves the right to unilaterally exercise the surge option to ensure mission requirements are met without disruption to ongoing operations.

Task Order Applicability: Surge support is task order driven and optional. The Government may unilaterally issue surge task orders as needed. Contractors must integrate additional personnel and resources quickly while meeting all PWS supporting tasks and performance standards.

CONTROLLED UNCLASSIFIED INFORMATION (CUI)

The following listed tasks help the contractor understand the requirements to meet the performance-based approach:

Supporting Tasks for Objective #9 Objective Statement

The objective of this requirement is to provide scalable, responsive surge support across all ITSS functional areas to address temporary increases in workload, emergent operational requirements, technology initiatives, or mission‑critical events, ensuring continuity of instruction, assessments, cybersecurity compliance, and enterprise IT operations without degradation to baseline services.

Task Order Applicability:

Surge support is task order–driven and optional. When exercised, task orders will define the duration, locations, functional areas, staffing levels, and performance expectations for surge activities. Contractors shall integrate surge resources rapidly while meeting all applicable PWS objectives, performance standards, and service level requirements

The contractor shall:

• Surge Staffing & Coverage: Provide additional qualified personnel to support service desk operations, onsite technical support, system administration, cybersecurity, identity management, and network operations during periods of increased demand.

• Instructional & Assessment Continuity: Expand coverage for classroom technology, assessment environments, testing windows, and esports labs to ensure uninterrupted instruction and student testing during surge periods.

• Cybersecurity & Compliance Support: Augment cybersecurity, IAVM, Zero Trust, and monitoring activities to maintain compliance, security posture, and SLA performance during surge events.

• Rapid Integration: Coordinate with Government personnel to onboard, credential, and integrate surge staff and resources quickly, minimizing disruption to ongoing operations.

• Performance Tracking & Reporting: Track surge activities, staffing utilization, and performance metrics, and provide surge‑specific reporting as required to demonstrate effectiveness and adherence to quality and SLA standards.

CONTROLLED UNCLASSIFIED INFORMATION (CUI)

Performance Standards and AQLs (Objective #9)

Standard 9.1 – Surge Staffing Responsiveness

• Standard: Surge personnel are mobilized and integrated within Government‑specified timelines.

• Measure: Time from task order issuance to surge staffing availability.

• AQL: 95% of surge personnel deployed within task order timelines.

Standard 9.2 – Continuity of Operations

• Standard: Baseline IT services, instructional technology, and assessment support are maintained during surge periods.

• Measure: SLA compliance rates for impacted services.

• AQL: ≥95% SLA compliance during surge execution.

Standard 9.3 – Surge Performance Reporting

• Standard: Surge activity reports and metrics are accurate and submitted as required.

• Measure: Timeliness and accuracy of surge reporting.

• AQL: 100% on‑time submission; ≥95% accuracy.

3.0 Constraints - Section

3.1 Work Hours & Place of Performance

The contractor shall conduct normal operations from 0730–1630 local time, Monday–Friday (Sunday–Thursday in Bahrain), excluding Federal holidays and Government closures. Support shall be provided across all DoWEA Regions (Europe, Pacific, Americas) and Headquarters locations, including OCONUS assignments. After-hours support is permitted only for scheduled or critical activities as described in Section 2.2 and as approved by the COR. Travel within the primary place of performance (e.g., between schools and offices within commuting areas) is required and not separately billable; additional CONUS/OCONUS travel may be required as authorized by the COR.

3.2 Federal Holidays

The contractor shall observe U.S. Federal holidays in accordance with Government schedules.

Bahrain-based personnel shall observe locally applicable holidays as directed, including Arafat Day Holiday, Eid Al-Adha Holiday, Al Hijri New Year, Ashoora, and the Prophet’s Birthday.

3.3 Security Clearance Requirements

All contractor personnel supporting this effort shall be U.S. citizens and must possess, at a

CONTROLLED UNCLASSIFIED INFORMATION (CUI)

minimum, an interim or final Secret clearance and IT-II eligibility at the start of performance.

School-based personnel shall also meet Child Care Background Check requirements per DoWI

1402.05 and DD 2981.

3.4 Installation and Building Access

The contractor shall comply with all installation access requirements, including CAC issuance, visitor control procedures, and local security screening. Personnel without required clearances must be escorted by cleared Government personnel as directed.

4.0 Government-Furnished Resources - Section

The Government will provide equipment, property, facilities, systems, manuals, and information necessary for the contractor to perform the tasks described in this PWS, including at a minimum:

• One Government laptop with accessories per authorized FTE

• Access to DoWEA networks, systems, ITSM, and collaboration platforms

• Applicable DoWEA policies, Customer Advisory Notices (CANs), Facility Advisory Notices (FANs), IAVM directives, and other governing documentation

Contractor use of Government-furnished resources shall comply with all applicable regulations and security requirements.

4.1 GFP/GFE

Government will provide laptops and required accessories. No personal devices may connect to DoWEA networks.

4.2 GFI/GFM

Government will provide required systems, manuals, and information

5.0 Contract Data Deliverables - Section

The contractor shall provide the following deliverables at a minimum:

PWS

Ref Deliverable Title Format Copies Due Date Submit

To

6.2 / 2.3

IAVM Assessment Report Contractor format 1 ≤ 3 business days after IAVM issue COR

6.2 /

2.3 POA&M Contractor format 1 ≤ 90 days after

IAVM issue COR

CONTROLLED UNCLASSIFIED INFORMATION (CUI)

2.7 Quality Control Plan

(QCP) Contractor format 1 Within 30 days of

PoP start COR

2.7 Performance

Improvement Plan Contractor format 1 Quarterly from PoP start COR

2.7 Contract Roster Excel (fields: location, name/VACANT, etc.) 1 Weekly COR

2.3 Cybersecurity reports

(as req.) Contractor format 1 As specified in

IAVM/cyber tasks COR

2.5

Assessment Readiness Confirmation

Email or report format

1 ≥ 1 week before scheduled tests

COR

6.0 Definitions - Section

This section defines technical or specialized terms used in the PWS to ensure clarity and consistency.

Contracting Officer’s Representative (COR) – An individual designated and authorized in writing by the Contracting Officer to perform specified technical or administrative functions, including surveillance and inspection of contractor performance and providing recommendations regarding acceptance of services.

7.0 Performance Requirement Summary (PRS) - Section

The PRS summarizes key performance objectives, standards, AQLs, and surveillance methods:

Objective Area

Performance Standard (Examples)

AQL Surveillance

Method

Inspector

Enterprise IT Support & Service Desk

Ticket creation & SLA resolution compliance

≥95% Monthly SLA dashboard review

CONTROLLED UNCLASSIFIED INFORMATION (CUI)

Device/Hardware & Software Support

Functional devices after service; timely warranty actions

≥95% / ≥95% Ticket/warranty audit

Cybersecurity/IAVM/Zero Trust

Timely IAVM reports; mitigation or POA&M within 90 days

100%

Document review; system scans

Directory & Account Management

Provisioning and password resets within required timeframes

≥98%

System logs;

ticket audits

Classroom & Assessment Support

Assessment readiness;

classroom tech availability

100% / ≥95%

Pre-test checks;

spot inspections

Network/Telephony/System Admin

Network, system, and telephony SLA compliance

≥95% / ≥98% compliance

Monitoring tools;

ticket review

Program Mgmt & Reporting

Timely, accurate deliverables & QCP/PIP updates

100% on time; ≥98% accuracy

Deliverable review

7.1 Quality Assurance Surveillance Plan (QASP) – Subsection

The Government will monitor contractor performance against this PWS using methods such as:

• SLA dashboards and ITSM reports

• Random and scheduled inspections

• Customer satisfaction surveys and feedback

• Monthly and quarterly performance reviews

The QASP may be updated unilaterally by the Government to reflect changes in surveillance methods or performance priorities.

8.0 Security Requirements – Section

The contractor shall comply with all applicable DoW, and DoWEA security requirements, including but not limited to:

CONTROLLED UNCLASSIFIED INFORMATION (CUI)

• Maintaining a Secret Facility Clearance (where required)

• Ensuring all personnel possess appropriate Secret clearances and IT-II sensitivity

• Complying with DD Form 254 and associated information security requirements

• Adhering to DoWM 5200.01 Vol 1–3, DoW 5200.02, DoW 5220.22-M, and DoWI

5200.48 (CUI)

• Following local security procedures, including wearing/displaying proper identification and reporting security incidents

• CMMC 2.0 Compliance Requirements

• The contractor shall comply with the Cybersecurity Maturity Model Certification (CMMC) 2.0 requirements applicable to this acquisition. CMMC level applicability is based on whether the contractor will handle Federal Contract Information (FCI) or Controlled Unclassified Information (CUI):

• Level 1 (Foundational): Applies to contractors that do not process, store, or transmit CUI and only handle Federal Contract Information (FCI). Contractors must implement the 17 basic safeguarding requirements in FAR 52.204 21.

• Level 2 (Advanced): Applies if the contractor will process, store, or transmit CUI and requires implementation of NIST SP 800 171 security controls.

• The Government may require proof of CMMC certification, assessment results, or affirmation statements as part of contract award or surveillance.

8.1 Cybersecurity Compliance Requirements

• Implement and maintain NIST SP 800 171 controls; conduct continuous monitoring and provide monthly security status reports.

• Encrypt all data in transit and at rest using FIPS 140 2/140 3 validated cryptography;

enforce Multi Factor Authentication (MFA) and Role Based Access Control (RBAC).

• Maintain audit logging, vulnerability management (including regular scanning and patching), configuration management, and incident response, including 72 hour breach notification to the Contracting Officer (CO) and DoDEA Cyber.

• Submit and maintain Supplier Performance Risk System (SPRS) scores in accordance with DFARS requirements; provide access for Government or authorized third party assessors.

• Ensure all subcontractors handling DoDEA data comply with DFARS 252.204 7012, CMMC, and all related cybersecurity requirements.

CONTROLLED UNCLASSIFIED INFORMATION (CUI)

• For cloud-based services: utilize FedRAMP Moderate/High or DoD authorized cloud environments for storing/processing CUI; provide all required documentation including data residency/sovereignty details.

• Comply with FERPA and COPPA for student data and execute the DoDEA Data Privacy Agreement (DPA) when applicable.

DoWEA/DoW reserve the right to require removal of contractor personnel whose actions conflict with Government interests.

9.0 Government-Furnished Property/Equipment/Information – Section

As stated in Section 4.0, the Government will furnish property, equipment, and information necessary for performance. The contractor shall:

• Safeguard all GFP/GFE and use it only for authorized purposes

• Track Government-furnished assets per DoWEA policy

• Immediately report loss, damage, or misuse to the COR

10.0 Other Pertinent Information – Section

10.1 Quality Control (QC)

The contractor shall develop and maintain an effective Quality Control program to ensure services are performed in accordance with this PWS. A written QCP shall be submitted to the KO and COR within 30 days of contract award; updates shall be submitted within 5 business days of Government acceptance of changes.

10.2 Quality Assurance (QA)

The Government will evaluate contractor performance under this contract in accordance with the QASP. QA activities will focus on adherence to performance standards, AQLs, and the overall effectiveness of services provided.

10.3 Status of Forces Agreement (SOFA) / Host-Nation Requirements Where applicable, contractor personnel must comply with Status of Forces Agreements and host-nation laws. Failure to obtain necessary authorizations, licenses, or SOFA status will not be grounds for waiver of performance requirements or price adjustment. The Government may

CONTROLLED UNCLASSIFIED INFORMATION (CUI)

assist where qualification is possible but is not responsible for securing such status.

10.4 Other Direct Costs (ODCs)

ODCs (e.g., tools/materials, lodging, vehicles, Defense Base Act insurance, tuition, and travel) are reimbursable only when explicitly authorized under cost-reimbursement CLINs and in accordance with applicable regulations and rates. General purpose business items are not allowable.

11 Transition Requirements – Section

11.1 Transition-In

The contractor shall execute a transition-in phase of up to 90 days, during which all key personnel and critical positions (e.g., Region PMs, District Leads/Helpdesk Managers) shall be onboard at the start of performance. At least 80% of FTE positions shall be staffed within 30 days of PoP start and 100% within 60 days.

11.2 Transition-Out

The contractor shall begin transition-out planning at least 120 days prior to contract expiration or termination and shall coordinate with the Government to ensure orderly transfer of responsibilities IAW FAR 52.237-3, Continuity of Services.

12.0 Contractor Personnel & Labor Categories – Section

Labor Categories Include:

The contractor shall provide qualified personnel across key labor categories to execute all performance areas, meeting DoWEA technical and security requirements. At a minimum, labor categories include:

• Multi-Capable IT Support Technicians

• Service Desk / Call Center Technicians

• Region Leads

• Project Managers

12.1 Multi-Capable IT Support Staff (K–12 Environment)

Responsibilities include Tier I/II support for students, teachers, and staff; hardware and software support; security and compliance tasks; classroom technology support; customer service and ticket management; account and device administration; knowledge management; and reporting.

Baseline certifications shall include, at minimum, Security+ CE, with role-based certifications

CONTROLLED UNCLASSIFIED INFORMATION (CUI)

such as A+, Network+, Microsoft Endpoint Administrator, and Google Administrator strongly preferred.

12.2 Helpdesk Call Center Technicians

Responsibilities include centralized Tier I support via phone, email, portal, and collaboration tools; ticket intake and documentation; first-contact resolution; customer communication;

knowledge base maintenance; and reporting. Recommended certifications include A+, Security+ CE, ITIL 4 Foundation, and Microsoft/Google fundamentals.

12.3 Training

Contractor employees may be required to complete periodic mandatory Government training (e.g., records management, cyber awareness). Additional training will not be provided by the Government unless explicitly authorized by the KO.

12.4 Section 508 Accessibility

Where applicable, the contractor shall ensure compliance with Section 508 standards for electronic and information technology, particularly 1194.41 (Information, Documentation and Support) and 1194.31 (Functional Performance Criteria), as required by the Government.

Required Certifications:

• Security+ CE

Recommended Certifications

• A+/Network+

• Microsoft Endpoint Administrator (MD-102)

• Google Workspace / Admin certifications