PWS DRAFT_J6 S3 - 832673670.docx

J6 Security Support Services J6 Security Support Services

PERFORMANCE WORK STATEMENT (PWS)

**DRAFT PWS**

1. Contracting Officer’s Representative (COR).

a. Primary COR. See DITCO Additional Text G1 - Points of Contact

b. Alternate COR. See DITCO Additional Text G1 - Points of Contact

c. Property Administrator. See DITCO Additional Text G1 - Points of Contact

2. Contract or Task Order Title. J6 Security Support Services

3. Background. The Defense Information Systems Agency (DISA) J6 Command, Control, Communications, and Computers Enterprise (C4E) Directorate (J6) operates, defends and provides critical Information Technology (IT) infrastructure and services to Department of War (DoW)-wide and to the DoW Senior Leaders. DISA J6’s mission is to empower our Nation’s senior leaders and the warfighter community with assured enterprise services to win in an evolving global landscape.

The J6 is responsible for the installation, operation, and maintenance of the enterprise infrastructure across multiple classifications.

J6 performs a wide variety of security functions in order to ensure the security of its personnel and facilities and to meet customer requirements.

This includes:

· Security Monitoring

· Developing and testing Continuity of Operations Plans

· Security Incident Management (Including Forensic Analysis)

· Vulnerability and Risk Assessment and Management

4. Objectives: The contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform Physical Security (PHYSEC), Personnel Security (PERSEC), Operations Security (OPSEC), Industrial Security (INDUSEC), and Special Access Program (SAP) Program Protection Plan (PPP) Services as defined in this PWS. The contractor shall perform to the quality standards as defined in this PWS. The contractor shall meet the security requirements and guidance as defined in the Department of Defense (DoD) 5200v1-4; DoD 5220.22-M; DoD 5105.21; and other applicable federal regulations to ensure the security and of J6.

5. Scope. The contractor shall provide PHYSEC, PERSEC, INDUSEC, and PPP Services.

The term PHYSEC refers to dedicated security discipline concerned with active and passive physical measures designed to safeguard personnel, equipment, installations, and facilities against espionage, sabotage, terrorism, damage, and unauthorized access. Physical security specifically covers the areas detailed by the security requirements and guidance as defined in the DoD 5200v1-4; DoD 5220.22-M; DoD 5105.21; and other applicable Federal regulations.

The PERSEC refers to the system of laws, policies, and procedures established to ensure that individuals—including military personnel, federal civilian employees, and contractors who are granted access to classified information, or assigned to sensitive duties, are and remain loyal, trustworthy, and reliable. The core components of PERSEC are position sensitivity designation, personnel security investigations, adjudication, and continuous vetting.

· Position Sensitivity Designation: Evaluating and defining the level of background investigation required for government positions to include non-sensitive, non-critical sensitive, critical sensitive, or special sensitive.

· Personnel Security Investigations: Background investigations (often initiated via the Questionnaire for National Security Positions, or SF-86) conducted by federal investigative agencies to gather facts about an individual’s loyalty, character, and reliability.

· Adjudication: The formal evaluation of information gathered during a PSI against established national security guidelines.

· Continuous Vetting: The ongoing monitoring process that replaced traditional periodic reinvestigations. It continuously reviews a cleared individual's background to identify potential risk indicators in real-time.

The term OPSEC refers to the systematic, analytical process that identifies and controls critical information and indicators of friendly force actions attendant to military operations and incorporates countermeasures to reduce the risk of an adversary exploiting those vulnerabilities. The five steps of OPSEC are (1) identify critical information; (2) analyze threats; (3) analyze vulnerabilities; (4) assess risk; and (5) apply countermeasures.

The term INDUSEC refers to the portion of national security policy concerned with safeguarding classified and Controlled Unclassified Information (CUI) that is released or disclosed to private sector contractors, educational institutions, and commercial organizations working with the government. The contractor shall have a working knowledge of National Industrial Security Program and all applicable Instructions, Manuals, and Directives.

The term FM refers to the occupational services focused on security of personnel using the physical space within associated environments. Its primary objective is to ensure that physical spaces are safe, secure, and compliant with security requirements.

· Physical Security & Access Control: Management of security personnel, surveillance networks, electronic access control systems, visitor logs, and perimeter fencing.

· Space Management & Planning: Maximizing building occupancy and coordinating personnel moves or office restructures.

The term PPP refers to a critical, regulatory document used to manage risks to technology, national security, and mission-critical systems throughout their lifecycles. The PPP acts as a single, comprehensive blueprint for protecting Critical Program Information (CPI) and vital system components from foreign collection, hardware/software tampering, supply chain exploitation, and cyberattacks. Components of the PPP include CPI identification; Supply Chain Risk Management (SCRM), cybersecurity strategy, anti-tamper planning, and system security engineering.

DISA’s overall security hierarchy is as follows: (1) DISA J1 (inclusive of Special Security Office [SSO] responsibilities), (2) DISA J6 Security Manager/Special Security Representative (SSR), as appointed in writing by the applicable DISA security authority, (3) contractor SSR, appointed in writing by SSO.

The Government may require surge support during the base or any option period, and surge modifications will be within the scope of the contract and provide increased support for the defined task areas of this PWS. Surge support over the life of the contract will not exceed 20% of the contractor’s total proposed cost/price for the base and all option periods, excluding any six-month extension of services pursuant to Federal Acquisition Regulation (FAR) 52.217-8.

6. Performance Requirements.

6.1 Task 1 - Program and Project Management Support - Under this effort, the Government considers the Contractor’s Program Manager (CPM) as the contractor’s single point of contact (POC) for the body of work described in this PWS. The CPM shall manage personnel covered under this PWS to ensure contract support requirements are maintained throughout the entire Period of Performance (PoP). The CPM shall provide administrative, financial, and managerial resources necessary to complete the work defined herein. The contractor shall provide program management oversight across the task order including contractual deliverables and financial controls, responding to internal/external requests for information, developing analysis, and integrating analysis into appropriate command level reports or briefings.

6.1.1 Subtask 1 - Kick-off Meeting. The contractor shall plan and conduct a contract kick-off meeting no later than 14 calendar days after award at the Government site location in the NCR to be determined at the time of award. All contractor key personnel shall be required to attend the meeting. The Government will reserve the right to limit video teleconference participation at the kick-off meeting. The contractor shall prepare and provide required meeting materials, including but not limited to an agenda and presentation. The contractor shall prepare meeting minutes, in addition to record, distribute, and report status of kick-off meeting action items.

6.1.2 Subtask 2 - Security Integrated Master Schedule (IMS).

The contractor shall develop a baseline and forecast resource loaded IMS utilizing Microsoft (MS) Project and fixed work task type. The contractor shall provide a Draft IMS NLT 15 calendar days after award and a Final IMS NLT 30 calendar days after award. The contractor shall provide monthly IMS reports. The contractor shall propose or use the program’s approved Work Breakdown Structure (WBS), data dictionary, and charge code structure and encompass all elements of cost needed to execute the entirety of scope (both Level of Effort and discrete work) outlined in this contract. The WBS shall delineate specific scope areas (e.g., internal versus external customer scope). Tasks shall be decomposed into granular manageable activities. The contractor shall ensure the IMS is in compliance with applicable Data Item Description-Management formatting requirements.

In addition, the contractor shall:

a. Provide all resources (labor categories or by individual) needed to execute the scope within the IMS.

b. Provide all labor resources (hours and average rates) in the IMS.

c. Provide all Other Direct Costs (ODC) and material resources (in dollars) in the IMS.

d. Provide a time phase of all resources within the IMS.

e. Develop and maintain an IMS baseline management process (approved by the government).

f. Maintain an updated monthly forecast and an accurate baseline in MS Project (submit updated baseline and forecast data no later than 10 workdays after the end of the contractor financial period close).

g. Document baseline changes with appropriate approvals.

6.1.3 Subtask 3 - Program Management Plan (PMP). The contractor shall provide a PMP that is due 30 calendar days after award and updates monthly. The contractor shall utilize the PMP as the foundation for information and resource management planning as well as to inform the Government how the contractor will manage the task order. The contractor shall use a WBS, a component of the PMP, during the performance of the task. The PMP shall be delivered in an editable, unlocked MS Word document. The contractor shall provide Government access to the PMP via the task order portal. The contractor shall provide services in accordance with (IAW) the latest Government-approved version of the PMP. At a minimum, the PMP shall:

a. Describe the proposed task order management approach and contractor organizational structure.

b. Describe the contractor’s approach to risk management including processes, procedures, and format.

c. Describe the communications approach to include rules of engagement between the contractor and the Government and communication mechanisms (e.g., Technical Status Meeting, In-Progress Review (IPR), and Personnel Status Report).

d. Describe the contractor’s Quality Control methodology for accomplishing task order requirements and objectives. This includes how the contractor’s processes and procedures will be tailored to and integrated with the Government to ensure high-quality performance.

6.1.4 Subtask 4 - Status Reporting. The contractor shall provide weekly and monthly activity, status, and in-progress reports as outlined below.

6.1.4.1 - Weekly Status Reports (WARs). The contractor shall submit a WSR that reports activity and progress to the COR. The contractor’s WSR shall provide updates of contractor performance and summarize tasks, including metrics, accomplishments, new efforts and future efforts planned for the next reporting period, challenges or problems encountered, and actions or involvement needed by the Government.

6.1.4.2 - Monthly Status Reports (MSRs). The contractor shall provide a MSR. The contractor’s MSR shall incorporate metrics sufficient in scope to permit an objective assessment of the contractor’s performance relative to work accomplished, schedules, and expenditures. At a minimum, the MSR shall include the following information:

a. Activities during the reporting period, by task (including ongoing activities, new activities, activities completed, and progress to date on all above-mentioned activities). Each section shall start with a brief description of the task.

b. Monthly performance metrics by task.

c. Site status including issues impacting sites, personnel, and performance.

d. Problems and corrective actions taken, includingissues or concerns and proposed resolutions to address them.

e. Risk reporting including the identified risks, impacts, and risk resolutions.

f. Personnel gains, losses, and statuses.

g. Government actions required.

h. Schedules including tasks, milestones, and deliverables; planned and actual start and completion dates for each task.

i. Summary of contractor travel.

j. Financial status including:

i. Cumulative actual task order burn and projected cost of each Contract Line Item Number (CLIN), WBS, and task area, for the current option year.

ii. Up-to-date spend plan including baseline, actuals, and forecast.

iii. Cumulative invoiced amounts for each CLIN and WBS.

iv. ODC CLIN tracking report showing pending commercial purchases, approved commercial purchases, costs, locations, and due dates.

v. Total incurred cost, broken down by labor and ODC, for the contractor’s services rendered for international partners. The total cost incurred shall be tracked by individual event and per international partner.

k. Schedule execution and forecast reports defined during the Program Baseline Review (PBR) (show major tasks, milestones, and deliverables; planned and actual start and completion dates for each).

l. Financial management reports defined during the PBR which shall include rate and usage variance.

m. Quantifiable projected costs (projected to be incurred) for each CLIN and/or Government-defined WBS elements from the end of the reporting period to the end of the Option Period with monthly revisions. Additionally, the report shall specifically identify projected and remaining costs by WBS for all work funded externally via Military Interdepartmental Purchase Request.

n. Variance explanations shall be reviewed for the top five variances that trip the variance thresholds defined during the PBR.

o. Time-phased manpower report by labor category.

p. Description of proposed baseline solutions versus actual solutions provided.

q. Any recommendations for change, modifications, or improvements in tasks or process.

r. Any changes to the Project Management Professional.

s. Contractor work initiatives, efficiencies, good-news stories, significant events, accomplishments, new undertakings, design, and process improvements undertaken during the reporting period, and follow-up reports on prior initiatives.

6.1.4.3 - In-Progress Reviews (IPRs). The contractor shall prepare an Integrated Program Review (IPR) Report (IPRR) that details the results of the activities/accomplishments/issues of the past week and planned actions/activities for the upcoming week against the PWS task areas. The contractor shall hold a meeting to present the information in the report to the Government. The report shall include the following:

a. Status of Key Projects and/or Product line tasks, milestones, and dependencies.

b. Key risks with recommended mitigation.

c. Applicable schedules.

d. Key accomplishments.

e. Teleworking personnel (if approved by the COR).

f. Status of Government Furnished Property (GFP) and travel.

g. Status of tiers two and three open and closed incidents and issues.

h. Other areas/topics as identified during the performance of this contract.

Deliverables:

PWS

Task#

Copies Frequency and Remarks

(PDF) to COR

previous month

than quarterly

than quarterly

previous month

*Standard Distribution: 1 copy of the transmittal letter without the deliverable to the KO; 1 copy of the transmittal letter with the deliverable to the Primary COR.

· Contractor requires either Secret, Top Secret (TS), or Top Secret/Sensitive Compartmented Information (TS/SCI) clearance levels as applicable in the security clearance table. Contractor requires access to Non-classified Internet Protocol Router Network (NIPRNet), Secret Internet Protocol Router Network (SIPRNet), DoD Network (DODNet-J) Joint Worldwide Intelligence Communications System (JWICS), and SCI platforms to provide updates of contractor performance and summarize tasks, including metrics, accomplishments, new efforts and future efforts planned for the next reporting period, challenges or problems encountered, and actions or involvement needed by the Government.

6.2 Task 2 - Security Advisory Support

6.2.1 Subtask 1 - Presentation and Briefing Support. The contractor shall provide support for senior and executive level management briefings; all briefings require Government approval. The contractor shall provide high level and technical documents and briefing support for J6, customers, General Officers, and Senior Executives. The briefings shall cover the overall capabilities and an explanation on how all capabilities compliment the overall mission. Briefings shall cater to the intended audience and answer questions about the capabilities provided. The contractor shall develop papers, summaries, and presentations to present to General Officers and Senior Executives.

6.2.2 Subtask 2 - Strategic Planning. The contractor shall review and propose recommendations to the Government for the J6 Security strategic plan which aligns with the J6 and DoD strategic goals and objectives. The contractor shall inform the Government of misalignments and/or inconsistent elements. The contractor shall ensure the J6 Security strategic plan is comprehensive and strategic in nature. The contractor shall identify Government and commercial best practices, evaluate security technologies, and provide recommended solutions that can be centrally managed with scalability to expand for internal and external support capability. The contractor shall review processes to determine how effectively threats are mitigated and incident response handled. The contractor shall document recommendations to include advantages and disadvantages of each recommendation. Emphasis is on ensuring that organizational frameworks, technologies, and processes remain proactively aligned with evolving industry standards, federal mandates, and commercial best practices. The goal is to future-proof operations and drive continuous modernization.

6.2.3 Subtask 3 - Documentation Analysis. The contractor shall perform an initial inventory and review of the policies, procedures, and related J6 security documentation and identify missing or outdated documentation. Subsequent reviews shall be performed on an annual basis.

6.2.4 Subtask 4 - Documentation Synthesis and Change Control. The contractor shall propose to the Government updates to the J6 Security documented processes, procedures, maps, Standard Operating Procedures (SOPs), Work Instructions (WI) and other living documents; and create new products to fill identified gaps. With Government approval, the contractor shall coordinate with impacted groups and individual stakeholders to promote awareness and support for new or updated policies and procedures. Documentation shall be prepared IAW DoD 5110.04-M-V1 & V2, unless otherwise directed by the Government. Emphasis is on ensuring that all documentation (as applicable) is accurately tracked, reviewed, approved, and maintained throughout their entire lifecycle.

6.2.4.1 The contractor shall integrate and continuously optimize automated workflows to reduce manual redundancies, accelerate decision cycles, and improve operational throughput. All automation initiatives must be approved by the Government and strictly comply with all associated data security guidelines.

6.2.5 Subtask 5 - Knowledge and Documentation Management & Dissemination. The contractor shall implement and sustain a robust framework for knowledge management and documentation management and dissemination. The primary objective is to optimize information sharing, secure the retention of mission data, and maintain strict compliance with records management directives.

6.2.5.1 The contractor shall provide implementation of processes for identifying, organizing, storing, and disseminating of information. Emphasis is on harnessing the collective knowledge of the organization to lead to better operational efficiencies. The contractor shall utilize best practices in executing knowledge management strategies that transform raw data into actionable organizational intelligence. This includes systematically capturing both tacit and explicit knowledge to support operational continuity.

6.2.5.2 The contractor shall store and manage all documentation developed and/or maintained under this contract and, as appropriate, disseminate, or publish material via mechanisms such as web sites and MS SharePoint. The contractor shall track all documentation, versions, and status for all draft and final work products. Files containing official correspondence and memorandums shall be maintained IAW internal administrative processes and procedures. The contractor shall prepare, reproduce, and file all security related packages and related documentation according to established procedures for Government approval. The tools and methods selected to perform this function must be approved by the COR prior to implementation, if different from the tools currently in use.

Deliverables:

PWS

Task#

Copies Frequency and Remarks

Briefings MS Word, PPT, or PDF to COR NLT three calendar days after COR request

the COR, no less than weekly

request

than weekly

PDF to COR 30 calendar days after contract kick-off

NLT three calendar days after COR request

from Kick-off and quarterly thereafter

the COR, no less than quarterly

quarterly thereafter

procedures, maps, and other living documents

from Kick-off and quarterly thereafter

the COR, no less than quarterly

Management & Dissemination Procedures

from Kick-off and quarterly thereafter

the COR, no less than quarterly

Dissemination Status Report

*Standard Distribution: 1 copy of the transmittal letter without the deliverable to the KO; 1 copy of the transmittal letter with the deliverable to the Primary COR.

· Contractor requires either Secret, TS, or TS/SCI clearance levels as applicable in the security clearance table. Contractor requires access to NIPRNet, SIPRNet, DODNet-J(JWICS), and SCI platforms to provide updates of presentations and briefings pertaining to this contract portfolio, including strategic planning.

6.3 Task 3 - PHYSEC Support

DISA/J6 manages over 14,000 network devices and houses those devices in over 1,700 locations within theJ6. The spaces, facilities, and equipment include offices, over 1,000 telecommunications closets, safes, and an accredited Protected Distribution System (PDS) with over 18,000 locks throughout the Pentagon. Physical security specifically covers the areas detailed by the DoD Information Assurance Certification and Accreditation Process controls to ensure the safe operation of the IT systems. The contractor, in coordination with and support of the Government, shall inspect the approximately 400 SCI and approximately 700 collateral secure spaces and the more than 60 miles of IT cabling infrastructure that interconnects the DISA/J6 network equipment. The majority of the systems are designated as Mission Assurance Category I systems. The contractor shall understand Information Security as a part of the certification and accreditation functions for SCI facilities and other classified facilities, which will house the IT Systems. Knowledge and understanding the various types and classification of the IT systems is paramount to assuring proper and appropriate physical security is implemented.

6.3.1 Subtask 1 - Physical Security Documentation. The contractor shall coordinate with the Government to safeguard all Government equipment, information, and property provided for contractor use. At the close of each work period, the contractor shall secure Government facilities, equipment, and materials.

6.3.2 Subtask 2 - Protection Distribution System. The contractor shall report unauthorized access of DISA/J6-owned PDS to the Government through periodic physical and technical inspections; inspections shall occur no less than annually. The contractor shall maintain inventory of locks, currently Sargent & Greenleaf (S&G) locks for the PDS. The contract shall properly document lockouts and defective locks weekly.

6.3.3 Subtask 3 - Telecommunication Closet and Manned Spaces Alarm Testing. The contractor shall perform periodic testing of alarms for DISA/J6 owned alarmed spaces; the contractor shall provide a testing plan to the Government for approval. The contractor shall test alarms on a biannual basis. The alarm tests must be documented by the contractor.

6.3.4 Subtask 4 - Physical Security Wireless Assessments. The contractor in coordination with the Government shall conduct Wireless assessments of all DISA/J6 manned spaces via weekly walkthroughs to ensure personnel are following DoD and DISA security guidance.

6.3.5 Subtask 5 - Access Control. The contractor in coordination with the Government shall coordinate and communicate with the Pentagon Force Protection Agency (PFPA) access control center on all access required by DISA/J6 personnel. This shall include requesting activity reports, access rosters, personnel pins, and PFPA Form 79 “Access Request Form.”

6.3.6 Subtask 6 - Lock Combination Change Database and Malfunction Reporting. In coordination with the Government, the contractor shall be performed once per year (or by occurrence) in combination changes for the telecommunications closets and PDS, all changes shall be documented. Contractor shall maintain inventory of S&G locks for the PDS; lockouts and defective locks must be properly documented and the contractor shall report weekly. Contractor shall maintain an inventory of CDX-10 and X-10 locks; lockouts, failures, and defective locks must be properly documented IAW applicable regulations and reported monthly.

6.3.7 Subtask 7 - Security Accreditation. The contractor shall coordinate with the Government when preparing Classified Open Storage Area (COSA) security accreditation packets and assessments. The contractor shall send packets to J6 Security Manager for review and approval prior to sending to the DISA Ft. Meade for accreditation.

PWS

Task#

Copies Frequency and Remarks

PDF to COR

PDF to COR

PDF to COR

PDF to COR

biannually thereafter

Physical Security Assessments

from Kick-off and quarterly thereafter

the COR, no less than quarterly

weekly thereafter

*Standard Distribution: 1 copy of the transmittal letter without the deliverable to the KO; 1 copy of the transmittal letter with the deliverable to the Primary COR.

· Contractor requires either Secret, TS, or TS/SCI clearance levels as applicable in the security clearance table. Contractor requires access to NIPRNet, SIPRNet, DODNet-J(JWICS), and SCI platforms to physical security, to include subtask areas supporting: Physical Security documentation, Protection Distribution System, Telecommunications Closet and Manned Spaces Alarm Testing, Physical Security Wireless Assessments, Access Control, Lock Combination Change Database and Malfunction Reporting, Security Accreditation, OPSEC, and supporting Antiterrorism/Force Protection.

6.4 Task 4 - PERSEC Support

6.4.1 Subtask 1 -PERSEC. The contractor shall provide Personnel Security Support Services in support of the J6 Enterprise security mission. The contractor shall adhere to applicable policies (e.g., DoDM 5105.21, FAR 7.05 (Inherently Governmental Functions)) and restrict from performing inherently Governmental functions. The personnel security team ensures that all J6 employees have the correct clearance levels to access the IT equipment for the classified and sensitive IT equipment standards in the DoD Regulations. The contractor shall:

· Verify individual clearances in the Defense Information System for Security (DISS) to ensure clearance investigation is complete and current with the correct information as well as taking and removing “Ownership” & “Servicing” relationships with personnel profiles. Adhere to applicable policies and directives as it pertains to North Atlantic Treaty Organization - Secret access after receiving briefing. Monitor personnel profiles for adverse reports through the notification tab in DISS.

· Prepare building badge applications for DISA/J6 Personnel Security approval. The contractor shall validate the type of Common Access Card (CAC) requested (CAC, Pentagon Facility Access Card, etc.) and verify need for emergency access code on the CAC.

· Issue appropriate J6 identification CAC to personnel during in-processing. Maintain a listing of the distribution daily.

· Obtain a NIPRNet, SIPRNet, Content Management Interoperability Services (CMIS), other higher classified systems, DISS, and Access Management Portal accounts in order to accomplish mission daily.

· Provide a standard memorandum for personnel who lose their Government-issued credentials. This memo will be signed by the individual attesting to the loss or destruction of these items and the circumstances. Maintain a file and a database of these memorandums. Report weekly.

· Process outgoing Visit Access Requests (VARs) within two business days for J6 employees visiting other secure facilities; weekly reporting required.

· Process in-coming VARs within two business days for all personnel requiring access to J6-managed facilities and networks. Weekly reporting required.

· Fulfill DISA Security mandates and CMIS requirements. Included, but not limited to, realigning all J6 SOPs, Work Instructions and processes with current procedures; uploading over 4,500 personnel information into CMIS, and uploading required documentation into each CMIS record, DISS record, personnel record on the ‘O’ Drive and other J6 documentation systems.

· Obtain, verify, prepare, and process documentation for In-processing & Out-Processing personnel, to include, but not limited to, renewing personnel, contract changes and Dual-Contractors. Create records, spreadsheets, policies and/or forms in relations to Personnel Security daily operations. Review and keep up-to-date policy information on the changes involving DoD regulations, instructions, manuals or policies in relationship to Personnel Security.

· Reviews System Authorization Access Request (DD2875) forms with information provided by DISS and submits to Government for validation and signature.

· Obtain ServiceNow (SNOW) accounts and incorporate work-flow instructions for customers involving Personnel Security requests. Monitor and process Personnel Security request within SNOW and the Personnel Security Mailbox.

· Host agency-wide training(s) in relation to Personnel Security.

6.4.2 Subtask 2 - Administrative Support for SCI Program. Contractor shall prepare for review the SCI nomination and indoctrination paperwork of J6 personnel to the SSO for approval. This will involve scheduling with the individual to be indoctrinated to include assisting with the documentation to ensure they are properly filled out and scheduling the session for viewing and reading appropriate regulations and the observance of the signing of the documents to be sent to SSO for processing.

Deliverables:

PWS

Task#

Copies Frequency and Remarks

DISS

MS Word, MS Excel, PPT, or PDF to COR

to COR

calendar days after a regulatory change impacting the memorandum

to COR

Individuals Indoctrinated and SCI De-briefed MS Word, MS Excel PPT, or PDF to COR

to COR

*Standard Distribution: 1 copy of the transmittal letter without the deliverable to the KO; 1 copy of the transmittal letter with the deliverable to the Primary COR.

· Contractor requires either Secret, TS, or TS/SCI clearance levels as applicable in the security clearance table. Contractor requires access to NIPRNet and SIPRNet platforms to perform personnel security to verify clearances in DISS, issue CACs, VARs, and other supporting tasks identified in this PWS task supporting Personnel Security.

6.5 Task 5 - OPSEC Support

The primary mission of OPSEC is to identify, control, and protect generally unclassified evidence (including CUI) that is associated with sensitive operations and activities. The contractor in coordination and support with the Government shall conduct OPSEC inspections of J6 manned spaces to ensure compliance with applicable DISA and DoD guidance. The core objective is to deny adversaries the ability to collect, analyze, and exploit critical information—often pieced together from public or seemingly harmless data—that could compromise DoW personnel, readiness, or mission success.

6.5.1 Subtask 1 - Antiterrorism/Force Protection. Focus is protecting personnel, information, and critical infrastructure against terrorist, insider, and criminal threats. The contractor in coordination and support with the Government shall ensure proper antiterrorism/force protection requirements are implemented and enforced IAW all policies (i.e., DISA Policies, DoDM).

6.5.2 Subtask 2 - Critical Information List (CIL) & Indicators List (CIIL) Development. Focus is on defining the exact assets, capabilities, and or details the adversary is seeking. The contractor in coordination and support with the Government shall analyze the organization’s core activities and functions to draft CIL(s), update, and refine CIIL(s).

6.5.3 Subtask 3 - Threat and Vulnerability Assessments. Focus is on mapping known adversarial collection capabilities against observable activities and physical footprints. The contractor in coordination and support with the Government shall continuously monitor, collect, and analyze threat data to identify potential adversaries and their collection capabilities. The contractor shall perform OPSEC assessments (internal/external) on automated information systems, public websites, and physical facilities to identify vulnerabilities.

6.5.4 Subtask 4 - OPSEC Plan (or OPLAN Annex). Focus is on formalizing the specific countermeasures required to protect the CIL throughout the mission lifecycle. The contractor in coordination and support with the Government shall formulate, document, and recommend effective operational plans to mitigate the risk of adversary exploitation.

6.5.4.1 OPSEC Education and Training Support. The contractor shall develop, maintain, and deliver tailored OPSEC training materials.

6.5.5 Subtask 5 - Walkthrough Audit and After Action Report (AAR) Support. Focus is on tactically evaluating physical and digital indicators, and then documenting findings to address them via corrective actions and/or recommendations on countermeasures. The contractor in coordination and support with the Government shall develop AARs based upon the findings from audits and vulnerability incidents.

Deliverables:

PWS

Task#

Copies Frequency and Remarks

Analysis

quarterly thereafter

quarterly thereafter

NTE X within a Quarter

*Standard Distribution: 1 copy of the transmittal letter without the deliverable to the KO; 1 copy of the transmittal letter with the deliverable to the Primary COR.

· Contractor requires either Secret, TS, or TS/SCI clearance levels as applicable in the security clearance table. Contractor requires access to NIPRNet and SIPRNet platforms to perform personnel security to verify clearances in DISS, issue CACs, VARs, and other supporting tasks identified in this PWS task supporting Personnel Security.

6.6 Task 6 - INDUSEC Support

6.6.1 Subtask 1 - INDUSEC. Contractor shall have a working knowledge of National Industrial Security Program and all applicable Instructions, Manuals, and Directives. IAW DISA physical security and DD254 Guides to the development and review of DD254s. The contractor shall conduct the provide a quality review in coordination with the Government process DD254s for DISA J6. The contractor shall conduct quarterly training of INDUSEC requirements and processes with J6 staff. The contractor shall coordinate with the J6 INDUSEC Program for direction and updates of requirements and guidelines to include DISAI 240-38 Industrial Security. The contractor shall recommend to the Government updates to DISA HQ INDUSEC Program documents. The contractor shall obtain all necessary accounts in support of the aforementioned actions.

6.6.1.1 Repository and Process Documentation Support. The contractor shall develop, create, organize, and maintain official security repositories of required documentation which includes the following:

· INDUSEC logs

· DD254 process flow charts

Emphasis is on ensuring that logs and charts are accurate, compliant, and properly controlled.

Deliverables:

PWS

Task#

Copies Frequency and Remarks

Excel, PPT, or PDF to COR

to COR

· Contractor requires either Secret, TS, or TS/SCI clearance levels as applicable in the security clearance table. Contractor requires access to NIPRNet, SIPRNet, DODNet-J(JWICS), and SCI platforms to provide INDUSEC support to develop, review, and process DD254s for DISA J6 and other supporting tasks identified in this PWS task supporting INDUSEC services.

6.7 Task 7 - J6 Facilities Management Support - Security Posture

6.7.1 Subtask 1 - Facilities Management Support. The contractor shall provide comprehensive physical security and risk management support to continuously assess, manage, and improve the organizational facilities security posture of all J6 managed spaces. The contractor shall manage the facilities operations, to include compliance oversight, vulnerability management, and integration of physical security practices into day-to-day activities while also maintaining accurate associated records and file documentation.

6.7.1.1 Physical Security & Access Control. The contractor shall support the auditing of facility access control policies, to include reviewing badging procedures, visitor control logs, and automated access control system permissions to ensure only authorized personnel have unescorted access to restricted areas. The contractor shall implement the key management control program inside designated Suites.

6.7.1.2 Space Management & Planning. The contractor shall maintain and update floor plans, to include ensuring accurate space designations and seating allocations. The contractor shall support the accreditation and lifecycle management of designated space within facilities.

6.7.1.3 Vulnerability & Risk Assessments. The contractor shall conduct Facility Security Assessments to identify physical vulnerabilities and evaluate compliance with Antiterrorism/Force Protection standards and recommend mitigating countermeasures for identified risks.

6.7.1.4 Security Posture Management. The contractor shall support the tactical oversight of integrated security systems. The contractor shall develop a(n):

· Facilities Maintenance Plan and submit it to the Government SSR for review. Once approved, the contractor shall update the document quarterly.

· Emergency Action Plan and submit it to the Government SSR for review. Once approved the contractor shall update the document quarterly.

6.7.1.5 Incident Response & Emergency/Continuity of Operations (COOP) Management Support. The contractor shall support post-incident security reviews and COOP exercise activities. The contractor shall conduct incident response and Emergency Action Assessments.

PWS

Task#

Copies Frequency and Remarks

from Kick-off and quarterly thereafter

*Standard Distribution: 1 copy of the transmittal letter without the deliverable to the KO; 1 copy of the transmittal letter with the deliverable to the Primary COR.

· Contractor requires either Secret, TS, or TS/SCI clearance levels as applicable in the security clearance table. Contractor requires access to NIPRNet, SIPRNet, DODNet-J(JWICS), and SCI platforms to support Facilities Management to include day-to-day facilities management, coordinate and support Government with key management control program inside suites, manage daily facilities operations, review and update facility SOPs, and maintain all facility program records and files.

6.8 Task 8 - Program-Specific Support. The contractor shall provide PERSEC and PHYSEC support services to the Government and J6 classified programs.

6.8.1 - Subtask 1 - PERSEC and PHYSEC Support.

6.8.1.1 PERSEC and PHYSEC Support for J6 Classified Programs. The contractor, in coordination and support of the Government, shall provide planning, design and implementation support to the Government in support of up to six (6) J6 classified programs, under the direction of the SSO, IAW applicable federal regulations, DISA guidance, and program-specific requirements, including but not limited to:

· DoDM 5205.01 Volume 3, DoD SAP Security Manual: Physical Security;

· DoD Directive 5205.07 SAP Policy;

· Intelligence Community Directive 705, SCIF;

· ICD 703 Protection of Classified National Intelligence;

· DoD Manual 5105.21 Volume 2, SCI Administrative Security manual: Administration of Physical Security, Visitor Control and Technical Security;

· Federal Specification FF-L 2740B, Locks, Combinations, Electromechanical;

· DoD Instruction 5240.05, Technical Surveillance Countermeasure (TSCM);

· Intelligence Community Directive – 705 (ICD-705) Technical Specifications;

· DoD 5220.22-M National Industrial Security Program Operating Manual (NISPOM);

· DoDI 8560.01 and supporting COMSEC Regulations;

· Applicable Executive Orders and Federal Regulations;

· Executive Order (E.O.) 12958 – Classified National Security Information; and

· Information Security Oversite Office Classified National Security Information, 32 Code of Federal Regulations (CFR), Part 2001.

6.8.1.1.1 The contractor shall evaluate security operations and deliver operational recommendations to the Government to achieve and sustain full compliance across all applicable PERSEC, PHYSEC, and information safeguarding directives.

6.8.1.2 The contractor shall provide program-level security documentation, including but not limited to Security Classification Guides (SCG):

· Implement review and approval procedures;

· Incorporate new policies and procedures; and

· Updates as required or annually;

6.8.1.3 The contractor SSR, appointed in writing by the J6 Chief of Security, in coordination with the Government shall:

6.8.1.3.1…