PWS (sourced sought draft) - Counterintelligence 2027.pdf

Defense Threat Reduction Agency

8725 John J. Kingman Road, Stop 6201 Fort Belvoir, VA 22060-6201

CUI

Performance Work Statement (PWS) Defense Threat Reduction Agency

8725 John J. Kingman Rd. Mailstop 6201 Fort Belvoir, VA 22060-6201

Counterintelligence Support Services

March 24, 2026

1 Introduction

1.1 Mission

The Defense Threat Reduction Agency (DTRA) enables Department of War (DoW), the U.S.

Government, and International Partners to counter and deter Weapons of Mass Destruction (WMD). DTRA’s J3/5/8 Force Protection (FP) Department, Counterintelligence (CI) Division is responsible for counterintelligence support to DTRA. DTRA counterintelligence programs include Counterintelligence Functional Services, Analysis and Production, Collection Management, CI Cyberspace Support, CI support to the Insider Threat Program, and Technical Surveillance Countermeasures (TSCM) Support.

1.2 Background

This is a non-personal services contract to support DTRA’s J3/5/8 FP CI Division. The Government shall not exercise any supervision or control over contractor personnel performing services under this contract. Contractor personnel will be accountable solely to the Contractor, who in turn is responsible to the Government. The Contractor shall determine methods and tools to achieve performance outcomes. Work under this effort may be performed at various DTRA locations including Kirtland Air Force Base, Albuquerque (ABQ), New Mexico; Travis Air Force Base, California; Kleber Kaserne, Kaiserslautern, Germany; and primarily, the Defense Threat Reduction Agency facilities in the National Capital Region (NCR) area. Further, contract support may be required at locations not specified in this Performance Work Statement (PWS).

1.3 Scope

The Contractor shall provide personnel to perform non-personal counterintelligence support services to assist Government personnel in executing security and counterintelligence functions within the NCR and other DTRA locations. These services support counterintelligence duties and responsibilities within J3/5/8 FP and its geographically separated locations, including:

• Counterintelligence Support to Insider Threat

Counterintelligence Support Services 2027 Performance Work Statement

• Counterintelligence Functional Services (Briefing/Debriefing, Research, Development, Testing and Evaluation (RDT&E), CI support to Supply Chain Risk Management (SCRM))

• Counterintelligence All Source Intelligence Analysis

• Counterintelligence Cyberspace Support

• Full-Stack Developer Support to Counterintelligence

• Collection Management

• Operations Support

• Onsite Lead (performs CI requirements)

• Technical Surveillance Countermeasures (TSCM) Support

Contractor support services are required to achieve the performance objectives in Section 3.0. Ad hoc tasks outside core objectives require a contract modification by the Contracting Officer (KO). All work shall comply with applicable laws, regulations, and directives listed in Section 2.0. Detailed objectives and standards for each functional area are provided in Section 3.0.

2 Applicable Directives

The contractor shall comply with the following directives, publications, and standards to the extent necessary to accomplish the requirements specified in the PWS. The Government will provide all listed publications and forms at the start of the contract period. Publications are current as of February 2026; the Contractor shall monitor updates via official DoD/Intelligence Community (IC) channels and implement changes immediately.

Change Process: The Government will notify the Contractor of additional references or amendments throughout the life of the contract. Supplements issued during the contract period shall be implemented without negotiation. Any changes in cost levied onto the contractor as a result of a supplemental change should be provided to the KO in writing, along with an updated cost proposal, within 10 calendar days following receipt of a supplemental change notification. If needed, negotiations will be held under the FAR 52.243-2 Changes-Cost-Reimbursement clause. Failure to submit a timely notification of supplement driven cost changes entitles the Government to continued performance at no cost increase (waivable by the KO according to paragraph (c) of the Changes clause). The Onsite Lead shall track publication compliance and report updates/amendments to both the Contractor and the KO/CS via email.

https://www.esd.whs.mil/Directives/issuances/dodd/ https://www.whitehouse.gov/presidential-actions/executive-orders/

2.1 Governing Publications

Executive Order (EO) 12968, Access to Classified Information, as amended Executive Order 12333, United States Intelligence Activities, December 4, 1981, as amended (latest: EO 13470, July 30, 2008) Executive Order 13467, Reforming Processes Related to Suitability for Government Employment, Fitness for Contractor Employees, and Eligibility for Access to Classified National Security Information Committee on National Security Systems Directive (CNSSD) 504, User Activity Monitoring (for UAM; current) DoD Directive 3115.18, DoD Access to and Use of Publicly Available Information, August 20, DoD Directive 5105.21, Defense Intelligence Agency, March 18, 2008 DoD Directive 5105.62, Defense Threat Reduction Agency, Change 2, May 1, 2020 (updated from Change 1) DoD Directive 5143.01, Under Secretary of Defense for Intelligence (USD(I)), October 24, DoD Directive 5148.11, Assistant to the Secretary of Defense for Intelligence Oversight, April 24, 2013 DoD Directive 5148.13, Intelligence Oversight, April 26 2017 DoD Directive 5230.20, Visits and Assignments of Foreign Nationals, June 22, 2005 DoD Directive 5240.02, DoD Counterintelligence, March 17, 2015, Change 2, May 16, 2018 DoD Directive 5240.06, CI Awareness and Reporting, May 17, 2011 DoD Instruction 3305.11, DoD CI Training and Certification, August 13, 2015 DoD Instruction 5200.39, Critical Program Information Identification and Protection Within Research, Development, Test, and Evaluation, May 28, 2015, Change 3, March 10, 2022 (updated from Change 2) DoD Instruction 5240.26, Counter Espionage, International Terrorism and the Counterintelligence Insider Threat, May 4, 2015; Change 3, October 2020 (updated from Change 2) DoD Instruction 5200.48, Controlled Unclassified Information (CUI) DoD Instruction 5240.05, Technical Surveillance Countermeasures (TSCM), April 3, 2014, Change 1, April 18, 2018 DoD Instruction 5240.18, CI Analysis and Production, November 17, 2009, Change 3, September 24, 2020 DoD Instruction 5240.19, CI Support to Defense Critical Infrastructure Program (DCIP), January 31, 2014 DoD Instruction 5240.22, CI Support to Force Protection, September 24, 2009 DoD Instruction 8510.01, Risk Management Framework (RMF) for DoD Information Technology DoD Instruction 8520.01, DoD Internet Services and Cyber Operations, March 14, 2014 https://www.esd.whs.mil/Directives/issuances/dodd/ https://www.whitehouse.gov/presidential-actions/executive-orders/

DoD Instruction O-5240.10, CI in the DoD Components, April 27, 2020 DoD Instruction O-5240.24, CI Activities Supporting Research, Development, and Acquisition (RDA), June 8, 2011 DoD Instruction S-5240.17, CI Collection Activities, March 14, 2014 DoD Instruction S-5240.23, “Counterintelligence (CI) Activities in Cyberspace (CICS),” December 13, 2010.

DoD Manual 5240.1-R, Procedures Governing the Activities of DoD Intelligence Components That Affect United States Persons, August 8, 2016 DoD Manual S-5240.05, The Conduct of Technical Surveillance Countermeasures (TSCM), April 23, 2015 DoD Manual 8140.03, Cyberspace Workforce Qualification and Management Program, February 15, 2023 DTRA Instruction 5240.06, CI Awareness and Reporting, March 2, 2026 DTRA Instruction 5240.07, Insider Threat Program, March 10, 2026 Intelligence Community Directive (ICD) 203, Analytic Standards Intelligence Community Directive (ICD) 206, Sourcing Requirements for Disseminated Analytic Products Intelligence Community Directive 705-1, Physical and Technical Security Standards for Sensitive Compartmented Information Facilities, September 17, 2010 Intelligence Reform and Terrorism Prevention Act of 2004 (IRTPA), as amended National Industrial Security Program Operating Manual (NISPOM), DoD 5220.22-M NIST SP 800-53, Security and Privacy Controls for Information Systems and Organizations, Revision 5, September 2020 (for Cybersecurity) The National Security Act of 1947, as amended Presidential Decision Directive/NSC-12 Security Awareness and Reporting of Foreign Contracts, August 5, 1993

General Compliance Requirements:

All personnel and activities shall adhere to these directives, with particular emphasis on cybersecurity (e.g. NIST SP 800-53, RMF), data protection (e.g. CUI, ICD 704), and intelligence oversight (e.g. DoDD 5148.13). The Contractor shall identify and mitigate risks (e.g., compliance gaps, emerging threats) in monthly status reports.

Non-compliance may result in corrective actions, fee reductions, or termination.

Training on key directives (e.g. EO 12333, DoDD 5240.02, DoDI O-5240.10) shall be completed within 30 days of hire, as specified in Section 4.1.

3 Performance Requirements and Objectives

The following performance objectives define the required outcomes for each functional area. Contractor personnel shall achieve these objectives to support DTRA’s counterintelligence mission. Performance will be measured by the quality, timeliness, accuracy, and completeness of deliverables and services, as evaluated using the below listed methods. Unless otherwise stated, positions vacant for more than 60 days, barring coordination and supporting information, will count against their management Contractor Performance Assessment Reporting (CPAR) metric. The Contractor shall provide temporary backfills meeting 80% of qualifications. Backfills must achieve full qualifications within 30 days. All tasks shall meet 95% compliance unless specified;

zero tolerance for security violations (defined as any unauthorized disclosure or non-compliance with Section 2.1 directives, verified by audits).

3.1 Counterintelligence Support to Insider Threat

Contractor personnel shall identify, analyze, and mitigate insider threats to DTRA personnel, technology, infrastructure, information, and facilities through proactive monitoring, reporting, and collaboration, achieving comprehensive threat detection and response.

Required Outcomes:

• Identify and report insider threat indicators from network traffic, system logs, User Activity Monitoring (UAM) data, and other artifacts with 100% accuracy (≥95% true positives in quarterly reviews); complete analytical support, referrals, and inquiry documentation within 72 hours of identification (≥95% compliance).

• Deliver briefings on insider threat to personnel and management with ≥95% positive feedback on clarity and relevance; respond to internal/external information requests within 24 hours (≥98% compliance).

• Maintain effective information sharing with InTP working groups (CI, Personnel Security, Information Technology (J6), Office of General Counsel, Office of Inspector General, and Human Resources (J1) as needed), participating in weekly interactions; submit weekly status reports documenting accomplishments and events (e.g. unauthorized system use, data exfiltration) with 100% on-time delivery.

• Complete required certifications (Insider Threat Hub Operations Course, Detection Analysis Course, Certified Counter-Insider Threat Professional- Fundamental (CCITP-F) within 12 months of hire; submit certificates to COR within 7 days of milestones; apply security/CI/cyber expertise to resolve threats while ensuring 100% compliance with privacy laws (verified annually).

• Utilize UAM solutions per CNSSD 504 for real time analysis and evidence provision, supporting 100% of authorized inquiries; safeguard information per policies, signing NDAs/SOPs upon hire.

3.2 Counterintelligence Functional Services (Briefing/Debriefing, RDT&E, SCRM)

Contractor personnel shall deliver CI briefings/debriefings, support DTRA operational missions and activities, protect Research, Development, Test, and Evaluation (RDT&E) efforts from foreign threats, and provide CI support to SCRM to safeguard DTRA assets, ensuring comprehensive personnel protection and technology security.

Required Outcomes:

• Operate Briefing and Debriefing Centers (BDC) per DoD/DTRA Instruction 5240.06, providing pre/post-travel briefings/debriefings and applying knowledge of foreign intelligence entities (FIE) operations and terrorist modus operandi in preparing briefings and recommendations to travelers, including senior department officials, with 100% coverage for all DTRA travelers.

• Draft, review, and disseminate operation and intelligence information reports (IIRs) within 5 days (≥95% on-time) contributing to national level production.

• Provide CI support to DTRA operational missions and activities and recommend countermeasures for mitigation and countering foreign influence, RDT&E and protect from FIE via Counterintelligence Support Plans (CISP) per DoD O-5240.24 and Program Protection Plans (PPP) per DoDD 5200.39; provide SCRM support including Critical Program Information (CPI)/Critical Research Technology (CRT) identification, training (≥4 sessions/year).

• Conduct Limited Threat Vulnerability Assessments (LTVAs) for test locations/variations (≥15/year), providing recommendations within 72 hours; offer on-site test support (pre/during/post) ensuring 100% protection of personnel/property/information (zero incidents); facilitate interagency liaison (≥6 monthly meetings) with zero unresolved issues.

• Complete CI threat assessment of RD contracts/awards, during source selection process, within 10 business days of receipt for support to RTPSO; manage threat assessments reports with 100% tracking accuracy; deliver tailored CI support to Research, Development, and Acquisition (CIRDA) training.

3.3 Counterintelligence All Source Intelligence Analysis

Contractor personnel shall produce timely, accurate CI analytical products to inform DTRA leadership and the IC on FIE threats, supporting force protection and Weapons of Mass Destruction (WMD) related missions.

Required Outcomes:

• Plan, research, and produce all-source CI assessments addressing FIE threats, delivering 24 short (2-10 pages) and 2 long (5-15 pages) reports annually with 100% compliance to ICD 203 and 206 standards (100% adoption rate); respond to associated requests for information (RFIs) within 48 hours of receipt (≥95% on-time per government or customer driven timelines).

• Publish consumer evaluations for cited intelligence within two weeks of product completion (≥95% on-time) to intelligence producers (≥95% completeness per analytical citation) achieving product usability, accuracy, and delivered on-time.

• Populate and maintain all analytical product records (e.g. evaluations, correspondences) per Standard Operating Procedures (SOP), completing records management archival within 10 days of finalization (≥95% compliance).

• Provide monthly, quarterly, and annual production statistics within five (5) business days post-period (95% on-time delivery).

3.4 Counterintelligence Cyberspace Support

Contractor personnel shall conduct defensive CI cyber activities to detect, identify, and deter cyber threats from FIE and Foreign Terrorist Organizations (FTO), supporting digital forensics examinations, proactive cyber threat hunts, and other defensive CI cyber activities.

• Execute defensive CI Cyber activities per DoDD 5240.02, DoDI S-5240.23, and DTRA standards (100% compliance) using government provided tools (e.g. Splunk, Tanium) for cyber threat hunting and daily foreign cyber activity identification and reporting (≥95% reporting, e.g. operational reports and/or intelligence report); research and analyze emerging cyber-related methodologies and tradecraft used by FIE and FTO. At least one comprehensive trend analysis report shall be submitted monthly, including actionable insights and recommendations.

• Extract and analyze digital evidence from systems using forensic tools (e.g. Encase, FTK, AXIOM, Cellebrite) within 72 hours of receipt, preserving chain of custody (100% documentation, with no instance of compromised evidence integrity); examinations and forensics reports must meet DoW and DTRA standards for accuracy and completeness (within 5 business days of receipt; 48 hours of task completion).

• Support CI Cyber team under Lead direction; brief senior leadership on operational reports and intelligence products; compile and disseminate CI Cyber activities metrics via approved DoW systems and formatting standards (daily/monthly; 95% on-time and accurate).

3.5 Full-Stack Developer Support to Counterintelligence

Contractor personnel shall conduct full-stack development in support of CI systems and databases while maintaining existing applications (e.g. CIMSID, Defense Ready) and developing new features (e.g. Dashboards, Reporting portals, etc.) to meet the evolving DTRA CI mission.

Required Outcomes:

• Execute full-stack development services; perform routine updates, fixes, and optimizations to ensure CI systems and databases remain functional and efficient (≥ 99% uptime and zero vulnerabilities in monthly scans); develop new features and functionalities based on user requirements to improve the application’s capabilities (≥ 1 new feature or functionality upgrade per quarter with approval from DTRA CIO Change Control Board (CCB)).

• Diagnose and resolve technical issues reported by users and provide technical support via DTRA-approved tracking mechanisms (100% reporting compliance; 48 hours resolutions from receipt); comply with DoW cybersecurity standards (e.g. DoDI 8500.01; 8510.01) by collaborating with cybersecurity teams and applying Risk Management Framework (RMF) controls (monthly/quarter security compliance reports; evidence of patch implementations).

• Conduct code review and appropriate testing to ensure application stability and functionality (100% RMF/DoDI 8510.01 compliance; 100% monthly reporting compliance; updated code repositories); maintain and update technical documentation (quarterly), including system architecture diagrams, code repositories, and user manuals (within 48 hours of any approved change).

3.6 Collection Management

Contractor personnel shall manage intelligence reporting to ensure quality timeliness, compliance with IC standards, maintain accurate collection and dissemination processes, and act as primary outreach to counterintelligence functional managers, interagency partners, and counterparts.

Required Outcomes:

• Perform Quality Assurance (QA) and serve as release authority for Intelligence Information Reports (IIRs) and consumer evaluations (≥ 200/year), ensuring facilitation of review and editing among counterparts to publish products within internal established government timelines (≥95% compliance); enforce internal reporting and evaluation standards to maintain ≤2 annual revisions agency wide.

• Deliver weekly IIR production statistics, with formal monthly, quarterly, and annual statistical reports delivered within 5 days following the end of the reporting period (100% on-time); manage intelligence collection requirements (national, DoW, DTRA) and interface with Defense Intelligence Agency (DIA) personnel, responding to taskers weekly (≥95% compliance), and provide formal CI group training at least semi-annually.

• Maintain database roles and accounts, approve DIA authenticated account requests within 24 hours and update information monthly (100% accuracy); disseminate all analytical reports and products to classified networks within 3 days post-coordination, ensuring archival is completed with ≥95% compliance.

3.7 Operations Support Specialist

Contractor personnel shall provide administrative support to ensure efficient briefing/debriefing operations and accurate operational tracking.

Required Outcomes:

• Manage Briefing/Debriefing Center (BDC) inbox/scheduling using current CI briefing/debriefing database (CIBD); print/post daily calendars with 100% accuracy; attend weekly branch/staff meetings.

• Support CI systems and database development; provide training to CI personnel on new features and functionalities.

• Update Learning Management System (LMS)/CIBD for Counterintelligence Annual Awareness and Reporting (CIAR) training attendance and surveys; review/add sign-in sheets weekly and send reports (attendance/stats) to branch chief.

• Provide quarterly/ad hoc stat reports; handle administrative tasks (e.g. printing questionnaires, room scheduling; ≥20 tasks/month) with 100% on-time scheduling/reporting.

• Maintain and schedule BDC and other briefing areas with 100% coverage by assigned agents and usage of space.

3.8 Onsite Lead (Performs CI Requirements)

The Onsite Lead shall provide senior-level oversight, coordination, and management of all contractor personnel and activities while performing hands-on CI tasks to support mission execution (duty split: 49% leadership/oversight, 51% direct CI contribution across functional areas).

• Serve as primary point of contact for Contracting Officer’s Representative (COR)/ Program

Manager (PM), representing Contractor in daily/weekly meetings (≥1/week; 100% attendance) and resolving escalations (personnel issues, task conflicts); oversee team performance with monthly internal reviews/training to maintain ≥95% overall AQL compliance.

• Coordinate resource allocation including surge support (Section 4.2) and ensure no position vacancies exceed 60 days; track/report Full Time Equivalent (FTE) utilization monthly (≥98% billable efficiency); submit quarterly team performance summaries to COR (100% on time).

• Perform direct CI tasks as required (e.g. high-priority Request for Information (RFIs) ≥5/month, briefings ≥10/year, threat assessments, SOP/Policy, tasking application coordinator) achieving outcomes equivalent to specialized roles (100% accuracy); facilitate cross-functional collaboration; maintain currency on new CI requirements and the impact to the Agency’s mission.

3.9 Technical Surveillance Countermeasure (TSCM) Support:

The Contractor shall provide Technical Surveillance Countermeasures operational support, reporting, and program sustainment services in support of Government counterintelligence and protective operations requirements. Services include mission execution (CONUS/OCONUS), time-sensitive response support, deliverables production, data entry to Government systems of record, professional development, and limited administrative support, all in accordance with applicable security and safety requirements.

Required Outcomes:

• Execute TSCM mission activities as required that may include pre-mission coordination, on-site/remote operational execution, out brief, required reporting, and required system of record entries. Zero (0) security violations attributable to contractor actions/omissions.

• Time-sensitive responses to suspected technical device/anomaly/indicator requiring rapid notification and adherence to local incident procedures are escalated promptly and handled consistently with Government direction.

• Mission documentation package (e.g. after-action report) ≥95% completeness and on time.

Provide within 30 business days after completion of mission.

• All deliverables shall be clear, concise, accurate, and conform to Government templates and classification/marking guidance. Enter required mission/event data into the Government designated USD(I) approved system of record within 5 Business Days of the mission or event, unless otherwise directed ≥95% on time entries; ≥98% data accuracy.

• TSCM specific Personnel Qualification, Certification, Recurring Training, and Professional Development requirements refer to Section 4.2.

• Deliver technical threat-based products and provide to the Government as required (≥98% accuracy and completeness) achieving product usability, accuracy, and delivered on time.

• Attend Government-approved conferences, meetings, and working groups to maintain technical currency and represent the program when directed. Contractor shall provide an actionable readout with recommendations and impacts on operations delivered within 10 business days after return (≥90% on time) and accepted first pass (≥95%).

• The Contractor shall comply with OSHA requirements, installation safety rules, and Government directed safety procedures. When required by installation policy or contract terms, shall submit an Activity Hazard Analysis (AHA) (or equivalent) for applicable tasks.

(AHA submitted by the Government required suspense (≥95% on time) and accepted with ≤1 revision cycle (≥95%).

o The Contractor shall use Personal Protective Equipment (PPE) as required by hazard analysis and site requirements. PPE compliance during observed work activities (≥95%).

o The Contractor shall ensure personnel can safely deploy, transport, and operate required TSCM equipment in operational environments, which may include confined spaces, elevated locations, and physically demanding conditions, while maintaining safe work practices and compliance with fall protection requirements where applicable. Zero (0) repeat violations of the same type within a quarter.

Incident/near-miss notification: notify Government within 1 hour and provide written summary within 1 business day (100%).

• The Contractor shall perform travel only when authorized in writing by the COR/KO and in accordance with contract terms. 100% of trips have written COR authorization prior to travel and within limits. Refer to Section 4.3 and 4.4 regarding Insurance and Certifications terms.

Acceptable Quality Levels (AQLs):

Functional Area Key AQL Metrics Measurement Method

3.1 CI support to Insider

Threat Program (InTP)

100% accuracy in assessments

Tracking logs; Quarterly Audits of artifacts

3.2 CI Functional Services 95% reporting quality and

timeliness

Operational reports and Intelligence Information Reports (IIRs)

3.3 CI All Source 95% product quality; 100%

Request for Information

Product and peer reviews;

Intelligence Analysis (RFI) timeliness response trackers

3.4 CI Cyberspace Support 100% Request for Support

(RFS) timeliness

Forensic exams; system logs

3.5 Full-Stack Developer

Support to CI

95% tool uptime and zero vulnerabilities; 100% reporting compliance

System monitoring and maintenance

3.6 Collection Management 100% timeliness; ≤2

revisions annually; 95% reporting quality

Database audits; statistical reports

3.7 Operations Support

Specialist

100% on-time scheduling/reporting

Calendar/database checks

3.8 Onsite Lead 95% team performance Quarterly evaluations

3.9 Technical Surveillance

Countermeasures (TSCM) Support

95% reporting completeness and timeliness; 98% accuracy

Product and peer reviews

4 General Requirements

4.1 Security and Special Considerations

All personnel require TOP SECRET//SCI clearance per ICD 704 and Contract Security Classification Specification (DD Form 254, Section 2.0). Verify and submit clearances via Defense Information System for Security (DISS) prior to assignment (Visitor Authorization Request (VAR) to GQDD614 for SCI and GQDD612 for collateral clearances). Comply with the 32 CFR Part 117 (previously known as the National Industrial Security Program Operating Manual (NISPOM)), and any revisions to that manual. The term of the VAR shall be for the term of the contract. No unauthorized releases of DTRA infrastructure information. CI Polygraphs may be required for positions with SCI clearance; failure may result in removal. The Onsite Lead shall ensure team-wide compliance, track expiration deadlines and coordinate timely renewals when needed.

TOP SECRET//SCI

Counterintelligence Support to Insider Threat Program Counterintelligence Functional Specialists Counterintelligence All Source Intelligence Analysts Counterintelligence Cyberspace Support

Full-Stack Developer Support to CI Collection Managers Operations Support Onsite Lead Technical Surveillance Countermeasures (TSCM) Support

4.2 Training Requirements

Prior to in-processing, all contractors shall complete: North Atlantic Treaty Organization (NATO) brief, Personally Identifiable Information (PII)/Cyber Awareness training and provide certificates to the Onsite Lead, COR, and DTRA Personnel Security (PerSec) staff for in-processing.

All contractors shall complete within thirty (30) days of hire (annually thereafter): Antiterrorism Level I (refresher after initial course), Information Security, Ethics, Operations Security (OPSEC), Counterintelligence Awareness and Reporting (CIAR), Intelligence Oversight, and key Sections 2.1 directives (e.g. EO 12333, DoDD 5240.02, DoDI O-5240.10, DoD 8140.03).

Submit certificates to COR (via Onsite Lead) within seven (7) calendar days. Additional DTRA training at Government expense, if directed.

4.2.1 TSCM, CI Cyberspace Support, and Developer Qualification and Certification Requirements

Contractors shall ensure all personnel performing functions meet the following requirements prior to performing independently:

• TSCM:

o Maintain a current Interagency Training Center (ITC) Practitioner certification (or Government approved equivalent) for everyone performing duties.

Complete minimum of 40 hours of TSCM-related training annually o First Aid/CPR/AED: Maintain current First Aid/CPR/AED certification for personnel as specified by the Government.

o Additional training includes but is not limited to: radiation safety training (required to operate X-Ray equipment), site specific requirements (wildlife safety, protected species), and/or familiarization/operation/maintenance of any new equipment/training essential to complete the mission.

• TSCM, CI Cyberspace Support, and Developer requirement:

o DoDM 8140.03 – Meet and maintain all applicable DoDM 8140 baseline and role-based qualification requirements for assigned duties, as designated by the Government.

• CI Cyberspace Support:

o Complete DoW Cyber Crime Center (DC3) Cyber Training Academy (CTA) Cyber Crime Investigator (CCI) training program

CCI training program consists of Introduction to Networks and Computer Hardware (INCH), Cyber Incident Response Course (CIRC), Windows Forensic Examinations (WFE, and Forensics and Intrusions in a Windows Environment (FIWE).

All training courses are provided on-site at DC3 CTA training facility in Columbia, Maryland.

Attendance and completion of each course shall incur no additional cost to the government. Contractor shall submit completion certificates to COR (via Onsite Lead) within 5 business days.

Report any Questionable Intelligence Activities or Significant/Highly Sensitive Matters per DoDD 5448.13 to CI or Agency Intelligence Oversight (IO) Officer, DTRA Inspector General (IG). Exceptions for skill(s) acquisition within 1 year at no cost to Government.

4.3 Insurance and Certifications

The contractor shall, without additional expenses to the Government, obtain all licenses, insurance, and certifications required to perform the work within or outside the DTRA facilities and shall comply with all applicable federal, state, applicable military installations and local laws. See Clause 52.228-10 for more information regarding vehicle and liability insurance requirements. The contractor shall ensure that all personnel are properly trained and competent to perform the assigned tasks. The contractor personnel operating Government vehicles (GOV) or Government furnished transportation shall have a valid U.S. driver’s license and shall comply with all applicable Fort Belvoir and other DTRA locations, installation, federal, state, and local driving laws. The contractor shall ensure a copy of all training certificates and licenses are kept on file and a copy provided to the COR when the assigned contractor personnel report to work.

All renewals of certificates and licenses must be kept current, and a copy provided to the COR within five (5) business days after renewal. Unless prohibited by circumstances beyond employee control, motor vehicle incidents or accidents shall be reported to the Government within 1 hour.

4.4 Travel Requirements (CONUS and OCONUS)

Travel is primarily conducted by CI Functional Services Specialists and TSCM. CI Functional Services Specialists and TSCM contractors must maintain a valid United States Passport.

Contractor employees may be required to travel up to 50 percent of the time. Contractor employees may be required to travel with less than 48-hours’ notice (short notice) in support of DTRA missions worldwide, that may include high-threat areas. Contractor employees may be required to travel to attend national level conferences, meetings or symposiums in support of DTRA missions or to participate in DTRA exercises or missions. Limited travel may be required for work performed at other DTRA locations and facilities worldwide. Travel will be identified as mission dictates. The contractor is responsible for all medical/immunizations expenses associated with travel to include emergency medical services for and during travel. All travelers must maintain active and up-to-date personal health insurance.

The contractor must obtain approval for all travel outside of local travel area in writing from the COR and track all travel expenses for submission. Unless prohibited, Contractor travel costs incurred outside of the local area, along with associated per diem costs, shall be consistent with the Joint Travel Regulations (JTR). When unable to comply with that threshold, supporting documentation must be provided to the COR/KO for prior approval. .

All travel shall be approved by PM/COR in writing (email is acceptable for short notice travel) in advance.

OCONUS Support:

The contractor, in conjunction with the Command or Agency staff, will make necessary arrangements for required visits and mission support activities.

4.5 Government Furnished Equipment (GFE)/Materials/Facilities

Reasonable Accommodations:

The Government shall provide Sensitive Compartmented Information Facility (SCIF) workspaces, office facilities, equipment (desks, computers, phones, printers), and access will be provided for classified networks for the preparation and storage of SCI data and any SCI document annexes associated with the efforts described in this PWS.

Any accommodation not identified above are the responsibility of the contractor for their personnel in the performance of their job (i.e. special needs such as chairs, wheelchairs and keyboards) and must abide by prevailing Government standards, to include, but not limited to Section 889 compliance.

Contractor Purchased Government Material (GFM):

If the contractor is required to purchase any GFM, all purchases of hardware and software shall be in accordance with (IAW) the procedures of FAR Part 45 and the Defense FAR (DFAR) and COR approval shall be obtained prior to any purchase being made shall be approved to purchases being made, by the COR, and shall be considered Government Property. As such, all care, maintenance, and considerations apply the same as it would for GFE hardware of software.

The contractor shall be liable for government property in their possession pursuant to FAR 52.245-1, as applicable.

Government Furnished Material for Contractor Use On/Off-site:

DTRA may provide Government equipment to the contractor for use onsite and offsite. The contractor shall comply with the contract clauses for accountability of government property in the possession of contractors. The Master Government Property List (MGPL) shall be updated at the time any new equipment is issued to the contractor by the government.

The MGPL shall include all equipment/property provided to the contractor, including equipment transferred between projects, broken and obsolete equipment, and items purchased outside the United States.

Ninety (90) days prior to Contract expiration, the contractor shall submit a final MGPL suitable for closeout purposes containing use/disposition recommendations.

The MGPL shall be delivered electronically in a spreadsheet using Microsoft Office Excel.

Abbreviations are not allowed. (CDRL A007)

4.6 Personnel Requirements

All personnel must be U.S. citizens. The Onsite Lead shall verify team qualifications upon initial hiring and annually thereafter. Positions shall not remain vacant for more than 60days. If a temporary backfill is utilized, the individual must meet 80% of the LCAT qualifications. Backfills must achieve full qualifications within 30 days. The Onsite Lead position shall not be vacant >5 consecutive business days; immediate senior-level backfill required. The Operations Support Specialist position shall not be vacant >2 consecutive business days; immediate backfill required.

4.7 Appearance of Contractor Employees

It is essential that a professional image be projected, and the contractor employees’ attire shall be clean, pressed, and fitted properly. Contractors shall not wear jeans unless approved in advance by the COR. DTRA on-site contractor staff represent DTRA core values to visitors, dignitaries, and civilian, contractor and military colleagues, host as well as other tenant organizations. With the exception of attire requirements for identified special occasions at the geographically separated unit performance location, communicated by the performance location lead, DTRA on-site contractor staff shall be professional, both in demeanor, and appearance, suitably attired, on most occasions in business casual but with a readily available professional attire, and as necessary, adjustments from business casual to business formal shall be expected and met. Any dispute regarding the professionalism of the contractor's on-site staff shall be referred to the COR and contractor's performance location Onsite Lead for immediate resolution.

4.8 Work Environment and Schedules

Place of Performance: Work under this effort may be performed at DTRA’s locations in Kirtland Air Force Base, Albuquerque (ABQ), New Mexico; Travis Air Force Base, California;

Kleber Kaserne, Kaiserslautern, Germany; and primarily, DTRA locations in the National Capital Region (NCR) area. Further, contract support may be required at locations not specified in this PWS. Support requirements may create a need for travel within local areas, Continental United States (CONUS) or Outside Continental United States (OCONUS).

For situational reasons to the benefit of the Agency (such as when the DTRC is physically closed but open virtually), contractor employees, primarily in the NCR, may be permitted to work off-site using Government Furnished Equipment (GFE) with prior PM/COR approval. When working off-site, contractors must use GFE, ensure the GFE is properly working, must use the current messaging application and be reachable via email. Building and workspace access must conform to all security protocols for entry, access & exit/closure. It is the contractor’s responsibility to identify work to be completed during the 8 hour workday. The approved work plan identifying work accomplished/performed will be submitted to the Onsite Lead and COR at the end of each offsite workday. Contractors are not permitted to work from offsite locations without an approved work plan.

During administrative Government closures, employees may request permission to work remotely. If the mission or the tasks assigned to the employee don’t lend themselves to telework, or if the employee requires an onsite secure system access to perform their assigned mission duties, these employees may work chargeable hours at the assigned duty station, in lieu of telework, with advance written COR coordination & approval.

If the employee cannot meet these conditions, the employee shall defer to their company’s policies regarding use of annual leave or admin time on these days.

Government building/base closure due to Weather or National Security is safety matter. In these instances, unless an individual is identified as an excepted employee, then the preceding administrative closure caveat for “allowable” onsite work is rescinded. During a Weather or National Security closure, a contracted employee may be permitted to TW with prior written permission from the COR or they shall defer to their Company’s policies regarding use of annual leave or admin time for the duration of the closure. Only approved TW hours should be charged to the contract.

Alternate Work Location Policy: Guidelines for alternate work locations or telework for contractors in alignment with the administration and reporting requirements related to Government Property as outlined in FAR 45.000 (b)(5).

• Authorization: In coordination with the Onsite Lead and mission requirements, off-site work using Government Furnished Equipment (GFE) may be authorized by the PM/COR if telework schedule differs from current administration guidance.

• Approval Process for extenuating circumstances: Approved work plans for an alternate work location will be situational and dependent on the nature of work, requirements, and pre-established capabilities to perform work (e.g., additional telework over 1 day per work week, holiday falls within work week, etc.)

a) All authorizations require prior COR/PM approval with email confirmation to ensure an official date is associated with the approval, not exceeding 40-hour weeks.

b) Approval may be revoked at any time at the discretion of the COR/PM.

c) Contractors must adhere to all terms and conditions outlined in the approved work plan while working from an alternate work location.

d) The approved work plan identifying work accomplished/performed must be submitted to the Onsite Lead/COR at the end of each offsite workday.

e) Contractors are not permitted to work from offsite locations without an approved work plan on file with COR/PM.

f) Additional situational considerations may be applied/removed at the COR/PM’s discretion without notice.

g) Additional holidays may be observed with prior written COR coordination (non-billable).

4.9 Normal Hours of Operation

Support Hours: The Contractor shall support DTRA Force Protection (FP) operations for the totality of the full-time equivalent (FTE) associated with their labor category. Each employee will propose a standard 8-hour duty day for themselves for approval by the Vendor and the COR. Contractor duty hours shall be scheduled between 0630-1800, Monday through Friday, with daily core hours of 1000-1200. Contractors will not start work before 0630, nor work later than 1800, unless given prior written approval by the COR. If the employee chooses to incorporate a 30 - 60 minute lunch break into their schedule the time allotted for a lunch break shall not be attributed to the FTE hours of a position and will extend the employee’s daily schedule to 8 ½ - 9hrs for the day. This schedule will be the employee’s assigned duty schedule for their performance under this contract unless/until a new schedule is proposed and reapproved by the Vendor and the COR. Contractor employees may temporarily alter the hours of their duty schedule based on work tempo with prior written approval from PM/COR.

Contractors in Key Personnel positions may be required to adjust their duty schedule as necessitated by assigned tasks and/or real world events. Standard work hours shall be Monday through Friday during normal duty hours except for the following Federal Holidays:

Government Recognized Holidays:

New Year’s Day Labor Day Martin Luther King’s birthday Columbus Day President’s Day Veterans Day Memorial Day Thanksgiving Juneteenth Christmas Independence Day

Note 1: During a surge or an adverse event, contractors work hours may change to ensure mission support is required. Hours during these instances may cover day, night and swing shifts (e.g., 0600

– 1430 or 1800 – 0230)

4.10 Other Direct Costs (ODCs)

ODCs are reimbursable costs for items not provided as GFE, supporting performance (per FAR

31.205 and DFARS 231.205).

Allowable ODC Category

Examples Annual Cap Approval Process

Specialized Tools/Software

Commercial forensic tools (e.g. AXIOM);

software licenses

≤$500K COR (30 days pre-purchase) + KO approval over annual cap

Personal Protective Equipment (PPE)

(Reference Section

3.9 TSCM)

E.g. Boots, hard hats, etc.

≤$10K COR provisional; KO final for recurring; Contractor shall provide cost estimate prior to purchase

Training and Certification

(Reference Section 4.2.1)

Certification exam fees for team

≤$10K COR provisional; KO final for recurring; Any additional DoD or required government training/certification associated with successful performance of role, that is not a pre-requisite for employment, will be considered for reimbursement.

ODC Guidance: Submit requests to COR (via Onsite Lead) 30 days pre-purchase with justification, cost estimate, and alternatives. No ODCs for general overhead. Track via monthly ODC reports (Excel with receipts, due on the 10th of following month). Reimbursement:

Actual/allowable costs with 5% admin fee cap; audit rights per FAR 52.216-7. The Onsite Lead shall certify ODC requests for necessity and compliance. (CDRL A008)

5 Quality

5.1 Quality Assurance Surveillance Plan (QASP)

The Government shall evaluate the contractor’s performance under this contract IAW the Government’s Quality Assurance Surveillance Plan (QASP). This plan is primarily focused on what the Government must do to ensure that the Contractor has performed IAW the performance standards. The QASP identifies the standards for completeness, reliability, accuracy, timeliness, and quality and how the standards will be assessed. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable quality level(s). For those tasks listed on the Acceptable Quality Level (AQL) table, the Government COR or evaluators will follow the methods of surveillance specified in the QASP and record all surveillance observations. When an observation indicates defective service performance, and requests corrective action from the contractor, the COR will require the contract manager or representative at the site to approve the observation. The initialing of the observation does not necessarily constitute concurrence with the observation, only acknowledgment that he or she has been made aware of the defective performance, the contractor shall notify the COR in writing within 24 hours of correction of a discrepancy. If deficiencies are not corrected within the required time frame, COR shall notify the KO for action. Government surveillance of tasks not listed in the AQL or by methods other than those listed in the QASP (such as provided for by the Inspection of Services clause) may occur during the performance period of this contract. Such surveillance will be done according to standard inspection procedures or other contract provisions. Any action taken by the KO as a result of surveillance will be IAW the terms of this contract.

5.2 Monthly Status Meetings

Regularly scheduled meetings shall be held monthly with the PM, COR, KO, Contract Specialist (CS) and all pertinent personnel from the Vendor’s staff (i.e. – onsite lead(s), contract management, finance, etc.). These meetings will provide an opportunity for all parties to address performance successes, challenges and any potential upcoming changes in staffing or contract elements. Meetings may be cancelled due to unforeseen conflicts but should resume as regularly scheduled as soon as possible. Written minutes of the monthly meetings will be recorded and included in the contract file. The COR, KO/CS and Vendor will have an opportunity to comment on the meeting minutes before they are finalized and signed by the KO or contract specialist. The COR and the Vendor need not wait for these meetings to correspond directly about performance concerns. The KO and/or CS shall be included in all direct correspondence so they can maintain situational awareness of contract performance.

5.3 Performance Evaluation Meetings

The KO may require the Onsite Lead and/or Site Lead Alternates to meet with the KO, CS, COR, and other Government personnel as deemed necessary. The contractor may request a meeting with the KO when he or she believes an additional meeting is necessary. Written minutes of any such meeting must be recorded in the contract and signed by the contract manager and the KO or CS. If the contractor does not concur with any portion of the minutes, such non-concurrence must be provided in writing to the KO within seven (7) calendar days following receipt of the minutes.

5.4 Transition

Transition Plan (CDRL A005): The Contractor shall develop and execute a comprehensive transition plan (CDRL A005) starting three (3) months prior to contract expiration, covering both onboarding (post award) and outgoing (pre-expiration) transitions. The plan ensures ≤5% downtime in critical functions (e.g. reporting, briefings) and zero security breaches during handoff. The Contractor shall lead transition coordination with the incoming Prime by holding formal weekly meetings starting ninety (90) days prior to contract expiration or upon execution of any follow-on contract, whichever comes later.

Required Transition Elements shall include, but are not limited to:

a) Knowledge Transfer: Document and transfer specific knowledge (e.g. CI processes, tool configurations, ongoing assessments) to successor Contractor or Government; up to 2 weeks overlap shadowing for Key Personnel (e.g. Onsite Lead, TSCM, etc.)

b) Service Continuity: Review, evaluate, and transition current support services (e.g. databases, workflows) ensuring continuity for all functional areas (Section 3.0); ≥95% knowledge transfer satisfaction per successor feedback survey.

c) Data and Documentation: Transition of historic data to successor per ICD 704 for classified materials; transfer all business/technical documentation (e.g. SOPs, MGPL, etc.) with ≤2 business days for system access handoff.

d) Asset Management: Disposition of Contractor-purchased Government-owned assets; transfer GFE/GFI with inventory assistance per Section 5.0; full asset reconciliation within 15 days post transition.

e) Security Handover: Turn-in all…