PWS-NIWDCEWD-SSN-Draft.pdf

UNCLASSIFIED

Enclosure (1)

PROFESSIONAL, TECHNICAL AND ADMINISTRATIVE SUPPORT

TO NAVY ELECTRONIC WARFARE

1.0 INTRODUCTION This Performance Work Statement (PWS) supports Cybersecurity services for Naval Information Warfighting Development Center (NIWDC) in support of the Electronic Warfare Database (EWD) requirements.

2.0 SCOPE This PWS effort encompasses support for NIWDC EWD technical, professional, and administrative support for the cybersecurity operations within the current Amazon Web Services (AWS) Information Level 6 (IL6) certified environment comprised of two Elastic Cloud Compute instances and one integrated cloud-based Development Operations (DEVOPS) environment. Contractor support shall ensure compliance with all applicable DoD, DoN, cybersecurity requirements, and shall include full lifecycle management—engineering, implementation, configuration management, patching, documentation, and sustainment—for technologies within PWS. Support will ensure systems security posture, safeguarding of sensitive data, specified deliverables and overall hygiene of the cloud environments. The contractor shall provide qualified and cleared personnel capable of performing the cybersecurity workforce (CSWF) roles to support the Department of the Navy (DoN) network, systems infrastructure and applications. The Contractor shall provide support and administration for future requirements as identified by the government.

3.0 TASK DESCRIPTION The following tasks describe NIWDC EWD professional, technical, and administrative support required under this contract:

3.1 – Navy Information Operations Database (NIODB) / Cybersecurity Support:

3.1.1. Estimated Labor Mix:

1. Information System Security Engineer III, (Key Personnel, Site Lead): 1912 hrs.

2. Information System Security Engineer II, 1912 hrs.

3.1.2 - Core Responsibilities: Ensure the confidentiality, integrity and availability of cloud information assets is in accordance with established standards and procedures. Develops and maintains knowledgebase on changing regulatory, threat, and technology landscapes to continually develop or maintain security policies and standards and ensure compliance. Provide security for the cloud technologies to protect the organization's data, analyzing existing cloud structures and new security methods. Develop security policies, conduct risk assessments, and ensure compliance with relevant regulations. This support shall include:

- Technical Support Security Tools Implementation: Deploy and maintain security software and tools, including firewalls, intrusion detection systems, and antivirus solutions.

System Updates: Ensure timely updates and patches are applied to all cloud-based systems to mitigate vulnerabilities.

Security and Compliance: Identify, confirm and apply the most current and relevant DISA STIGs, Zero Trust, requirements for all supported applications.

Remediate STIG findings or coordinate mitigation strategies in support of Authority to Operate (ATO) and RMF compliance. Ensure that all applications remain configured securely and operate within DoN cybersecurity policies.

Security Control Implementation: Implement and configure security controls as dictated by organizational policies and standards.

Monitoring: Monitor security alerts and logs to detect security incidents.

Vulnerability Management: Analyze, review, and report on all scans of networks and systems to identify vulnerabilities, prioritize them based on risk, and work with IT teams/engineers/admins to remediate them.

Configuration Management:

Develop and maintain configuration management plans.

Manage the configuration of hardware, software, and networks.

Ensure documentation of configurations and any changes.

Conduct configuration audits to ensure compliance with standards and policies.

Disaster Recovery: Develop and maintain comprehensive disaster recovery plans and strategies.

Conduct risk assessments and business impact analyses.

Coordinate disaster recovery testing and drills to validate plans.

Ensure effective data backup and recovery solutions are in place.

Collaborate with stakeholders to align DR plans with business continuity initiatives.

Develop and Implement cybersecurity audit processes for application software/networks/systems and oversee ongoing independent audits to ensure that operational and Research and Design (R&D) processes and procedures are in compliance with organ Apply coding and testing standards, apply security testing tools including “‘fuzzing” static-analysis code scanning tools, and conduct code reviews.

Conduct Privacy Impact Assessments (PIA) of the application’s security design for the appropriate security controls, which protect the confidentiality and integrity of Personally Identifiable Information (PII).

Develop methods to monitor and measure risk, compliance, and assurance efforts.

Develop specifications to ensure risk, compliance, and assurance efforts conform with security, resilience, and dependability requirements at the software application, system, and network environment level.

Draft statements of preliminary or residual security risks for system operation.

Maintain information systems assurance and accreditation materials.

Monitor and evaluate a system’s compliance with information technology (IT) security, resilience, and dependability requirements.

Perform validation steps, comparing actual results with expected results and analyze the differences to identify impact and risks.

Plan and conduct security authorization reviews and assurance case development for initial installation of systems and networks.

- Administrative Support:

Policy Development: Formulate and update cybersecurity policies and procedures to align with all applicable DoD, DoN, cybersecurity requirements.

Risk Management: Carry out risk assessments and develop strategies to mitigate identified risks.

Documentation: Maintain detailed documentation of security policies, incident response plans, and compliance audits. Reviews, updates, validates and authors of less than 30 Cybersecurity procedures (SOPs) as required.

Maintain all documents required for system compliance in eMASS. Create and maintain documentation for system, incident reports, Plan of Action and Milestones (POAMs), patch schedules, compliance status, and remediation steps for inspections, audits, and RMF artifacts. Maintain comprehensive system documentation including configurations, baselines, and changes.

Support and maintain accreditation and risk assessment documentation through continuous monitoring through the system’s lifecycle.

- Professional Support

Provide expert advice and guidance on threats and cybersecurity findings, reports and trends.

Incident Response: Respond to security incidents, this includes initial investigation, containment, and reporting.

Compliance and Auditing: Assist in preparing for and participating in security audits. Ensure that systems comply with relevant regulations and frameworks (e.g., NIST, RMF, ISO 27001).

3.1.3 - Qualification Required: The following knowledge, skills and abilities shall be considered the minimum requirements for this position:

- Key Personnel, Site Lead shall have 7+ years of demonstrated experience in cybersecurity in multiple security domains, such as network security, application security, cryptography, and cloud security.

Certification: Contractor (Lead) shall have CISSP certification.

5+ years of demonstrated experience in cybersecurity or IT role with a focus on security. Proficiency with security tools such as ACAS, SIEM platforms (e.g., Splunk), and a strong understanding of security implementation for applications, compliance, auditing and monitoring security alerts and logs is essential.

3+ years of demonstrated experience in Endpoint security (HBSS/Trellix/ESS), configuration, policy enforcement, application, network traffic and SIEM analysis, and monitoring.

Certification: Contractor shall have either CompTIA Security+, GIAC Security Essentials (GSEC), or Certified Ethical Hacker (CEH).

- All Contractor employees working Cyber/IT functions must comply with DoD and Navy training requirements in DoDM 8140.03.

3.1.4 – Deliverables

• A&A Review: Comprehensive report documenting current risk assessment of

NIWDC systems and any non-documented deltas from the ATO (A&A baseline) annually.

• Contingency Plan review, including recommendations, tasks, annually.

• Documentation reports: includes review, Monthly Status Reports, invoices, update status of Cybersecurity SOPs, policies, summary of changes made in DADMS, and the PPSM registry databases; changes to the authorized software list; changes to the authorized external device list; and the status of system restorations are due NLT the 10th business day of the following month.

• Other reports may be required but are situational in nature (e.g.: Cybersecurity infractions and/or identified incidents require immediate reporting; specific Cybersecurity threat mitigation). Volume of situational reports is estimated at less than 10 per month.

3.1.5.- Contractor Personnel: During the first 90 days of performance, the Contractor shall make no substitutions of personnel unless the substitution is necessitated by illness, death, or termination of employment. The Contractor shall notify the COR within 15 calendar days after the occurrence of any of these events and provide any necessary information.

3.2 - Navy Information Operations Database (NIODB) / Cloud System Administrator Support

3.2.1 - Estimated FTE:

1. Cloud System Administrator – 3824 hrs.

3.2.2 – Core Responsibilities: The Contractor shall provision and operate cloud environment (AWS): manage and optimize the cloud environments, provide continuous operation, security, and scalability. The Contractor shall provision and configure cloud resources, such as virtual machines, storage, and networking components, to support various business applications and workloads. Monitor system performance, respond to alerts, ensuring high availability and reliability of cloud services. Performing routine maintenance tasks, software updates, patch management, performance tuning.

Run monitoring and operations: logs/metrics/traces, alerting, on-call response, troubleshooting performance and availability issues.

Perform patching and vulnerability remediation: patch cycles, image updates, config drift fixes, coordinate with security findings (CSPM/scan results).

Administer backup/restore and disaster recovery: snapshots, replication, RTO/RPO testing.

Document standard operating procedures and maintain configuration/asset inventories.

• Install, configure, update, patch, monitor, and troubleshoot cloud-hosted systems, virtual servers, operating systems, and associated platform services within the authorized cloud environment.

• Monitor system resource availability, performance, functionality, integrity, scalability, and operational efficiency, including compute, storage, and network components.

• Conduct functional, integration, and connectivity testing to ensure continued operability of cloud-hosted applications, services, and external interfaces.

• Perform periodic system maintenance including electronic housekeeping, log reviews, disk and storage checks, service restarts, backup validation, patch validation, performance tuning, and scheduled reboots when required.

• Design, implement, and manage Microsoft Active Directory / identity policies, group policies, role-based access controls, security groups, and access control lists in accordance with organizational standards, business rules, and mission needs.

• Develop, maintain, and document system administration standard operating procedures, cloud operational runbooks, recovery procedures, and configuration management processes.

• Comply with approved organizational system administration procedures, cloud governance requirements, and configuration management controls.

• Implement and enforce local and cloud network usage policies, segmentation rules, access restrictions, and approved connectivity procedures.

• Ensure timely testing and application of security patches, hotfixes, firmware updates, and vendor-released mitigations for commercial and government-furnished products integrated into the cloud environment in accordance with timelines established by the management authority and applicable cybersecurity directives.

• Maintain approved secure baselines for operating systems, servers, cloud resources, and hosted applications in accordance with organizational policy, Defense Information Systems Agency DISA STIGs, RMF controls, and applicable United States Department of the Navy DoN cybersecurity requirements.

3.2.3 – Qualification Required: The following knowledge, skills and abilities shall be considered the minimum requirements for this position:

- 3+ yrs: demonstrated experience of design/admin of enterprise services (AD forests, PKI); standardization and hardening; performance/capacity planning;

mentoring; incident lead; cross-domain/cloud/hybrid operations.

- 2+ yrs: demonstrated experience of independent administration of Windows/Linux servers; AD/GPO, backup/restore, monitoring; patch/vuln remediation; automation with scripts; troubleshooting production outages.

Windows Server and/or Linux administration experience. Networking fundamentals. Patch management and vulnerability remediation experience.

Monitoring/logging tools experience. Scripting/automation (PowerShell/Bash;

Python a plus), documentation and change management discipline.

- Certifications: Contractor shall have relevant certification supporting cloud platform. (e.g., AWS, Azure Security+, Microsoft Windows Server, or Red Hat

(RHCSA/RHCE)).

- All Contractor employees working Cyber/IT functions must comply with DoD and Navy training requirements in DoDM 8140.03.

3.2.4 – Deliverables

4.0 OTHER

4.1 Security: Contractor personnel working on-site shall possess a Top Secret clearance with SCI access as a condition of hire to support NIWDC services.

The following special security procedures apply to administration and execution of this contract to ensure proper safeguarding of SCI:

NIWDC Special Security Officer (SSO) will review the SCI requirements of this

PWS prior to issuance of a DD Form 254.

NIWDC Contracting Officer’s Representative (COR), SCI clearance required, will coordinate with the SSO on all requests by the Contractor for access, storage and processing of SCI materials and assist the Contractor in obtaining Government services and support from the SCI community, as required for contract performance.

Contractor access to SCI shall be at Government facilities only.

Contractors do not require substantial access to SCI.

Contractors require entry and unescorted access to SCI areas.

Use or storage of SCI at contractor operated facilities is not required.

The Government contracting activity does not require access to SCI for contract award or oversight.

Contractor will receive classified documents for reference only; however, if any classified information is generated in performance of this contract, it shall be derivatively classified and marked consistent with the source material.

Contractor requires access to classified source data up to and including Top

Secret in support of the work effort. Any extracts or use of such data requires the contractor to apply derivative classifications and markings consistent with the source documents. Use of “Multiple Sources” on the “Derived From” line necessitates compliance with the NISPOM, paragraph 4-208a, and the use of a bibliography.

Personnel with an active TS/SCI with foreign family/association ties may require additional SCI processing through SSO Navy and/or DoD and may not be authorized to support this contract until that additional processing is complete. Due to the increased risk and potential delay in support, additional SCI processing shall be accomplished prior to contractor employees being assigned to support this requirement.

Exceptions are granted, but not guaranteed, on a case-by-case basis and require prior approval from the contract Contracting Officer’s Representative and agency Commanding Officer (COM). Reference: ICD 704 Implementation Guidelines for Processing and Granting Access to

Navy Affiliates with Foreign Influence Concerns and Heightened Risk Factors

4.2 CONTRACTOR TRAINING: Contractor will complete all annual training requirements identified by the Contracting Officer's Representative (COR) to include the following:

- Controlled Unclassified Information (CUI)

- Records Management in the DON

- Classification Management Refresher Training

- Derivative Classification Training

- Originator Control (ORCON) Training

- DoD Cyber Awareness Challenge

- NIWDC Intelligence Oversight Training

- Operations Security (OPSEC)

- Level 1 Anti-Terrorism Training (3-year)

- DON Active Shooter

- Privacy & PII Awareness Training

- Combating Trafficking In Person (CTIP)

4.3 CONTRACTOR IDENTIFICATION: For all services provided under this PWS, the Contractor employee(s) shall identify themselves as Contractor personnel by introducing themselves or being introduced as Contractor personnel and displaying distinguishing badges or other visible identification for meetings with Government personnel. Additionally, contractor personnel shall identify themselves as Contractor employees in telephone conversations and in formal and informal written correspondence. The Contractor shall advise the Government on all changes in personnel (key or otherwise) during the performance of this effort. 30 days’ notice will be given prior to personnel changes being made by the Contractor and emphasis should be made to thorough and complete turnover from one member to the other.

4.4 GOVERNMENT FURNISHED EQUIPMENT/INFORMATION: The Government will provide access to current information and data on a case-by-case basis. For permanent on-site personnel, government furnished material will be provided as necessary to perform any assigned task. All material provided shall be considered the property of the Government and will be returned to the designated representative or technical point of contact (TPOC) upon completion of the task. For permanent on-site contract personnel, the Government will provide a workspace and normal office equipment needed to complete the task. Contractor shall protect DoD sensitive unclassified data regardless of the location or ownership of the transport media, including, but not limited to mobile computing devices and removable storage media; whether Government furnished or contractor owned/leased. The Contractor shall comply with all current information assurance, information security policies, procedures, and statutes applicable to DoD information technology; including the July 3, 2007, DoD CIO Policy Memorandum on Encryption of Sensitive Unclassified Data at Rest on Mobile Computing Devices and Removable Storage Media.

For contract personnel working at the vendor accredited facility/corporate office, the vendor will furnish material/workspace as necessary to perform assigned tasks.

4.5 Place of Performance: Performance of these tasks will occur at the following locations:

Naval Information Warfare Training Group Norfolk, 1247 West C Street, Building

U-132, Naval Station, Norfolk, VA. 23511 Vendor approved office upon COR approval.

4.6 Period of Performance:

Base Year: 28 September 2026 – 27 September 2027 Option Year 1: 28 September 2027 – 27 September 2028 Option Year 2: 28 September 2028 – 27 September 2029 Option Year 3: 28 September 2029 – 27 September 2030 Option Year 4: 28 September 2030 – 27 September 2031

FAR 52.217-8: 28 September 2031 to 27 March 2032

4.7 Hours of Operation: The Contractor shall be responsible for conducting business between the hours of 0700-1600 Monday through Friday except Federal holidays or when the Government facility is closed, due to local or national emergencies, administrative closings, or similar Government directed facility closures.

4.8 Recognized Holidays: The Contractor is not required to perform services on Federal holidays. Federal law (5 U.S.C 6103) establishes the following public holidays for Federal employees.

New Year’s Day 1-January Martin Luther King’s Birthday Third Monday in January President’s Day Third Monday in February Memorial Day Last Monday in May Juneteenth National Independence Day 19-June Independence Day 4-July Labor Day First Monday in September Columbus Day Second Monday in October Veterans Day 11-November Thanksgiving Day Fourth Thursday in November Christmas Day 25-December

THE FOLLOWING NAVSUP LOCAL TEXT IS HEREBY MADE PART OF THE

STATEMENT OF WORK/PERFORMANCE WORK STATEMENT.

Contractor Unclassified Access to Federally Controlled Facilities, Sensitive Information, Information Technology (IT) Systems or Protected Health Information

Executive Order 13467, Reforming Processes Related to Suitability for Government Employee, Fitness for Contractor Employees and Eligibility for Access to Classified National Security Information, Homeland Security Presidential Directive (HSPD)-12, requires government agencies to develop and implement Federal security standards for Federal employees and contractors. The 5 CFR 32 Part 157 in concert with DoD Manual 1000.13, Vol 1, implements the Federal Standards.

APPLICABILITY

This text applies to all DoD sponsored individuals who require CAC eligibility (or login and P/W if acceptable per contract) for: Physical access to DoD facilities or non-DoD facilities on behalf of DoD; Logical access to information systems (whether on site or remotely); or remote access to DoD networks that use only the CAC logon for user authentication, or access to sensitive and protected information. This applies to the

Office of the Secretary of Defense, the Military Departments, the Office of the Chairman of the Joint Chiefs of Staff and the Joint Staff, the Combatant Commands, the Office of the Inspector General of the DoD, the Defense Agencies, the DoD Field Activities and all other organizational entities within the DoD (hereinafter referred to collectively as the "DoD Components").

Each contractor employee providing services at a Navy Command under this contract is required to obtain a Department of Defense Common Access Card (DoD CAC).

Additionally, depending on the level of computer/network access, the contract employee will require a successful investigation as detailed below.

ACCESS TO FEDERAL FACILITIES

Per HSPD-12 and implementing guidance, all contractor employees working at a federally controlled base, facility or activity under this clause will require a DoD CAC.

When access to a base, facility or activity is required contractor employees shall in-process with the Command’s Security Manager upon arrival to the Command and shall out-process prior to their departure at the completion of the individual’s performance under the contract.

START-UP PERIOD

All contractor resource onboarding documents must be submitted via the prime contractor. The prime contractor shall make all necessary preparations to assume full responsibility for productive performance of the performance start date.

Definition of “productive”:

a. Visit Authorization Request (VAR)

b. Contractor Information Sheet (CIS)

c. Completed EQIP (Electronic Investigation)

d. All contractor resource(s) must have an active JPAS profile.

e. Common Access Card (CAC)

Note (1): Invoicing by the contractor will begin as of the commencement of the performance period of services and no reimbursement will be paid by the government for efforts expended during the start-up period.

Note (2): Foreign Nationals are not allowed access to the functional/system side of Enterprise Resource Planning (ERP).

ACCESS TO DOD INFORMATION TECHNOLOGY ( IT) SYSTEMS

In accordance with (IAW) Secretary of the Navy (SECNAV) M-5510.30, contractor employees who require access to DoN or DoD networks are categorized as IT-I, IT-II, or

IT-III. The IT-II level, defined in detail in SECNAV M-5510.30, includes positions which require access to sensitive information. Sensitive information includes information protected under the Privacy Act, to include Protected Health Information (PHI). All contractor employees under this contract who require access to Privacy Act protected information are therefore categorized no lower than IT-II. IT Levels are determined by the requiring activity’s Command Information System Security Manager (ISSM)/Information Assurance Manager (IAM).

Contractor employees requiring privileged or IT-I level access, (when specified by the terms of the contract) require a Single Scope Background Investigation (SSBI) or T5 or T5R equivalent investigation , which is a higher level investigation than the National Agency Check with Law and Credit (NACLC)/T3/T3R described below. Due to the privileged system access, an investigation suitable for High Risk national security positions is required. Individuals who have access to system control, monitoring, or administration functions (e.g. system administrator, database administrator) require training and certification to Information Assurance Technical Level 1 and must be trained and certified on the Operating System or Computing Environment they are required to maintain.

Access to sensitive IT systems is contingent upon a favorably adjudicated background investigation. When access to IT systems is required for performance of the contractor employee’s duties, such employees shall in-process with the Navy Command’s CSM and ISSM/IAM upon arrival to the Navy command and shall out-process prior to their departure at the completion of the individual’s performance under the contract.

Completion and approval of a System Authorization Access Request Navy (SAAR-N) form is required for all individuals accessing Navy Information Technology resources.

The decision to authorize access to a government IT system/network is inherently governmental. The contractor supervisor is not authorized to sign the SAAR-N;

therefore, the government employee with knowledge of the system/network access required or the COR shall sign the SAAR-N as the “supervisor”.

The SAAR-N shall be forwarded to the Command’s Security Manager at least 30 days prior to the individual’s start date. Failure to provide the required documentation at least 30 days prior to the individual’s start date may result in delaying the individual’s start date.

When required to maintain access to required IT systems or networks, the contractor shall ensure that all employees requiring access complete annual Cyber Awareness training and maintain a current requisite background investigation. The Contractor’s Security Representative shall contact the Command Security Manager for guidance when reinvestigations are required.

INTERIM ACCESS

The Command's Security Manager may authorize issuance of a DoD CAC and interim access to a DoN or DoD unclassified computer/network upon a favorable review of the investigative questionnaire and advance favorable fingerprint results. When the results of the investigation are received and a favorable determination is not made, the contractor employee working on the contract under interim access will be denied access to the computer network and this denial will not relieve the contractor of his/her responsibility to perform.

DENIAL OR TERMINATION OF ACCESS

The potential consequences of any requirement under this clause including denial or termination of physical or system access in no way relieves the contractor from the requirement to execute performance under the contract within the timeframes specified in the contract. Contractors shall plan ahead in processing their employees and subcontractor employees. The contractor shall insert this clause in all subcontracts when the subcontractor is permitted to have unclassified access to a federally controlled facility, federally controlled information system/network and/or to government information, meaning information not authorized for public release.

CONTRACTOR’S SECURITY REPRESENTATIVE

The contractor shall designate an employee to serve as the Contractor’s Security Representative. Within three workdays after contract award, the contractor shall provide to the requiring activity’s Security Manager and the Contracting Officer, in writing, the name, title, address and phone number for the Contractor’s Security Representative. The Contractor’s Security Representative shall be the primary point of contact on any security matter. The Contractor’s Security Representative shall not be replaced or removed without prior notice to the Contracting Officer and Command Security Manager.

BACKGROUND INVESTIGATION REQUIREMENTS AND SECURITY APPROVAL

PROCESS FOR CONTRACTORS ASSIGNED TO NATIONAL SECURITY

POSITIONS OR PERFORMING SENSITIVE DUTIES

Navy security policy requires that all positions be given a sensitivity value based on level of risk factors to ensure appropriate protective measures are applied. Contractor employees under this contract are recognized as Non-Critical Sensitive [ADP/IT-II] positions when the contract scope of work require physical access to a federally controlled base, facility or activity and/or requiring access to a DoD computer/network, to perform unclassified sensitive duties. This designation is also applied to contractor employees who access Privacy Act and Protected Health Information (PHI), provide support associated with fiduciary duties, or perform duties that have been identified as National Security Positions. At a minimum, each contractor employee must be a US citizen and have a favorably completed NACLC or T3 or T3R equivalent investigation to obtain a favorable determination for assignment to a non-critical sensitive or IT-II position. The investigation consists of a standard NAC and a FBI fingerprint check plus law enforcement checks and credit check. Each contractor employee filling a non-critical sensitive or IT-II position is required to complete:

• SF-86 Questionnaire for National Security Positions (or equivalent OPM investigative product)

• Two FD-258 Applicant Fingerprint Cards (or an electronic fingerprint submission)

• Original Signed Release Statements

Failure to provide the required documentation at least 30 days prior to the individual’s start date shall result in delaying the individual’s start date. Background investigations shall be reinitiated as required to ensure investigations remain current (not older than 10 years) throughout the contract performance period. The Contractor’s Security Representative shall contact the Command Security Manager for guidance when reinvestigations are required.

Regardless of their duties or IT access requirements ALL contractor employees shall in-process with the CSM upon arrival to the command and shall out-process prior to their departure at the completion of the individual’s performance under the contract.

Employees requiring IT access shall also check-in and check-out with the Navy Command’s ISSM/IAM. Completion and approval of a System Authorization Access Request Navy (SAAR-N) form is required for all individuals accessing Navy Information Technology resources. The SAAR-N shall be forwarded to the Navy Command’s Security Manager at least 30 days prior to the individual’s start date. Failure to provide the required documentation at least 30 days prior to the individual’s start date shall result in delaying the individual’s start date.

The contractor shall ensure that each contract employee requiring access to IT systems or networks completes annual Cyber Awareness training and maintain a current requisite background investigation. Contractor employees shall accurately complete the required investigative forms prior to submission to the Command Security Manager.

The Command’s Security Manager will review the submitted documentation for completeness prior to submitting it to the Office of Personnel Management (OPM);

Potential suitability or security issues identified may render the contractor employee ineligible for the assignment. An unfavorable determination is final (subject to SF-86 appeal procedures) and such a determination does not relieve the contractor from meeting any contractual obligation under the contract. The Command’s Security Manager will forward the required forms to OPM for processing. Once the investigation is complete, the results will be forwarded by OPM to the DoD Central Adjudication Facility (CAF) for a determination.

If the contractor employee already possesses a current favorably adjudicated investigation, the contractor shall submit a Visit Authorization Request (VAR) via the Joint Personnel Adjudication System (JPAS) or a hard copy VAR directly from the contractor’s Security Representative. Although the contractor will take JPAS “Owning” role over the contractor employee, the Navy command will take JPAS "Servicing" role over the contractor employee during the hiring process and for the duration of assignment under that contract. The contractor shall include the IT Position Category per SECNAV M-5510.30 for each employee designated on a VAR. The VAR requires annual renewal for the duration of the employees’ performance under the contract.

BACKGROUND INVESTIGATION REQUIREMENTS AND SECURITY APPROVAL

PROCESS FOR CONTRACTORS ASSIGNED TO OR PERFORMING NON-

SENSITIVE DUTIES

Contractor employee whose work is unclassified and non-sensitive (e.g., performing certain duties such as lawn maintenance, vendor services, etc. ...) and who require physical access to publicly accessible areas to perform those duties shall meet the following minimum requirements:

• Must be either a US citizen or a US permanent resident with a minimum of 3 years of legal residency in the United States (as required by The Deputy Secretary of Defense DTM 08-006 or its subsequent DoD instruction) and

• Must have a favorably completed National Agency Check with Written Inquiries (NACI) or T1 investigation equivalent including an FBI fingerprint check prior to installation access.

To be considered for a favorable trustworthiness determination, the Contractor’s Security Representative must submit for all employees each of the following:

• SF-85 Questionnaire for Non-Sensitive Positions

• Two FD-258 Applicant Fingerprint Cards (or an electronic fingerprint submission)

• Original Signed Release Statements

The contractor shall ensure each individual employee has a current favorably completed National Agency Check with Written Inquiries (NACI) or T1 equivalent investigation, or ensure successful FBI fingerprint results have been gained and investigation has been processed with OPM

Failure to provide the required documentation at least 30 days prior to the individual’s start date may result in delaying the individual’s start date.

* Consult with your CSM and ISSM/IAM for local policy when IT-III (non-sensitive) access is required for non-US citizens outside the United States.