PWS_DTMO Travel Data Support_DRAFT.docx

Defense Travel Management Office Performance Work Statement (PWS) for Travel Data Repository Support

1.0 INTRODUCTION

The Defense Travel Management Office (DTMO) requires database and infrastructure contractor support for the DTMO’s travel data repository (referred to as the Commercial Travel Information Management (CTIM)). The CTIM enables the DTMO to manage and measure the performance of the Department of Defense (DoD) Travel Enterprise. CTIM also supports DTMO applications and is a data source for partner systems and other stakeholders.

2.0 BACKGROUND

2.1 The consolidation of travel data, and its availability to drive decision making and manage programs, continues to be a foundational element in pursuit of DTMO’s strategic initiatives concerning the Defense Travel Enterprise. The CTIM consolidates travel data from commercial travel contracts, DoD and other Federal Government sources, and other sources as needed. This repository enables the discovery of data patterns, allows for the development of meaningful metrics, fosters issue resolution, facilitates data-driven decision making, and allowances setting. The CTIM also enables the DTMO to fulfill legislative mandates, such as Sec. 631 of the 2012 National Defense Authorization Act (NDAA) requiring DoD to create and maintain a DoD travel compliance program.

2.2 The majority of DTMO’s data sources within the repository are from vendors contracted to support the DTMO. These contracts are periodically awarded to new vendors with modified or new data requirements, requiring database administrator support to properly incorporate the new or modified data elements. New data sources, enhancements, or technical solutions that complement or improve the existing scope of data are also periodically identified. These may require contractor support in analysis and integration into CTIM.

2.3 The DTMO implemented a Business Intelligence (BI) solution to provide a means to view and interpret repository data and allow for the efficient management and improvement of travel programs. Ultimately, the BI tool will provide self-service reports, dashboards, and additional analytical functions to support data-driven decision making for the DTMO and eventually across the DoD.

3.0 SCOPE

The Contractor shall provide all necessary personnel, equipment, supplies and services to successfully manage the DTMO’s CTIM and related IT infrastructure.

4.0 REQUIREMENTS The Contractor shall:

4.1 General Requirements:

4.1.1 Possess experience in the areas of:

4.1.1.1 Global Distribution Systems (GDS),

4.1.1.2 Government travel suppliers,

4.1.1.3 Commercial travel data including air, rail, car, lodging, bus, and other modes of travel,

4.1.1.4 Travel data suppliers, such as GTCC,

4.1.1.5 Government travel policy (e.g., Joint Travel Regulation), including air, rail, car, lodging, bus, and other modes of travel.

4.1.2 Maintain and support the current data infrastructure and data sources and have the ability to integrate, implement, and maintain new data and data sources as needed. Infrastructure maintenance includes database design/architecture, data analysis, data processing, and data support (to feed and expose data to various travel applications). Create, maintain and update supporting architecture and tool documentation including: reports, database and infrastructure documentation. See Attachment A – High Level Overview.

4.1.3 Plan, implement, and manage a process that validates the accuracy of data within CTIM.

4.2 Support DTMO Travel Data Infrastructure:

4.2.0 The DTMO Travel Data Infrastructure is currently comprised of approximately 19 terabytes of data in 50+ billion records. Supporting the Travel Data Infrastructure includes technical support and providing software solution(s) to enable the required data feeds into the repository as outlined below.

4.2.1 Technical Support

4.2.1.1 Maintain separate environments for development, testing, and production.

4.2.1.2 Provide software testing and support to system administrators and database administrators such as Compliance Tool, PCTRT, Data Governance Tool, Traditional CBA, and Basic Allowance Housing (BAH), TART.

4.2.1.3 Ensure software functionality is maintained when the database infrastructure and/or database software is upgraded. This includes any proprietary software used to support this contract in accordance with cloud provider mandates.

4.2.1.4 Store data using industry best practices.

4.2.2 Ensure data efficiency by performing the following activities:

4.2.2.1 Validating data against predetermined rules to ensure inaccurate and/or incomplete data is not loaded into the reporting tables.

4.2.2.2 Eliminating redundancies in the database to reduce storage needs and improve data accuracy.

4.2.2.3 Normalize data to reduce storage needs and the duplication of data.

4.2.2.4 Use referential integrity to increase database performance, ensuring all table references used in the database are valid.

4.2.2.5 Minimize physical space requirements for all travel data storage.

4.2.3 Ensure ingested data is organized and structured in a way that facilitates the DTMO’s records management retention schedule compliance.

4.2.4 Global Distribution Systems (GDS)

4.2.4.1 Provide, implement, and maintain a software solution to pull DoD Passenger Name Records (PNRs) from the appropriate GDS and upload into the CTIM. This is currently limited to DoD contracted Travel Management Companies (TMCs) PNRs in Sabre and WorldSpan, but may be expanded to other GDS and/or other travel supplier types such as rental car vendor GDS records, lodging GDS records, and/or reference data directly from the GDS. When it is anticipated software upgrades are needed, notify and coordinate with DTMO when this occurs.

4.2.5 Within 90 days of implementation and quarterly thereafter, provide the DTMO a matrix for each GDS used by the DTMO’s data suppliers identifying all fields provided by the GDS. At a minimum each matrix should provide:

a) Field Name

b) If XML, start and end tags for field; if other format, position of field in file

c) Plain language definition of field

d) Indicator if the field is captured by Contractor and ingested into the CTIM tables

e) Indicator if the field is captured by Contractor and not ingested into the CTIM tables

f) Indicator if the field is available to be captured by the Contractor but is not captured

g) If field is captured by Contractor and ingested into the CTIM tables, note the first CTIM raw or reporting table and field name where the data is loaded.

4.2.6 Establish GDS access to specific Pseudo City Codes (PCCs) to facilitate the data ingestion from GDS used by DoD contracted TMCs. Any solution to pulling and uploading GDS PNRs must allow for the possibility of multiple Extract, Transform, and Load (ETLs) from a single TMC and/or single PCC.

4.2.7 The software solution (section 4.2.2) must be able to collect, maintain, and store data in the DTMO's current enterprise environment (known as Passport) currently located in DMDC OCI environment and must be able to perform the same functions if DTMO transitions to a different cloud based solution at a future date.

4.2.8 Pull GDS data used by contracted TMCs that are based on PNR activity (e.g., when a PNR is created, updated, ticketed, cancelled or refunded). In addition to standard PNR data, the contractor will collect DoD specific data (e.g., user defined and comment fields). See Attachment B – TMC Data Requirements. (note, the TMC Data Requirements are periodically updated based on changes to the TMC contracts, the latest revision, ver 6.3.1.1, is referenced in this PWS)

4.2.9 Validate data pulled from GDS against pre-determined rules for completeness and accuracy. Maintain records of validation errors and of when corrected PNRs have been received.

4.2.10 Add, delete, and maintain connections to PCCs. Currently there are two connections, one to Sabre and one to Worldspan.

4.2.11 Be responsible for maintaining GDS access for PNR data pulls. The historical average number of unique PNRs for FY21, FY22, and FY23 by GDS are as follows:

Average # of Unique PNRs per Month

4.2.12 Continuously develop and maintain tables, scripts, and/or other tools required to ingest government and vendor-provided data files that arrive in a multitude of file types and formats; historically these files have been formatted as CSV, fixed width text files, XML, and/or spreadsheets.

4.2.13 Provide support for travel applications that utilize the travel repository. This support can include building the necessary table structure to support new applications (e.g., Traditional CBA reconciliation, Integrated Lodging, AVenU, DARC interface, Bus Movement, New Per Diem Interface/Tool), maintaining existing application table structure and enabling portions of data to be accessed, utilized and maintained through travel applications, or creating user interfaces using tools such as Oracle APEX (currently in use), or other specified technology. Current DTMO travel applications supported by the travel repository include but are not limited to:

· Travel Explorer (TraX), a travel planning, training and help desk support application,

· Per Diem Rate Information Manager (PRI$M), an application that integrates and publishes federal per diem rates,

· Compliance Tool, a tool that checks aspects of a submitted travel voucher and identifies potential errors to be fixed,

· Premium Class Travel Reporting Tool, an application that routes records with other than coach/economy travel through a review, update, and approval process.

4.2.14 Maintain data collection services to meet maintenance requirements, this includes: shutdown of data collection services in preparation for system outages, maintenance, and restart data collection services once outages are completed. Historically this occurs one to four times a month and typically occurs after business hours. Unless previously agreed to with the DMTO, if the system has been taken down for maintenance or other downtime, data processes must be fully restored and operational within 4 hours once the data repository is back online.

4.2.15 Support Business Intelligence Reporting

4.2.15.1 Stage and schedule data extractions in support of the DTMO Business Intelligence tool within 2 business days upon request.

4.2.15.2 Build and automate delivery of recurring reports to internal DTMO customers, DoD customers, and other Federal entities. These reports are provided to the end customers.

4.3 Integrate, Implement, and Maintain Travel Data Sources (see Attachment C – Data Sources):

4.3.1 Implement and maintain existing travel data sources currently ingested into the repository to include:

4.3.1.1 Routine pull of reservation data from the Global Distribution Systems, as described in section 4.2.5, in near real time or, if special circumstances prohibit near real time, a minimum of once per day.

4.3.1.2 Integrate monthly TMC data of all travel arrangements to include, but not limited to, air, rail, bus, rental vehicle, and lodging arrangements from the previous calendar month provided. (see file format in Attachment B - TMC Data Requirements).

4.3.1.3 Integrate DoD Allowances data and develop logic to calculate rates for allowances setting. Develop interface(s) for data entry using approved technology in conjunction with data import files. Develop/modify technical documentation as needed.

4.3.1.4 Daily feed of all Government Travel Card (GTCC) transactions provided by the DoD contracted travel card vendor. The travel card vendor also provides monthly and quarterly reference and summary data files.

4.3.1.5 Daily feed of authorization and voucher data from the Defense Travel System (DTS) and future DoD travel system.

4.3.1.6 Monthly feed of foreign per diem rates from Department of State, or process files as needed for non-routine processing.

4.3.1.7 Twice-annual feed of domestic per diem rates from the General Services Administration (GSA), or process files as needed for non-routine processing.

4.3.1.8 Monthly or quarterly reports of all US Government car rentals provided by the various rental car vendors, or process files as needed for non-routine processing.

4.3.1.9 Monthly feed of lodging stays under the DoD lodging program provided by the Fed Rooms contractor, or process files as needed for non-routine processing.

4.3.1.10 Weekly updates of GSA City Pair fares. Individual fares can be updated on an ad hoc basis throughout the year, or process files as needed for non-routine processing.

4.3.1.11 Quarterly, import Meals and Quarters availability and rates data and generate data extracts, or process files as needed for non-routine processing.

4.3.1.12 Twice a month, import lodging data for the Integrated Lodging Program and generate extract files, or process files as needed for non-routine processing.

4.3.1.13 Manage data in compliance with DoD records retention schedules Administrative Instruction (AI)-15 and System of Records Notices (SORN). Create/maintain Data Retention Plan.

4.3.2 Integrate any new sources, vendors, and/or formats into the CTIM and perform data maintenance activities. Data maintenance requires continuous monitoring and adjusting of data to ensure data is integrated and available for use. Activities for integrating new data and maintenance include:

4.3.2.1 Design/Architecture of the necessary tables to store the raw and reporting data.

4.3.2.2 Building or modifying raw data source and reporting tables.

4.3.2.3 Developing or modifying the ETL scripts to incorporate the data into the data source specific reporting tables.

4.3.2.4 Updating metadata tables and data dictionary as changes are made under 4.3.2 and sub bullets.

4.3.2.5 Integrating the data into the canonical master data set, when applicable.

4.3.2.6 Closing out any old data sources that cease delivery.

4.4 Develop and maintain comprehensive Data Quality Control Program:

4.4.1 Plan, implement, and manage a process that monitors, measures, and reports on data quality from the various data sources. Any issues identified during the Data Quality Program shall be reported to the DTMO with the proposed resolution, and a priority for resolution established by the DTMO. The Data Quality Program shall include the following:

4.4.1.1 Defined Extract, Transform, Load/File Processing Report (ETL/FPR) Process. Maintain data validations as part of the ETL process. Data must be checked against a set of validations, as defined by the DTMO, and results must be communicated to the DTMO, and to the submitting party, as part of an FPR. The contractor shall propose an FPR format. Implement a solution to integrate corrected and/or new records. Ensure elimination of duplicate records that already exist within the data repository and track the changes to the data.

4.4.1.2 Regularly monitor data sources and ensure completeness of data source submittals, including:

4.4.1.2.1 Monitoring and reporting on vendors to ensure files are submitted on time (based on commercial travel vendors defined schedules), to include files expected to correct previously submitted errors.

4.4.1.2.2 Notify the COR and/or DTMO functional POCs of vendors who have not submitted on time and continue to monitor and report until completion.

4.4.1.3 Ensuring data received matches with corresponding reference data (e.g., TMC is using acceptable Site IDs to identify where the travel reservation data is coming from and vendors are submitting field appropriate content (numbers in numeric fields, email addresses in email fields, etc.)).

4.4.1.4 Addressing all classes of data (e.g., air, ground, hotel, travel card, reference) and all source groups (e.g., TMCs, travel card vendor, category vendors).

4.4.1.5 Performing data assurance at the system, file, record and data element levels, as appropriate.

4.4.1.6 Provide details and timeframes describing travel data quality assurance methods and how monitoring results will be communicated to both DoD and data providers.

4.4.1.7 Defined procedures to ensure data integrity (i.e., reliability, accuracy, and consistency) across development, test and production environments.

4.4.1.8 Validation methods to be used include:

4.4.1.8.1 Data type checks.

4.4.1.8.2 Batch totals (checks for missing records).

4.4.1.8.3 Check digits.

4.4.1.8.4 Consistency checks (checks fields to ensure data in these fields corresponds (e.g., if title = “Mr”, then gender = “M”)).

4.4.1.8.5 Null value checks (checks that important data are actually present and have not been omitted).

4.4.1.8.6 Logic checks (checks that an input does not yield a logical error, e.g.; if hotel check in date populated, hotel rate code should be present or hotel check in date should not be after hotel check out date).

4.4.1.8.7 Range checks (checks that the data lie within a specified range of values).

4.4.1.8.8 Reference Table checks (checks that value matches one in a specific reference table.field)

4.4.1.8.9 Boolean (should be Y/N, 1/0, or other Boolean value)

4.4.1.8.10 List (does the data match a value in a specified list)

4.4.1.8.11 Review and maintain the data chasing program so corrected data can be correctly integrated into reporting tables. Data chasing program shall include:

4.4.1.8.11.1 Building or modifying data quality issue tables to capture records that failed validations, the reason(s) records failed validations, when corrections are due, if corrections have been received, how many attempts to correct the error were made, and when a record was corrected.

4.4.1.8.11.2 Prepare 30/60/90 day error aging reports to be delivered to specified persons at the DTMO and the data provider.

4.4.2 The Data Quality Control Program shall be documented in a Data Quality Program Plan, delivered within 30 days of contract award and updated on at least an annual basis. The Contractor must implement the Data Quality Program plan upon approval by the DTMO and develop and maintain all other necessary documentation.

4.5 Develop and Maintain Supporting Documentation:

4.5.1 Develop and maintain technical documents in support of 4.1 through 4.4. These documents include but not limited to:

4.5.1.1 ETL scripts. The code used to import data from DTMO vendors into reporting tables shall be provided to the DTMO.

4.5.1.2 Submit updated Entity Relationship Diagrams (ERDs) the first week of each month for each data source, to include raw and reporting tables as well as the canonical master data set. As-Is ERDs will be provided at the post award conference.

4.5.2 Maintain and expand the Data Traceability Metadata Tables of the entire data repository. These tables will describe, at a minimum, data types, data formats, plain English descriptions of the purpose of the tables, columns, and other database entities, validations, calculations, and transformations of data from its source through reporting and the canonical master data set as well as the lineage of data from source to canonical master reporting tables and the reverse, from master tables to the source data files.

This will include a full data dictionary for all raw tables, reporting tables, reference tables and canonical master data set. The Matrix will also demonstrate how each element is built from previous layers of the database (i.e., what fields are from what tables and what calculations are used to determine the value of a field in a subsequent table). An updated copy including any modifications to the CTIM or additions (for example, new data sources) as performed and integrated under paragraph 4.2 will be submitted to the government once per quarter thereafter.

4.5.3 Operational Support. The Contractor shall ensure data processing and monitoring is performed on a continuous basis (i.e., 24 hours a day, 7 days a week (24/7)). Data processing and monitoring shall be accomplished in an automated manner, including notifications. The Contractor shall notify the Government of any performance issues consistent with the timeframes defined in Section 4.7.1, in accordance with the criticality of the issue.

4.6 Provide Transition of Contract Services:

Provide a plan for transition out (within 150 days of contract ending) services to ensure minimum disruption to vital Government business. This plan shall address how the Contractor will work with the successor Contractor and Government personnel to ensure that there will be no service degradation during and after the transition period. The 90-day transition period shall include:

4.6.1 Phase-out Implementation Period activities:

4.6.1.1 Submit a contract transition phase-out plan 150 days prior to the end of contract that describes all necessary transition related activities to ensure successful transfer of knowledge and documentation to the awarded vendor. The plan shall describe current access permissions into the DTMO enclave (common access cards), the methods to assume responsibility for the SQL and PL/SQL that performs ETL from the various external data sources into appropriate raw tables; moving data from raw to reporting tables, and integration into application tables including maintenance of the canonical master data set.

4.7 Perform Program Management:

4.7.1 Utilize DTMO’s issue tracking system to manage tasks and issues. Issue priorities and definition will be established by the DTMO. An example:

· Priority 1 (Showstopper) – A critical issue impacting production tools and/or database access/function. Should be escalated and reported to the government technical POC within 1 hour of identification and resolved for government validation within 4 hours.

· Priority 2 (High) – A major issue causing deficiencies in performance and/or data loss with no acceptable workaround. Should be reported to the government technical POC immediately and resolved for government validation within 24 hours.

· Priority 3 (Moderate) – A medium issue or major issue with no acceptable workaround. Should be resolved for government validation within 3 business days.

· Priority 4 (Low) – A medium issue with an acceptable workaround or a minor issue with low impact to data accessibility/functionality.

· Priority 5 (Cosmetic) – A minor issue with an acceptable workaround or a purely cosmetic change.

4.7.2 Conduct Status Meetings on a weekly basis. These meetings shall be used to review recent work, discuss ongoing activities, and prioritize open issues and tasks.

4.7.3 Participate in three In-Process Reviews (IPR) during the transition period (PWS 4.6). These IPRs will be at the 15, 30 and 45 day segments of the implementation period.

4.7.4 In-person quarterly reviews may be required at the government site to discuss topics such as present and future projects, tasks and schedules. The vendor will produce meeting minutes following the in-person quarterly review.

4.7.5 Provide a Monthly Status Report (MSR) to describe the status of activities performed during the previous calendar month and document, at a minimum:

· Period of Report

· Summary of Work Completed

· Summary of Work in Progress

· Summary of Work Started

· Deliverables Provided

· Project Schedules/Task Lists with Priorities

· Document Status/Schedule with Priorities

· Security Related Events

· Known or Anticipated Issues, With Plans of Action

4.8 Participate in a Post-Award Conference.

This meeting shall provide an introduction between the Contractor personnel and Government personnel who will be involved with the contract. The meeting shall provide the opportunity to discuss technical, management and security issues. The Post Award Conference will aid both the Government and Contractor in achieving a clear and mutual understanding of all requirements and identify and resolve any potential issues. The Contractor shall be prepared to discuss any items requiring clarification and gather information as necessary to support each deliverable.

5.0 DELIVERABLES

6.0 CONTRACTOR MANPOWER REPORTING

The contractor shall report ALL contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract via SERVICE CONTRACT REPORTING (SCR) which has replaced the legacy Enterprise Contractor Manpower Reporting Application (ECMRA). SCR is located in in the System for Award Management (SAM) (https://sam.gov).

Reporting inputs will be for the labor executed during the period of performance during each Government fiscal year (FY), which runs October 1 through September 30. While inputs may be reported any time during the FY, the reporting period for contractors in SAM is generally open from mid-October to mid-December for reporting against the prior government fiscal year, all data shall be reported no later than October 31 of each calendar year, unless a later date is otherwise authorized by the Department of Defense.

7.0 CONTRACTOR TRAVEL

Local travel only at contractor expense.

8.0 SECURITY

NOTE: Security Clearances are not required for access to unclassified data.

8.1 Personnel Security. Overarching security requirements are UNCLASSIFIED access. The Contractor/Subcontractor personnel under this contract will require unclassified access to DoD network(s), Information Technology (IT) systems, Government Furnished Equipment (GFE), DOD credential, also known as the Common Access Card (CAC) for physical and logical access to federally controlled facilities and or DoD Information Systems (IS) with Personally Identifiable Information (PII) or Controlled Unclassified Information (CUI).

8.1.1 All Contractor personnel assigned to this contract are required to obtain and maintain the appropriate background investigation (BI) and adjudication or suitability determination in accordance with DODI 5200.02-DoD Personnel Security Program (PSP).

8.1.2 The contractor/subcontractor personnel on this contract will be designated a [Noncritical-Sensitive] position for Unclassified access.

8.1.3 Provide personnel already vetted or able to undergo a background investigation according to Department of Defense (DoD) regulations.

8.1.4 Must have or be able to obtain a completed [Tier 3 (T3)] an equivalent or higher BI according to the Defense Counterintelligence and Security Agency (DCSA) and the Office of Personnel Management (OPM) investigative alignment.

8.2 Security Clearances. Not required.

8.3 Staffing. The personnel supporting this contract requiring a DHRA sponsored CAC, access to DoD network(s), DoD information systems with CUI/PII data or IT/Information Systems must be Citizens of the United States. This includes personnel assigned or working on the contract at any remote sites.

8.4 Onboarding. Prior to requesting access to DHRA sponsored resources (e.g., DoD credential(s), Network(s), IT systems, Information Systems (IS) or facility), provide an official request via DHRA’s onboarding system(s)/encrypted email/DoD SAFE accompanied by a complete Defense Logistics Agency Headquarters (DLAH) Form 1728 - Request for HQC Contractor Badge and/or Information Technology (IT) Access. The DHRA Security and the Defense Logistics Agency (DLA) Personnel Security (PERSEC) will validate the appointed contractor has a favorably adjudicated [Tier 3] BI that meets the requirement for access at DHRA or has the required Personnel Security Investigation (PSI) of equivalent or greater in scope with a minimum of interim eligibility.

8.5 Listing of Employees & Clearance Documentation. The Contractor shall maintain a current listing of employees. Within 10 calendar days of contract award, the Contractor shall provide the COR a list with the names, location of performance and clearance requirements of all company employees assigned to this effort. The employee list should include the following information: Contract number, employee information (full legal names), DHRA center/office, job location, clearance level needed (Top Secret/SCI, Top Secret, Secret or None (Position of Trust for unclassified access)), IT access level needed (privilege, authorize or other). The list shall be validated by the company and DHRA PERSEC. An updated listing shall be provided when an employee's status or information changes.

8.6 Access To Sensitive Information. To the extent that the work under this contract requires the Contractor to have access to DoD sensitive information the Contractor shall after receipt thereof, treat such information as confidential and safeguard such information from unauthorized use and disclosure. The Contractor agrees not to appropriate such information for its own use or to disclose such information to third parties unless specifically authorized by the Government in writing.

8.6.1 The Contractor shall allow access only to those employees who need the sensitive information to perform services under this contract and agrees that sensitive information shall be used solely for the purpose of performing services under this contract. The Contractor shall ensure that its employees will not discuss, divulge or disclose any such sensitive information to any person or entity except those persons within the Contractor’s organization directly concerned with the performance of the contract.

8.7 Information Technology (IT) Level Investigation Requirements. The contractor/subcontractor personnel supporting this contract will require Moderate (IT-II) access to DHRA IT & Information.

8.7.1 Contractor personnel, who perform work on sensitive networks, IT systems or applications, will be required to obtain and maintain the appropriate investigation and adjudication determination. The Contractor shall assure that individuals assigned to the contract undergo the respective BI and have obtained the proper eligibility, based on job function or tasks performed by the contractor personnel.

8.7.2 IT-Level position category designation does not imply or convey access to classified information.

8.7.3 The IT Level will determine the access level needed to perform work on the DoD IT Systems/Networks. The IT access level is designated based on the IT system/network requirements according to the DoD Cyber, Security Technical Implementation Guides (STIGs) https://public.cyber.mil/stigs/.

8.7.4 It is the responsibility of the contractor to ensure the employees meet the appropriate Tier investigation prior to requesting IT access. The applicable IT access levels are as follows:

8.7.5 Authorize – Moderate Risk: All personnel in positions in which the individual is responsible for the-direction, planning, design, operation, or maintenance of a computer system, and whose work is technically reviewed by a higher authority of the Privilege to ensure the integrity of the system. All personnel identified in one or more of these job functions must complete a Tier 3 (T3) or Tier 3 Reinvestigation (T3R), an equivalent or higher BI to meet the Noncritical-Sensitive role. Roles may include, but are not limited to:

· Access to and/or processing of proprietary data, information requiring protection under the Privacy Act of 1974.

· Those with the ability to aggregate and extract data en masses from an automated records repository containing PII.

· Other positions designated by the Agency head that involve a degree of access to a system that creates a significant potential for damage or personal gain less than that in Privilege positions.

8.8 Personal Identifiable Information (PII) and Tier Investigations. All personnel supporting this contract must protect PII data according to the Privacy Act of 1974. Personnel requiring access to Information Technology (IT) or access to DoD Information Systems that contain military active duty, guard, or reservists’ PII or information pertaining to Service members that are otherwise protected from disclosure where such access has the potential to cause serious damage to national security, must be vetted accordingly and protect the data, including, but is not limited to the abilities and capability according to the job functions mentioned here:

8.8.1 Tier 3/Tier 3R for Noncritical-Sensitive – Moderate Risk: All personnel with the ability to aggregate and extract military PII en masses from an automated records repository requires at a minimum, a favorably adjudicated Tier-3 (T3) BI or equivalent.

8.8.2 The Contractor shall report immediately to the DHRA Privacy Office and secondly, to the COR, discovery of any Privacy breach.

8.9 Controlled Unclassified Information Requirements for DoD Contractors. The following procedures will be used to protect Controlled Unclassified Information (CUI) documents and materials:

8.9.1 HANDLING: Access to CUI material shall be limited to those employees needing the material to perform their duties. The CUI marking is assigned to documents and material created by a DoD User Agency. CUI is not a classification, but requires extra precautions to ensure it is properly safeguarded and disseminated and is not released to the public without government authorization.

8.9.2 MARKING: Mark unclassified documents containing CUI: “CUI" at the top and bottom of each page, include the CUI warning box, and the CUI Designation Indicator Block as required in DoDI 5200.48.

8.9.2.1 Mark other records such as computer print outs, photographs, films, tapes, or slides in accordance with DoDI 5200.48 so the receiver or viewer knows that it contains CUI material.

8.9.2.2 Mark a message containing material in accordance with DoDI 5200.48. Unclassified messages containing CUI material must show the abbreviation (CUI) before the text begins.

8.9.2.3 Ensure documents transmitting CUI material call attention to any attachments containing CUI.

8.9.2.4 CUI material released to a contractor by a DoD user agency must have the following statement on the front page or cover:

THIS DOCUMENT CONTAINS CUI MATERIAL AND MUST BE REVIEWED BY A GOVERNMENT REPRESENTATIVE UNDER THE REQUIREMENTS OF DODI 5200.48, DODI 5230.09, and DODI 5230.29.

8.9.3 STORAGE: During normal duty hours, place CUI material in an out-of-sight location if your work area is accessible to persons who do not have an authorized government purpose for access to the material. After normal duty hours, store CUI material to prevent unauthorized access. File with other unclassified records in unlocked files or desks when internal building security is provided and the file is marked as CUI. When there is no internal security, locked buildings or rooms usually provide adequate after hours protection. For additional protection, store CUI material in locked containers such as file cabinets, desks, or bookcases.

8.9.4 TRANSMISSION: CUI documents and materials may be transmitted via first class mail, parcel post or for bulky shipments-fourth class mail. Within the CONUS discussion of CUI material on the telephone is authorized if necessary for the performance of the contract and no alternative is available. Electronic transmission of CUI (voice, data, or facsimile) should be by approved secure communications systems whenever practical. If there is a fax transmission, the sender must ensure the intended receiver is available to receive it or a cover sheet will be used to allow carrying it to the final recipient to avoid unauthorized disclosure of the CUI.

8.9.5 RELEASE: CUI material shall not be released outside of the contractor’s facility except to the representative of DoD or DHRA.

8.9.6 DESTRUCTION: When the CUI material no longer meets the threshold for safeguarding and dissemination, it shall be immediately decontrolled, be processed through the records management process, and destroyed by the approved methods identified in DoDI 5200.48 precluding its disclosure to unauthorized individuals by rendering it unreadable, indecipherable, and irrecoverable.

8.10 Position of Trust (POT) Requirements. DCSA and OPM offers the Tier background investigations, Tier 1 (T1) – Tier 5 (T5) for Position of Trust determination. The T5 being the most stringent investigation and T1 being the least stringent.

8.10.1 The Government is responsible for the cost of POT or sponsor a DoD-determined equivalent background check for unclassified access.

8.10.2 The Position of Trust BI process requires the DoD Government Security Office to review each request and establish the BI sponsorship. Submit a request and list of personnel for security investigation to the DHRA Security Office point of contact(s) to be provided by the COR- NLT five (5) business days after contract award.

8.10.3 Per DCSA a [T3 or T3 Reinvestigation (T3R)] meets the requirement for a [Noncritical-Sensitive] position. A new application for a DoD [T3/T3R] BI for Position of Trust determination requires FBI fingerprints check, proof of US Citizenship and a Personnel Security Questionnaire (PSQ) on the Standard Form (SF) 86 using the National Background Investigation Services – electronic Application (NBIS/eApp). The Contractor employees shall provide all requested information pursuant to the Privacy Act of 1974 when requested by the Government. The Government Security Office will provide instructions according to the individual case and Tier BI to access the eApp system. For information visit NBIS at https://www.dcsa.mil/is/nbis/

8.10.4 Reciprocity. The DHRA and DLA PERSEC will use reciprocity to the extent possible and if necessary will request re-adjudication by the DoD Consolidated Adjudications Facility (CAF) or DCSA Consolidated Adjudication Services (CAS) to support the DoD standards per Executive Order E.O 13488, Granting Reciprocity on Excepted Service and Federal Contractor Employee Fitness and Reinvestigating Individuals in Positions of Public Trust.

8.10.4.1 A BI equivalency will be according to the investigative alignments offered by the OPM and the DCSA here, https://www.dcsa.mil/Portals/91/Documents/pv/GovHRSec/Position_Designation_Investigation_Type_Chart_Sept_2017.pdf

8.10.4.2 Reciprocity consideration includes verifying break in service longer than 24 months as a US Military, US Civilian or US Contractor from the last favorable investigation.

8.10.5 A new Position of Trust applicant under this contract must obtain at a minimum interim eligibility from DLA Security prior to the assignment and performance of their duties in support of the Government in this contract.

8.10.6 DHRA’s interim Position of Trust eligibility is sponsored by DHRA Security and approved by DLA PERSEC.

8.10.7 Eligible interim Position of Trust personnel expectations include, but are not limited to:

8.10.7.1 Comply with all personnel security requirements as specified by DHRA and DLA PERSEC;

8.10.7.2 Attain and maintain favorable FBI fingerprint results;

8.10.7.3 Comply with all investigative and adjudicative requirements, which includes responsiveness to time-sensitive requests (e.g., interview(s), additional information or clarification) from the DLA PERSEC, investigator or the adjudicative agency (DoD CAF/CAS);

8.10.7.4 Attain and maintain favorable eligibility to the designated BI.

8.11 Controlled/Restricted Areas. The Contractor shall be compliant with local procedures for entry to DHRA controlled/restricted areas where Contractor personnel will work.

8.12 Physical Security. The Contractor shall safeguard all Government property and controlled forms provided for Contractor use and adhere to the Government property requirements contained in this contract. At the end of each work day, all Government facilities, equipment and materials shall be secured.

8.13 Pass and Identification Items. The Contractor shall ensure the pass and identification items required for contract performance are obtained for employees and non-government owned vehicles.

8.14 DoD Credentials/Common Access Card (CAC). Contractor personnel must obtain a DoD credential or CAC if they are assigned to perform work under this contract requiring access to DoD network(s), CUI/PII data, IT/Information Systems, DoD Facilities or non-DoD federally controlled facilities on behalf of the DoD on a recurring basis per DODM 1000.13, DoD Identification (ID) Cards: ID Card Life-Cycle.

8.14.1 Comply with HSPD-12 Personal Identity Verification (PIV) issuance requirements. Be responsible for obtaining a CAC or PIV and be in ready status prior to requesting access to DoD resources such as DoD Facilities, DoD IT/Information Systems (IS).

8.14.2 CAC Applicant supporting this contract will need to meet the following requirements:

8.14.2.1 Execute, obtain/maintain a favorable FBI National Criminal History Check (fingerprint check);

8.14.2.2 Have an open [Tier 3 or equivalent BI to meet Noncritical-Sensitive] role;

8.14.2.3 Be ready to provide two forms of identification (I-9 document);

8.14.2.4 Provide proof of U.S Citizenship.

8.15 Retrieving Identification Media. The Contractor shall retrieve all identification media, including vehicle passes from employees, including those who depart for any reason before the contract expires; e.g. terminated for cause, retirement, etc.

8.16 Access Badge Control. The Contractor shall establish and implement methods of making sure all keys/badges issued to the Contractor by the Government are not lost or misplaced and are not used by unauthorized persons.

8.16.1 Prohibited Use. The Contractor shall prohibit the use of keys, issued by the Government, by any persons other than the Contractor’s employees and the opening of locked areas by Contractor employees to permit entrance of persons other than Contractor employees engaged in performance of contract work requirements in those areas.

8.17 Conduct while on Government Installation. The CO may direct the contractor to remove an employee(s) from an assignment under this contract for reasons of security or misconduct.

8.18 Weapons, Firearms, and Ammunition. Contractor employees are prohibited from possessing weapons, firearms, or ammunition, on themselves or within their contractor-owned vehicle or privately-owned vehicle while on DoD/DHRA installations.

8.19 Reporting Requirements. Contractor personnel shall report to an appropriate authority any information or circumstances of which they are aware may pose a threat to the security of DoD personnel, Contractor personnel, resources, and classified or unclassified defense information.

8.20 Government Furnished Equipment (GFE). The Contractor shall establish and implement procedures to ensure all GFE to include laptops and other data processing devices, issued to the Contractor by the Government are not lost or misplaced, are not used by unauthorized persons or are not subject to unauthorized external devices. The Contractor shall immediately report to the COR any occurrences of lost GFE within two (2) hours of discovery of occurrence. In the event that GFE is lost, the Contractor may be required, upon written direction of the CO, to replace the equipment at no additional cost to the Government. The Government may replace the equipment and deduct the cost of such from the monthly payment due the Contractor.

8.21 Lock Combinations. N/A.

8.22 Offboarding. Upon completion of the contract, an employee’s relocation or termination of an employee, or upon request from the COR in accordance with DHRA centers or offices security policies coordinate the employees removal from work under this contract with the COR.

8.22.1 If at any time, any Contractor personnel supporting this contract are unable to obtain/maintain an adjudicated [T3 BI], the Contractor shall immediately notify the COR and coordinate removal of such a person from work under this contract and replace the individual with appropriate level background investigation knowledge, skill and ability (KSA) required to perform services.

8.22.2 As the contractor replaces employees, the contractor shall submit the outgoing employee’s installation access and return all CACs/badge(s)/identification card(s) immediately to the COR, who will turn it in to the local Installation Access Control Office or Government Security Office.

8.22.3 Submit an Off-boarding notification to the COR and the DHRA PERSEC as soon as the contractor knows an employee is leaving the contract.

8.22.4 When personnel change, provide updated personnel security list to the COR within three business days of a change.

8.23 Information System Security. The Contractor shall implement Information System (IS) security protections and ensure the protections are appropriate to the confidentiality, integrity, and availability needs of the Government. Establish appropriate administrative, technical, and physical safeguards to protect any and all nonpublic Government data.

9.0 Cybersecurity

9.1 Risk Management Framework. All Information Systems (IS), Platform Information Technology (PIT) and Information Technology (IT) Services or Products under this requirement, that receive, transmit, store, or process nonpublic government data must be accredited in accordance with Department of Defense (DOD) Instruction (DoDI) 8510.01, Risk Management Framework (RMF) for DoD Information Technology (IT) and comply with annual Federal Information Security Management Act (FISMA) security control testing. IS and PIT systems must be categorized in accordance with Committee on National Security Systems Instruction (CNSSI) 1253, implement a corresponding set of security controls from the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, and use assessment procedures from NIST SP 800-53A with additional DoD-specific assignment values, overlays, implementation guidance, and assessment procedures as required.

9.1.1 All systems subject to RMF must present evidence of authorization in the System Security Plan (SSP), Security Assessment Report (SAR) Plan of Action and Milestones (POA&M) and authorization decision document or show that the system has a DoD Risk Management Framework (RMF) or equivalent DoD Component PIT system accreditation decision that is current within 3 years. Evidence of FISMA compliance must be presented in the form of a POA&M. Systems must have and maintain an Authority to Operate (ATO) or, if acceptable to the Government, an Interim Authority to Operate (IATO) by contract award.

9.2 Information Security Continuous Monitoring (ISCM). ISCM is defined as maintaining ongoing awareness of information security, vulnerabilities, and threats to support organizational risk management decisions. ISCM is a critical part of the risk management process to ensure that IS and PIT operations remain within an acceptable level of risk despite any changes that occur. The Contractor shall maintain ongoing monitoring, analysis and incident response procedures for all IS and PIT systems under this requirement in accordance with NIST SP 800-137.

9.3 Cybersecurity Service Provider (CSSP). The Contractor shall perform CSSP services in accordance with DoDI 8530.01, Cybersecurity Activities Support to the DoD Information Network Operations, Change 1, July 25, 2017.

9.4 Cyber Incident Reporting. Within one (1) hour of discovery of any cyber incident the Contractor shall notify the DMDC Incident Response (IR) team by emailing an Initial cyber incident report to the following organizational box: dodhra.dodc-mb.dmdc.list.ir-team@mail.mil, with subsequent reporting every 24 hours until the incident is closed. The Contractor shall also notify the COR and CO at the time the incident is reported to DMDC/IR.

9.5 Compliance with Cybersecurity and Privacy DoD Instructions and Directives. The Contractor and all Contractor personnel with access to or responsibility for nonpublic Government data under this contract shall be in compliance with the latest versions of:

· DoD Instruction (DoDI) 8500.01, Cybersecurity

· DoD Instruction (DoDI) 8510.01, DoD Risk Management Framework (RMF) for DoD Information Technology (IT)

· The Privacy Act (5 U.S.C. 552a)

· DoDI 8530.01, Cybersecurity Activities Support to the DoD Information Network Operations, Change 1, July 25, 2017

· DoD Instruction 5400.11 DoD Privacy and Civil Liberties Programs, January 2019

· DoD Instruction 6025.18 Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule Compliance in DoD Health Care Programs, March 2019

· DOD Instruction (DoDI) 5200.02 DoD Personnel Security Program (PSP) (Incorporating Change 3, Effective September 24, 2020)

· HSPD-12, Homeland Security Presidential Directive

· NIST SP 800-137, Information Security Continuous Monitoring

· DOD Instruction (DoDI) 8140, Cybersecurity Workforce

· DOD Manual (DoDM)8570.01-M, Information Assurance Workforce Improvement Program

9.6 Cloud Computing. Any commercial cloud computing services used for this requirement must comply with the DoD Cloud Computing Security Requirements Guide and DoD Cloud Computing Supplemental Guidance and Information as published by the Defense Information Systems Agency (DISA).

9.6.1 The Contractor shall have been issued an Authority to Operate (ATO) or Provisional-ATO (P-ATO) by Defense Information Systems Agency at the impact level appropriate to DHRA requirements to provide the relevant cloud computing services in accordance with DoD Cloud Computing SRG. Evidence of DISA authorization must be presented to the government.

9.6.2 The Contractor shall provide CSSP services that align with DoD Cloud Computing SRG requirements and will have a separate Service Level Agreement (SLA) initiated by the government.

9.7…