PWS_Draft 02182026.docx

PERFORMANCE WORK STATEMENT (PWS)

1. Contracting Officer’s Representative (COR).

a. Primary COR. Lucian Hammond

b. Administrative COR. Trinetta Black

c. Property Administrator. Sadie Barrett

2. Contract or Task Order Title.

Department of Defense (DOD) Privacy Information Management System (DPIMS) Sustainment

3. Background.

The Defense Information Systems Agency (DISA), a Combat Support Agency, engineers and provides command and control capabilities and enterprise infrastructure to continuously operate and assure a global net-centric enterprise. DISA directly supports joint warfighters, national level leaders, and other missions and coalition partners across the full spectrum of operations. The Program Management Office (PMO) and the program governance structure develop and sustain systems for use by mission partners both internal and external to DISA. As such, each has requirements to validate, and implement software associated with these systems. The Business Systems Portfolio develops and integrates Agency business systems solutions, which includes systems that address key areas such as personnel management, financial management, telecommunication services, contract management, and customer relations among other support services to the DISA mission.

4. Objectives.

DPIMS is the DOD current enterprise-level case management system used for breach reporting across all DOD entities (Combatant Commands, Services, and Agencies). Its purpose is to provide standardized reporting and case management to improve efficiency and streamline operations related to data breaches. It replaced previously used, often inefficient and inconsistent, methods of managing these reports. DPIMS shall provide a continuously improving, enterprise-level capability that supports all DOD breach reporting, processing, analyzing and retention requirements. The DPIMS solutions should continue to provide DOD standardized breach reporting and case‑management capabilities, enable efficiencies, streamline workflows, provide business‑optimized processes:

· Enterprise Transformation

· Provides enhanced case management and annual reporting features

· Alignment with DISA Enterprise Approach

· Mirrors other DISA enterprise solutions that migrate

· Maintain standardized, scalable capability

· Continually improve functionality, consistency, and operational efficiency

· Maintain:

· A consolidated data repository

· Standardized data and processes

· A unified web portal

· Advanced analytical and reporting capabilities

5. Scope.

DISA provided the DPIMS solution as an enterprise, vendor-managed PaaS platform for breach reporting and case management, which operates within a DoD-authorized Microsoft Azure Government IL5 environment.

DPIMS is a capability that uses advanced threat intelligence, automated investigation, threat tracker, attack simulation, categorization and prioritization, system intrusion in real-time to keep pace with the evolving security landscape.

The Government may also require surge support during the base or option periods, with modifications limited to the defined task areas. Surge support will not exceed 10% of the contractor’s total proposed cost/price for the base and all option periods, excluding any six-month extension of services under FAR 52.217-8.

The underlying application consists of a Commercial-off-the Shelf (COTS) solution that is hosted in a DOD approved, cloud hosting environment, as DOD approved Software-as-a-Service (SaaS) solution emulation. The solution includes a unified Single Sign-on web portal for consolidation and reporting. The solution provides broad case management capabilities such as workflow/sub-flows, import/export capabilities, role-based functionality, reporting (pre-built and ad-hoc), content federation, work-flow assignments, notifications, authorization controls, claims service automation, analytics and dashboards using a single sign on portal.

The scope of this effort includes the following areas related to DPIMS breach reporting as further described in Section 6:

Task 1 – Project Management (FFP): This task provides Project Management, Contractor supervision, Technical Writing expertise and documentation support for the DPIMS PMO, and system.

Task 2- Change and Release Management (FFP): This task requires the contractor to perform the management of generated requirements from DOD, DISA, PCLT, and the DPIMS user community.

Task 3 - Tiered Support (FFP): This task requires the contractor to perform engineering life cycle maintenance, system administration and database administration for the system.

Task 4 – Operations, Maintenance and Sustainment (FFP): This task calls for the formation, staffing and operation of a Tier II and a Tier III support structure that shall perform high level troubleshooting, fault isolation, and incident mitigation for all parts of the service as well as the engineering support to facilitate incident mitigation.

Task 5 – Cyber Security (FFP): This task requires the contractor to perform Information Assurance tasks including delivering reports and providing services in line with the risk management framework.

The Government may require surge support during the base or any option period, and surge modifications will be within the scope of the contract and provide increased support for the defined task areas of this PWS. Surge support over the life of the contract will not exceed 10% of the contractor’s total proposed cost/price for the base and all option periods, excluding any six-month extension of services pursuant to FAR 52.217-8.

6. Performance Requirements.

6.1 Task 1. Project Management

The contractor shall:

a) Provide planning, direction, coordination and control necessary to accomplish all the requirements in this PWS.

b) Manage project schedules and coordinate contractor activities.

c) Participate in and prepare monthly Program Management Review (PMR) presentations.

d) Brief status of task order performance and associated deliverables to the PMO.

e) PMR inputs shall be provided at the task level.

f) the contractor shall provide PMR inputs for subtasks associated with issues, if issues arise.

g) The contractor shall provide a Monthly Status Report (MSR)

a) The MSR will provide a description of activities and deliverables during the current month for the task order.

b) The descriptions shall include problem definitions and recommendations for project resolution with particular attention given to risk management activities.

c) The contractor shall identify and communicate issues and risks and offer recommendations on how issues / risks should be mitigated to successfully satisfy the requirements.

d) The contractor shall highlight activities / issues needing Government guidance and identify new risks or changes in existing risk management/mitigation activities.

h) Progress of work completed as related to the PWS tasks and subtasks

i) All reimbursable expenses including travel shall be approved in writing in advance by the COR for the expense to be reimbursed.

j) Submit Trip Reports to the Government within 5 business days after the trip has been completed.

k) The contractor shall maintain an Integrated Master Schedule and update it throughout the Period of Performance (PoP).

l) The IMS shall include milestones, tasks, changes and resources and dates.

m) Input into the Integrated Master Schedule (IMS) shall show any proposed changes, the reasons for changes, and the potential impact on the program.

n) Critical changes to the IMS shall be coordinated with the COR and Program Manager (PM) before implementation.

o) The contractor shall prepare and provide a Task Order Management Plan describing the management approach, organizational resources and management controls to be employed to meet the performance and schedule requirements for the PWS execution.

p) The contractor shall ensure all tasks are completed according to the agreed schedule and quality for each task.

q) The contractor shall provide technical and functional activities required for integration of all tasks specified within the PWS.

r) The contractor shall establish clear organizational lines of authority and responsibility to ensure effective management of the resources assigned to the requirements.

s) The contractor shall have quality assurance processes and plans in place throughout the life of this task order.

t) The contractor shall adhere to DOD Information System (IS) and Platform Information Technology (PIT) cybersecurity policies and provide status during the PMR.

u) The contractor shall coordinate with the COR, when the contractor believes that any Government activity may impact performance and/or schedule.

v) The contractor shall appraise program management and COR on productivity and quality assurance.

w) The contractor shall facilitate the document review and approval process with the Government.

x) Provide Summary Briefings with a focus on roadblocks, issue resolutions, and near-term tasks and objectives.

Subtask 1 – Kick-Off Meeting (KOM)

The contractor shall:

a) Prepare for and participate in a KOM with the Government to establish a baseline of understanding after the issuance of this task order a no later than (NLT) five (5) business days after the start of each Period of Performance (POP).

a) Participants will include the PMO and all relevant Government stakeholders at the direction of the Government Program Manager and Contractor Project Manager.

b) The contractor shall present the details of its intended approach for review.

c) The KOM will serve to resolve strategic questions, refine goals, define success, and explore the biggest challenges and breakthrough opportunities for the Government.

d) Coordinate the agenda for the KOM and include, at a minimum, the introduction of management and technical teams and establish a common understanding of the task order.

e) Other relevant items may be introduced at the discretion of the contractor and/or the Government

f) The contractor shall document KOM notes, an Action Item List and schedule future activities.

Subtask 2 Training

The Contractor shall:

a) Develop and maintain the DPIMS Training Plan.

b) Create and update DPIMS Training Materials to train DPIMS end-users, case managers, and SAs in the preparation of operational use of the system.

c) Develop training artifacts, which describes the configured COTS solution, to include self-help videos, tutorials, user guides, and other on-demand materials in support of Government users performing projects utilizing the DPIMS enterprise tool.

d) Deliver and record a minimum of two (2) training sessions via PMO approved medium to the DPIMS enterprise tool user community. Maintain training materials to ensure they are updated to the current version of the published application. Provide annual training to the end user.

Subtask 3 Ramp-Up Plan

The contractor shall:

a) Develop and execute a Ramp-Up Plan that describes the procedures and tasks the contractor will execute to ensure its staff is fully equipped, ready to perform, NLT 15 business days after the PoP start date. The ramp-up period will be the first business day through the 15th business of the PoP.

b) Provide and maintain a Contractor Escalation Contact List so that the Government may contact the appropriate personnel for information within the PoP.

Subtask 4 Transition-Out Plan (OPTIONAL)

The contractor shall:

c) Meet with the Government to plan the overall transition strategy within 120 business days of PoP end.

d) Provide the final written Transition-Out Plan to the Government, within 40 business days prior to PoP end.

e) Assure a seamless, expeditious, and orderly transition of all services and responsibilities from the incumbent contractor to the Government and/or a follow-on contractor. The transition must be completed with minimal disruption to Government operations by the end of the existing task order's Period of Performance (PoP)

f) The contractor must create a detailed Transition-Out Plan.

g) Provide training and documentation to familiarize the new team with the services and operations outlined in the Performance Work Statement (PWS).

h) Include a thorough risk assessment and a corresponding mitigation strategy for the transition process.

i) Detail the inventories and locations of all documentation, such as technical drawings, configuration data, implementation plans, and CONOPS. The plan must also address data retention and access schemes.

j) The plan should outline the specific milestones required for a successful transition. It must also feature a communication and reporting plan to provide regular updates on milestone progress.

k) Ensure a smooth transition of all engineering-related efforts to the incoming team.

l) In addition to the plan itself, the contractor is required to provide comprehensive materials including files and documentation, all in-progress working files.

m) Final files for all completed tasks, complete historical files and CONOPS procedures.

Subtask 5 Training

The contractor shall:

a) Develop and maintain the Training Plan in conjunction with the IPT

b) Create and support appropriate Training Materials to train end-users, case managers, and SAs in the preparation of operational deployments for each LOB/domain.

c) Assess training requirements based on planned “to-be” system and functional baseline. Develop training artifacts, which describes the configured COTS solution, to include self-help videos, tutorials, user guides, and other on-demand materials in support of Government users performing projects utilizing the DPIMS enterprise tool.

d) Deliver and record a minimum of two (2) virtual training sessions via PMO approved medium to the DPIMS enterprise tool user community.

Table Task 1 Deliverables

Final: 40 business days prior to task order end

*Standard Distribution: 1 copy of the transmittal letter without the deliverable to the KO; 1 copy of the transmittal letter with the deliverable to the Primary COR.

6.2 Change and Release Management

The contractor shall configure the solution to:

a) The contractor shall maintain a configured COTS solution with minimal custom coding and maintain it as a SaaS or standalone hosted solution federated with the network domain (i.e., NIPR).

b) The solution must be:

c) Hosted within the Continental United States (CONUS) and accessible under the DISA.MIL domain.

d) Hosted via a commercial cloud solution that is Federal Risk and Authorization Management Program (FedRAMP/IL5) compliant, or in a data center designated to host at the desired classification level.

e) Accessible from both CONUS and Outside Continental United States (OCONUS).

a) Not require the installation of client software or browser plugins.

b) Integrate with DoD Enterprise Identity, Credential, and Access Management (E-ICAM) to use existing agency federated services for authentication and account management (e.g., Automated Account Provisioning).

c) Enforce access controls (e.g., role-based, least privilege, mandatory).

d) Employ certificate-based authentication via Common Access Card.

e) Maintain architecture that supports a workflow.

f) Provide a single unified web portal for submitting/managing requests, viewing status, and responding to notifications.

g) Utilize forms and contextual processing.

h) Store all data, attributes, documents, and history in a common data repository.

e) Maintain archiving functionality in accordance with Federal and National Archives and Records Administration (NARA) rules, with data formats that support electronic querying.

f) The Contractor shall gather additional business requirements for the system, including process rules, web portal needs, data storage, and reporting/analytics.

i) The contractor shall Provide testing services for the solution.

j) Utilize automated testing where it is the most efficient solution.

k) Provide an ongoing DPIMS Testing Execution Analysis and Results report detailing status, roadblocks, and target fixes.

Deliverables:

Determined Format, Government approved

Distribution* Reviewed and updated annually

Determined Format, Government approved Final version 15 business days prior to deployment user facing change Standard Distribution* Updated with any substantial change in functionality

*Standard Distribution: 1 copy of the transmittal letter without the deliverable to the KO; 1 copy of the transmittal letter with the deliverable to the Primary COR.

6.3 Task 3 Tiered Support.

a) Provide comprehensive help desk support for the DPIMS application, adhering to the following tiered responsibilities

b) Utilize the DISA-identified trouble ticket tracking system (e.g., ITSM) to log, track, and document all user issues and their resolutions from initial report to final closure

c) Upon notification, respond to all incidents within 15 minutes to update the ticket status to "In Progress."

d) Provide hourly updates for all Priority 1 and 2 tickets, and updates every two hours for all other tickets, unless marked as deferred or referred to

e) Isolate, identify, analyze, and repair system failures and degradations within the production support area of responsibility (AOR)

f) Escalate issues that cannot be resolved at the current support level and follow them through to final resolution

g) Provide application support via phone and email to the global DPIMS user base in both CONUS and OCONUS, serving as the primary response to user questions, needs, and concerns.

h) Configure and manage DPIMS user accounts

i) If the application is unavailable or has greatly reduced functionality, the contractor shall notify the COR and Incident Response Team (IRT) within 4-6 business hours.

j) Within 4-8 hours of the incident's start, provide a restoration plan detailing the root cause, the corrective action (noting if it is temporary), and a long-term solution if required.

k) Provide an After-Action Report (AAR) upon resolution of critical incidents.

l) Develop, update, and maintain Standard Operating Procedures (SOPs), an Incident Log, a Known Error Database (KED), and incident resolution scripts for all support tiers.

m) Obtain and maintain a Secret clearance and Secret Internet Protocol Router (SIPR) access.

n) Troubleshoot and report on the status of Operations Orders (OPORDS), Fragmentary Orders (FRAGO), and Information Assurance Vulnerability Management (IAVMs).

1. Provide a monthly report that includes:

0. A list of all open tickets, sorted by priority (1-5) and then by age (oldest first).

0. Details for each ticket: ticket number, priority, description, corrective action, open/close dates, and associated tickets.

0. Trend analysis, including a summary of recurring issues, the distribution of causes, and recommended corrective actions to prevent future incidents.

0. Metrics on the number of problems resolved at the Tier II and Tier III levels.

Help Desk Tier II The contractor shall:

a) Assume primary responsibility for Tier II support, acting as the escalation point for the Tier I service desk.

b) Minimize ticket response and closure time to less than 2 business hours.

c) Identify and resolve systemic incidents that cannot be resolved at the Tier I level.

d) Maintain system configuration files.

e) Collaborate with Tier III to develop scripts for automatically resolving recurring incidents or to recommend permanent fixes.

f) Create and maintain written mitigation SOPs for Tier I and Tier II.

g) Help Desk Tier III

h) The contractor shall:

i) Assume primary responsibility for Tier III support, acting as the escalation point for Tier II.

j) Minimize ticket response and closure time to within 4 business hours.

k) Provide emergency software or configuration changes to correct operational problems.

l) Develop automated scripts or permanent code fixes to eliminate recurring known errors.

m) Act as the interface with vendors when necessary.

n) Train Tier I and Tier II personnel on any new or modified system capabilities.

o) Assist lower tiers with updating documentation (SOPs, knowledge modules) to reflect system changes.

Deliverables:

Determined Format, Government approved

Distribution* Reviewed and updated quarterly

Determined Format, Government approved Final version 15 business days prior to deployment Standard Distribution* Updated with any substantial change in functionality

*Standard Distribution: 1 copy of the transmittal letter without the deliverable to the KO; 1 copy of the transmittal letter with the deliverable to the Primary COR.

6.4 Task 4. Operations Maintenance and Sustainment

The contractor shall operate, maintain, and sustain the DPIMS capability including:

a) Provide primary interface between the Program Manager, Development Team, Security Officers (ISSO/ISSM), and the Hosting Team.

b) Ensure system availability and compliance with the Risk Management Framework (RMF).

c) Provide production, development, and testing support.

d) Identify opportunities for automation.

e) Ensure optimal database design and operations.

f) Configure and manage user accounts.

g) Serve as the administrative interface between the Program Manager, Development team, Security Officers (ISSO/ISSM), and Hosting Team.

h) Ensure system availability, RMF compliance, and optimal database performance.

i) Support production, development, and testing environments, identifying areas for automation.

j) Configure and manage user accounts.

k) Note: This role requires IT Level I privileged access and a Secret clearance for handling SIPRNet information (OPORDS, FRAGO, IAVMs, and other security patches

l) Provide technical support for application development, migration, integration, and sustainment.

m) Support hosting environment maintenance and upgrades.

n) Regularly update software with fixes and security updates.

o) Support scheduled backups and recovery operations.

p) Monitor systems and perform modifications as required because of preventive or corrective maintenance.

q) Manage, coordinate, and implement technology upgrades and refreshes.

r) Maintain a Secret clearance, as is required to handle SIPR-related information (OPORDS, FRAGO, IAVMs, security patches).

s) Create and maintain a System Security and lan Plan.

t) Prepare certification and accreditation documentation to achieve an Authority to Operate (ATO).

u) Document all security violations and incidents in a monthly Security Requirements Report.

v) Test and assess the impact of software/hardware security patches and upgrades.

w) Prepare all certification and accreditation documentation required to achieve an Authority to Operate (ATO).

a) Develop and maintain a comprehensive System Security and Privacy Plan.

b) Manage breach requests, based on DD Form 2959, and enable the production of various breach reports (e.g., Congressional, After Action, Lessons Learned).

c) Enforce security and ownership rules for all requests and artifacts.

d) Document and report all security violations and incidents monthly to the Government COR/ACOR via the Security Requirements Report.

a. Create and update a System Administration Guide (SAG).

e) Maintain a step-by-step Implementation and Configuration Guide.

f) Maintain an Operations and Maintenance Process and Procedures document.

g) Maintain a Data and System Backup and Restoration Procedures SOP.

h) Maintain a Recovery Plan for system degradation or destruction.

i) Develop and maintain a Concept of Operations (CONOPS).

j) Create and update a Known Error Database.

k) Gather necessary documentation (testing reports, configuration guides, lessons learned) and organize it on the government-provided web portal.

a. ii) Provide a daily DPIMS System Status Report for outages or hazardous conditions.

l) Submit a Change Request (CR) for any technical system modifications.

m) Create, maintain, and update the following key documents:

a. System Administration Guide (SAG)

b. Implementation and Configuration Guide

c. Operations and Maintenance Process and Procedures

d. Data and System Backup and Restoration Procedures (SOP)

e. System Recovery Plan

f. Concept of Operations (CONOPS)

g. Known Error Database

n) Provide a daily DPIMS System Status Report detailing unscheduled outages or hazardous conditions.

o) Enable the production of various breach reports (e.g., Congressional, After Action).

p) Manage the workflow of breach requests, including status tracking and work assignments.

q) Implement hierarchical groups for assigning and managing breaches.

r) Allow for overriding work assignments and process steps.

s) Implement timers to track process steps and send notifications for approaching deadlines.

t) Support document repositories associated with breach reports.

u) Provide technical support for application development, migration, integration, and sustainment.

v) Manage and support hosting environment maintenance, upgrades, and technology refreshes.

w) Test, implement, and assess the impact of all software/hardware patches, fixes, and upgrades.

x) Prepare and manage maintenance releases in accordance with the Configuration Control Board (CCB) process.

y) Support scheduled system backups (nightly incremental, weekly full) and testing backups (weekly incremental, monthly full), as well as recovery operations.

a) Monitor system performance, performing modifications as needed to ensure optimal performance.

b) Develop and maintain the DPIMS web portal.

c) Implement and manage a robust workflow for breach requests, including status tracking, hierarchical work assignments, and process overrides.

d) Utilize timers and automated notifications to ensure breach reporting timelines are met.

e) Develop metrics to track defect rates, resolution times, and release cycles.

f) ccc) Conduct trend analysis to prevent system degradations and outages, recommending improvements to the government.

g) Use government-approved issue tracking tools for analytics and defect tracking.

h) Implement capabilities to record detailed logs, audit trails, and history for all system events and activities.

i) Recommend and document corrective actions for system improvements (security, stability, performance).

j) Develop metrics for tracking defect rates, resolution times, and release cycles.

k) Conduct trend analysis to prevent network degradations and outages.

l) Gather system information and operating data to provide metrics for status reports.

m) Use government-specified issue tracking tools for analytics.

Deliverables:

Determined Format, Government approved

Distribution* Reviewed and updated quarterly

Determined Format, Government approved Final version 15 business days prior to deployment Standard Distribution* Updated with any substantial change in functionality

*Standard Distribution: 1 copy of the transmittal letter without the deliverable to the KO; 1 copy of the transmittal letter with the deliverable to the Primary COR.

6.5 Task 5. Cyber Security

a) Prepare the certification and accreditation documentation (e.g. Application Security documentation, RMF, Government artifacts) required to achieve and maintain Government ATO.

b) Ensure Government ATOs are current and active.

c) Comply with all Government/DISA Security Technical Implementation Guides and Security (STIG) Requirements Guides, checklists, and other implementation guidance applicable to applications, systems, and infrastructures under review.

d) The contractor will document the security control (IA) expectations and clarify the responsibilities of both the contractor and the government. Furthermore, the contractor must monitor and adhere to all security policies within the approved government cloud software.

e) Maintain favorable security posture for the SaaS tool.

f) Comply with all applicable Government and DISA processes, policies, and procedures as they are updated and/or newly implemented.

g) Manage, maintain, and publish approved patches, updates, changes, and new capabilities/baselines to production.

h) Provide a comprehensive Risk Management Plan to address, identify, assess, and provide prioritization of risks (including how risks will be recorded, reported and mitigated).

i) Plans shall include the full range of risks that could impact the project including but not limited to resources, access, physical and cyber security, and unplanned events.

j) Acknowledge receipt of DISA Tasking Orders (DTOs) within 24 hours and respond with ISSM approved timelines.

k) Manage Security Compliance

l) Monitor and report on Assured Compliance Assessment Solution (ACAS)

m) Manage Vulnerabilities

n) Monitor vulnerabilities from reports, instructions, orders, emails, memos, messages, or other monitoring systems. (ACAS, IAVMs, DTOs, FRAGO)

o) Mitigate within ISSM approved timelines.

p) Document and Report vulnerability status (POA&Ms and Cyber Reports).

Deliverables:

Determined Format, Government approved

Distribution* Updated Monthly

Government approved 15 business days prior to ATO renewal submission Standard Distribution* Updated Monthly

*Standard Distribution: 1 copy of the transmittal letter without the deliverable to the KO; 1 copy of the transmittal letter with the deliverable to the Primary COR.

7. Performance Standards.

6.1. Task 1 - Project Management

Documents are delivered on time. (e.g. MSR, IMS, TOMP, Ramp-Up Plan)

Training:

Validate training materials are timely, complete, and beneficial to the different user groups within the Government.

Work shall be delivered on time during the hours of 9:00 am to 3:00 p.m. EST

Target Acceptability: > 97% of documents and materials on-time deliveries.

Minimum Acceptable: > 95% documents and materials on time deliveries.

No more than one unjustifiable complaint per quarter based on content.

Discrepancies that occur are minor and are resolved in a satisfactory manner 5 business days

100% Inspection

The Contractor shall identify and track changes and update system and design documentation within (15) days of changes being implemented.

Performance/ Deliverables:

Contain required information, 90% accurate/error free, and delivered on time.

Any required revisions are:

· Resolved within 1 week Accepted by KO/COR

100% Inspection

6.3 Task 3 - Help Desk Tiers II and III:

Validate ability to close tickets within the designated levels.

Target Acceptability: 90% of system tickets will be closed within 2 business hour window during operating hours.

Minimum Acceptable: > 85% of system tickets will be closed within a 2 business hour window during operating hours.

Periodic Inspection

6.4 Task 4 Operations Maintenance and Management:

Prepare, distribute, and maintain plans, instructions, guidance, and SOPs concerning the security and system(s) operations.

Provide Technical Support per the PWS during core hours.

Target Acceptability: > 97% of technical services delivered on time.

Minimum Acceptable: > 95% of technical services delivered on time.

No more than one unjustifiable complaint per quarter.

Discrepancies that occur are minor and are resolved in a satisfactory manner within 48 hours of determination.

Periodic Inspection

6.5. Task 5 – Cyber Security:

Maintain DPIMS ATO Application Security Support documents / RMF/ Government documents and artifacts are accurate, complete, on-time, and approved.

Implement and enforce all Government IS and PIT system cybersecurity policies in alignment with the RMF.

Adhere to security requirements of the PWS. Develop and execute a Cyber Security plan for secure management, configuration, implementation, and operation of the network infrastructure.

Target Acceptability: Material contains required information and delivered on time at least 95% of the time.

Minimum Acceptability: Material contains required information and is delivered on time at least 93% of the time.

Revisions that occur are minor and are resolved to the COR’s satisfaction.

No more than one unjustifiable complaint per quarter.

Discrepancies that occur are minor and are resolved in a satisfactory manner within 48 hours of determination.

Report all security incidents within 24 hours of the incident 99% of the time.

100% Inspection

Enclosure 2c, PWS Page 27 of 38 Pages 11June2020/Version 16

Enclosure 2c, PWS Page 36 of 38 Pages 11June2020/Version 16

Task 5 -

Target Acceptability: (DPIMS/ ATO received) Obtained initially and renewed in advance of expiration.

Minimum Acceptable: (DPIMS/ ATO received) Obtained initially and renewed with conditions; conditions to be resolved within timeline stated on authorization.

Periodic Inspection

8. Incentives

The Government will positively and/or negatively review the contractor’s performance based on the success or failure in meeting quality assurance surveillance plan objectives. The Government will make determinations for option period award based on task order performance, as measured by the Quality Assurance Surveillance Plan. The contractor is incentivized to earn favorable Government reviews to support continuation of DISA work and to support contract/task order awards with other Government agencies seeking DISA’s input on the contractor’s past performance and the Contractor Performance Assessment Reporting System.

9. Place of Performance.

Mission Location: DISA Headquarters located at Ft. Meade MD

Place of Performance The work will be performed primarily at remote location approved by the contractor. All classified work will be performed at a facility cleared for the classification of the data "classified material" will be accessed. Access to SIPR will be at a DOD approved remote location.

9.1. Travel

Travel in and around the primary place of performance may be required throughout PoP.

Additional travel within CONUS may be required to support the requirements of this PWS.

9.1.1 Local Travel

Travel will be considered local travel when it is within 50 miles of the individual’s primary place of performance/duty station. Local travel will not be reimbursed.

9.1.2 CONUS

In coordination with the COR, the contractor may be required to support activities outside the contractor’s local site. The contractor shall inform the COR, in writing, of the estimated total travel costs prior to any trip outside their local site. The COR will coordinate such requests. The COR must expressly approve, in writing prior to any travel occurring, travel outside their local site. Specific travel requirements shall be coordinated with the COR and shall be in accordance with Federal Acquisition Regulation (FAR) 31.205-46 requirements and limitations. Reimbursement for travel expenses shall be made in accordance with the Federal Travel Regulations.

9.1.3 Alternate Place of Performance- Contingency Only.

As determined by the COR, contractor employees may be required to work at an alternate place of performance (e.g., home, the contractor's facility, or another approved activity within the local travel area) in cases of unforeseen conditions or contingencies (e.g., pandemic conditions, exercises, Government closure due to inclement weather, etc.). Additionally, the contractor may be required to account for the whereabouts of their personnel should this information be requested by the COR. Nonemergency/non-essential con tractors should not report to a closed Government facility. Contractor shall prepare all deliverables and other task order documentation utilizing contractor resources. To the extent possible, the contractor shall use best efforts to provide the same level of support as stated in PWS. In the event the services are impacted, reduced, compromised, etc., the KO or the contractor may request an equitable adjustment pursuant to the Changes clause of the task order.

10. Period of Performance.

The PoP will be one, 12-month base period and four, 12-month option years (to be exercised at the discretion of the Government). In addition, FAR clause 52.217-8 will be included which allows the Government to authorize performance for an additional 6 months if deemed necessary.

Recognized Federal Holidays: The contractor is not required to perform services on Federal Holidays (as specified on the U.S. Office of Personnel Management website), unless otherwise specified by the COR.

Unplanned Federal Government Closure: In the event an authorized official, by either executive or legislative order, declares Federal offices closed (treated as a holiday for pay and leave purposes), the order only applies to Federal employees (unless otherwise stated in the order).

11. Security Requirements.

This section supplements Block 13 of the Government provided DD Form 254, Contract Security Classification Specification. The following security requirements shall apply to this effort.

NOTE: This Indefinite Delivery Contract’s security requirements/DD254 will cover all future Tasks Orders; DD254s will not be required for individual task orders.

The contractor shall coordinate visits with site Point of Contract (POC)s providing at least a 72-hour notice (or according to each site security requirements) prior to any site access. Contractor personnel without security clearances performing any task under this PWS must be escorted by cleared DISA personnel (civilian, military, or contractor).

References:

a. DISA End User Access Agreement

b. DISA Instruction 240-240-01, External Peripheral Devices Authorized for Network Connectivity

c. DISA Instruction 240-110-8, Information Security

d. DISA Instruction 240-110-34, Controlled Unclassified Information (CUI)

e. DISA Instruction 240-110-36, Personnel Security

f. DISA Instruction 240-110-38, Industrial Security

g. DISA Instruction 240-110-43, Counterintelligence

h. DISA Instruction 240-110-43, Insider Threat Program

i. DISA Instruction 630-230-19, Cybersecurity

j. DoD Manual 5200.01, Vol. 1 and 3, DoD Information Security Program, 17 January 2025

k. DoD Manual 5200.01, Vol. 2, DoD Information Security Program, 28 July 2020

l. DoD Instruction 5200.48, Controlled Unclassified Information (CUI), 6 March 2020

m. DoD Manual 5200.02, Procedures for the DoD Personnel Security Program (PSP), 3 April 2017, Change 1, 29 October 2020

n. 32 CFR Part 117, National Industrial Security Program Operating Manual (NISPOM), 24 February 2021

o. DoD Directive 5240.06, Counterintelligence Awareness and Reporting (CIAR), 17 May 2011, Change 3, 31 August 2020

p. DoD Instruction O-5240.24, Counterintelligence (CI) Activities Supporting Research, Development, and Acquisition (RDA), 8 June 2011, Change 2, 15 July 2020

q. DoD Instruction 5205.16, “The DoD Insider Threat Program,” December 20, 2024

r. DoD Instruction 5230.24, Distribution Statements for DoD Technical Information, 10 January 2023

s. DoD Instruction 8510.01, Risk Management Framework for DoD Systems, 19 July 2022

t. DoD Manuel 5400.07, DoD Freedom of Information Act (FOIA) Program, 25 January 2017

u. Security Executive Agent Directive 3 (SEAD 3) Reporting Requirements for Personnel with Access to Classified Information or Who Hold Sensitive Position, 12 June 2017

v. Security Executive Agent Directive 4 (SEAD 4), National Security Adjudicative Guidelines, 8 June 2017

w. DISA Instruction 240-15-4 United States Security Authority for North Atlantic Treaty Organization Affairs

x. DISA Instruction 240-110-35 Sensitive Compartmented Information (SCI)

y. DoD Manual 5105.21, Vol. 1-3, Sensitive Compartmented Information (SCI) Administrative Security Manual, 19 October 2012, Change 2, 06 October 2020

z. DoD Manual 5205.07 Special Access Program Security Manual, 17 January 2025

References for contracts with SCIF Accreditation requirements at contractor locations:

a. Intelligence Community Directive 705, Sensitive Compartmented Information Facilities, 26 May 2010

b. Intelligence Community Standard 705-01, Physical and Technical Security Standards for Sensitive Compartmented Information Facilities, 17 September 2010

c. Intelligence Community Standard 705-02, Standards for Accreditation and Reciprocal Use of Sensitive Compartmented Information Facilities, 22 December 2016

d. Intelligence Community Directive 503, Intelligence Community Information Environment Risk Management, 25 October 2024

e. Intelligence Community Directive 702, Intelligence Community Technical Security and Signals Countermeasures, 26 August 2022.

References for contracts with WINDAR-S and Android Smart phones /tablets for DMCC requirements:

a. Chairman of the Joint Chief of Staff Instruction (CJCSI) 6211.02D Defense Information System Network (DISN) Responsibilities, 24 January 2012

b. DoD Instruction 8010.01, Department of Defense Information Network (DODIN) Transport, 10 September 2018

c. Defense Information System Network (DISN) Connection Process Guide (CPG), Version 6.1, 2023.

11.1 Facility Security Clearance. Work performed under this contract/order is up to the Secret. Therefore, the company must have a final Secret Facility Clearance from the Defense Counterintelligence and Security Agency (DCSA) Facility Clearance Branch.

11.1.2 Invalidated Facility Clearance. Companies with invalidated facility…