Source Selection Information – See FAR 2.101 and 3.104

PERFORMANCE WORK STATEMENT

Performance Work Statement (PWS) for Information Technology (IT)

Application Development Software Support Services for the

Financial and Air Clearance Transportation System (FACTS)

1.0 Introduction:

NAVSUP Business Systems Center (BSC) Contractor Support

Services (CSS) is acquiring contractor support services

(CSS) to support application development and efforts.

NAVSUP BSC requires technical support services to support the DoD legacy joint transportation system, Financial and

Air Clearance Transportation System (FACTS). FACTS provides

Navy shipping functionality, Naval Cargo Routing, and DoD air cargo clearance capabilities. Support services will include software engineering, coding, integration testing, business analyzing, auditing, documentation of change requests, customer support, training, and knowledge sharing.

2.0 Background:

The contractor will be required to work with NAVSUP BSC organic resources to develop, test, audit, collect functional and technical requirements, knowledge of EDI transactions and document lessons learned from system development efforts, migrations, and stakeholder engagement.

2.1 Requiring Organization:

The organization requiring the services outlined in the Performance Work Statement (PWS) is:

NAVSUP Business Systems Center FACTS Program

Management Office 1837 Morris Street, Suite 600

Norfolk, VA 23511-3492

2.2 Project Description:

The purpose of this PWS is to obtain contract services for support and maintenance of application processes and data services as well as support necessary to deliver the related changes to the

NAVSUP BSC IT mission described in the Introduction paragraph of this PWS.

Tasks will be tracked by the Technical Assistant

(TA)/Government Project Manager throughout the project. Deliverables are described below in section

5.0 Tasks and 6.0 Deliverables.

3.0 Scope: The scope is to obtain secure application

development, modification, auditing, and support for FACTS system integration, to include lifecycle management and sustainment of the application. The contractor is required to provide expertise and support in the resolution of system problems and provide customer support in coordination with

NAVSUP BSC organic staff. FACTS is a legacy application with

ANSI X12 EDI and web service interfaces, java front end access cloud-hosted on DISA’s Stratus, and Gen COBOL backend hosted on a DISA mainframe.

The following application support service roles are required.

Each role includes the requirement for developing system documentation, mentoring, and knowledge transfer:

The goal of this PWS is to obtain contractor support services to provide the following:

• Versatilist Software Engineer o Develop and debug system code to maintain the application o Agile Software Delivery o Maintain System Artifacts o Conduct technical analysis to resolve problems with the application o Support Security Posture through Continuous Monitoring activities

• Scrum Master o Manage Azure DevOps backlog o Plan, schedule, and conduct Agile ceremonies o Coordinate technical team execution o Coordinate stakeholder communication

• Versatilist Systems Analyst o Define requirements of the sustainment work through user stories o Write and execute test plans o Train users o Assist users with access o Create and Maintain System Artifacts o Troubleshoot and facilitate team collaboration for user issues and requests o Conduct technical analysis to support application sustainment needs.

o Support Security Posture through Continuous Monitoring activities

• Information Center Specialist o Manage new and existing user accounts and access o Troubleshoot and facilitate team collaboration for user issues and requests

NOTE: A Versatilist is someone who may be a specialist for a particular discipline, while also able to perform additional roles with ease, e.g., a Software Developer with Operations

Automation skills.

Development will be performed with an agile team in small sprints.

4.0 Directives:

The contractor shall comply with the following directives, and any updated/future versions as they are released:

• Federal Information Security Modernization Act of 2014

(“FISMA”)

• Common Criteria for Information Technology Security

Evaluation, Part 3: Security Assurance Components, April

2017, Version 3.1, Revision 5, CCMB-2017-04-003

• DoDI O-2000.16-V1, DoD Antiterrorism Program Implementation, 17 November 2016 (incorporating Change 3, 7 May 2021)

• DoDD 5205.02E, OPSEC, 20 June 2012 (incorporating Change 2, 20 August 2020)

• SECNAV 3070.2A, Navy OPSEC, 9 May 2019

• SECNAVINST 5500.35, Navy Physical Security Program, 22

February 2022

• NAVSUPINST F5500.3, Insider Threat, 17 August 2020

• DoD Instruction 5400.11, DoD Privacy and Civil Liberties

Programs, 29 January 2019 (incorporating Change 1, 8

December 2020)

• DoD Directive 8000.01, Management of the DoD Information

Enterprise, 17 March 2016 (incorporating Change 1 July

2017)

• DoD Directive 8140.01, Cyberspace Workforce Management, 5

October 2020

• DoD Instruction 4161.02, Accountability and Management of

Government Contract Property, 27 April 2012 (incorporating

Change 2, 31 August 2018)

• DoD Instruction 8320.07, Implementing the Sharing of Data, Information, and Information Technology (IT) Services in the Department of Defense, 3 August 2015 (incorporating

Change 1, 5 December 2017)

• DoD Instruction 8500.01, Cybersecurity, 14 March 2014, Change 1, 7 October 2019

• DoD Instruction 8510.01, Risk Management Framework (RMF) for DoD Systems, 19 July 2022

• DoD Instruction 8582.01, Security of Non-DoD Information

Systems Processing Unclassified Nonpublic DoD Information, 9 December 2019

• DTM 24-001, DoD Cybersecurity Activities Performed for

Cloud Service Offerings, 27 February 2024

• SECNAVINST 5510.36B, DoN Information Security Program, 12

July 2019

• 252.239-7001 Information Assurance Contractor Training and

Certification (Please note that contractors are still held to DoD 8570 until DFARS is updated.)

• DoDM 8140.03, Cyberspace Workforce Qualification and

Management Program, 15 February 2023

• DoD 8570.01-M Information Assurance Workforce Improvement

Program, December 19, 2005, Incorporating Change 3, January

24, 2012

• SECNAV Instruction 5211.5F, Department of the Navy Privacy

Program, 20 May 2019

• SECNAV Instruction 5239.3C, DON Cybersecurity Policy, 2 May

• OPNAVINST 5239.1D, U.S. Navy Cybersecurity Program, 18 July

• OPNAVINST 5239.4, Chief of Naval Operations Cybersecurity

Safety Program, 14 September 2018

• SECNAV Manual M-5239.2, DON Cyberspace Information

Technology and Cybersecurity Workforce Management and

Qualification Manual, 27 June 2016

• SECNAV M-5239.3, Department of the Navy Cybersecurity

Manual, April 2022

• SECNAV Manual M-5510.30C, Department of the Navy Personnel

Security Program, 24 January 2020

• CJCSI 6211.02D, Defense Information Systems Network (DISN)

Responsibilities, 24 January 2012

• DoD Public Key Infrastructure (https://cyber.mil/pki-pke)

• ISO/IEC/IEEE 12207:2017 Systems and Software Engineering –

Software Life Cycle Processes

• ANSI/EIA 649C-2019 – Configuration Management Standard

• ANSI/EIA 836B-2015 – Configuration Management Data Exchange and Interoperability

• Federal Risk and Authorization Management Program

(“FedRAMP”)

• Department of Defense Cloud Computing Security Requirements

Guide, Version 1, Release 4, dated 14 January 2022

• All applicable Security Requirements Guides, Security

Technical Implementation Guides, and National Security

Agency security configuration guides when assessment and authorization is required

• NIST SP 800-37 Revision 2, Risk Management Framework for

Information Systems and Organizations, December 2018

• U.S. Navy Risk Management Framework Process Guide, Version

4.0, 5 March 2024

• NIST SP 800-53 Revision 5, Security and Privacy Controls for Information Systems and Organizations, September 2020, includes updates as of 10 December 2020

• NIST SP 800-53A Revision 5, Assessing Security and Privacy

Controls in Information Systems and Organizations, January

• NIST SP 800-171r3, Protecting Controlled Unclassified

Information in Nonfederal Systems and Organizations, May

• NIST SP 800-171Ar3, Assessing Security Requirements for

Controlled Unclassified Information, May 2024

• NAVSUPINST 5239.5, Cybersecurity and Defensive Cyberspace

Operations Policy, 25 March 2019

• ISO/IEC 19770-1:2017 – Information Technology – IT Asset

Management – Part 1: IT Asset Management Systems -

Requirements

• ISO/IEC 19770-2:2015 - Information Technology -- Software

Asset Management -- Part 2: Software Identification Tag

• ISO/IEC 19770 Series - Information Technology – IT Asset

Management

• A Guide to the Project Management Body of Knowledge (PMBOK®

Guide) - Seventh Edition

• Section 508 of the Rehabilitation Act of 1973 (amended by the Workforce Investment Act of 1998, 7 August 1998)

• SECNAVINST 5720.44C - DON Public Affairs Policy and

Regulations, 21 February 2012, Change 2 10 April 2019

(specifically, Chapter 7: Public Communication on the

Internet)

• SECNAVINST 5510.30C, Department of Navy Personnel Security

Program, 24 January 2020

• Homeland Security Presidential Directive (HSPD)12, Policy for a Common Identification Standard for Federal Employees and Contractors, 27 August 2004

• DoD Manual 5200.02, Procedures for the DoD Personnel

Security Program (PSP), 3 April 2017

• DoD Manual 5200.08-R, Physical Security Program, 27 May

2009, 3 April 2017

• DoD Instruction 5200.48, Controlled Unclassified

Information (CUI), March 6, 2020

• NSAMECHINST 5530.1C CH-1, Naval Support Activity

Mechanicsburg Installation Access Control, 23 August 2019

• DFARS 252.204-7012, Safeguarding Covered Defense

Information and Cyber Incident Reporting” from the memorandum Updated Implementation of “the DIB Memo” dated

06 Sep 2019

• SECNAVINST 5200.43A, Government Furnished Property, Accountability and Management, 10 September 2021, Change 1

4 August 2022

5.0 Requirements/Tasks: The contractor shall be obligated

contractually to perform every requirement in this performance work statement. Not every performance requirement has a related standard expressed in this document. In such cases the performance standard is either inherent in the requirement or performance is to be in accordance with standard commercial practice.

Per DFARS 211.106, contractor employees shall identify themselves as contractor personnel by introducing themselves or being introduced as contractor personnel and displaying distinguishing badges or other visible identification for meetings with Government personnel. In addition, contractor personnel shall appropriately identify themselves as contractor employees in telephone conversations and in formal and informal written correspondence.

5.1 Agile Processes

All contractor team members shall:

5.1.1 Ensure complete transparency through

creating and updating all activities in the Enterprise Platform, Azure DevOps, which shall be kept current within one (1) business day.

5.1.2 Participate as agile team members in agile

ceremonies.

5.1.3 Develop Product Backlog Items (PBI)

estimates and roadmaps in support of project schedules.

5.1.4 Update and Complete PBIs and bugs

representing any unit of measurable work that provides value to NAVSUP and serves as a deliverable.

5.1.5 Explain procedures and automate manual

processes.

5.1.6 Provide walkthrough exercises to explain all

application modules.

5.1.7 Have other team members assist on basic

tasks to cross-train.

5.1.8 Follow all enterprise standards and project

specific standards and requirements.

5.1.9 Provide technical advice to Navy resources, NAVSUP teams, management, and customers/users.

5.1.10 Provide customer support by

troubleshooting and researching issues.

5.1.11 Manage the configuration of the

application software, Software Lifecycle

Management documentation, and application code history control.

5.1.12 Identify and document configuration

items using a baseline.

5.1.13 Integrate Agile Release Team, Configuration Management, and Operations activities to unify software development lifecycle concerns in a holistic DevSecOps approach.

5.1.14 Conduct quality audits of NAVSUP

products, perform causative research on errors, and provide corrective action.

5.1.15 Extract data for preparation of

management reports.

5.2 Code Design, Development, Maintenance, Audit, and

Documentation

The Versatilist Software Engineer shall:

5.2.1 Modify system code in support of changes

required to keep the system functional.

5.2.2 Work with the government Team and

stakeholders to define the requirements.

5.2.3 Write, debug, and maintain code using the

NAVSUP defined software development processes.

5.2.4 Code in accordance with quality assurance

audits to ensure coding standards have been practiced, and that the code is compatible across the application.

5.2.5 Review code structure to evaluate high level

design.

5.2.6 Utilize various code analysis tools to

discover common issues and vulnerabilities.

5.2.7 Perform manual code analysis to detect bugs, performance bottlenecks, security vulnerabilities, and maintainability risks.

5.2.8 Migrate system code from existing code bases

to new code bases.

5.2.9 Maintain all source code within defined

project repository.

5.2.10 Upload all source code each business

day to ensure no loss of work.

5.2.11 Create and maintain batch procedures to

populate database tables.

5.2.12 Provide the full range of

System/Software Development Lifecycle activities to include requirements, analysis, design, development, test, security, and deployment.

5.2.13 Perform functions relating to design, software engineering/programming, unit testing, and maintenance.

5.2.14 Ensure string tests within functional

units are completed.

5.2.15 Design, develop, and use automated

Configuration Management (CM) tools.

5.2.16 Determine the feasibility of design

alternatives, translate systems requirements into application prototypes, and develop problem resolutions.

5.2.17 Review each module and the entire

system for design validity, including validation of record input, data elements, and output reports.

5.2.18 Determine and design system

architecture.

5.2.19 Implement recognized standard system

engineering best practices, resulting in improved supportability, survivability, reliability, and maintainability of program code.

5.2.20 Develop output media/forms.

5.2.21 Design and test user interfaces.

5.2.22 Deliver system code compatible with

operating in a “cloud” environment.

5.2.23 Create a program design document (PDD)

that will be provided to stakeholders for their approval before system modifications occur.

5.2.24 Implement code changes required for

approved modified functionality in the PDD.

5.2.25 Document all maintained technical

programming components.

5.2.26 Provide source code instructional

tools.

5.2.27 Automate builds, testing, and

deployments within continuous integration / continuous delivery (CI/CD) pipelines.

5.2.28 Enforce security and quality standards

within the delivery pipeline as gated steps.

5.2.29 Maintain compute resource inventories

and enforce established configurations and controls for delivery pipeline effectiveness.

5.2.30 Identify and define any delivery

pipeline impact concerns to agile, RMF, and release artifacts.

5.2.31 Establish software supply chain and

technical artifact management practices across artifacts such as libraries, dependencies, and builds.

5.2.32 Incorporate distributed version control

with Git based version control practices into delivery pipelines.

5.2.33 Automate operations concerns by

implementing monitoring and self- healing automation techniques.

5.3 Technical Coordination

The Scrum Master shall:

5.3.1 Develop clear, concise release notes for

user consumption.

5.3.2 Report relevant metrics to be agreed upon

by the TA. Examples include release burnup, sprint burndown, planned vs accepted PBI estimates, escaped defects, and velocity.

5.3.3 Coordinate all activities (analysis, design, development, testing, and deployment) required to complete each PBI or bug as defined in the Acceptance Criteria and

Definition of Done.

5.3.4 Work with the Product Owner to decompose

each PBI or bug down to the level that is achievable within a sprint (e.g., generally requiring less than 10-15 business days to complete) and identify the Acceptance

Criteria for each PBI and define the sprint

Definition of Done.

5.3.5 Identify all tasks required to successfully

complete each PBI or bug and document in

Azure DevOps.

5.3.6 Show traceability and dependencies between

requirements through Epics, Features, PBIs or bugs, and Tasks and systems in Azure

DevOps.

5.3.7 Effectively facilitate scrum, agile events, and practices.

5.3.8 Support user and team meetings to gather

requirements and determine validity of work and planned efforts.

5.3.9 Ensure items are properly reviewed and

approved, fully documented, and incorporated in the appropriate revision/version.

5.3.10 Ensure task dependencies are identified

and sequenced in project schedule.

5.3.11 Ensure changing priorities are

communicated to team and reflected in project schedule.

5.4 Testing, Training, and Evaluation

The Versatilist Systems Analyst shall:

5.4.1 Update and maintain user manuals.

5.4.2 Coordinate, schedule, and conduct user

training for all application modules.

5.4.3 Develop test procedures and test cases for

integration, regression, and system level test.

5.4.4 Support customers and users in testing, assuring software and systems quality and functionality.

5.4.5 Run batch jobs or create scripts.

5.4.6 Conduct overall system tests to ensure

functional unit inter-relationships are functioning properly.

5.4.7 Provide support to the development of

release packages.

5.4.8 Create and maintain system application

documentation to include but not limited to, Operational Concept Documents (OCD), Requirements

Statements, System Specifications, Design

Documents, System Flowcharts, Test Plans, Use

Cases, User Guides, Implementation Plans, or similar documents.

5.4.9 Manage and maintain the documentation

library.

5.5 Information Center Specialist

The Information Center Specialist shall:

5.5.1 Review and validate access requests.

5.5.2 Maintain an auditable repository of access

forms.

5.5.3 Build/rebuild user accounts to authorized

role and privileges.

5.5.4 Reset passwords upon request for valid

users.

5.5.5 Perform a quarterly user audit.

5.5.6 Ensure user access information and guides

are current and correct.

5.5.7 Coordinate and escalate when warranted to

develop complete technical responses to customer inquiries, issues, and requests with application team.

5.5.8 Support development of user stories in PBIs

or bugs to ensure requirements are captured.

5.5.9 Track all customer requests with relevant

details through to resolution.

Performance Standard: All work associated with the tasks described in section 5.0 will be consistent with industry best practices and following Enterprise and Project specific standards including software development and version control.

All software released will follow the government Configuration

Management process and management controls.

Assessment Method: All documents will be vetted and reviewed with the Government and all identified stakeholders within five (5) business days.

6.0 Deliverables: All deliverables must meet the format

requirements specified by the Contracting Officer’s

Representative. Documentation related to these services shall be made available electronically. The following list details the contract deliverables:

6.1 Monthly Status Report. Status reports shall be sent

electronically to the Technical Assistant (TA) and

Contracting Officer’s Representative (COR) within seven (7) days following the end of the monthly period documenting the performance on the task order. The monthly status report shall include the following elements:

o Resources by name and position titles o Date project/task received o Status of work with accomplishments documented o Percentage of project/task completed o Estimated date of project/task completion o Any issues/problems encountered or possible and recommended solutions o Changes to the Project Management Plan (PMP) to include roles and responsibilities and schedule changes o Identify any Government dependencies that are overdue which impact schedule or performance o Evaluate performance and determine adequacy of staffing.

6.2 Staffing changes and onboarding status of resources

6.3 Ongoing Status Reporting. All team members shall use

the government’s tasking/status tool, Azure DevOps, to track status, issues, and milestones. Metrics shall be compiled and provided to support leadership briefings, stakeholder engagement, or programmatic decisions as requested.

6.4 Source Code. The Versatilist Software Engineer shall

check in all code and working updates at the end of each day to the defined government repository tool.

6.5 Documentation. Versatilist Software Engineer, Versatilist Systems Analyst, Data Administrator, and

Scrum Master shall collaborate as appropriate to provide system flows, program specifications, system test results, technical programming specification documentation, implementation instructions, code audit results, and release procedures. Results from manual and automated code analysis shall be combined into a comprehensive report, providing a summary and listing the found issues and recommendations. This documentation shall be stored in Azure DevOps, SharePoint, MS Teams, and other team collaboration tools and repositories.

6.6 Knowledge Transfer. Each team member shall create a

log of knowledge transfer tasks in the teams

SharePoint site after each Sprint Retrospective. A periodic review shall occur every 4 weeks from the beginning of the period of performance.

6.7 Role-Based Deliverables

Deliverables Applicable to All Roles Delivery

Timing

Communication with the Program/Project Manager and Technical Assistant (TA) of progress of tasks, project costs, and any possible impediments to meeting the specified deliverable dates and budget.

As Required

Develop Product Backlog Items (PBI) estimates and roadmaps in support of project schedules.

As Required

Updated work items representing any unit of measurable work.

As Required

Documented procedural explanations. As Required

Manage the configuration of the application software, Software

Lifecycle Management documentation, and application code history control.

As Required

Conduct quality audits of NAVSUP products, perform causative research on errors and provide corrective action.

As Required

Extract and provide data for preparation of management reports.

As Required

Versatilist Software Engineer Deliverables Delivery

Timing

Modify system code in support of changes required to keep the system functional.

As Required

Work with the government Team and stakeholders to define the requirements.

As Required

Write, debug, and maintain code using the NAVSUP defined software development processes.

As Required

Review code structure to evaluate high level design.

As Required

Migrate system code from existing code bases to new code bases.

As Required

Create and maintain batch procedures to populate database tables.

As Required

Design, develop, and use automated CM tools. As Required

Determine the feasibility of design alternatives, translate systems requirements into application prototypes, and develop problem resolutions.

As Required

Determine and design system architecture. As Required

Develop output media/forms. As Required

Deliver system code compatible with operating in a “cloud” environment.

As Required

Create a program design document (PDD) that will be provided to stakeholders for their approval before system modifications occur.

As Required

Implement code changes required for approved modified functionality in the PDD.

As Required

Document all maintained technical programming components.

As Required

Provide source code instructional tools. As Required

Automate builds, testing, and deployments within continuous integration / continuous delivery (CI/CD) pipelines.

As Required

Identify and define any delivery pipeline impact concerns to agile, RMF, and release artifacts.

Establish software supply chain and technical artifact management practices across artifacts such as libraries, dependencies, and builds.

As Required

Incorporate Git based version control practices into delivery pipelines.

As Required

Scrum Master Deliverables Delivery

Timing

Develop clear, concise release notes for user consumption.

As Required

Report relevant metrics to be agreed upon by the

TA. Examples include release burnup, sprint burndown, planned vs accepted PBI estimates, escaped defects, and velocity.

As Required

Coordinate all activities (analysis, design, development, testing, and deployment) required to complete each PBI or bug as defined in the Acceptance Criteria and

Definition of Done.

As Required

Work with the Product Owner to decompose each

PBI or bug down to the level that is achievable within a sprint (e.g., generally requiring less than 10-15 business days to complete) and identify the Acceptance Criteria for each PBI or bug and define the sprint Definition of

Done.

As Required

Identify all tasks required to successfully complete each PBI or bug and documents in Azure DevOps.

As Required

Show traceability and dependencies between requirements through Epics, Features, PBIs or bugs, and Tasks and systems in Azure DevOps.

As Required

Support user and team meetings to gather requirements and determine validity of work and planned efforts.

As Required

Ensure items are properly reviewed and approved, fully documented, and incorporated in the appropriate revision/version.

As Required

Ensure task dependencies are identified and sequenced in project schedule.

As Required

Ensure changing priorities are communicated to team and reflected in project schedule.

Versatilist Systems Analyst Deliverables Delivery

Timing

Update and maintain user manuals. As Required

Coordinate, schedule, and conduct user training for all application modules.

As Required

Develop test procedures and test cases for integration, regression, and system level test.

As Required

Support customers and users in testing, assuring software and systems quality and functionality.

As Required

Demonstrate proficiency in the FACTS application.

As Required

Run batch jobs or create scripts. As Required

Conduct overall system tests to ensure functional unit inter-relationships are functioning properly.

As Required

Provide support to the development of release packages.

As Required

Create and maintain system application documentation.

As Required

Manage and maintain the documentation library. As Required

Information Center Specialist Deliverables Delivery

Timing

Review and validate access requests. As Required

Maintain an auditable repository of access forms.

As Required

Build or rebuild user accounts to authorized roles and privileges.

As Required

Reset passwords upon request for valid users. As Required

Perform a quarterly user audit. As Required

Ensure user access information and guides are current and correct.

As Required

Coordinate, and escalate when warranted, to develop complete technical responses to customer inquiries, issues, and requests with application team.

As Required

Support development of user stories in PBIs or bugs to ensure requirements are captured.

As Required

Track all customer requests with relevant details through to resolution.

6.8 Monthly Payment Request. The contractor shall submit a

monthly payment request (invoice) electronically using

Wide Area Workflow (WAWF) by the 10th day of each month in accordance with the WAWF routing table specified in the contract. WAWF is available on the internet at https://piee.eb.mil.

The Period of Performance (POP) for each invoice shall be for one month. Included with the invoice shall be support documentation such as, but not limited to, travel authorizations (if applicable) and a monthly status report. Invoices received without the support documentation (in the correct format) will be rejected.

The contractor shall submit a final invoice or zero cost invoice to properly close out the contract.

6.9 Mandatory Annual Training: The contractor shall

participate in DoD/DoN mandatory annual training when announced by the Government. The contractor shall complete the mandatory annual training by the announced due dates.

Contractors are required to complete the following mandatory training, and any updated/future mandatory training courses as released:

1) DoD Cyber Awareness Challenge. The contractor shall complete DoD Cyber Awareness Challenge mandatory training one (1) business day after contract award. Kevin McNamara, 564-230-2625 is the POC for the Cyber Awareness training.

Training can be accessed at https://www.cyber.mil/cyber-awareness-challenge

2) Operations Security (OPSEC)

3) Training and Readiness – the Active Shooter Part 1 (Per

OPNAVINST F3300.53D this training is required within 90 days of start date)

4) Training and Readiness – the Active Shooter Part 2

5) Combating Trafficking in Persons

6) NAVSUP BSC Annual Security Refresher

7) DoD Mandatory Controlled Unclassified Information (CUI)

8) DoN Level 1 Antiterrorism (AT) Awareness (required annually for the first 3 years and then triennially thereafter)

The below Gov’t mandatory training may be added if it is needed for your specific contract, or else delete:

9) Records Management in the DoN: Everyone’s Responsibility

10) Workplace Violence Prevention

11) DON Harassment Prevention Training DoN No FEAR

12) NAVSUP Enterprise Annual Risk Management https://piee.eb.mil/ https://www.cyber.mil/cyber-awareness-challenge https://www.cyber.mil/cyber-awareness-challenge

13) Department of the Navy Annual Privacy Training – PII

14) Counter Intelligence Awareness and Reporting – CIAR

15) DoN Civilian Sexual Assault Prevention and Response

Training

6.7 Cyberspace Workforce (CWF) DoD 8570.01-M requirements

are specified in 10.0

Unless stated otherwise, the following instructions apply to all deliverables 6.1 to 6.6:

• All versions of the deliverables required by the TO shall be delivered electronically to the COR and/or his/her designee and shall be subject to Government review and approval.

• Deliverable due dates shall take into account the review periods described below.

o Draft deliverables will be reviewed and feedback and/or requested changes provided within 7 business days (unless otherwise specified).

o Government reserves the right to request a formal review session with the contractor during these timeframes and may request that the contractor make changes to any version of a deliverable.

o Government will review and approve or reject all final versions of all deliverables within 7 business days of receipt

(unless otherwise specified).

o If any deliverable is rejected, the contractor will be notified within the specified time periods and will have 7 calendar days within which to rework the deliverable and resubmit for Government approval. All changes to any version of a deliverable and/or deliverable outline shall be approved by the COR. If more than the specified number of calendar days is required for Government review and approval, the COR will inform the contractor of the need for an extension within the initial review period.

o Contractor shall prepare and submit the deliverables on or before the required due date to the COR or designee via email.

For deliverables that are not documents the contractor shall submit a description of the deliverable and any associated documentation or descriptive information. In no case shall any deliverable be received by the Government less than 21 calendar days prior to the end of the Period of Performance.

o Rejection of any deliverable by the Government does not excuse the contractor from meeting the baseline due dates for any other deliverables.

7.0 Period of Performance:

Work shall be performed from the period of performance start date for one year with four additional one (1) year option periods and the option to extend services up to 6 months with the inclusion of FAR 52.217-8. Some flexibility in daily hours is permitted with the TA’s approval.

8.0 Place of Performance:

The NAVSUP BSC, Norfolk, VA is the primary site for performance.

No contractor services shall be performed on Saturdays, Sundays, Government Holidays or during base closures. The contractor shall follow appropriate local base policy for reporting to work during severe weather and base closure. The contractor is not authorized to begin work until both the Visit Authorization

Request (VAR) and System Authorization Access Request DD 2875 forms have been successfully processed and base and system access have been granted. Remote work is authorized with the coordination and approval of the COR or TA. Overseas Travel is not required.

9.0 Travel:

No Travel is required for this Order. Travel shall be in accordance with FAR 31.205-46. All travel must be pre-approved in writing by the TA and COR prior to the actual travel and all travel must be funded in the contract prior to any travel expenses being incurred.

No travel shall occur outside of the period of performance dates of the contract. Travel 12 hours or less, per diem does not apply.

Foreign (overseas) Travel will not be required for this Order.

If travel, domestic or overseas, is required, the contractor is responsible for making all needed arrangements for their personnel.

9.1 Travel Policy. The Government will reimburse the

contractor for allowable travel costs incurred by the contractor in performance of this PWS and determined to be in accordance with FAR subpart 31.2, subject to the following provisions:

Travel required for tasks assigned under this contract shall be governed in accordance with rules set forth for temporary duty travel in FAR 31.205-46.

9.2 Travel other. Travel, subsistence, and associated labor

charges for travel time are authorized whenever a task assignment requires work to be accomplished at a temporary alternate worksite. Travel performed for personal convenience will not be reimbursed.

10.0 Security:

ON-BOARDING PROCESS

All contractor resource onboarding documents must be submitted via the prime contractor. An employee is considered to be

“productive” upon completion of the following items:

a. OF-306 signed by contractor employee

b. FD-258 fingerprint card (Contingent upon availability of electronic fingerprinting submission)

c. Completed NBIS – SF 86 (Electronic Investigation) within 20 days after contract award

d. All contractor resource(s) must have an active Defense Information System for Security (DISS) profile within 20 days after contract award

e. Complete Mission Partner (MP) Identity, Credential, and Access Management (ICAM) registration for the Common Access

Card (CAC)/(including CAC renewals)

f. System Authorization Access Request DD 2875

g. Cyber Awareness Training Certification

h. Information Assurance (IA) certification (if applicable)

i. User Access Request (UAR) Only applies when contractor requires access to ERP/SAP (Contractor does not require this access.)

j. TWMS profile for each contractor (IA/Security training compliance System of Record)

k. Annual Security Training (Derivative Classification, NATO Brief, NDA (SF-312), and SIPRNet Training) (classified and/or privileged access contracts ONLY)

Note (1): Invoicing by the contractor will begin as of the commencement of the performance period of services. Travel for onboarding and CAC appointments and renewals is not reimbursable.

Note (2): Dual Citizenship and Foreign Nationals are not allowed access to the functional/system side of ERP/SAP.

Contractor and subcontractor employees performing under this task order are required to sign a Non-disclosure Agreement (NDA) as part of their onboarding process. Refer to DFARS 252.204-7000, Disclosure of Information, and DFARS 252.204-7003, Control of

Government Personnel Work Product.

See SUPTXT204-9400(4-22) Contractor Unclassified Access to

Federally Controlled Facilities, Sensitive Information, Information Technology (IT) Systems or Protected Health

Information (DEC 2018)

This local text does not apply to non-U.S. Nationals (foreign nationals) who are contactor employees performing work overseas.

The local text is applicable to the United States Nationals living in the U.S. or overseas who are performing work on a Navy contract.

The investigation of a non-U.S. national at a foreign location must be consistent with a NACI, to the extent possible, and include a fingerprint check against the FBI criminal history database, an FBI investigations file (name check) search, and a name check against the terrorist screening database.

Also, the above cited reference notes that Foreign Nationals may not be granted CAC Credentials until completion of their investigation and not in the interim.

Per DoD 5200.2-R, DoD Components must initiate and ensure completion of a background investigation before applying the credentialing standards to a non-U.S. national at a foreign location. The background investigation must be favorably adjudicated before a CAC can be issued to a non-U.S. national at a foreign location. The type of background investigation may vary based on standing reciprocity treaties concerning identity assurance and information exchanges that exist between the U.S.

and its allies or agency agreements with the host country.

(1) SUPTXT204-9400(4-22) CONTRACTOR UNCLASSIFIED ACCESS TO

FEDERALLY CONTROLLED FACILITIES, SENSITIVE INFORMATION,

INFORMATION TECHNOLOGY SYSTEMS OR PROTECTED HEALTH INFORMATION

The security text does not apply in cases where the contractor/vendor does not have access to Navy Marine Corps

Intranet (NMCI) computers, is not issued a Common Access Card

(CAC) and is involved in training or other short term duties of less than 30 days duration that allow for the use of a visitor request. In these cases, the government employee must submit a

Visitor Access Request (VAR) to the main gate or applicable processing entity for your facility and assume responsibility to escort those without CAC Credentials.

This text does not apply to non-United States (U.S.) Nationals

(foreign nationals) who are contactor employees performing work overseas. This text is applicable to the U.S. Nationals living in the U.S. or overseas who are performing work on a Navy

The investigation of a non-U.S. national at a foreign location must be consistent with a National Agency Check with Written

Inquiries (NACI), to the extent possible and include a fingerprint check against the Federal Bureau of Investigation

(FBI) criminal history database, an FBI investigations file

(name check) search and a name check against the terrorist screening database. Also, the above cited reference notes that

Foreign Nationals may not be granted CAC credentials until completion of their investigation and not in the interim.

Per Department of Defense Memorandum (DoDM) 5200.2, Department of Defense (DoD) components must initiate and ensure completion of a background investigation before applying the credentialing standards to a non-U.S. national at a foreign location. The background investigation must be favorably adjudicated before a

CAC can be issued to a non-U.S. national at a foreign location.

The type of background investigation may vary based on standing reciprocity treaties concerning identity assurance and information exchanges that exist between the U.S. and its allies or agency agreements with the host country.

CONTRACTOR UNCLASSIFIED ACCESS TO FEDERALLY CONTROLLED

FACILITIES, SENSITIVE INFORMATION, IT SYSTEMS OR PROTECTED

HEALTH INFORMATION

Executive Order 13467, Reforming Processes Related to

Suitability for Government Employee, Fitness for Contractor

Employees and Eligibility for Access to Classified National

Security Information, Homeland Security Presidential Directive

(HSPD)-12, requires government agencies to develop and implement

Federal security standards for Federal employees and contractors. The 5 CFR 32 Part 157 in concert with DoD Manual

1000.13, Vol 1, implements the Federal Standards.

APPLICABILITY

This text applies to all DoD sponsored individuals who require

CAC eligibility (or login and P/W if acceptable per contract) for: Physical access to DoD facilities or non-DoD facilities on behalf of DoD; Logical access to information systems (whether on site or remotely); or remote access to DoD networks that use only the CAC logon for user authentication, or access to sensitive and protected information. This applies to the Office of the Secretary of Defense (OSD), the Military Departments, the

Office of the Chairman of the Joint Chiefs of Staff and the

Joint Staff, the Combatant Commands, the Office of the Inspector

General of the DoD, the Defense Agencies, the DoD Field

Activities and all other organizational entities within the DoD

(hereinafter referred to collectively as the "DoD Components").

Each contractor employee providing services at a Navy command under this contract is required to obtain a DoD CAC.

Additionally, depending on the level of computer/network access, the contract employee will require a successful investigation as detailed below. If at any time, any contractor employee requiring a CAC is unable to possess/maintain the required adjudicated background investigation, the contractor shall immediately notify the NAVSUP COR to coordinate removal of such a person from work under this contract.

ACCESS TO FEDERAL FACILITIES

Definition. As used in this clause - Military installation means a base, camp, post, station, yard, center, or other activity under the jurisdiction of the Secretary of a military department or, in the case of an activity in a foreign country, under the operational control of the Secretary of a military department or the Secretary of Defense (see 10 U.S.C. 2801(c)(4)).

Per HSPD-12 and implementing guidance, all contractor employees working at a federally controlled base, facility or activity under this clause will require a DoD CAC. When access to a base, facility or activity is required contractor employees shall in-process with the Command's Security Manager (CSM) upon arrival to the command and shall out-process prior to their departure at the completion of the individual's performance under the

Training. Contractor employees who require routine physical access to a Federally controlled facility or military installation shall complete “Level I Antiterrorism Awareness

Training” prior to gaining access to a facility and annually thereafter in accordance with DoDI O-2000.16 Vol I. In accordance with Department of Defense Instruction O-2000.16

Volume 1, DoD Antiterrorism (AT) Program Implementation: DoD AT

Standards, Level I Antiterrorism Awareness Training shall be completed by:

1. Completion of “Level I Antiterrorism Awareness Training” available at https://jkodirect.jten.mil/pdf/atl1/launch.html; or

2. Under the instruction of a qualified Level I Antiterrorism

Awareness instructor; or

3. Providing a training certificate for “Level I Antiterrorism

Awareness Training” training showing completion within the last calendar year in accordance with DoDI O-2000.16 Vol I.

The contractor will submit certificates of completion for each affected contractor employee and subcontractor employee to the

COR or to the contracting officer, if a COR is not assigned, prior to being granted access to a Federally controlled facility or military installation.

Subcontracts. The Contractor shall include the substance of this clause, including this paragraph (d), in subcontracts, including subcontracts for commercial items, when subcontractor performance requires routine physical access to a Federally-controlled facility or military installation.

OPERATION SECURITY (OPSEC)

It is DoD policy according to DoD Directive 5205.02E, “DoD

Operations Security (OPSEC) Program,” June 20, 2012, as amended to establish and maintain OPSEC programs to ensure national security-related missions and functions are protected.

Training: Contractor employees shall comply with all DoD OPSEC requirements and complete “OPSEC Awareness for Military Members, DoD Employees and Contractor” training within 30 days of onboarding the contract and annual refresher training thereafter. Training shall be completed through a DoD sponsored and certified computer or web-based learning instruction available at https://securityawareness.usalearning.gov/opsec/index.htm.

The contractor will submit certificates of completion for each affected contractor employee and subcontractor employee to the

COR or to the contracting officer, if a COR is not assigned, within 30 calendar days after training is completed by all employees and subcontractor personnel.

ACCESS TO DOD INFORMATION TECHNOLOGY (IT) SYSTEM

In Accordance With (IAW) DON CIO Memorandum (IT LEVEL

DESIGNATION ON DD FORM 2875 SYSTEM AUTHORIZATION ACCESS REQUEST)

08 September 2020, contractor employees who require access to

Department of the Navy (DoN) or DoD networks are categorized as

Privileged, Enhanced, or Authorized users. All user level accesses may include positions which require access to

Controlled Unclassified Information (CUI). CUI includes sensitive information protected under the Privacy Act, to include PHI. System Levels are determined by the requiring activity's Command Information System Security Manager

(ISSM)/Information Assurance Manager (IAM).

Contractor employees requiring Privileged access, (when specified by the terms of the contract) require a Tier 5 (T5) or

T5R equivalent investigation, which is a higher level investigation than the Tier 3 (T3) and T3R described below. Due to the privileged system access, an investigation suitable for

High Risk national security positions is required. Individuals who have access to system control, monitoring, or administration functions (e.g. system administrator, database administrator) require training and certification to Information Assurance (IA)

Technical Level 1, and must be trained and certified on the

Operating System (OS) or Computing Environment (CE) they are required to maintain. In addition, employees requiring

Privileged Access will need to complete the following additional security training: Derivative Classification training, NATO

Briefing, NDA (SF-312), and SIPNet training.

Contractors requiring Enhanced access, (when specified by the terms of the contract) require a T3, T3R, or equivalent investigation, which is a higher level investigation than the

Tier 1 (T1) described below. Due to the enhanced system access, an investigation suitable for Moderate Risk national security positions is required.

Access to sensitive IT systems is contingent upon a favorably adjudicated background investigation. When access to IT systems is required for performance of the contractor employee's duties, such employees shall in-process with the Navy CSM and ISSM/IAM manager upon arrival to the Navy command and shall out-process prior to their departure at the completion of the individual's performance under the contract. Completion and approval of a

System Authorization Access Request DD 2875 form is required for all individuals accessing Navy IT resources. The decision to authorize access to a government IT system/network is inherently governmental. The contractor supervisor is not authorized to sign the DD 2875; therefore, the government employee with knowledge of the system/network access required or the

Contracting Officers Representative (COR) shall sign the DD 2875 as the supervisor.

The DD 2875 shall be forwarded to the CSM upon the contractor employee acquiring a Common Access Card (CAC) credential.

Failure to obtain a CAC credential may result in delaying the individual's start date.

When required to maintain access to required IT systems or networks, the contractor shall ensure that all contractor employees requiring access complete annual Cyber Awareness training, and maintain a current requisite background investigation. The contractor's security representative shall contact the CSM for guidance when reinvestigations are required.

INTERIM ACCESS

The CSM may authorize issuance of a DoD CAC and interim access to a DoN or DoD unclassified computer/network upon a favorable review of the investigative questionnaire and advance favorable fingerprint results. When the results of the investigation are received and a favorable determination is not made, the contractor employee working on the contract under interim access will be denied access to the computer network and this denial will not relieve the contractor of his/her responsibility to perform.

DENIAL OR TERMINATION OF ACCESS

The potential consequences of any requirement under this clause including denial or termination of physical or system access in no way relieves the contractor from the requirement to execute performance under the contract within the timeframes specified in the contract. Contractors shall plan ahead in processing their employees and subcontractor employees. The contractor shall insert this clause in all subcontracts when the subcontractor is permitted to have unclassified access to a federally controlled facility, federally-controlled information system/network and/or to government information, meaning information not authorized for public release.

ACCESS TO CONTROLLED UNCLASSIFIED INFORMATION

Safeguarding sensitive unclassified information is critical to achieve NAVSUP Modernization efforts and deliver cutting-edge and uncompromised capabilities. The Secretary of Defense’s operations security (OPSEC) campaign plan stresses the importance of protecting controlled unclassified information

(CUI). CUI encompasses OPSEC, critical technology, intelligence, and personally identifiable information that, if not properly identified, marked, and controlled, could impair NAVSUP’s ability to conduct its mission. Contractor employees with access to Controlled Unclassified Information (CUI) shall comply with

DoDI 5200.48 - Controlled Unclassified Information (CUI) and complete DoD approved initial and annual refresher CUI training.

a. Whenever Government provides CUI to, or CUI is generated by, non-DoD entities, all CUI records must be handled as required by the approved mandatory disposition authority.

b. All CUI records must follow the approved mandatory disposition authority whenever the Government provides CUI to, or CUI is generated by, non-DoD entities in accordance with

Section 1220-1236 of Title 36, CFR, Section 3301a of Title 44, U.S.C., and the DoDI 5200.48.

c. Contractor…