PWS- Program Support Services.pdf

Performance Work Statement (PWS)

Naval Supply Systems Command (NAVSUP) Business Systems Center (BSC)

Program Support Services

1.0 Introduction

The Naval Supply Systems Command (NAVSUP) Business Systems Center (BSC) has the need for contractor support services to support a variety of initiatives to improve overall organizational effectiveness and operational efficiency. Support services are required for emergent program support needs, in the areas of information technology, supply chain and logistics areas.

2.0 Background:

NAVSUP BSC works closely with their stakeholders to provide information systems and program support through its Business Systems Center. NAVSUP BSC is the Navy's premier Information Technology provider of choice with responsibility to design, develop, and maintain information systems supporting numerous activities in the functional areas of logistics, supply chain management, transportation, finance and accounting.

2.1 Requiring Organization

The organization requiring the services outlined in the Performance Work Statement (PWS) is:

NAVSUP Business Systems Center 5450 Carlisle Pike Bldg. 409 Mechanicsburg, PA 17055

2.2 Project Description

NAVSUP BSC must collaborate with their stakeholders on a wide range of mission and business challenges so that the services, processes, and policies of NAVSUP are enabled by information systems that are efficient, effective, and affordable. NAVSUP BSC and their stakeholders both rely on the ability to bring together a superior workforce to accomplish their shared mission through a combination of Government and contractor personnel and delivery teams. This Performance Work Statement (PWS) sets the parameters for obtaining contractor support under an IDIQ contract for services that are intended to benefit both the stakeholders and NAVSUP

BSC.

It is anticipated that individual task orders will be formalized around specific tasks supporting ongoing or upcoming project requirements included in the scope of work defined in the PWS.

Specific details of task assignments, deliverables, documentation and applicable standards will be provided in awarded task orders.

3.0 Scope

The scope of this Indefinite Delivery Indefinite Quantity (IDIQ) contract is to provide the necessary level of professional and technical support required to facilitate shared objectives of stakeholders and NAVSUP BSC.

The goal of this PWS is to obtain contractor support services to provide program support services to the NAVSUP BSC staff in the areas of IT, business support services and analysis positions to be introduced in the requirements sections of this document and fully within individual task orders.

4.0 Directives

The contractor shall comply with the following directives, and any updated/future versions as they are released, and consider them in developing their technical proposal and management plan:

Federal Information Security Modernization Act of 2014 (“FISMA”)

DoD Instruction 5400.11, DoD Privacy and Civil Liberties Programs, 29 January 2019

DoD Directive 8000.01, Management of the DoD Information Enterprise, 17 March 2016 (incorporating Change 1 July 2017)

DoD Directive 8140.01, Cyberspace Workforce Management, 11 August 2015 (incorporating Change 1, 31 July 2017)

DoD Instruction 4161.02, Accountability and Management of Government Contract Property, 27 April 2012 (incorporating Change 2, 31 August 2018)

DoD Instruction 8320.07, Implementing the Sharing of Data, Information, and Information Technology (IT) Services in the Department of Defense, 3 August 2015 (incorporating Change 1, 5 December 2017)

DoD Instruction 8500.01, Cybersecurity, 14 March 2014, Change 1, 7 October 2019

DoD Instruction 8510.01, Risk Management Framework (RMF) for DoD Information Technology, 12 March 2014 (incorporating Change 2, 28 July 2017)

DoD Instruction 8582.01, Security of Non-DoD Information Systems Processing Unclassified Nonpublic DoD Information, 9 December 2019

SECNAVINST 5510.36B, DoN Information Security Program, 12 July 2019

DoD 5400.11-R, Department of Defense Privacy Program, 14 May 2007

DoD 8570.01-M, Information Assurance Workforce Improvement Program, 19 December 2005 (incorporating Change 4, 10 November 2015)

SECNAV Instruction 5211.5F, Department of the Navy Privacy Program, 20 May 2019

SECNAV Instruction 5239.3C, DON Cybersecurity Policy, 2 May 2016

SECNAV M-5239.1, DoN Information Assurance Manual, November 2005

OPNAVINST 5239.1D, U.S. Navy Cybersecurity Program, 18 July 2018

OPNAVINST 5239.4, Chief of Naval Operations Cybersecurity Safety Program, 14

September 2018

SECNAV Manual M-5239.2, DON Cyberspace Information Technology and Cybersecurity Workforce Management and Qualification Manual, 27 June 2016

SECNAV Manual M-5510.30, Department of the Navy Personnel Security Program, 1 June 2006

CJCSI 6211.02D, Defense Information Systems Network (DISN) Responsibilities, 24 January 2012

DoD Public Key Infrastructure (https://cyber.mil/pki-pke)

ISO/IEC/IEEE 12207:2017 Systems and Software Engineering – Software Life Cycle Processes

ANSI/EIA 649C-2019 – Configuration Management Standard

ANSI/EIA 836B-2015 – Configuration Management Data Exchange and Interoperability

Federal Risk and Authorization Management Program (“FedRAMP”)

Department of Defense Cloud Computing Security Requirements Guide, Version 1, Release 3, dated 6 March 2017

All applicable Security Requirements Guides, Security Technical Implementation Guides, and National Security Agency security configuration guides when assessment and authorization is required

Common Criteria for Information Technology Security Evaluation, Part 3: Security Assurance Components, April 2017, Version 3.1, Revision 5, CCMB-2017-04-003

NIST SP 800-37 Revision 2, Risk Management Framework for Information Systems and Organizations, December 2018

U.S. Navy Risk Management Framework Process Guide, Version 3.1, 3 February 2020

NIST SP 800-53 Revision 4, Security and Privacy Controls for Federal Information Systems and Organizations, April 2013, includes updates as of 22 January 2015

NIST SP 800-53A Revision 4, Assessing Security and Privacy Controls in Federal Information Systems and Organizations, December 2014, includes updates as of 18 December 2014

NIST SP 800-171 Revision 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, February 2020

NIST SP 800-171A, Assessing Security Requirements for Controlled Unclassified Information, June 2018

NAVSUPINST 5239.5, Cybersecurity and Defensive Cyberspace Operations Policy, 25 March 2019

ISO/IEC 19770-1:2017 – Information Technology – IT Asset Management – Part 1: IT Asset Management Systems - Requirements

ISO/IEC 19770-2:2015 - Information Technology -- Software Asset Management -- Part 2: Software Identification Tag

ISO/IEC 19770 Series - Information Technology – IT Asset Management

A Guide to the Project Management Body of Knowledge (PMBOK® Guide) - Sixth Edition

Section 508 of the Rehabilitation Act of 1973 (amended by the Workforce Investment Act of 1998, 7 August 1998)

SECNAVINST 5720.44C - Department of the Navy Policy for Content of Publically Accessible World Wide Web Sites, 21 February 2012 (incorporating Change 1, 14 October 2014)

SECNAVINST 5510.30C, Department of Navy Personnel Security Program, 24 January

Homeland Security Presidential Directive (HSPD)12, Policy for a Common Identification Standard for Federal Employees and Contractors, 27 August 2004

DoD Manual 5200.02, Procedures for the DoD Personnel Security Program (PSP), 3 April 2017

DoD Manual 5200.08-R, Physical Security Program, 27 May 2009, 3 April 2017

NTTP 3-13.3, Operations Security (OPSEC), September 2017

DoD Instruction 5200.48, Controlled Unclassified Information (CUI), March 6, 2020

NSAMECHINST 5530.1C CH-1, Naval Support Activity Mechanicsburg Installation

Access Control, 23 August 2019

The following Directives are only applicable for classified Task Orders (Secret or higher clearance required):

Executive Order 13467 as amended, Establish the Roles and Responsibilities of the National Background Investigations Bureau and Related Matters, 30 June 2008

Executive Order 13526, Original Classification Authority, 29 December 2009

DoD 5220.22-M, National Industrial Security Program Operating Manual, 18 May 2016

DoD 5220.22, Volume 2, National Industrial Security Program: Security Procedures for Government Activities Operating Manual, 1 August 2018

DoDM 5200.01 Volume 1, DoD Information Security Program: Overview, Classification, and Declassification, 4 May 2018

DoDM 5200.01 Volume 2, DoD Information Security Program: Marking of Information, 14 May 2019

DoDM 5200.01 Volume 3, DoD Information Security Program: Protection of Classified Information, 19 March 2013

5.0 Requirements/Tasks

The contractor shall be contractually obligated to perform every requirement in at least one requirements group in this performance work statement. Not every performance requirement has a related performance standard or assessment measure expressed in this document. In such cases, the performance standard or performance measure is either inherent in the requirement or performance is to be in accordance with NAVSUP BSC standards which will be provided upon award.

Per DFARS 211.106, contractor employees shall identify themselves as contractor personnel by introducing themselves or being introduced as contractor personnel and displaying distinguishing badges or other visible identification for meetings with Government personnel. In addition, contractor personnel shall appropriately identify themselves as contractor employees in telephone conversations and in formal and informal written correspondence.

5.1 Requirements Group 1 - Software Development Services

5.1.1 IT Software Engineering

The contractor shall provide IT software engineering support including:

analyzing and refining systems requirements;

translating systems requirements into applications prototypes;

planning and designing systems architecture;

writing, debugging, and maintaining code;

determining and designing applications architecture;

determining output media/formats;

designing user interfaces;

working with customers to test applications;

assuring software and systems quality and functionality;

integrating hardware and software components;

writing and maintaining program documentation;

evaluating new applications software technologies; and ensuring the rigorous application of information security/ information assurance policies, principles, and practices to the delivery of application software services.

5.1.2 IT Internet Development

The contractor shall provide IT internet development support including:

determining overall technical design and structure of Internet services;

monitoring functionality, security, and integrity of Internet services;

troubleshooting and resolving technical problems with the design and delivery of Internet services;

collecting and analyzing Internet services usage and performance statistics;

evaluating new Internet services and technologies;

providing technical advice to Internet content providers; and ensuring the rigorous application of information security/ information assurance policies, principles, and practices in the delivery of Internet services.

5.1.3 IT Systems Analysis

The contractor shall provide IT systems analysis support including:

performing needs analyses to define opportunities for new or improved business process solutions;

consulting with customers to identify and specify requirements;

developing overall functional and systems requirements and specifications;

conducting business process reengineering;

conducting feasibility studies and trade-off analyses;

preparing business cases for the application of IT solutions;

defining systems scope and objectives;

developing cost estimates for new or modified systems;

ensuring the integration of all systems components; e.g., procedures, databases, policies, software, and hardware;

planning systems implementation; and ensuring the rigorous application of information security/ information assurance policies, principles, and practices to the systems analysis process.

5.2 Requirements Group 2 – Administration Services

5.2.1 IT Customer Support

The contractor shall provide IT customer support including:

diagnosing and resolving problems in response to customer reported incidents;

researching, evaluating, and providing feedback on problematic trends and patterns in customer support requirements;

developing and maintaining problem tracking and resolution databases;

installing, configuring, troubleshooting, and maintaining customer hardware and software;

developing recommendations for customer service performance requirements;

developing recommendations for customer support policies, procedures, and standards;

providing customer training; and ensuring the rigorous application of information security/information assurance policies, principles, and practices in the delivery of customer support services.

5.2.2 IT Systems Administration

The contractor shall provide IT systems administration support including:

planning and scheduling the installation of new or modified hardware and operating systems and applications software;

managing accounts, network rights, and access to systems and equipment;

managing systems resources including performance, capacity, availability, serviceability, and recoverability;

implementing security procedures and tools;

developing and documenting systems administration standard operating procedures;

resolving hardware/software interface and interoperability problems;

ensuring systems availability, functionality, integrity, and efficiency;

maintaining systems configuration;

managing the installation and integration of systems fixes, updates, and enhancements; and ensuring the rigorous application of information security/ information assurance policies, principles, and practices in the delivery of systems administration services.

5.2.3 IT Operating Systems

The contractor shall provide IT operating systems support including:

analyzing systems requirements in response to business requirements, risks, and costs;

evaluating, recommending, verifying, and validating the systems software environment;

evaluating, recommending, and installing compilers, assemblers, and utilities;

integrating hardware and software components within the systems environment;

monitoring and fine-tuning performance of the systems environment;

evaluating new systems engineering technologies and their effect on the operating environment;

and ensuring that information security/information assurance policies, principles, and practices are an integral element of the operating environment.

5.2.4 IT Network

The contractor shall provide IT network support including:

analyzing and defining network requirements;

defining and maintaining network architecture and infrastructure;

configuring and optimizing network servers, hubs, routers, and switches;

analyzing network workload;

monitoring network capacity and performance;

diagnosing and resolving network problems;

developing network backup and recovery procedures;

installing, testing, maintaining, and upgrading network operating systems software; and ensuring the rigorous application of information security/ information assurance policies, principles, and practices in the delivery of network services.

5.2.5 IT Infosec

The contractor shall provide IT Infosec support including:

developing recommendations for policies and procedures to ensure information systems reliability and accessibility and to prevent and defend against unauthorized access to systems, networks, and data;

conducting risk and vulnerability assessments of planned and installed information systems to identify vulnerabilities, risks, and protection needs;

promoting awareness of security issues among management and ensuring sound security principles are reflected in organizations’ visions and goals;

conducting systems security evaluations, audits, and reviews;

developing systems security contingency plans and disaster recovery procedures;

developing and implementing programs to ensure that systems, network, and data users are aware of, understand, and adhere to systems security policies and procedures;

participating in network and systems design to ensure implementation of appropriate systems security policies;

facilitating the gathering, analysis, and preservation of evidence used in the prosecution of computer crimes;

assessing security events to determine impact and implementing corrective actions; and ensuring the rigorous application of information security/ information assurance policies, principles, and practices in the delivery of all IT services.

5.3 Requirements Group 3 – Data and Analysis Services

5.3.1 IT Data Management

The contractor shall provide IT data management support including:

analyzing and defining data requirements and specifications;

designing, normalizing, developing, installing, and implementing databases;

maintaining, monitoring, performance tuning, backup, and recovery of databases;

installing, configuring, and maintaining database management systems software;

analyzing and planning for anticipated changes in data capacity requirements;

developing and administering data standards, policies, and procedures;

developing and implementing data mining and data warehousing programs;

evaluating and providing recommendations on new database technologies and architectures; and ensuring the rigorous application of information security/ information assurance policies, principles, and practices in the delivery of data management services.

5.3.2 Operations Research and Analysis

The contractor shall provide operations research and analysis support including:

Provide statistical analysis, stochastic modeling, network analysis and optimization, as well as modeling and simulation, and decision support

Methods Development and Assessment – applying expert knowledge of particular classes of problems and the ability to develop associated problem solving methods;

Problem Solving –working directly to correct deficiencies or improve the performance of systems, processes, or operations;

Problem Definition – utilizing/framing “what if” questions in the formulation of problem statements;

Model Development – representing the important factors of the problem and their relationships to selected features of the real world;

Hypothesis Testing and Investigation –Successive integration of analogies, patterns, and relationships, and usually involves feedback and further restructuring; and

Predictions/Explanations – Predicting future events or explain past events, recommendation of the best alternatives, and presentation of relevant tradeoffs and limitations to decision makers.

5.3.3 Supply Systems Analysis

The contractor shall provide supply systems analysis support including:

initiating, developing, installing, or administering a supply program;

coordinating with customers and overseeing the implementation of actions involving requirements determination, acquisition of supplies and materials, managing property accountability systems, and assuring that property is in place where and when needed;

developing and issuing supply handbooks and other publications for agency and/or industry use;

sponsoring and developing training programs, conferences and seminars;

conducting surveys and studies of supply operations to determine proper application of improved supply methods or approved industry techniques;

providing technical advice, guidance, and assistance on supply operations to agency personnel;

developing, installing, or advising on financial or other management control programs for supply operations for such purposes as controlling operations, determining supply costs, planning and budgeting, and evaluating supply management performance;

developing design specifications, reviewing data processing systems that support supply programs, and documenting additions, changes, or deletions;

monitoring and making recommendations to modify inventory control systems for subordinate and regional level programs;

evaluating storage and distribution systems for potential introduction of automated controls and systems of data flow and reports; and other combinations of work that involve program management, or review, analysis, and recommending improvements in operations, programs, automated systems, methods, or procedures.

Performance Measurement Criteria: Task success will be evaluated by the success of contractor at meeting imposed due dates for deliverables and documentation. This effort includes providing qualified personnel following industry accepted methodologies and other pertinent practices. The effort is further characterized by always operating with the Government’s best interest in mind, using efficient and effective methods and demonstrating sound cost control.

The government reserves the right to periodically review personnel qualifications and certification of personnel working on this order and ask for the removal of any person not maintaining their qualifications or certifications. Performance Standards and Assessment Methods will be further defined at the task order level.

6.0 Deliverables: All deliverables must meet the format requirements specified by the individual task orders. Documentation related to these services shall be made available electronically. The following list details the contract deliverables:

6.1 Monthly Status Report. Status reports shall be sent electronically to the TA and COR within seven (7) days following the end of the monthly period documenting the performance on the task order. The monthly status report shall include the following elements:

Resources by name

Date project/task received

Status of work with accomplishments documented

Percentage of project/task completed

Estimated date of project/task completion Issues/problems encountered or possible and recommended solutions

Changes to the Project Management Plan (PMP) to include roles and responsibilities and schedule changes

Identify any Government dependencies that are overdue which impact schedule or performance

Evaluate performance and determine adequacy of staffing.

6.2 Contractor’s Quality Assurance Plan. The contractor shall develop and maintain a quality assurance plan. This QA Plan should detail the methodology to be used by the contractor to monitor and ensure that all support services are provided and individual qualifications and certifications remain current. The contractor shall provide the Initial Quality Assurance Plan to the COR and TA not later than ten (10) days after contractor award. Unless stated otherwise, the following instructions apply to all deliverables:

All versions of the deliverables required by the task order shall be delivered electronically to the COR and/or his/her designee and shall be subject to Government review and approval.

Deliverable due dates shall take into account the review periods described below.

Draft deliverables will be reviewed and feedback and/or requested changes provided within 7 business days (unless otherwise specified).

Government reserves the right to request a formal review session with the contractor during these timeframes and can request that the contractor make changes to any version of a deliverable.

Government will review and approve or reject all final versions of all deliverables within 7 business days of receipt (unless otherwise specified).

If any deliverable is rejected, the contractor will be notified within the specified time periods and will have 7 calendar days within which to rework the deliverable and resubmit for Government approval. All changes to any version of a deliverable and/or deliverable outline shall be approved by the COR. If more than the specified number of calendar days is required for Government review and approval, the COR will inform the contractor of the need for an extension within the initial review period.

Contractor shall prepare and submit the deliverables on or before the required due date to the COR or designee via email. For deliverables that are not documents the contractor shall submit a description of the deliverable and any associated documentation or descriptive information. In no case shall any deliverable be received by the Government less than 21 calendar days prior to the end of the task order Period of Performance.

Rejection of any deliverable by the Government does not excuse the contractor from meeting the baseline due dates for any other deliverables.

7.0 Period of Performance

The ordering period of performance for this IDIQ contract will be a base year and four, one-year options.

8.0 Places of Performance

The primary place of performance will be Mechanicsburg, PA 17055. Additional on-site support may be required at other CONUS locations, OCONUS locations to include Hawaii, or off-site locations to be determined by each task order.

9.0 Travel

Specific travel requirements will be addressed as required at the task order level. If not the primary place of performance, travel may be expected to be accomplished to other locations (including international) in support of projects when pre-approved by the TA and COR.

Obtaining a passport will be the responsibility of the traveler/company to include all costs to obtain passports. It is not anticipated that there will be a requirement for contractor to travel for any conference attendance.

If the contractor is required to travel to other locations, such travel shall be in accordance with FAR 31.205-46. All travel must be pre-approved in writing by the TA and COR prior to the actual travel and all travel must be funded in the contract prior to any travel expenses being incurred. No travel shall occur outside of the period of performance dates of the contract.

Travel 12 hours or less, per diem does not apply.

If travel is required, the contractor is responsible for making all needed arrangements for their personnel.

9.1 Travel Policy. The Government will reimburse the contractor for allowable travel costs incurred by the contractor in performance of this PWS and determined to be in accordance with FAR subpart 31.2, subject to the following provisions:

Travel required for tasks assigned under this contract shall be governed in accordance with rules set forth for temporary duty travel in FAR 31.205-46.

Unallowable travel costs: Change or cancellation fees for travel.

9.2 Travel other. Travel, subsistence, and associated labor charges for travel time are authorized whenever a task assignment requires work to be accomplished at a temporary alternate worksite. Travel performed for personal convenience will not be reimbursed.

9.3 Air/Rail Travel. In rendering the services, the contractor shall be reimbursed for the actual costs of transportation incurred by its personnel not to exceed the cost of economy class rail, or plane fare, to the extent that such transportation is necessary for the performance of the services hereunder and is authorized by the Contracting Officer’s Representative (COR). Such authorization by the COR shall be indicated in the order or in some other suitable written form.

10.0 Security

All positions are classified as noncritical-sensitive. Future task orders may require a security clearance for requirements (DD254 may be required at the task order level). Per SECNAV M-

5510.30 (Department of the Navy Personnel Security Program) and DOD 5220.22-M (National Industry Security Program Operating Manual), only U.S. Citizens are eligible for security clearances.

This clause does not apply to non-U.S. Nationals (foreign nationals) who are contactor employees performing work overseas.

The clause is applicable to the United States Nationals living in the U.S. or overseas who are performing work on a Navy contract.

The investigation of a non-U.S. national at a foreign location must be consistent with a NACI, to the extent possible, and include a fingerprint check against the FBI criminal history database, an FBI investigations file (name check) search, and a name check against the terrorist screening database.

Also, the above cited reference notes that Foreign Nationals may not be granted CAC Credentials until completion of their investigation and not in the interim.

Per DoD 5200.2-R, DoD Components must initiate and ensure completion of a background investigation before applying the credentialing standards to a non-U.S. national at a foreign location. The background investigation must be favorably adjudicated before a CAC can be issued to a non-U.S. national at a foreign location. The type of background investigation may vary based on standing reciprocity treaties concerning identity assurance and information exchanges that exist between the U.S. and its allies or agency agreements with the host country.

SUPTXT204-9400(7-18) Contractor Unclassified Access to Federally Controlled Facilities, Sensitive Information, Information Technology (IT) Systems or Protected Health Information (JUN 2018)

Executive Order 13467, Reforming Processes Related to Suitability for Government Employment, Fitness for Contractor Employees, and Eligibility for Access to Classified National Security Information, and Homeland Security Presidential Directive (HSPD)-12, requires government agencies to develop and implement Federal security standards for Federal employees and contractors. The 5 CFR 32 part 157 in concert with DoD Manual 1000.13, Vol 1, implements the Federal Standards.

APPLICABILITY

This text applies to all DoD sponsored individuals who require CAC eligibility (or login and P/W if acceptable per contract) for: Physical access to DoD facilities or non-DoD facilities on behalf of DoD; Logical access to information systems (whether on site or remotely); or remote access to DoD networks that use only the CAC logon for user authentication, or access to sensitive and protected information. This applies to the Office of the Secretary of Defense, the Military Departments, the Office of the Chairman of the Joint Chiefs of Staff and the Joint Staff, the Combatant Commands, the Office of the Inspector General of the DoD, the Defense Agencies, the DoD Field Activities, and all other organizational entities within the DoD (hereinafter referred to collectively as the "DoD Components").

Each contractor employee providing services at a Navy Command under this contract is required to obtain a Department of Defense Common Access Card (DoD CAC). Additionally, depending on the level of computer/network access, the contract employee will require a successful investigation as detailed below.

ACCESS TO FEDERAL FACILITIES

Per HSPD-12 and implementing guidance, all contractor employees working at a federally controlled base, facility or activity under this text will require a DoD CAC. When access to a base, facility or activity is required contractor employees shall in-process with the Command’s Security Manager upon arrival to the Command and shall out-process prior to their departure at the completion of the individual’s performance under the contract.

START-UP PERIOD

All contractor resource onboarding documents must be submitted via the prime contractor. The prime contractor shall make all necessary preparations to assume full responsibility for productive performance as of the performance start date.

Definition of “productive”:

a. Visit Authorization Request (VAR)

b. Contractor Information Sheet (CIS)

c. FD-258 fingerprint card

d. Completed EQIP (Electronic Investigation)

e. All contractor resource(s) must have an active JPAS profile

f. Common Access Card (CAC)

Note (1): Invoicing by the contractor will begin as of the commencement of the performance period of services, and no reimbursement will be paid by the Government for efforts expended during the start-up period.

Note (2): Dual Citizenship and Foreign Nationals are not allowed access to the functional/system side of Enterprise Resource Planning (ERP).

ACCESS TO DOD IT SYSTEMS

In accordance with SECNAV M-5510.30, contractor employees who require access to DoN or DoD networks are categorized as IT-I, IT-II, or IT-III. The IT-II level, defined in detail in SECNAV M-5510.30, includes positions which require access to sensitive information.

Sensitive information includes information protected under the Privacy Act, to include Protected Health Information (PHI). All contractor employees under this contract who require access to Privacy Act protected information are therefore categorized no lower than IT-II. IT Levels are determined by the requiring activity’s Command Information System Security Manager (ISSM)/Information Assurance Manager (IAM).

Contractor employees requiring privileged or IT-I level access, (when specified by the terms of the contract) require a Single Scope Background Investigation (SSBI) or T5 or T5R equivalent investigation, which is a higher level investigation than the National Agency Check with Law and Credit (NACLC)/T3/T3R described below. Due to the privileged system access, an investigation suitable for High Risk national security positions is required. Individuals who have access to system control, monitoring, or administration functions (e.g. system administrator, database administrator) require training and certification to Information Assurance Technical Level 1, and must be trained and certified on the Operating System or Computing Environment they are required to maintain.

Access to sensitive IT systems is contingent upon a favorably adjudicated background investigation. When access to IT systems is required for performance of the contractor employee’s duties, such employees shall in-process with the Navy Command’s Security Manager and Information System Security Manager (ISSM)/Information Assurance Manager (IAM) upon arrival to the Navy command and shall out-process prior to their departure at the completion of the individual’s performance under the contract. Completion and approval of a System Authorization Access Request Navy (SAAR-N) form is required for all individuals accessing Navy Information Technology resources. The decision to authorize access to a government IT system/network is inherently governmental. The contractor supervisor is not authorized to sign the SAAR-N; therefore, the government employee with knowledge of the system/network access required or the COR shall sign the SAAR-N as the “supervisor”.

The SAAR-N shall be forwarded to the Command’s Security Manager at least 30 days prior to the individual’s start date. Failure to provide the required documentation at least 30 days prior to the individual’s start date may result in delaying the individual’s start date.

When required to maintain access to required IT systems or networks, the contractor shall ensure that all employees requiring access complete annual Cyber Awareness) training, and maintain a current requisite background investigation. The Contractor’s Security Representative shall contact the Command Security Manager for guidance when reinvestigations are required.

INTERIM ACCESS

The Command's Security Manager may authorize issuance of a DoD CAC and interim access to a DoN or DoD unclassified computer/network upon a favorable review of the investigative questionnaire and advance favorable fingerprint results. When the results of the investigation are received and a favorable determination is not made, the contractor employee working on the contract under interim access will be denied access to the computer network and this denial will not relieve the contractor of his/her responsibility to perform.

DENIAL OR TERMINATION OF ACCESS

The potential consequences of any requirement under this text including denial or termination of physical or system access in no way relieves the contractor from the requirement to execute performance under the contract within the timeframes specified in the contract. Contractors shall plan ahead in processing their employees and subcontractor employees. The contractor shall insert this text in all subcontracts when the subcontractor is permitted to have unclassified access to a federally controlled facility, federally-controlled information system/network and/or to government information, meaning information not authorized for public release.

CONTRACTOR’S SECURITY REPRESENTATIVE

The contractor shall designate an employee to serve as the Contractor’s Security Representative.

Within three work days after contract award, the contractor shall provide to the requiring activity’s Security Manager and the Contracting Officer, in writing, the name, title, address and phone number for the Contractor’s Security Representative. The Contractor’s Security Representative shall be the primary point of contact on any security matter. The Contractor’s Security Representative shall not be replaced or removed without prior notice to the Contracting Officer and Command Security Manager.

BACKGROUND INVESTIGATION REQUIREMENTS AND SECURITY APPROVAL

PROCESS FOR CONTRACTORS ASSIGNED TO NATIONAL SECURITY POSITIONS

OR PERFORMING SENSITIVE DUTIES Navy security policy requires that all positions be given a sensitivity value based on level of risk factors to ensure appropriate protective measures are applied. Contractor employees under this contract are recognized as Non-Critical Sensitive [ADP/IT-II] positions when the contract scope of work require physical access to a federally controlled base, facility or activity and/or requiring access to a DoD computer/network, to perform unclassified sensitive duties. This designation is also applied to contractor employees who access Privacy Act and Protected Health Information (PHI), provide support associated with fiduciary duties, or perform duties that have been identified as National Security Positions. At a minimum, each contractor employee must be a US citizen and have a favorably completed NACLC or T3 or T3R equivalent investigation to obtain a favorable determination for assignment to a non-critical sensitive or IT-II position. The investigation consists of a standard NAC and a FBI fingerprint check plus law enforcement checks and credit check. Each contractor employee filling a non-critical sensitive or IT-II position is required to complete:

•SF-86 Questionnaire for National Security Positions (or equivalent OPM investigative product) •Two FD-258 Applicant Fingerprint Cards (or an electronic fingerprint submission) •Original Signed Release Statements

Failure to provide the required documentation at least 30 days prior to the individual’s start date shall result in delaying the individual’s start date. Background investigations shall be reinitiated as required to ensure investigations remain current (not older than 10 years) throughout the contract performance period. The Contractor’s Security Representative shall contact the Command Security Manager for guidance when reinvestigations are required.

Regardless of their duties or IT access requirements ALL contractor employees shall in-process with the Command’s Security Manager upon arrival to the command and shall out-process prior to their departure at the completion of the individual’s performance under the contract.

Employees requiring IT access shall also check-in and check-out with the Navy Command’s Information Systems Security Manager (ISSM)/Information Assurance Manager (IAM)Manager.

Completion and approval of a System Authorization Access Request Navy (SAAR-N) form is required for all individuals accessing Navy Information Technology resources. The SAAR-N shall be forwarded to the Navy Command’s Security Manager at least 30 days prior to the individual’s start date. Failure to provide the required documentation at least 30 days prior to the individual’s start date shall result in delaying the individual’s start date.

The contractor shall ensure that each contract employee requiring access to IT systems or networks complete annual Cyber Awareness training, and maintain a current requisite background investigation. Contractor employees shall accurately complete the required investigative forms prior to submission to the Command Security Manager. The Command’s Security Manager will review the submitted documentation for completeness prior to submitting it to the Office of Personnel Management (OPM); Potential suitability or security issues identified may render the contractor employee ineligible for the assignment. An unfavorable determination is final (subject to SF-86 appeal procedures) and such a determination does not relieve the contractor from meeting any contractual obligation under the contract. The Command’s Security Manager will forward the required forms to OPM for processing. Once the investigation is complete, the results will be forwarded by OPM to the DoD Central Adjudication Facility (CAF) for a determination.

If the contractor employee already possesses a current favorably adjudicated investigation, the contractor shall submit a Visit Authorization Request (VAR) via the Joint Personnel Adjudication System (JPAS) or a hard copy VAR directly from the contractor’s Security Representative. Although the contractor will take JPAS “Owning” role over the contractor employee, the Navy Command will take JPAS "Servicing" role over the contractor employee during the hiring process and for the duration of assignment under that contract. The contractor shall include the IT Position Category per SECNAV M-5510.30 for each employee designated on a VAR. The VAR requires annual renewal for the duration of the employee’s performance under the contract.

BACKGROUND INVESTIGATION REQUIREMENTS AND SECURITY APPROVAL

PROCESS FOR CONTRACTORS ASSIGNED TO OR PERFORMING NON-

SENSITIVE DUTIES

Contractor employee whose work is unclassified and non-sensitive (e.g., performing certain duties such as lawn maintenance, vendor services, etc. ...) and who require physical access to publicly accessible areas to perform those duties shall meet the following minimum requirements:

• Must be either a US citizen or a US permanent resident with a minimum of 3 years legal residency in the United States (as required by The Deputy Secretary of Defense DTM 08-006 or its subsequent DoD instruction) and

• Must have a favorably completed National Agency Check with Written Inquiries (NACI) or T1 investigation equivalent including a FBI fingerprint check prior to installation access.

To be considered for a favorable trustworthiness determination, the Contractor’s Security Representative must submit for all employees each of the following:

• SF-85 Questionnaire for Non-Sensitive Positions

• Two FD-258 Applicant Fingerprint Cards (or an electronic fingerprint submission)

• Original Signed Release Statements

The contractor shall ensure each individual employee has a current favorably completed National Agency Check with Written Inquiries (NACI) or T1 equivalent investigation, or ensure successful FBI fingerprint results have been gained and investigation has been processed with

OPM

Failure to provide the required documentation at least 30 days prior to the individual’s start date may result in delaying the individual’s start date.

* Consult with your Command Security Manager and Information Systems Security Manager (ISSM)/Information Assurance Manager (IAM) for local policy when IT-III (non-sensitive) access is required for non-US citizens outside the United States.

DoD 8570.01-M Information Assurance Workforce Improvement Program.

_____ No Additional IA Certification Required

____X_ Information Assurance DoD 8570.01-M Required:

IA Certification Level: If additional IA Cert is required, it will be detailed at the task order level.

DoD Directive 8570.1 of 15 Aug 2004, Information Assurance Training, Certification, and Workforce Management DoD 8570.01- Manual of 19 December 2005, IA Workforce Improvement Program SECNAV Instruction 5239.3B of 17 June 2009, DON Information Assurance Policy SECNAV Manual-5239.2 of 29 May 2009, DON Information Assurance Workforce Management Manual to Support the Information Assurance Workforce Improvement Program

Computing Environment Certification: If Comp Environment Certification is required, it will be detailed at the task order level.

Privileged system access may be required and detailed at the task order level.

The Contractor shall ensure that personnel accessing information systems have the proper and current information assurance certification to perform information assurance functions in accordance with DoD 8570.01-M, Information Assurance Workforce Improvement Program.

The Contractor shall meet the applicable information assurance certification requirements, including-

(1) DoD-approved information assurance workforce certifications appropriate for each category and level as listed in the current version of DoD 8570.01-M.

(2) Appropriate operating system certification for information assurance technical positions as required by DoD 8570.01-M.

(a) Upon request by the Government, the Contractor shall provide documentation supporting the information assurance certification status of personnel performing information assurance functions.

(b) Contractor personnel who do not have proper and current certifications shall be denied access to DoD information systems for the purpose of performing information assurance functions.

Proof of the above-indicated IA baseline certification is to be provided for all contractor personnel prior to time of engagement. In addition to the IA certificate, active enrollment and participation in the certification maintenance program must be established prior to contract award to ensure the appropriate access can be secured by contractor resources.

All required IA baseline certifications must be current at the contract period start date;

there is no “grace” period to obtain these certifications. Computing environment certification must be current no later than six (6) months after start. Questions and additional information requirements may be addressed by contacting the NAVSUP Business Systems Center Information System Security Manager (ISSM).

Certification shall be forwarded to:

Jacquelin Jamison, Code 94

NAVSUP Business Systems Center ISSM

5450 Carlisle Pike, Bldg. 409

Mechanicsburg, PA 17055

Email: Jacquelin.jamison@navy.mil

11.0 Government Furnished Equipment / Information / Materials

Work is expected to be performed at the government site or offsite, depending on the task order. Contractor is authorized to use government network, computers, copiers, and other equipment assigned in government facilities as needed. The government will provide work facilities to the on-site contractor. The government will provide required computer hardware/software and access to local telephones with voicemail and long distance access when the contractor is acting on behalf of the government at the government site. The government will provide all equipment, tools and servers used to maintain software and host these applications. If the contractor is supporting off-site, the government will provide GFE computers for access to government systems (if needed). Equipment usage forms will be filled out and kept on file for all GFE.

12.0 Qualifications/Experience

In response to task order requirement, the contractor shall provide individuals with the experience and qualifications defined in the task order PWS.

13.0 Non-Disclosure Agreement

Contractor and subcontractor employees performing work under this task order are required to sign a Non-Disclosure Agreement (NDA) as part of their onboarding process. The contractor shall maintain copies of all signed agreements and have the documents readily available at the COR’s request. Refer to DFARS 252.204-7000, Disclosure of Information, and DFARS 252.204-7003, Control of Government Personnel Work Product.

14.0 Other Requirements

Section 508 Compliance

Section 508 of the Rehabilitation Act requires Federal agencies to make their electronic and information technology accessible to people with disabilities. This applies to all Federal agencies when they develop, procure, maintain, or use electronic and information technology.

All electronic and information technology (EIT) procured through this task order must meet the applicable accessibility standards specified in 36 CFR 1194.2, unless an agency exception to this requirement exists. Any agency exceptions applicable to this task order are listed below.

The standards define Electronic and Information Technology, in part, as “any equipment or interconnected system or subsystem of equipment, that is used in the creation, conversion, or duplication of data or information.” The standards define the type of technology covered and set forth provisions that establish a minimum level of accessibility. The application section of the standards (1194.2) outlines the scope and coverage of the standards. The standards cover the full range of electronic and information technologies in the Federal sector, including those used for communication, duplication, computing, storage, presentation, control transport and production. This includes computers, software, networks, peripherals and other types of electronic office equipment.

Privacy Act

During performance of this order, the contractor may have access to Privacy Act data. Should this occur, the contractor shall safeguard all privacy information, and ensure this data is accessed and maintained in accordance with applicable laws and regulations. If access occurs, FAR 52.224-1 and 52.224-2 apply.

Key Personnel

Under this contract, the Contractor may be required to provide Key Personnel, defined as those individuals who contribute to the development or execution of a project in a substantive measurable way. In all task orders that require Key Personnel, the contractor shall notify the Contracting Officer and COR in writing prior to making any change in personnel identified as key for the duration of the task order PWS. Notification will occur no less than 14 days prior to such change. If substitutions are to be made, the contractor shall demonstrate that the qualifications of the prospective person(s) are at least equal to the person(s) replaced.

The Government reserves the right to request substitute contractor support personnel due to unsatisfactory performance, insufficient knowledge, or inadequate skill levels necessary to complete assigned task.

Wid…