PWS v20MAR25.pdf

DRAFT

PERFORMANCE WORK STATEMENT

Cloud Tenant Infrastructure Support Team

Part 1 General Information

1. GENERAL

1.1 Background. The mission of the Defense Finance and Accounting Service (DFAS) is to lead the Department of Defense (DoD) in finance and accounting by ensuring the delivery of efficient, exceptional quality pay and financial information. In 1991, the Secretary of Defense created DFAS to reduce the cost of DoD finance and accounting operations and to strengthen financial management through consolidation of finance and accounting activities across the department. DFAS performs finance and accounting operations at 10 geographically dispersed offices with a civilian workforce of approximately 12,455 personnel.

In fiscal year (FY) 2022, DFAS:

• Processed 135.6 million pay transactions (6.5 million people/accounts)

• Made 6.2 million travel payments

• Paid 13.7 million commercial invoices

• Maintained 110.5 million General Ledger accounts

• Managed $1.08 trillion in Military Retirement and Health Benefits Funds

• Made $558 billion in disbursements to pay recipients

• Managed $542 billion in Foreign Military Sales (reimbursed by foreign governments)

• Accounted for 1,347 active DoD appropriations

The vision of DFAS is to be a recognized leader in DoD's financial management by consistently delivering first-class service and products. Providing effective and efficient information processing tools and services is key in achieving DFAS’ vision.

The DFAS Payroll Services (PS) Directorate provides critical support in the execution of the DFAS mission of providing accurate and timely payments to 2.9 million military retirees and their eligible surviving beneficiaries.

The Defense Retired and Annuitant Pay System (DRAS)information system provides accurate and timely Pay services for Military service members, retirees and annuitants. To improve the overall quality of DoD financial management through modernization, elimination of redundancies and consolidation of mainframe submodules of the current legacy DRAS hosted mainframe system, the resulting DRAS-Modernization (DRAS- M) information system will be hosted within a commercial Cloud Service Provider (CSP).

1.2 DRAS-M Tenant Environment

1.2.1 Secure Cloud Computing Architecture (SCCA): DFAS is a Dept of Defense organization and DFAS DRAS-M is an Impact level 5 information risk, and all security controls need to be implemented for Default Deny, Auditing and Incident Response. A standard approach for boundary and application hosted in commercial cloud environments is mandated that include Agency use of a Cloud Access Point, currently in the DFAS Blue Cloud Environment, a Virtual Data Center Security Stack, a Virtual Data Center Managed Services, and an ability to implement the DoD Trusted Cloud Credential Manager, ICAM. DFAS DRAS-M can achieve a cost savings and decreased cyber risk through leveraging of existing and tested ‘Landing Page’ for the DFAS Blue Cloud Environment. The required Cyber Security Service Provider (CSSP) is DFAS CSSP. The current agency cloud instance has an environment with firewalls, load balancing, development, test and production enclaves and it houses the DFAS CSSP Sentinel environment.

1.2.2 High Level DRAS-M Architecture. The DRAS-M leverages a DoD contract for commercially hosted, GovCloud, DoD IL-5 complaint tenant architecture. The separate DRAS-M Tenant connects to the DoD NIPRnet from behind DFAS BCAP and agency landing page, and consists of interconnected subscription supporting 6 virtual networks:

Environment Subscription VNET IP Development Development Environment Dev VNET Internal Test Test Environment Test VNET Internal Production Production Environment Prod VNET Internal Troubleshooting Production Environment Troubleshooting VNET Internal Customer Acceptance & Testing Production Environment Customer Acceptance& Testing VNET Internal Infrastructure & Security Management Environment Infrastructure & Security VNET Internal DMZ DMZ Environment DoD DMZ and P-DMZ DoD IP

The VNET will host Java applications with Oracle backends databases accessed via front facing Web servers, supported through Infrastructure as Code (IaC) and DevSecOps process and its internal hosted code repository.

Infrastructure will implement a combination of Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS) to implement appliances such as servers, file storage, workstations, routers, firewalls, switches, web caching and bandwidth compression devices, Intrusion Detection Systems (IDS), Intrusion Prevention System (IPS), and other equipment documented in a Detailed Design Document available following contract award. Network connectivity is provided utilizing Transmission Control Protocol / Internet Protocol (TCP/IP) suite via the NIPRNet. DFAS employees and contractors will utilize DFAS owned equipment which connects to the NIPRNet, and DRAS-M Privileged users will access the DRAS-M Tenant via virtual desktops hosted within the CSP’ tenant to manage the environment.

The DRAS-M ISSM is responsible for conducting the Incident Response within the DRAS-M Tenant , but the DFAS Cyber Security Service Provider (CSSP) is the CSSP of record and will be involved in coordination of cyber events at the agency level.

The DFAS Cloud Program Management Office (DFAS CPMO) has management and ownership of all agency network, firewall, and most CSSP services for the DFAS land page site though which the DRAS-M Tenant is accessed. DRAS-M will utilize the DFAS CSSP security vulnerability scanning services within its production environment, but has responsibility for tracking and remediation of identified vulnerabilities. DRAS-M is responsible for security vulnerability scanning within its DevSecOps environments. DRAS-M is responsible for ensuring host based security software is deployed within its Tenant with logging to the DFAS CSSP.

1.2.3. High Level Service Tiers:

• Application: The Application tier contains standard DFAS workstation images for the virtual desktops, DevSecOps software, and operation of applications hosted on IaaS and containers to include, Java, Oracle and Cognos

• Server: The Server tier consists of both IaaS and containers consisting of Red Hat Linux operations systems.

• Storage: DRAS-M will utilize SaaS storage including CSP’s blob storage and individual data storage for each IaaS or container.

• Network: The Network tier contains virtual communications networks and systems including PaaS and SaaS appliances for network routing, switching, load balancing and caching capabilities.

• Security: The Security tier contains technology capabilities and procedures for secure operation and monitoring of the DRAS-M infrastructure at both the network and host-based level.

• Network Management: The Network Management tier consists of technology capabilities and procedures for remotely managing and monitoring the DRAS-M infrastructure. DFAS DRAS-M will require the use of CSP hosted virtual desktops to manage the environment, and other cloud native applications like web gateways and storage.

1.2.4. High Level Tools:

1.2.4.1 Data Access Management (DAM) security platform which will:

• Implement Zero Trust and enforce RBAC for cell , column and row access.

• Implement data Tagging and data loss prevention

1.2.4.2. Disaster Recovery capability includes live duplication of Oracle Database to a warm site

1.2.4.3. DevSecOps and development of Infrastructure as Code (IaC) within the cloud environment through containerized orchestration of development and automated workflow release to enforce compliance with DoD IL- 5 controls. DRAS-M will be implementing DevSecOps and needs internal code repository and access to DAST and SAST. DoDI 8580.01 (2004) directs cyber security to be “fully integrated into all phases of their acquisition, upgrade, or modification programs, including initial design, development, testing, fielding, and operation.

1.2.4.4. DRAS-M Tier I, II and III must use the DFAS Information Technology Service Management (ITSM) system, the DFAS instance of ServiceNow, as the NIPR hosted ticketing system.

1.2.4.5. DRAS-M architecture consists of SaaS solutions including the CSP’s Blob storage, individual File storage for all containers and IaaS Servers, and large object storage.

1.2.4.6. Security: DFAS DRAS-M as a DoD organization is required to conduct a defense-in-depth approach that incorporates support 100% monitoring for audit and cyber compliance. This includes but not limited to:

1.2.4.6.1. RBAC for system access control and Network ‘Default Deny’

1.2.4.6.2. SaaS security tools and local endpoint security

1.2.4.6.3. Implementation of endpoint tagging (DATT) for all hosts/containers

1.2.4.6.4. Implementation of Logging to the DFAS CSSP Security Event Integration Manager (SEIM)

1.2.4.6.5. Implementation of Zero Trust for all access including service account to Database and API calls

1.2.4.6.6. DevSecOps cyber tools within agency's DFAS Blue Cloud Hosted environment which include SAST tools, and the DAST tools

The expectation is the DRAS-M architecture may change as directives and the mission evolves but the emphasis on protecting the data and enterprise identity management will continue to have a high impact on the architecture.

1.3 Objectives. DRAS-M is seeking a contract for personnel to conduct Operation & Management (O&M) of the DRAS-M’s IL-5 cloud hosted Tenant infrastructure.

In addition to meeting project objectives, the contractor shall:

• Consistently take steps to understand the business issues and opportunities of DRAS-M and how they are supported and affected by the services associated with this T.O.

• Ensure delivery of required products and services in accordance with (IAW) the Performance Requirements Summary (PRS) and Performance Work Statement (PWS).

• Work collaboratively with other contractors, Government representatives, and business partners to achieve T.O. objectives.

• Resolve the complexities and difficulties characteristic of implementing, integrating, supporting, maintaining, and securing the resources and services provided under this T.O.

• Continuously and proactively improve the services required with this T.O. and the associated business value through innovative support and service in coordination with the Contracting Officer’s Representative (COR).

• Establish and maintain a collaborative working relationship with DFAS affording continual process improvements.

• Recommend ways to improve the DRAS-M mission, enhance customer satisfaction, and reduce cost.

• Continuously improve performance, reliability, security, and cost reduction of the services provided throughout the T.O. period of performance.

• Be flexible in meeting dynamic DRAS-M requirements.

• Provide a management information system that provides accurate information, in coordination with, and when requested by the COR, concerning the services being provided, the measurement of those services against defined service level agreements, and the prices associated with those services.

1.4 Scope. The contractor shall provide the following personnel for the following mission:

Task Area 1 Management

DCWF

IT Plain Text Role

# of pers hours

Mission Billet

Project Manager

Business

Responsible for ensuring System Managers’ priorities in financial resources and Security support the continued wholistic operational effectiveness of the information system and the effective cyber defense of the data.

628/632

Cloud Infrastructure Engineers/ SW Cloud Architect

Maintain the deployed IL-5 cloud architecture, leveraging Infrastructure as Code (IaC) to automate the deployment and scaling of secure environments. Lead efforts in managing the cloud hosted infrastructure for DRAS-M, integrating the CSP support with DRAS-M support, implementing Zero Trust frameworks, ensuring vulnerability assessments are integrated throughout, validating endpoint security intrusion detection within IL-5 networks.

Cloud Security Engineer

Develop and implement security designs for new and existing systems.

Maintain the defense in depth of the 5 cloud architecture, leading efforts in configuring Web Application Firewalls (WAF), intrusion detection systems, and endpoint protection platforms within IL-5 networks.

Leveraging automated endpoint behavior, the enforcement of the Zero Trust frameworks, continuous vulnerability assessments, and endpoint security. Ensures ISSM has the process and resources to defend the Information System, and Provide technical guidance on security controls and mitigations.

Task Area 2 Core Infrastructure Support

DCWF IT Plain Text Role # of pers hours Mission Billet

441/444

Network Operations Specialist (Tier II and III)

24/7

Maintain the DoD Zone Firewalls and segmented virtual networks, Maintain the six virtual networks spanning Development, Test, Customer Acceptance, Troubleshooting, Production, and Security Infrastructure. Tier II and III Technicians with specialized skills for DRAS-M Tennent network issues identified by Technical Support Specialist, via DFASNOW. Coordinate with DBCE Network Architecture team for BCAP and DMZ issues. Coordinate with CSP for network PaaS and SaaS network support issues.

System Administrator (OS) (Tier II and III) environments in IL-5 cloud environments and ensure IA compliance.

Tier II and III Technicians with specialized LINUX skill support IaC deployment of containers and IaaS Linux appliances, and support the deployments of the Java and Oracle on these appliances. Supports the DRAS-M Container and IaaS Linux issues identified by Technical Suport Specialist, via DFASNOW.

System Administrator (COGNOS) (Tier II and III) on call

Maintain the COGNOS server that supports DRAS-M reporting and ensure IA compliance. Supports DRAS-M COGNOS reporting issues identified by Technical Support Specialist, via DFASNOW.

System Administrator (WEB) (Tier II and III)

Administer secure server operating systems and Web Server infrastructure and ensure IA compliance. Tier II and III Technicians with specialized Web Admin experience support IaC deployment of the Web Servers. Coordinates with DRAS-M Network support to handle connection issues of customers like GEX platform of individuals identified by Technical Support Specialist, via DFASNOW.

Database Administrator (Tier III) on call

Maintain the high-availability Oracle databases, ensuring optimal performance and compliance with DoD IL-5 standards. Tier II and III Technicians with specialized Oracle skill support IaC deployment on IaaS Linux appliances, support DRAS-M Oracle Database managers database interactions with Java Application. Supports DRAS-M Container and IaaS Linux issues identified by Technical Support Specialist, via DFASNOW.

Technical Support Specialist (help desk/Tier I)

Tier I support for DRAS-M incident reporting and initial troubleshooting for System access, application, database and AVD issues. Leverage DFASNOW for Trouble tickets, routed to Tier II and III Technicians with specialized skills for more complex issues.

Task Area 3 Cyber Security Infrastructure Support DCWF IT Plain Text Role # of pers hours Mission Billet

541/461

Vulnerability Assessment Analyst (VAA)/System Security Analyst

Conduct and oversee vulnerability assessments, via automated vulnerability assessment tools, that DoD IL5 compliance is integrated within the software development lifecycle. Develop and recommend to the ISSM risk mitigation strategies to address vulnerabilities. Works with developers to ensure security patches are integrated into system design as directed by the ISSM.

DevSecOps Specialist

Works with DFAS DevSecOps teams to ensure that the provided automated CI/CD pipelines support the DRAS-M ability to develop, maintain and deploy secure code, Responsible for ensuring the DRAS-M developers integrate security into the software development lifecycle, to deploy secure applications across multiple virtual networks, and implementing Zero Trust methodologies

Cyber Defense Instructure Support

Works with the Security Engineer to supports the ISSM with continuous monitoring, compliance, security assessments. Coordinate with DFAS CSSP to manage and administer the updating of rules and signatures (e.g., intrusion detection/protection systems, anti-virus, and content blacklists) for specialized cyber defense applications. Will leverage the organic CSP cyber defense applications and systems (e.g., anti-virus, audit and remediation) or Virtual Private Network (VPN) devices, to include installation, configuration, maintenance, backup and restoration.

total 23

The contractor’s services shall be firm fixed-price (FFP) and labor hours (LH) and meet the acceptable levels of performance (ALP) as forth at technical exhibit 1. LH will be used for Program & Project Management, Core Infrastructure and Cyber Security Infrastructure support and be capped annually at 5% of the annual contract cost.

LH is used for surge support that falls outside normal DRAS-M Tenant operations.

1.4.1 Project Management Support. The contractor shall provide project support under this T.O. This includes management and oversight of all activities performed by all contractor personnel to satisfy the requirements identified in this PWS. The contractor shall identify a Project Manager (PM), one of the key personnel by name, who shall provide management, direction, financial reporting, quality assurance, and leadership of the execution of this T.O.

See section 5.5 for further details on Project Management Support requirements.

1.4.3 Core Infrastructure Support Services. Provides functionality, reliability, and efficiency of cloud-based infrastructure, services, and systems in the cloud environment. The duties encompass a wide range of activities, including monitoring and managing cloud resources. Responsible for leveraging DevSecOps process and deploying Infrastructure as Code (IaC), ensuring STIG compliant and effective hardening of resources using the latest IL-5 approved cloud native services or tools and though collaboration with Cyber Security Infrastructure Support.

Functional areas include:

• Network performance and Security

• Database performance and Security

• IaaS and Containerized Appliance performance and Security

• 24/7/365 Break Fix of all DRAS-M infrastructure

• Disaster Recovery and Continuity of Operations (COOP)

• Implementation of new DRAS-M infrastructure

• Account Creation

• Emerging Technology and Process Improvement

1.4.4 Cyber Security Infrastructure Support Services. Integrated into O&M activities for threat protection and domain-specific expertise for DoD IL5 policy development and guidance. This team should drive security audit, including monitoring and managing cloud resources, Risk Management Framework (RMF) and incident response. Conducts collaboration with Core Infrastructure Support to ensure leveraging DevSecOps process and Infrastructure as Code (IaC) are used with the latest IL-5 approved cloud native services or tools.

Functional areas include:

• 24/7/365 logging to DFAS SEIM through continuous monitoring and improvement of security postures.

• 24/7/365 Respond to and investigate cloud security incidents.

• Implement and manage cloud security tools including End Point Security Systems

• Vulnerability Scanning Analysis

• DevSecOps principles to deliver reliability, scalability, and security

• Cyber Security Log Monitoring

1.5 Period of Performance: The anticipated period of performance shall be for one (1) Base Year of 12 months and four (4) option years of 12 months each.

1.6 General Provisions

1.6.1 Recognized Holidays. May include additional holidays as authorized by the President of the United States.

New Year’s Day Labor Day Martin Luther King Jr.’s Birthday Columbus Day President’s Day Veteran’s Day Memorial Day Thanksgiving Day Independence Day Christmas Day Juneteenth

1.6.2 Hours of Operation: The contractor is responsible for conducting business between the core hours of 8:30 a.m. and 3:00 p.m., observing Government flex hours of 6:30 a.m. to 5:00 p.m., Monday through Friday except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. The contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS. Core Infrastructure support personnel are required 24/7 to perform operations support. Some positions and project work may require a specific schedule or disallow flexible hours. Vacancies must be filled within 30 days of the contracted employee’s departure. Extended absences of 90 days or more will require backfill of that position even if the contractor returns to the contract after the extended absence.

1.6.2.1 Extended/Emergency Hours: When mission needs dictate, at the request of or upon coordination with the COR, Contracting Officer Representative (COR), or Technical Point of Contact (TPOC), the contractor staff shall be available outside facility duty hours (i.e. will work nights and weekends) to support the types of work described within this PWS.

1.6.3 Place of Performance: The contractor shall support DFAS Continental United States (CONUS) DFAS Sites for support include the following: Bratenahl, OH; Cleveland, OH; Columbus OH; and Indianapolis, IN

1.6.3.1 The following contract functions are deemed critical with the required contractor onsite work performance location as indicated:

• Project Manager (primary and alternate): Indianapolis, IN

• Cloud Infrastructure Engineer: Indianapolis, IN and/or Bratenhal, OH

• Cloud Security Engineer: Indianapolis, IN

• Tier II or III Infrastructure Support: Indianapolis, IN and/or Bratenhal, OH

• Technical Support Specialist (help desk): Indianapolis, IN; Bratenhal, OH; and/or Columbus, OH

• Vulnerability Assessment Analyst: Indianapolis, IN; Bratenhal, OH; and/or Columbus, OH

• Cybersecurity Defense Infrastructure: Indianapolis, IN; Bratenhal, OH; and/or Columbus, OH

• DevSecOps Support: Indianapolis, IN; Bratenhal, OH; and/or Columbus, OH

1.6.3.2 The contractor shall provide remote support as needed for DFAS sites using contractor personnel located at the onsite work performance locations identified in 1.6.3.1.

1.6.3.3 Contractor personnel may, on limited occasions, travel to DFAS sites with DRAS-M to provide support that cannot be provided remotely.

1.6.3.4 Place of performance for key personnel identified in section 5.5.6.2 is either Indianapolis, IN or Bratenhal, OH

1.6.3.5 The Contractor may be authorized to work from a remote location when it is advantageous to the DFAS mission. This must be coordinated and approved in advance by the COR and the Technical Point of Contact (TPOC). Note: All work involving classified information must occur in appropriately designated areas within DFAS facilities. Work involving classified information will not take place at the contractor facility or remote locations.

1.6.4 Post Award Conference/Periodic Progress Meetings: The contractor agrees to attend any post award conference convened by the contracting activity or designated contract administration office IAW Federal Acquisition Regulation Subpart 42.5. The Contracting Officer (CO), COR, and other government personnel, as appropriate, may meet periodically with the contractor to review the contractor's performance. At these meetings the CO will apprise the contractor of how the Government views the contractor's performance and the contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the Government.

1.6.5 Contracting Officer Representative (COR): The COR will be identified by separate letter. The COR and TPOC monitors all technical aspects of the T.O. and assists in contract administration. The COR and/or TPOC is authorized to perform the following functions: assure the contractor performs the technical requirements of the T.O.; perform inspections necessary in connection with T.O. performance; maintain written and oral communications with the contractor concerning technical aspects of the T.O.; issue written interpretations of technical requirements, including Government drawings, designs, and specifications; monitor contractor's performance and notify both the Contracting Officer and contractor of any deficiencies; coordinate availability of Government furnished property; and provide site entry of contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates, or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting T.O.

1.6.6 Quality Assurance Surveillance Plan. The government will evaluate the contractor’s performance under this T.O. IAW the Quality Assurance Surveillance Plan (QASP). This plan is primarily focused on what the Government will do to ensure the contractor performed IAW the performance standards. The QASP defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable level of support. Attached, as Technical Exhibit 1, is a Performance Requirement Summary, which sets forth the tasks, results, acceptable level of performance and surveillance method. Unless indicated otherwise, the rating period will be every 12 months (annually) via input into the Contractor Performance Assessment Reporting System (CPARS) with formal monthly status reports on progress.

1.6.7 Contractor Travel: Performance under this T.O. may require travel by contractor personnel to assist with information gathering, system problem identification or resolution, testing of software releases, and software installation. The Government will reimburse the contractor for allowable travel cost incurred by the contractor in performance of the T.O. IAW Federal Acquisition Regulation (FAR) Subpart 31.205-46.

Travel must be approved by the COR in advance of travel.

1.6.7.1 Travel, subsistence, and associated labor charges for travel time are authorized for travel beyond a 50-mile radius of the local office, whenever a task assignment requires work to be accomplished at a temporary alternate work site. No travel, subsistence or associated labor charges for travel time shall be charged for work performed within a 50-mile radius of the Contractor’s local office, normal work site, or temporary work site unless approved in advance by the COR. Authorized travel must exceed twelve (12) hours for entitlement to per diem. Under no circumstances will costs be reimbursed for travel performed for personal convenience and daily travel to and from the normal work site, to include parking expenses. A contract line item number (CLIN) will be used for contractor travel reimbursement.

1.6.7.2 Relocation costs and travel costs incident to relocation are not allowable and will not be reimbursed hereunder. All travel requires Government approval/authorization and notification to the COR.

1.6.8 Organizational Conflict of Interest: Contractor and subcontractor personnel performing work under this contract may receive, have access to, or participate in the development of proprietary or source selection information (e.g., cost or pricing information, budget information or analyses, specifications or work statements, etc.) or perform evaluation services which may create a current or subsequent Organizational Conflict of Interest (OCI) as defined in FAR Subpart 9.5. All contractor personnel will sign a non-disclosure agreement (NDA) prior to working functions under this T.O. The contractor shall notify the Contracting Officer immediately whenever it becomes aware that such access or participation may result in any actual or potential OCI and shall promptly submit a plan to the Contracting Officer to avoid or mitigate any such OCI. The contractor’s mitigation plan will be determined to be acceptable solely at the discretion of the Contracting Officer and in the event the Contracting Officer unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the Contracting Officer may elect other remedies as he or she deems necessary, including prohibiting the contractor from participation in subsequent contracted requirements which may be affected by the OCI. Contractor personnel will sign a NDA prior to engagement on the T.O.

1.6.9 Section 508 Compliance: Unless the Government invokes an exemption, all Electronic and Information Technology (EIT) products and services proposed shall fully comply with Section 508 of the Rehabilitation Act of 1973, per the 1998 Amendments, and the Architectural and Transportation Barriers Compliance Board’s Electronic and Information Technology Accessibility Standards at 36 C.F.R. §1194. The contractor shall identify all EIT products and services proposed, identify the technical standards applicable to all products and services proposed, and state the degree of compliance with the applicable standards. Additionally, the contractor shall clearly indicate where the information pertaining to Section 508 compliance can be found (e.g., contractor’s or other’s exact web page location). The contractor shall ensure that the list is easily accessible by typical users beginning at time of award.

1.6.9.1 The contractor shall ensure that all EIT products and services proposed that are less than fully compliant are offered pursuant to extensive market research, which ensures that they are the most compliant products available to satisfy the solicitation’s requirements.

1.6.9.2 If any such EIT product or service proposed is not fully compliant with all of the standards, the contractor shall specify each specific standard that is not met, provide a detailed description as to how the EIT product or service does not comply with the identified standard(s), and shall also indicate the degree of compliance.

1.6.10 Identification of Contractor Employees: All contract personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. They shall also ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed. Contract personnel will be issued a Government Common Access Card (CAC) identifying them as a contractor after favorable security adjudication. Contractor employees shall wear a CAC at all times while in the facility.

1.7 Security Requirements:

1.7.1 General Requirements. Contractor personnel must meet the following conditions of employment.

1.7.1.1 Must be a U.S Citizen or National.

1.7.1.2 Registered for Selective Service (males born after 12-31-1959). A Status Information Letter is required for any male born after 12-31-1959 that is not registered with Selective Service.

1.7.1.3 This is a national security position, which may require access to classified information, requires a favorable fitness review and security clearance as a condition of employment. Failure to maintain security eligibility may result in termination.

1.7.2 Facility Security Clearance Requirements: The contractor must possess a Facility Security Clearance at the classification level of Secret prior to work performance.

1.7.3 Personnel Security Investigation (PSI) Requirements:

1.7.3.1 Contractor personnel will require, except for the roles mention in the 1.7.3.1.1 and 1.7.3.1.2, Secret security clearance based on a favorably adjudicated Tier 3 (or equivalent) Noncritical-Sensitive (formerly IT-II) or higher-level Investigation granting National Security eligibility. Contractor personnel must also have current enrollment (within 5 years) in the Continuous Vetting program, in accordance with Trusted Workforce 2.0 standards prior to work performance. The contractor company is responsible for obtaining required investigations and security clearances for their employees performing on this contract. IAW standard DFAS Personnel Security policy, ALL incoming contractors must submit a new set of fingerprints (taken within the last 30 days) *.

1.7.3.1.1 Project Management Support contractor personnel, at a minimum, will require IT-II access based on a favorable Tier 3 (T3) investigation, or National Agency Check, Local Agency Checks and Credit Check (NACLC) investigation, or equivalent Periodic Reinvestigation prior to work performance.

1.7.3.1.2 The following positions will require IT-I access based on a favorable and current (within 5 years) Tier 5 (T5) investigation, or Single Scope Background Investigation (SSBI), or equivalent Periodic Reinvestigation (PPR; SBPR) prior to work performance.

1.7.3.1.2.1 Tier II and III Infrastructure Support

1.7.3.1.2.2 Cloud Infrastructure Engineer

1.7.3.1.2.3 Cloud Security Engineer

1.7.3.2 Contractor personnel must apply for a fingerprint appointment immediately (the next business day) upon award date.

1.7.3.3 Contractor personnel shall submit the Contractor Request for Investigation (CRI) (DFAS Form 9035) immediately (the next business day after providing fingerprints) to the Contracting Officer Representative (COR).

The information needed in the Declaration for Federal Employment (OF-306) shall also be submitted to the COR by contractor personnel.

1.7.3.4 The COR will submit the OF-306, DFAS Form 9035, and proof of fingerprints to DFAS Personnel Security all at once. Under no circumstances should this documentation be submitted less than fifteen (15) calendar days prior to the intended performance start date. DFAS Personnel Security will review all submitted documentation to validate whether contractor personnel meet personnel security requirements to perform work on the contract or if a new background investigation is required.

1.7.3.5 Contractors obtaining favorable security evaluations and DoD CACs for required contractor employees performing on this contract is a prerequisite for contractor performance and invoicing. Also, the failure of a contractor to provide employees who can obtain a favorable security adjudication and a DoD CAC in a timely manner may be considered negatively when assessing contractor performance, termination, or other. *New fingerprints are not required if any of the following apply:

1.7.3.5.1 The person has been fingerprinted for the Defense Counterintelligence and Security Agency (DCSA) within the past 30 days.

1.7.3.5.2 The person is currently undergoing a background investigation, or reinvestigation, by DCSA or any other Federal agency.

1.7.3.5.3 The person has a background investigation currently being adjudicated by the DCSA Adjudication and Vetting Services (DCSA-AVS) or another AVS.

1.7.3.5.4 The person has been favorably adjudicated within the past 30 days by the DCSA AVS or a AVS from any other Federal agency: or

1.7.3.5.5 The person is coming directly from another DoD agency, with no break in service. This includes any of the military branches as well as the U.S. Coast Guard; however, service members in an inactive reserve status are not included.

1.7.3.5.6 The DFAS Personnel Security Office otherwise determines that no new fingerprints are required.

1.7.4 Regulatory Requirements. Contractor personnel shall follow the security and training requirements in DoDM 5220.23, “Industrial Security Procedures for Government Activities,” DoDM 5200.01, Volumes 1-3, “DoD Information Security Program,” DoDI, 5200.48, “Controlled Unclassified Information,” DFAS 2000.1-I, “Force Protection Mission,” DFAS 5200.1-I, “Information Security Program,” DFAS 5200.8-I, “Physical Security Program,” and DFAS 5200.10-I, “Counter Insider Threat Program.” Contractor personnel shall follow all host security requirements in accordance with Part 117 of Title 32, Code of Federal Regulations; paragraph 117.16.

Ensure that all contracting officers include applicable clauses in all contracts that require work to be performed for a DFAS location. The contractor shall immediately report any occurrences of violation of stated regulations to the DFAS Manager of the area to which they are assigned, Contracting Officer (CO), COR, Director, Force Protection, and the DFAS Personnel Security Office.

1.7.4.1 DoD Issuances can be located at the following web link: https://www.esd.whs.mil/dd/dod-issuances/

1.7.4.2 DFAS Instructions can be located at the following agency portal web link:

https://dfasportal.dfas.mil/docs/Documents/Forms/AllItems.aspx?RootFolder=%2fdocs%2fDocuments%2fOfficia l%20Forms%20and%20Pubs&FolderCTID=0x012000C5AD4BBE89E91A47852CADC95291E394

1.7.5 DFAS Personnel Security Incident Reporting Requirements, the National Industrial Security Program and Due Process as it Relates to DFAS Contractor Personnel. The National Industrial Security Program (NISP) is a partnership between the federal government and private industry to safeguard classified information and CUI.

1.7.5.1 Executive Order 12829, as amended, "National Industrial Security Program," further amended by Section 6 of E.O. 13691, was established to achieve cost savings and to ensure that industry safeguards the classified information with which it is entrusted while performing work on contracts, programs, bids, or research and development efforts while working for the United States Government.

1.7.5.2 It is important to note that personnel employed as contractors for DFAS are not covered under the National Industrial Security Program (NISP) and are exempt from the provisions of 5 C.F.R. 731. This means that DFAS contractor personnel involved in an incident that potentially violates one or more of the National Security Adjudicative Guidelines found at https://www.dni.gov/files/NCSC/documents/Regulations/SEAD-4-Adjudicative- Guidelines-U.pdf, are not entitled to Due Process rights normally afforded to federal civilian employees and those personnel covered under NISP; more specifically, DFAS Personnel Security may suspend or revoke contractor personnel access to DFAS IT systems, sensitive information and/or DFAS facilities.

1.7.6 Incident Reporting Requirements.

1.7.6.1 In all cases, whenever a DFAS contractor displays conduct, or is involved in any incident, which is in violation of any of the thirteen National Security Adjudicative Guidelines*, the contractor must immediately report the incident to the contractor company Security Office/Facility Security Officer, the DFAS Manager of the area to which they are assigned, the CO, the COR, the Director, Force Protection, and the DFAS Personnel Security Office. Reporting to DFAS Personnel Security may be made by phone to (317) 212-7888, by email to dfas.indianapolis-in.zh.mbx.dfas-inhrsecurity@mail.mil, or, in the case of personnel physically located at DFAS Indianapolis Center, in person to the DFAS Personnel Security Office located on the third floor center hallway at Column 320T.

1.7.6.2 All incidents will be investigated by DFAS Personnel Security and, depending on the date of the subject’s most recent investigation, may need to have an updated background investigation initiated. Those that do not require a new investigation will have all relevant information regarding the incident forwarded to the DCSA AVS for review and re-adjudication. *The thirteen National Security Adjudicative Guidelines are:

1.7.6.2.1 GUIDELINE A: Allegiance to the United States

1.7.6.2.2 GUIDELINE B: Foreign Influence

1.7.6.2.3 GUIDELINE C: Foreign Preference

1.7.6.2.4 GUIDELINE D: Sexual Behavior

1.7.6.2.5 GUIDELINE E: Personal Conduct

https://www.esd.whs.mil/dd/dod-issuances/ https://dfasportal.dfas.mil/docs/Documents/Forms/AllItems.aspx?RootFolder=%2fdocs%2fDocuments%2fOfficial%20Forms%20and%20Pubs&FolderCTID=0x012000C5AD4BBE89E91A47852CADC95291E394 https://dfasportal.dfas.mil/docs/Documents/Forms/AllItems.aspx?RootFolder=%2fdocs%2fDocuments%2fOfficial%20Forms%20and%20Pubs&FolderCTID=0x012000C5AD4BBE89E91A47852CADC95291E394 https://www.dni.gov/files/NCSC/documents/Regulations/SEAD-4-Adjudicative-Guidelines-U.pdf https://www.dni.gov/files/NCSC/documents/Regulations/SEAD-4-Adjudicative-Guidelines-U.pdf mailto:dfas.indianapolis-in.zh.mbx.dfas-inhrsecurity@mail.mil

1.7.6.2.6 GUIDELINE F: Financial Considerations

1.7.6.2.7 GUIDELINE G: Alcohol Consumption

1.7.6.2.8 GUIDELINE H: Drug Involvement and Substance Misuse

1.7.6.2.9 GUIDELINE I: Psychological Conditions

1.7.6.2.10 GUIDELINE J: Criminal Conduct

1.7.6.2.11 GUIDELINE K: Handling Protected Information

1.7.6.2.12 GUIDELINE L: Outside Activities

1.7.6.2.13 GUIDELINE M: Use of Information Technology

1.7.6.3 Some Examples of Incidents That Require Reporting to DFAS Personnel Security:

1.7.6.3.1 An arrest for any criminal offense, not including minor traffic violations, by any law enforcement agency. This DOES include the traffic offenses of Driving Under the Influence of Alcohol or Drugs, and Reckless Driving.

1.7.6.3.2 Violation of any court order.

1.7.6.3.3 Civil judgements.

1.7.6.3.4 Delinquencies on any debt for 180 days or longer.

1.7.6.3.5 Federal, State or Local tax issues or delinquencies.

1.7.6.3.6 Delinquencies on any Federal debt (including Federal Student Loans and Federally backed home mortgage loans).

1.7.6.3.7 Child Support delinquencies.

1.7.6.3.8 Filing for Chapter 7 or Chapter 13 bankruptcy in any Federal Bankruptcy Court.

1.7.6.3.9 Foreign Travel.

1.7.6.3.10 Marriage or Cohabitation with a Foreign National (person from a foreign country).

1.7.6.3.11 Having a close personal friendship with a Foreign National with regularly occurring contact.

1.7.6.3.12 Ownership of property or financial accounts in a foreign country; and

1.7.6.3.13 Being approached by a person know to be, or suspected to be, working as an agent of a foreign government or terrorist organization, or any other person, who seeks any information about DFAS, the Department of Defense, or the U.S. Government, especially if the person offers money or something of value to the contractor employee.

It should be noted that a person’s delinquency on federal debt of any kind may not obtain or maintain favorable personnel security adjudication or be considered for a contractor position with DFAS unless they can provide documentary proof that a payment plan has been established with the government agency to whom the debt is owed, and that regularly recurring payments are being made. Contractor personnel who cannot obtain and maintain a favorable personnel security adjudication may not have access to government data, facilities, and/or equipment required under the contract.

NOTE: This list does not cover every potential incident or offense; any incident in which a contractor is involved, and a question exists as to whether it should be reported, should report the incident to DFAS Personnel Security, who will then determine if further action is warranted. Failure to report an incident is, in and of itself, an incident involving personal conduct, and may, in some cases, be more serious than the original incident.

1.7.7 Foreign Travel by DFAS Contractor Personnel

1.7.7.1 Official and Unofficial (Personal) Travel: Official U.S. Government Business: persons employed as contractor employees with DFAS, to include those with Noncritical Sensitive (formerly IT-II) access, Critical Sensitive (formerly IT-I) access, access to critical program information (related to Research, Development, Test, and Evaluation), sensitive compartmented information, and/or special access program information, in accordance with DoD Directive 5240.06, are required to complete a DFAS Form 9133, Notification of Foreign Travel, not less than 30 calendar days prior to the scheduled travel.

1.7.7.2 One copy shall be sent the DFAS Personnel Security group box at dfas.indianapolis-in.zh.mbx.dfas-inhrsecurity@mail.mil and one copy shall be turned into the Site Force Protection Office of the DFAS site where they are stationed. Site Force Protection POC information:

https://dfasportal.dfas.mil/ddss/force_protection/Pages/SiteSpecificForceProtectionSecurityServices.aspx

1.7.7.3 Upon receipt of the completed Form 9133, the Site Force Protection Office will contact the contractor employee to validate training, complete the country/theater clearance package, as required, and schedule a Foreign Travel briefing. Immediately prior to travel, contractor employees will check with the State Department at https://travel.state.gov/content/travel/en/traveladvisories/traveladvisories.html.html for any travel advisories for the country or region being traveled to and take the appropriate steps to ensure their safety for any location covered by a travel advisory or warning.

1.7.8 Security Education and Training. Contractor personnel shall receive initial, continuous and refresher security education training in accordance with DoDM 5200.01, Volume 3, “DoD Information Security Program – Protection of Classified Information,” DoDI 5200.48, DFAS 2000.1-I, DFAS 5200.1-I, DFAS 5200.8-I, and DFAS 5200.10-I. Contractor personnel shall also complete all required contractor training requirements identified in this SOW/PWS.

1.7.9 Access To, Accountability For, and Safeguarding of Classified Information and Controlled Unclassified Information (CUI). The DFAS manager of the requiring office will determine what classified information and CUI contractor personnel are given access to. Classified Information and CUI may not be disclosed to contractor personnel unless required for contract performance. Contractor personnel shall safeguard classified information and CUI in accordance with DoDM 5200.01, Volumes 1-3, DoDI 5200.48 and DFAS 5200.1-I. The sponsoring DFAS activity will provide storage capability for all classified information and CUI required for contract performance. All work involving classified information must occur in appropriately designated areas within DFAS facilities. Work involving classified information will not take place at the contractor facility. The contractor must return all classified information to the DFAS Manager of the requiring office upon termination of the contract or when no longer required. Contractor personnel must monitor CUI for aggregation and compilation based on the potential to generate classified information. Contractor personnel must report the potential classification of aggregated or compiled CUI to the DFAS Manager of the area to which they are assigned, the CO, the COR, and the Director, Force Protection.

1.7.10 Installation Entry and Common Access Card (CAC) Requirements.

1.7.10.1 The Contractor shall comply with established security procedures for entering government installations and facilities. Contractor employees shall be required to obtain and wear identification (ID) badges that will permit access into the facility.

1.7.10.2 Contractors shall work with the assigned DFAS COR/Mission Partner Account Sponsor (MPAS) to obtain a CAC using Mission Partner Identity Credential Account Management (MP ICAM). Under no circumstances will a CAC be issued to any person unless that person has been cleared by the DFAS Personnel Security Office to work on the contract.

1.7.10.3 All CACs and badges issued to Contractor personnel are government property and must be returned to the assigned DFAS COR/MPAS upon departure from the program or at the conclusion of the contract, whichever comes first. CACs can also be mailed in or turned into RAPIDS locations. Contractors whose CAC is lost or mailto:dfas.indianapolis-in.zh.mbx.dfas-inhrsecurity@mail.mil mailto:dfas.indianapolis-in.zh.mbx.dfas-inhrsecurity@mail.mil https://dfasportal.dfas.mil/ddss/force_protection/Pages/SiteSpecificForceProtectionSecurityServices.aspx https://travel.state.gov/content/travel/en/traveladvisories/traveladvisories.html.html stolen must report the loss as soon as possible to the assigned DFAS COR/MPAS and present documentation that the CAC is missing and describing the circumstances under which the loss occurred. The assigned DFAS COR/MPAS will follow agency CAC procedures to issue a new CAC.

1.7.10.4 Contractors’ must not share their CACs and passwords with any other staff members. The assigned DFAS COR/MPAS will report any violation or suspected violation to the Contracting Officer and DFAS MP ICAM Account Security Manager (MPASM). Any violators will be temporarily or permanently removed from the project. If a Contractor has a CAC issued from another agency, that CAC must be revoked and returned before issuance of a new CAC.

1.7.11 DoD Mandated Training.

1.7.11.1 DoD Mandatory Contractor Personnel Training Requirements: The contractor shall direct that its employees performing under this contract complete the annual mandatory training in accordance with the DoD mandate identified for each training module.

1.7.11.2 Contractor personnel working at a DFAS site who require a CAC, or contractor personnel working remote via VPN, need to complete the following training modules within 30 days after receipt of CAC, (note for Cyber Awareness Challenge Module 003, completion of this module is required prior to requesting a new DFAS network or VPN account), as a precondition for continued attendance and/or network access.

1.7.11.3 In addition, these modules shall be completed annually to retain accessibility. Noncompliance will negatively impact contract performance and lead to the loss of CAC and/or network access for contractor personnel.

1.7.11.3.1 Continuity of Operations and Crisis Management Organization. Contractor personnel will take the training through the DFAS Portal upon receipt of Network access.

1.7.11.3.2 Cyber Awareness Challenge. Completion of this module is required prior to requesting a new DFAS network or VPN account. For contractor personnel unable to access the DFAS Portal, the same training is available at: https://public.cyber.mil/training/cyber-awareness-challenge/ Upon completion of the training Contractor personnel shall maintain a copy of…