PWS for B3291 SSM rev4.docx

PERFORMANCE WORK STATEMENT (PWS)

Naval Surface and Mine Warfighting Development Center Site Security Manager (SSM) San Diego, California

1. GENERAL INFORMATION:

1.1 The purpose of this requirement is to provide a full-time Site Security Manager (SSM) to plan and oversee construction security surveillance services in San Diego, CA. The Contractor personnel will support Naval Surface Force secure construction projects In-Accordance-With (IAW) the Intelligence Community Directive (ICD) 705 and Department of Defense (DoD) policies.

1.2 Construction project size, scope, complexity. The site of performance is Building 3291; a 7,700 sq/ft facility renovation on Naval Base San Diego composed of one auditorium and seven office/conference rooms. The Contractor will support design and conduct planning, oversight, and accreditation support to attain co-use accreditation of the facility to ICD/ICS 705 Tech Spec and DoDM 5205.07 standards. Work is expected to be 5 days a week, 8 hours per day.

1.3 The contractor provided Site Security Manager (SSM) shall serve as the primary point of contact regarding Special Compartmented Information Facility (SCIF) and Special Access Program Facility (SAPF) construction security at the project site and responsible for developing and implementing all aspects of a Construction Security Plan (CSP). The SSM will coordinate with the Contracting Officer Representative (COR) and will forward information to the Accrediting Official (AO) and Naval Surface and Mine Warfighting Development Center (SMWDC) Command Government Program Manager (CGPM) or Command Government SAP Security Officer (CGSSO) as required by ICD 705. The SSM is responsible for overseeing and validating daily site security actions in accordance with (IAW) the approved CSP and the terms and conditions of the contract. However, final approval authority for formal security determinations, risk acceptances, and facility accreditation remains strictly with the designated Government officials (e.g., AO, CGPM, CGSSO, or KO).

1.4 The SSM is the appropriate entity who will use such info to ensure the construction of the SCIF and SAPF is not compromised. The AOs will visit the site to review SSMs compliance as required. Concerns identified by the AOs will be provided to the SSM and the SMWDC CGPM or CGSSO, who will be available to address any questions posed by the AO and include the COR and Contracting Officer (KO) in the dialog (so any areas affecting the terms and conditions of the contract are duly considered in any actions).

2. BACKGROUND – U.S. Government Intelligence Community sponsored construction projects are subject to overarching and unique program considerations. The infrastructure, equipment, and services being acquired will be critical to ensuring that these construction projects comply with the requirements defined in the ICD 705, "Physical and Technical Security Standards for Sensitive Compartmented Information Facilities", and the DoD 5105.21-M-Volumes 1,2,3, "Sensitive Compartmented Information Administrative Security Manual", dated October 2012. In addition, the ICD 705 has several implementing documents to include ICS 705-I, ICS 705-2 and the "IC Technical Specifications for Construction and Management of Sensitive Compartmented Information Facilities (SCIF), IC Tech Spec for ICD/ICS 705," dated 26 July 2021 and known as the Tech Specs. Documents available at www.odni.gov. Concurrent to SCIF construction standards, DoD Manual 5205.07 provides guidance and specifications for Department of Defense Special Access Program physical security and SAPF construction.

3. SCOPE -- The Contractor shall provide an SSM to oversee design, planning, construction security and the construction security monitoring program, which shall include all aspects of physical, personnel, technical, and procedural security as required for supported secure projects to fully comply with ICD 705 and ensure successful accreditation of the secure facility. For Operational Security (OPSEC) purposes, contract documents will refer to projects under the purview of the ICD 705 as Secure Work Areas (SWA) in lieu of SCIF/SAPF, but the terms shall be interchangeable. The contract scope shall include an SSM who can develop and manage a construction security program, administrative, construction surveillance operations, and provide the necessary documentation for Accreditation.

3.1. Construction Security Monitoring Services: provide a Site Security Manager who can develop and manage the Construction Security Plan.

3.2. Site Security Manager: Provide expert recommendations, advice, and input during all phases of B3291 project, to include Planning, Design, Bidding, Initiation, Setup, and successful accreditation. The Construction General Contractor (not the SSM) is responsible for site safety, accident prevention plans, and providing the SSHO.

3.3. Personnel:

Contractor Personnel:

The SSM is the key personnel on this contract. After contract award, the Contractor shall notify COR prior to replacing Government approved key personnel, and shall demonstrate that the qualifications of the proposed replacement personnel are equal to or better than the qualifications of the position. Key personnel changes shall not be allowed without Government approval. The Contractor shall submit a resume, and training certification in accordance with position description below, to the Government with their initial proposal.

Key personnel must meet the following requirements to be considered technically qualified to perform on this contract:

3.3.1. SSM

3.3.1.1. Must have active/adjudicated Top Secret/Sensitive Compartmented Information (TS/SCI) security clearance.

3.3.1.2. Must have at least ten (10) years of security experience specifically related to SCIF/SAPF construction, Intelligence Operations, Counter-Intelligence Operations, Counter-Surveillance Operations, Technical Surveillance Counter-Measures, Physical Security, or a combination of these experiences.

3.3.1.3. Must have at least five (5) years of direct experience working on ICD-705 construction projects or working as a Physical Security Special Security Officer (SSO). Direct experience for the SSM means working at the project location as a CST, SSC, or SSM.

3.3.1.4. Must be familiar with the sixteen (16) standard divisions of construction and must have knowledge of technical listening devices commonly used by foreign intelligence services.

3.3.1.5. Must hold a valid certificate for the successful completion of a Thirty-Two (32) Hour or greater Site Security Manager (SSM) Training Course.

3.3.1.6. Must hold a valid certificate for the successful completion of a Forty (40) Hour or greater CST (CST) Training Course.

3.3.1.7. Must have a good understanding of the ICD/ICS-705 as demonstrated by experience working on at least three (3) separate ICD-705 projects.

3.3.1.8. Should have a Bachelor’s degree from an accredited university, preferably in a security or intelligence field.

3.4. Government Roles:

Note: Refer to ICD/ICS 705 Tech Specs for specific functions of each personnel listed in table above.

3.5. Overall Construction Security Program Management – The Contractor shall be capable of providing an SSM who is capable of planning and managing a construction security monitoring program which shall include all aspects of physical, personnel, technical, and procedural security as required for supported secure projects to fully comply with ICD 705.

3.6. The Contractor shall maintain strict compliance with this PWS and other terms and conditions contained herein in order to monitor and detect unauthorized access to internal controlled areas during the construction period and to deter the implantation of clandestine surveillance devices or systems by construction workers into the structure being constructed and/or its surroundings. The Contractor shall furnish the SSM with, equipment, training, and supplies required to provide construction site security monitoring IAW with all applicable rules, laws and regulations as stated in this PWS. The Contractor shall comply with all applicable local regulations and standards.

3.6.1 The Contractor shall be required to comply with all training requirements, as required for contract performance. The Contractor shall provide its employees and any sub-Contractors the support infrastructure to meet the requirements of this contract.

3.7 Organizational Conflict of Interest: Contractor and Subcontractor personnel performing work under this contract may receive, have access to or participate in the development of proprietary or source selection information (e.g., cost or pricing information, budget information or analyses, specifications or work statements, etc.) or perform evaluation services which may create a current or subsequent Organizational Conflict of Interests (OCI) as defined in FAR Subpart 9.5. The Contractor shall notify the Contracting Officer immediately whenever it becomes aware that such access or participation may result in any actual or potential OCI and shall promptly submit a plan to the Contracting Officer to avoid or mitigate any such OCI. The Contractor’s mitigation plan will be determined to be acceptable solely at the discretion of the Contracting Officer and in the event the Contracting Officer unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the Contracting Officer may affect other remedies as he or she deems necessary, including prohibiting the Contractor from participation in subsequent contracted requirements which may be affected by the OCI.

3.8 The Contractor shall provide a full-time SSM to support the Building 3291 renovation project at Naval Base San Diego.

3.8.1 Security Requirements – The minimum required security clearance is, US Top Secret (TS)/SCI eligible. Work will require access to SMWDC SCIF and SCI computer network. Contractor must receive, store, process, or safeguard classified information exclusively within Government-controlled facilities and systems at Naval Base San Diego

3.8.2 Operations – The Contractor shall provide an SSM to be utilized throughout the project. The SSM will develop all required Construction Security documents to ensure compliance with the ICD-705 and relevant DoD guidance, provide effective threat/risk mitigation strategies as requested by the CGPM, CGSSO, or project AO, and perform security inspections and project security to identify vulnerabilities and provide solutions to findings.

3.8.3 SSM Operations will include:

3.8.3.1.1 In coordination with the AO/CGSSO/SSO, develop Concept Approval documents and coordinate for SCIF/SAPF AO approval.

3.8.3.1.2 Complete ICD/ICS 705 Tech Spec SCIF/SAPF Pre-construction Checklist(s).

3.8.3.1.3 Complete TEMPEST checklist(s).

3.8.3.1.4 In coordination with the AO/CGPM or CGSSO/SSO, and in accordance with DoDM 5105.21.v3 and DoDM 5205.07, develop the Construction Security Plan (CSP), coordinate approval, and update as required through the duration of the contract.

3.8.3.1.5 Participate in meetings, in-progress reviews, integrated concept and product teams, working groups, and design meetings. The SSM shall support the government at conferences and meetings, in the capacity of a SSM by providing input to ensure project security from start to finish, but will not speak on behalf of the Government. While the SSM must be dedicated to this project and shall not hold other positions, this does not prohibit the SSM from coordinating with or integrating separately identified acoustic, RF-shielding, CST, CAG, or other personnel.

3.8.3.1.6 Perform design reviews of the project plans throughout each phase of the design process. Design reviews shall be done from a security perspective to confirm designs and plans are inclusive of SCIF/SAPF accreditation requirements, both in their identification and within the details.

3.8.3.1.7 Conduct risk assessments as directed by the AO/CGPM or CGSSO/SSO.

3.8.3.1.8 Develop Building 3291 Operations Standard Operating Procedures and Emergency Action Plan to support accreditation and eventual building utilization as directed by CGPM or CGSSO.

3.8.3.1.9 Ensure the requirements contained within the ICD/ICS-705 (current version), DoDM, 5105.21 Volume 2 (current version), and DoDM 5205.07 Volume 3 (current version) are implemented and advise the AO/CGPM or CGSSO/SSO of compliance or variances.

3.8.3.1.10 Conduct periodic security inspections to ensure compliance with the CSP.

3.8.3.1.11 Document security violations or deviations specific to the CSP and notify the AO/CGSSO/SSO within 3 business days.

3.8.3.1.12 Ensure that procedures to control site access are implemented.

3.8.3.1.13 Maintain a list of workers used on the project and include this list in the final SCIF accreditation file.

3.8.3.1.14 Implement procedures to deny unauthorized site access.

3.8.3.1.15 Maintain CST and CAG site records for the duration of the project to be included into the final accreditation package.

3.8.3.1.16 Create, develop, and apply inspection methods to be conducted by SSM when inspecting construction materials, finished and unfinished construction work, tools, equipment, personnel, and personal items such as bags, lunch boxes, and associated items.

3.8.3.1.17 Shall use knowledge of DoD, the ICD/ICS, and additional administrative policies, regulations, instructions, and procedures in order to develop and apply new techniques to implement and execute innovative SCIF/SAPF construction security strategies to achieve the goals and objectives for the construction security and accreditation of this project.

3.8.3.1.18 Initiate the Fixed Facility Checklist (FFC) and TEMPEST Checklist, compile required documentation (floor plans, certifications, details, etc.) for submission to the AO/SSO.

3.8.3.1.19 Oversee STC and IEEE 299-2006 testing.

3.8.3.1.20 Provide recommendations, advice, and input as well as preliminary document support (e.g. Concept Approval, risk assessment, pre-construction checklists, initial TEMPEST checklist) during planning and design.

3.9 The Government reserves the right to require the removal from the project of any Contractor employee who does not meet the service requirements of this PWS, is unable or unwilling to perform assigned work, poses a security/safety risk, or engages in misconduct.

The Contractor shall be solely responsible for the management, conduct, and discipline of its employees, including the correction of unacceptable performance, unprofessional behavior, disorderly conduct, ineffective or improper communication with others, and inappropriate dress.

If the Government determines that a Contractor employee's continued performance is unacceptable or detrimental to the mission, the Contracting Officer’s Representative (COR) will notify the Contracting Officer (KO). The Contracting Officer will formally coordinate the removal request with the Contractor. Upon receipt of direction from the Contracting Officer, the Contractor shall immediately remove the identified employee from Government premises and shall not redeploy the rejected employee to this project. The Contractor shall provide a fully qualified substitute/replacement. All costs associated with the removal and replacement of Contractor personnel shall be borne entirely by the Contractor at no additional cost to the Government.

3.10 Documentation – All documentation must be turned in to the CGPM/CGSSO and SSO in digital format upon completion of this project and/or as requested by the Government throughout the project. The Contractor will provide a computer system capable of compiling all documentation from digital devices for turn over to the Government. Handwritten documentation will NOT be accepted on this project. At a minimum the SSM will ensure that the following activities/events are documented:

3.10.1 Detailed descriptions of all construction activities including: Date, Time, Location, Person(s) completing work, Work being performed, Monitoring CST(s), and accompanying photos.

3.10.2 Detailed descriptions of all security incidents involving persons that occur on the Secure Construction Site including: Date, Time, Person(s) involved, Description of incident, Reporting CST(s), and accompanying photos (if applicable).

3.10.3 Detailed descriptions of all construction security deficiencies including: Date, Time, Location, Person(s) involved (if applicable), Description of deficiency, Reporting CST(s), and accompanying photos.

3.10.4 Detailed descriptions of all construction close-ins/seal-ins for the duration of the project including: Date, Time, Location, Type of close-in/seal-in, Person(s) completing work, Monitoring CST(s), and accompanying photos.

3.10.5 Complete access control log of all persons who access and exit the secure construction site including: Full name, Date/Time entered, Date/Time exited.

3.10.6 Complete list of all vehicles that access the Secure Construction Site including: Date, Time of entrance, Time of exit, Driver’s name, Driver’s license number, Vehicle license plate number, and Reason for entrance.

3.11 Sound Transmission Class (STC) Instrumental Testing. The SSM shall ensure that this testing is done in accordance with ICD-705.

3.12 Electromagnetic Shielded Enclosure Testing. Qualified acoustic and electromagnetic-shielding testing specialists may perform the required instrumented testing as subcontractors under the SSM's coordination, subject to Government and CTTA oversight. To permit responsible and comparable pricing, all testing will be separately priced and discussed when the building requires its final testing. The Contractor, or qualified Sub-contractor, shall perform Electromagnetic Shielded Enclosure Testing in accordance with the Institute of Electrical and Electronics Engineers number 299-2006 (IEEE 299-2006) standard. The testing method shall ensure uniform measurement procedures and techniques are provided for determining the effectiveness of electromagnetic shielding enclosures at frequencies from 9 kHz to 18 GHz (extendable to 50 Hz and 100 GHz, respectively) for enclosures having all dimensions greater than or equal to two (2) meters. The types of enclosures covered include, but are not limited to, single-shield or double-shield structures of various construction, such as bolted demountable, welded, or integral with a building; and made of materials such as steel plate, copper or aluminum sheet, screening, hardware cloth, metal foil, or shielding fabrics. The Contractor shall coordinate with the AO/CGPM or CGSSO/SSO and Certified TEMPEST Technical Authority (CTTA) prior to any electromagnetic shielded enclosure testing. Electromagnetic Shielded Enclosure Testing performed by the Contractor shall:

3.12.1 Include all Radio Frequency/Electromagnetic (RF/EM) shielded perimeter rooms/walls/doors required to meet IEEE-299-2006 standards.

3.12.2 Provide a written Electromagnetic Shielded Enclosure Testing report (with visual graphs showing frequencies tested) for each area tested to the AO/CGPM or CGSSO/SSO verifying and identifying the numerical level of attenuation (shown in db.) of each test conducted.

3.12.3 For any tested areas that do not meet the minimum RF/EM attenuation requirements of the project, the Contractor shall perform a physical inspection (non-destructive) of the tested area to identify points of RF/EM ‘leakage’ and likely failure driving factors.

3.12.4 The report shall include areas of failure, type of post inspection conducted, and recommendations for corrective action to enable final accreditation in accordance with ICD/ICS-705, DoDM policies/directives/regulations, and the project specific (CTTA issued) TEMPEST Countermeasure Review (TCR).

3.12.5 The Contractor shall provide all Electromagnetic Shielded Enclosure Testing equipment, materials, and trained/certified personnel to meet this requirement.

3.12.6 Electromagnetic Shielded Enclosure Testing results shall not be shared outside of the AO/CGPM or CGSSO/SSM/CTTA without approval from the AO/CGPM or CGSSO/CTTA.

3.13 Equipment operations – The Contractor shall be familiar with all the equipment and systems that is already on site. Any documents that contained personal identifiable information, to include but not limited to, electronic data, record of Identification Badges, Log books, etc. will become the property of the Government at the completion of the contract or BOD (Building Occupancy Date). At no time will the Contractor remove anything that contains or had contained in the past personal identifiable information from the construction site without the proper authorization of the SSO.

3.14 Equipment list and specifications.

3.14.1 Airport/Package X-Ray machine – The Contractor shall ensure that the SSM is capable of operating and supervising X-Ray inspection systems.

3.14.2 Non-Linear Junction Detector – The Contractor shall ensure that the SSM is capable of operating and supervising a new Non-Linear Junction Detector (NLJD). This device will be used in the in the building for the inspection of materials and finished construction work.

3.14.3 Hand Held Metal Detector Wands – The Contractor shall ensure that the SSM is capable of operating and supervising handheld metal detecting wands.

3.14.4 Badging – The Contractor shall ensure that the SSM is capable of operating and supervising use of badging systems to support issue to all personnel requiring site access.

3.14.5 The SSM will oversee the development and maintenance of the ID card designs and provide necessary changes if needed.

3.14.6 IRIS Scanner System – The Contractor shall ensure that the SSM is capable of operating and supervising use of biometric identification systems that will be used to enroll and verify the identity of all personnel requiring access to the construction site. The Contractor shall provide a weekly report of condition and operation to the CGSSO.

3.15 Location:

3.15.1 SSM work location will be in San Diego, CA for the duration of the Contract.

3.15.2 The contractor will be responsible for self-transport to and from the designated parking area and construction site to meet the performance objectives of the contract. Refer to map of Naval Base San Diego, 32nd Street Dry Side below.

4 Service Contract Reporting (SCR):

4.1 The Contractor shall report total dollar amount invoiced and all contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract via a secure data collection site. The contractor is required to completely fill in all required data fields using the following web address: https://www.sam.gov.

4.2 Reporting inputs will be for the labor executed during the period of performance during each Government fiscal year (FY), which runs October 1 through September 30. While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year. Contractors may direct questions to the help desk, linked at https://www.sam.gov.

5 Contractor Unclassified Access To Federally Controlled Facilities, Sensitive Information, Or Protected Health Information

5.1 Homeland Security Presidential Directive (HSPD)-12, requires Government agencies to develop and implement Federal security standards for Federal employees and Contractors. The Deputy Secretary of Defense Directive-Type Memorandum (DTM) 08-006 – “DoD Implementation of Homeland Security Presidential Directive – 12 (HSPD-12)” dated November 26, 2008 (or its subsequent DoD instruction) directs implementation of HSPD-12. This clause is in accordance with HSPD-12 and its implementing directives.

5.2 Applicability:

5.2.1 This text applies to Contractor employees requiring physical access to any area of a federally controlled base, facility or activity. This clause also applies to Contractor employees who access Privacy Act and Protected Health Information, provide support associated with fiduciary duties, or perform duties that have been identified as National Security Position, as advised by the command security manager. It is the responsibility of the responsible security officer of the command/facility where the work is performed to ensure compliance.

5.2.2 Each Contractor employee providing services at a Navy Command under this contract is required to obtain a Department of Defense Common Access Card (DoD CAC).

5.3 Access To Federal Facilities.

5.3.1 Per HSPD-12 and implementing guidance, all Contractor employees working at a federally controlled base, facility or activity under this clause will require a DoD CAC. When access to a base, facility or activity is required the Contractor shall in-process with the Command’s Security Manager upon arrival to the Command and shall out-process prior to their departure at the completion of the individual’s performance under the contract.

5.3.2 Contractors Security Representative

5.3.2.1 The Contractor shall designate an employee to serve as the Contractors Security Representative. Within three work days after contract award, the Contractor shall provide to the requiring activity’s Security Manager and the Contracting Officer, in writing, the name, title, address and phone number for the Contractors Security Representative. The Contractors Security Representative shall not be replaced or removed without prior notice to the Contracting Officer and Command Security Manager.

5.3.3 Background Investigation Requirements and Security Approval Process for Contractors Assigned To National Security Positions Or Performing Sensitive Duties

5.3.3.1 Navy security policy requires that all positions be given a sensitivity value based on level of risk factors to ensure appropriate protective measures are applied. Contractor employees under this contract are recognized as Non-Critical Sensitive [ADP/IT-II] positions when the contract scope of work requires physical access to a federally controlled base, facility or activity and/or requiring access to a DoD computer/network, to perform unclassified sensitive duties. This designation is also applied to Contractor employees who access Privacy Act and Protected Health Information (PHI), provide support associated with fiduciary duties, or perform duties that have been identified as National Security Positions. At a minimum, each Contractor employee must be a US citizen and have a favorably completed SSBI or T5 or T5R equivalent investigation to obtain a favorable determination for assignment.

5.3.3.2 Failure to provide the required documentation at least 30 days prior to the individual’s start date shall result in delaying the individual’s start date. Background investigations shall be reinitiated as required to ensure investigations remain current (not older than 10 years) throughout the contract performance period. The Contractor’s Security Representative shall contact the Command Security Manager for guidance when reinvestigations are required.

5.3.3.3 Regardless of their duties or IT access requirements ALL Contractor employees shall in-process with the SMWDC Command Security Manager and Special Security Officer (SSO) upon arrival to the command and shall out-process prior to their departure at the completion of the individual’s performance under the contract.

6 SAFETY REQUIREMENTS: None.

7 WORK HOURS.

7.1 The Contractor shall provide services to address SSM responsibilities and will be responsible for the operations listed in this PWS during all working hours for the duration of this project. The expected hours of site operation during construction are 8 hours per day 5 days per week, excluding all Federal Holidays. The Contractor shall work a standard workweek of Monday through Friday 0800-1600 (40 hours per week).

7.2 The Contractor shall provide services to address SSM responsibilities and will be responsible for the operations listed in this PWS during standard working hours, 0800-1600 Pacific Time Monday through Friday, not including federal holidays and weekends.

8 DELIVERABLES

8.1 The Contractor shall provide one (1) soft copy, each, of all reports to the CGSSO. Deliverables are, as follows:

3.8.3.1.14

Vehicle control

3.8.2

9 PERIOD OF PERFORMANCE

The contract term shall be for a period of 12 (twelve) months with an optional six (6) months extension under FAR 52.217-8, Option to Extend Services.

2 | Page image1.png