Revised PWS_FY26_Nutanix_April2026.docx

PERFORMANCE WORK STATEMENT (PWS)

FOR

Nutanix IT Equipment Maintenance & Support

PART I: GENERAL INFORMATION

1.0 General: This is a non-personal services contract to provide maintenance & support for the Nutanix IT equipment located at the located at the Corpus Christi Army Depot (CCAD), Corpus Christi, Texas. The Government will not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn is responsible to the Government.

1.1 Description of Services: The contractor shall furnish all labor, tools, material, equipment, and supervision necessary to perform the IT equipment maintenance and support accordance with the performance work statement (PWS).

1.2 Background This procurement is for maintenance and support for the depot’s Nutanix IT equipment, utilized for the purpose of providing maintenance, troubleshooting, repairs, replacement parts and telephone support.

1.3.Scope: The Contractor shall provide comprehensive maintenance and support on all depot owned Nutanix IT equipment. Support includes telephone/remote support, technical support, designated response times, hardware support and software support.

1.4 Objectives: The purpose of this Performance Work Statement (PWS) is to list the requirements and response times, including equipment to be covered, which will be identified on a separate equipment list with serial numbers provided. Specific response times are in section 5 of this PWS.

1.5 General Information:

1.5.1 Quality Control Plan (QCP): The Contractor’s existing quality assurance system shall be utilized in accordance with FAR 12.208.

1.5.2 Quality Assurance (QA): The Government will evaluate the contractor's performance under this contract in accordance with the requirements as defined in this PWS. This quality requirement is focused on what the Contractor must do to ensure that the maintenance and support services are completed within the required time frame and within the standards as set forth in the contract.

1.5.3 Recognized Holidays. The following are recognized US holidays. The Contractor shall ensure the necessary support is available on these days if required:

1.5.4 Operating Hours: The contractor shall provide services between the 0600 – 1800, Monday through Friday, with the exception of US Holidays or periods when the Government installation/facility is closed due to local or national emergencies, administrative closings or similar Government directed installation/facility closings.

1.5.5 Reserved

1.5.6 Place of Performance: The Contractor shall perform at the Contractor’s location.

1.6 Security Requirements: The following information is provided on security related matters.

1.6.1 Reserved

1.6.2 Reserved

1.6.3 Reserved

1.6.4 Reserved

1.6.4.1 Reserved

1.6.4.2 Reserved

1.6.4.3 Reserved

1.6.4.4 Reserved

1.6.5 Reserved

1.6.5.1 Reserved

1.6.5.2 Reserved

1.6.6 Reserved

1.6.7 Reserved

1.6.8 Safeguarding Covered Defense Information: Contractors and subcontractors are required to safeguard covered defense information that resides in or transits through covered contractor information systems by applying specified network security requirements and reporting of cyber incidents in accordance with 48 CFR 204.73. DoD Industry resources for Controlled Unclassified Information can be found at https://www.dcsa.mil/Industrial-Security/Controlled-Unclassified-Information-CUI/

1.7 Reserved

1.8 Post Award Conference/Periodic Progress Meetings: The Contractor shall attend any post award conference convened by the contracting activity or contract administration office in accordance with FAR Subpart 42.5. The Contracting Officer, COR, and other Government personnel, as appropriate, may meet periodically with the Contractor to review the Contractor's performance. At these meetings the Contracting Officer will apprise the Contractor of how the Government views the Contractor's performance and the Contractor shall apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the Government.

1.8.1 The Contractor shall attend, participate in, and furnish input to scheduled and unscheduled meetings, conferences, and briefings that relate to the functions and services herein as required by the Government to provide effective communication and impart necessary information. The Contract Manager or designated representative shall attend meetings as requested by the Government. Meeting attendees shall at times include Contractor managerial, supervisory, and other personnel knowledgeable of the subject matter. Meetings may start or end outside of regular duty hours.

1.9 Contracting Officer’s Representative: Contracting Officer Representative (COR): The COR will be identified by a separate letter. The COR monitors all technical aspects of the contract and assists in contract administration. A letter of designation is sued to the COR, a copy of which is sent to the Contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting order.

1.10 Key Personnel: The following personnel are considered key personnel by the Government: Program Manager and Alternate Program Manager. The Contractor shall provide a Program/Contract Manager who shall be responsible for the performance of the work. The name of this person and an Alternate Program/Contract Manager, who shall act for the Contractor when the Program/Contract Manager is absent, along with a Curriculum Vitae (CV) for each of these individuals, shall be provided in writing to the Contracting Officer no later than 5 days after contract award.

1.11 Identification of Contractor Employees: All Contractor personnel attending meetings, answering Government telephones, and working in other situations where their Contractor status is not obvious to third parties must identify themselves, to include proper marking of signature blocks in correspondence, to avoid creating an impression in the minds of members of the public that they are Government officials. The Contractor shall ensure that all documents or reports, produced by Contractors are suitably marked as Contractor products or that Contractor participation is appropriately disclosed.

1.12 Reserved

1.13 Reserved

1.14 Reserved

1.15 Reserved

1.16 Non-Disclosure Requirements: Performance under this contract may require the Contractor to access data and information proprietary to a Government agency, another Government Contractor, or of such nature that its dissemination or use other than as specified in this work statement would be adverse to the interests of the Government or others. The Contractor shall not divulge or release data or information developed, or obtained under performance of this PWS, except to authorized Government personnel or upon written approval of the Contracting Officer. The Contractor shall not use, disclose, or reproduce proprietary data, which bears a restrictive legend, other than as specified in this PWS. All documentation showing individual names or other personal information shall be controlled and protected under the provisions of the Privacy Act of 1974, Public Law 93-579, 5 United States Code (U.S.C.) Section 552a.

1.17 Protection of Government and Contract Information: Per Public Use Notice of Limitations stated by Defense imagery Management operations Center and contained at www.dimoc.mil/resources/limitations/, the Contractor shall not cite any information (e.g., contract information, pictures, locations, etc.) obtained through this contract on any hard copy or digital marketing tools to include its company website.

1.18 Non-Disclosure Statements: The Contractor shall provide signed non-disclosure agreements to the Government no later than ten (10) business days prior to commencement of work under the contract. Disclosure of information by Contractor personnel may result in removal of Contractor personnel from performance under this contract.

1.19 Reserved

1.20 Reserved

1.21 Safety: The following provides information pertaining to Safety and Accident Prevention:

1.21.1 The Contractor shall conduct all work in a safe manner and in compliance with Federal, State, Local, Department of Defense, Army, and Depot regulations and national consensus standards.

1.21.2 The Contractor will provide a Site-Specific Safety and Occupational Health Accident Prevention Plan (APP) and Activity Hazard Analysis (AHA).

1.21.2.1 Site-Specific Safety and Occupation Health Accident Prevention Plan (APP). The Contractor will develop, promulgate, and enforce a written site-specific safety and occupational health accident prevention plan (Herein referred to as safety plan). The safety plan shall identify protocols and procedures to ensure a safe and healthy workplace. The safety plan will be reviewed and deemed acceptable by the COR before beginning any on-site activities.

1.21.2.2 Activity Hazard Analysis (AHA). The Contractor will identify in sequence the activities being performed, the specific anticipated hazard, equipment, materials, and the control measures to implemented to eliminate or minimize each hazard to an acceptable level of risk. The contractor will use the more stringent standard when standards are different. The names of the competent and qualified person required for a particular activity (e.g., excavation, scaffolding, fall protection, or other activities as specified by OSHA) shall be identified and included in the activity hazard analysis, as well as proof of their competency and qualification. The analysis will be reviewed and deemed acceptable by the COR before beginning any on-site activities.

1.21.3 Service Condition. No part of the services covered by the McNamara-O’Hara Service Contract Act of 1965 will be performed in buildings or surroundings or under working conditions, provided by or under the control or supervision of the Contractor or any Subcontractor, which are unsanitary or hazardous or dangerous to the health or safety of service employees engaged to furnish the services.1.23 Required Training: The following provides information on training requirements.

1.23.1 Reserved

1.23.2 Reserved

1.23.3 iWATCH Training: The Contractor and all associated subcontractors shall brief all employees on the local iWATCH program (training standards provided by the requiring activity ATO). This locally developed training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the COR. This training shall be completed within ten (10) calendar days after the contract is awarded and prior to work commencement, with the results reported to the COR within five (5) business days after the contract is awarded and within ten (10) calendar days after new employees commence contract performance. Verification of the training shall be provided to the COR via memorandum on Contractor company letterhead and signed by an authorized company representative prior to work commencement.

1.23.4 Reserved

1.23.5 Reserved

1.24 Reserved

1.24.1 Reserved

1.24.2 Reserved

1.24.3 Reserved

1.25 Reserved

1.26 Reserved

1.27 Reserved

PART 2: DEFINITIONS & ACRONYMS

2.0 DEFINITIONS AND ACRONYMS:

2.1 Definitions: Although not inclusive of every term used within this PWS, the following provides a list of definitions used throughout this PWS and commonly used in the acquisition field.

CONTRACTOR. A supplier or vendor awarded a contract to provide specific supplies to the Government. The term used in this contract refers to the prime.

CONTRACTING OFFICER (KO). A person with authority to enter into, administer, and/or terminate contracts, and make related determinations and findings on behalf of the Government. Note: The only individual who can legally bind the Government.

CONTRACTING OFFICER'S REPRESENTATIVE (COR). As defined in DFARS 202.101, means an individual designated and authorized in writing by the Contracting Officer to perform specific technical or administrative functions. DoD Instruction (DoDI) 5000.72, Part II Definitions states the following when defining a COR: “Defined in subpart 202.101 of Reference (f). Any individual delegated responsibilities pursuant to subpart 1.602-2 of Reference (e), regardless of local terminology, must be certified in accordance with this instruction. For example, local terminology can be COR, Contracting Officer’s technical representative, technical point of contact, technical representative, alternate COR, administrative COR, assistant COR, line item manager, task order manager, quality assurance personnel, quality assurance evaluator, or COR management.” In addition, Army Regulation 70-13, Chapter 2, paragraph 2-2g, states, in part, the following when providing other surveillance support personnel to assist the COR when needed, “…These other surveillance support personnel may serve as on-site representatives of the COR in performance of actual contract surveillance if they meet all COR requirements and have been appointed by the Contracting Officer as alternate CORs.”

DELIVERABLE. Anything that can be physically delivered and includes non-manufactured items such as meeting minutes or reports.

PHYSICAL SECURITY. means that part of security concerned with physical measures designed to safeguard personnel; to prevent unauthorized access to equipment, installations, material, and documents; and to safeguard against espionage, sabotage, damage, and theft.

QUALITY ASSURANCE. The Government procedures to verify that products being provided by the Contractor meet acceptable standards.

QUALITY CONTROL. All necessary measures taken by the Contractor to assure that the quality of an end product shall meet contract requirements.

SUBCONTRACTOR. One that enters into a contract with a prime contractor. The Government does not have privity of contract with the subcontractor.

WORKDAY. The number of hours per day the Contractor provides support in accordance with the contract.

WORK WEEK. Monday through Friday , unless specified otherwise.

2.2 Acronyms: Although not inclusive of every term used within this PWS, or that may be included in an acquisition, the following provides a list of acronyms commonly used in the acquisition field.

PART 3: GOVERNMENT FURNISHED PROPERTY, EQUIPMENT AND SERVICES

3.0 GOVERNMENT PROPERTY AND SERVICES:

3.1 Facilities: The Government will not provide office space or work area on site.

3.2 Equipment: NONE

3.3 Materials: NONE

3.4 Services: NONE

3.5 Utilities: NONE.

3.6 Personnel Access: None

PART 4: CONTRACTOR FURNISHED ITEMS

4.0 CONTRACTOR FURNISHED IT EMS AND RESPONSBILITIES:

4.1 General: The Contractor shall furnish all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items necessary to perform services as described in the PWS and associated contract documents, except for those items specified in Part 3 Government Property and Services.

4.2 Reserved

4.3 Reserved

4.4 Reserved

4.5 Background Checks: The Contractor shall provide Background Checks in accordance with this PWS and as determined by the Government.

PART 5: SPECIFIC TASKS

5.0 REQUIREMENTS :

5.1 Basic Services: The Contractor shall provide comprehensive maintenance and support on all depot owned Nutanix IT equipment. The equipment list is as follows:

SEE ATTACHED EQUIPMENT LIST.

5.2. Telephone/Remote Support: The Contractor shall provide telephone and remote support that meets the following requirements: Single, exclusive toll-free telephone number for support. Remote support shall be performed via virtual meeting. Telephone and remote support shall be available 24 hours per day, 7 days per week. Calls trouble reports shall be routed to U. S. Citizen technicians with proficiency in the English language. Telephone and remote support shall be provided for every Nutanix device owned by CCAD.

5.3. Technical Support: The Contractor shall provide technical support which will consist of 100% 24 hours per day, 7 days per week support by U. S. Citizen engineers located at a U. S. based support center. Technicians shall be proficient in the English language. Technical support shall be provided for every Nutanix device owned by CCAD. Technicians shall be certified to provide full-stack support for customer applications.

5.4. Response Times: The Contractor shall meet the following response time requirements:

Priority 1 – 1 hour Priority 2 – 4 hours Priority 3 – 8 hours.

5.5. Hardware Support: The Contractor shall provide hardware support to include hardware replacement with on-site parts replacement if issue diagnosis requires replacement parts. Replacement parts shall be provided by close of business (COB) on the next business day. In the event of a hardware failure requiring a Return Material Authorization (RMA), the Government will retain the equipment/hardware requiring replacement.

5.6. Software Support: The Contractor shall provide software support to include major and minor maintenance, patch releases and upgrades. Repairs, patch installs and updates shall be provided via virtual meeting or by telephone, as all physical work will be performed by Government personnel.

5.7. Firmware Updates: The contractor shall provide firmware updates within 5 business days of availability. The Contractor shall provide firmware updates that have the capability to address issues that cause Nutanix equipment to malfunction or run slowly and also enhance security by providing security patches. The updates shall allow management of the Nutanix hardware’s core operations.

PART 6: PUBLICATIONS

6.0 Applicable Publications (Current Editions): The following publications, manuals, regulations, etc. are mentioned in this PWS and are listed below.

6.1.3 32 Code of Federal Regulation (CFR) Part 2002, Controlled Unclassified Information

6.1.4 32 Code of Federal Regulation (CFR) Part 117 National Industrial Security Program Operating Manual (NISPOM)

6.1.5 Federal Acquisition Regulation Subpart 24.1 CFR Part 24 and Part 39.105

6.1.6 Unified Facilities Criteria (UFC) 4-010-01 DoD Minimum Antiterrorism Standards for Buildings

6.1.7 Defense Acquisition Regulation 252.204-7008 Compliance with Safeguarding Covered Defense Information Controls

6.1.8 Defense Acquisition Regulation 252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting

6.1.9 DoDI 1000.13, Identification (ID) Cards for Members of the Uniformed Services, Their Dependents, and other Eligible Individuals

6.1.10 DoDM 1000.13, Volume 1, DoD Identification (ID) Cards: ID Card Life-Cycle

6.1.11 DoDM 5200.02 Procedures for the DoD Personnel Security Program

6.1.12 DoDI 5200.02 DoD Personnel Security Program

6.1.13 DoDI 5200.48, Controlled Unclassified Information

6.1.14 DoDD 5230.25, Withholding of Unclassified Technical Data from Public Disclosure

6.1.15 DoDD 5240.06 Counterintelligence Awareness and Reporting (CAIR)

6.1.16 DoD 8570-M Information Assurance Workforce Improvement Program

6.1.17 AR 25-1 Army Information Technology

6.1.18 AR 25-2 Army Cybersecurity

6.1.19 AR 25-55, The Department of the Army Freedom of Information Act

6.1.20 AR 70-31, Standards for Technical Reporting

6.1.21 AR 190-13 The Army Physical Security Program

6.1.22 AR 360-1, The Army Public Affairs Program

6.1.23 AR 380-5, Army Information Security Program

6.1.24 AR 380-10, Foreign Disclosure and Contact with Foreign Representatives

6.1.25 AR 380-49, Industrial Security Program

6.1.26 AR 380-67, Personnel Security

6.1.27 AR 530-1, Operations Security

6.1.28 AR 735-5 Property Accountability Policies

6.1.29 EM 385-1-1 U.S. Army Corps of Engineers Safety and Health Requirements

6.1.30 530-CCAD-001 CCAD Operations Security Plan (OPSEC)

6.1.31 CCAD Physical Security Plan

PART 7: ATTACHMENT AND TECHNICAL EXHIBIT LISTING

7.1 Attachment 1: Performance Requirements Summary

7.2 Attachment 2: Equipment List

7.3 Attachment 3: Security Requirements

ATTACHMENT 1: Performance Requirements Summary

ATTACHMENT 2: Equipment List

PART #: RS-HW-FED-PRD-ST

Description: 24/7 federal / stateside production level short term HW support renewal for Nutanix hardware

PART #: RS-NRDK-HDD-12TB-ST

Description: Renewal support for non-returned 12TB HDD replacement (per drive) for short-term

PART #: RS-NRDK-HDD-18TB-ST

Description: Renewal support for non-returned 18TB HDD replacement (per drive) for short-term

PART #: RS-NRDK-HDD-8TB-ST

Description: Renewal support for non-returned 8TB HDD replacement (per drive) for short-term

PART #: RS-NRDK-SSD-1.92TB-ST

Description: Renewal support for non-returned 1.92TB SSD replacement (per drive) for short-term

PART #: RS-NRDK-SSD-3.84TB-ST

Description: Renewal support for non-returned 3.84TB SSD replacement (per drive) for short-term

PART #: RS-NRDK-SSD-7.68TB-ST

Description: Renewal support for non-returned 7.68TB SSD replacement (per drive) for short-term

PART #: RSWA-NUS-ADR-FP

Description: Subscription renewal, Nutanix Unified Storage (NUS) advanced replication add-on software license & federal production software support service for 1 TiB of data stored, 1 Year

PART #: RSWA-NUS-SEC-FP

Description: Subscription renewal, Nutanix Unified Storage (NUS) security add-on software license & federal production software support service for 1 TiB of data stored, 1 Year

PART #: RSW-EUC-ULT-FP

Description: Subscription renewal, End User Computing (EUC) ultimate software license & federal production software support service for 1 user, 1 Year

PART #: RSW-NCI-ULT-FP

Description: Subscription renewal, Nutanix Cloud Infrastructure (NCI) ultimate software license & federal production software support service for 1 CPU Core, 1 Year

PART #: RSW-NCM-STR-FP

Description: Subscription renewal, Nutanix Cloud Manager (NCM) starter software license & federal production software support service for 1 CPU Core, 1 Year

PART #: RSW-NUS-PRO-FP

Description: Subscription renewal, Nutanix Unified Storage (NUS) pro software license & federal production software support service for 1 TiB of data stored, 1 Year

PART #: RSW-NUS-STR-FP

Description: Subscription renewal, Nutanix Unified Storage (NUS) starter software license & federal production software support service for 1 TiB of data stored, 1 Year

ATTACHMENT 3: Security Requirements

CAO: April 2019

SECURITY REQUIREMENTS FOR ALL CONTRACTS PERFORMED AT CORPUS CHRISTI ARMY DEPOT

Place these security requirements in all Statement of Works (SOW’s) and Performance Work Statements (PWS’s) for contracts performed at Corpus Christi Army Depot (CCAD).

This document is a brief overview of rules and regulations of Naval Air Station Corpus Christi (NASCC) and Corpus Christi Army Depot (CCAD). It is not intended to be all-inclusive or cover all contingencies.

Direct specific security requirements questions to the following numbers:

CCAD: (361) 961-3313

NASCC: (361) 961-2480

Regulations:

Army Directive 2014–05 (or its successor) Policy and Implementation Procedures for Common Access Card Credentialing and Installation Access for Uncleared Contractors

AR 25-1, Army Knowledge Management and Information Technology AR 25-2, Information Assurance

AR 25-55, The Department of the Army Freedom of Information Act AR 70-31, Standards for Technical Reporting

AR 190-13, Department of the Army Physical Security Program AR 360-1, The Army Public Affairs Program AR 380-5, Department of the Army Information Security Program

AR 380-10, Foreign Disclosure and Contact with Foreign Representatives AR 380-49, Industrial Security Program

AR 380-67, Personnel Security (PERSEC); AR 530-1, Operations Security (OPSEC)

AR 530-1, AMC Supp Operations Security (OPSEC) AR 530-1, CCAD Plan Operations Security (OPSEC) AMC-R 525-13, AMC Force Protection Program

DoD 5220.22-M National Industrial Security Program Operating Manual DoD Directives 5230.24, Distribution Statements on Technical Documents

DoD Directives 5230.25, Withholding of Unclassified Technical Data from Public Disclosure DoD Regulation 5200.2 Personnel Security Program

DoD 5400.11-R, Department of Defense Privacy Program UFC 4-010-01 9 February 2012 Change 1, 1 October 2013

DoD MINIMUM ANTITERRORISM STANDARDS FOR BUILDINGS UNIFIED FACILITIES CRITERIA (UFC)

DoDI 1000.13, Identification (ID) Cards for Members of the Uniformed Services, Their Dependents, and other Eligible Individuals

DoDD 5400.11, Department of Defense Privacy Program, October 29, 2014

DoDM 1000.13, Volume 1, DoD Identification (ID) Cards: ID Card Life-Cycle DoDI 5200.02 DoD Personnel Security Program

DoDM 5200.02 Procedures for the DoD Personnel Security Program

Federal Acquisition Regulation Subpart 24.1 CFR Part 24 and Part 39.105

U.S. Office of Personnel Management Memorandum, "Final Credentialing Standards for Issuing Personal Identity Verification Cards under HSPD-12," July 31, 2008Federal Acquisition Regulation (FAR), March 2005

1. Conduct and Behavior: IAW DoD Directive 5200.8, “Security of DoD Installations and Resources”, the NAS commander has broad authority to remove or exclude any person or persons from the military installation to protect personnel and property, to maintain good order and discipline, and to ensure the uninterrupted and successful performance of the installations mission. In the exercise of this authority, the commander may refuse to grant entry or may bar Contractor employees. Refusal of entry or barment of any employee does not relieve the Contractor of the responsibility to continue performance under this contract.

1.1. All personnel entering and working at CCAD are subject to all rules, regulations and applicable laws. All personnel and their effects are subject to search, to include vehicles and company belongings.

1.2. No person shall willfully fail or refuse to comply with lawful orders or direction of any civilian or military security police officer.

1.3. The Contractor shall not employ persons for work on this contract if such employees are identified to the Contractor by the Government as a potential threat to the health, safety, security, general well-being or operational mission of the installation and its population. Disrespectful behavior, failure to obey orders or regulations, fighting, horseplay, stealing, illegal use of drugs (using/transporting/selling), consuming or being under the influence of alcohol, or being in the possession of illegal weapons are prohibited and subject to appropriate penalties. This may include being detained, banned from entering the Government facility, or remanded to civilian authorities.

1.4. All Contractor personnel will limit their travel on the installation only to specific areas required for performance of the contract, specified break and meal areas, or in travel directly to and from these locations. Employees found on the installation away from officially identified areas may be detained and/or debarred from the installation.

1.5. Subcontracts; if the Contractor enters into a Subcontractor arrangement with another Contractor, the prime Contractor is responsible for Subcontractor performance and compliance. The prime Contractor must provide a copy of the security requirements to the subcontractor. The contracting officer must ensure any questions of adequacy of the Subcontractor are resolved to the mutual satisfaction of the prime Contractor, Subcontractor, security, and CCAD commander.

1.6. All prospective government and contractor employees are subject to a check of their criminal history prior to being granted access to CCAD. Adverse or derogatory information revealed by these checks, or failure to provide full disclosure, may result in denial of access.

2. Support:

2.1 Security support provided by CCAD to the Contractor includes (if applicable) storage containers for classified information/material, use of base destruction facilities, classified reproduction facilities, use of base classified mail services, security badging, investigation of security incidents, base traffic regulations, use of security forms, and conducting inspections required by DoD 5220.22-M “Industrial Security Regulation”, AR 380-49 “Industrial Security Program”, AR 380-5 “Department of Army Information Security Program”, and AR 25-2 “Information Assurance” and others as required or deemed necessary by the Government.

2.2 Security support requiring joint Army and Contractor coordination includes packaging classified information, mailing and receiving classified materials, implementing emergency procedures for protection of classified information, security checks, and internal security controls for protection of classified material, sensitive material, and high value pilfer able property.

3. Security Investigation Requirements:

3.1. Investigation requirements including IT level and CAC requirements should be clearly indicated in the contract and Performance Work Statement (PWS) as prescribed in paragraph 4.1303, of the FAR:

Personal Identity Verification of Contractor Personnel

(a) The Contractor shall comply with agency personal identity verification procedures identified in the contract that implement Homeland Security Presidential Directive-12 (HSPD-12), Office of Management and Budget (OMB) guidance M-05-24 and Federal Information Processing Standards Publication (FIPS PUB) Number 201.

(b) The Contractor shall account for all forms of Government-provided identification issued to the Contractor employees in connection with performance under this contract. The Contractor shall return such identification to the issuing agency at the earliest of any of the following, unless otherwise determined by the Government:

(1) When no longer needed for contract performance.

(2) Upon completion of the Contractor employee’s employment.

(3) Upon contract completion or termination.

(c) The Contracting Officer may delay final payment under a contract if the Contractor fails to comply with these requirements.

(d) The Contractor shall insert the substance of this clause, including this paragraph (d), in all subcontracts when the subcontractor’s employees are required to have routine physical access to a Federally-controlled facility and/or routine access to a Federally-controlled information system. It shall be the responsibility of the prime Contractor to return such identification to the issuing agency in accordance with the terms set forth in paragraph (b) of this section, unless otherwise approved in writing by the Contracting Officer.

3.2. Subcontracts; if the Contractor enters into a Subcontractor arrangement with another Contractor, subcontractors must be clearly identified in the contract agreement.

3.3. Contractors must maintain the same level investigation or higher as their civilian counterparts. In the absence of a civilian counterpart, CCAD Security will determine the level of investigation based on a position sensitivity review. Close coordination with the COR and company are required. All documentation required for access to CCAD for classified contracts or IT Level I & II shall be processed through the CCAD Security Personnel Security Office prior to entering CCAD facilities.

3.4. Classified Contracts: An interim clearance must be in place prior to entering CCAD facilities. All documentation (i.e. SF 86, etc.) required for security clearance shall be processed through the Contractor Facility Security Office (FSO).

3.4.1. For all contracts involving employees who require a security clearance for performance of their duties or access to classified material, the Contractor must possess or obtain a facility security clearance prior to performing contract work. If the Contractor does not possess a facility clearance, the Government (Contracting Office) may request one from the Defense Security Service (DSS).

3.4.2. Contractor employees without a clearance level or background check properly indicated in the Joint Personnel Adjudication System (JPAS) or its successor, will not be assigned to this task directly or indirectly. Contractor employee(s) will not be authorized access, regardless of personal clearance, without the facility first being cleared to the appropriate level by Defense Security Service (DSS).

3.4. The Contractor shall request security clearances for personnel requiring access to classified information or IT Level I or II within 15 days after receiving a facility clearance. If the Contractor is already cleared, they shall request security clearances for the personnel within 15 days after contract award. Due to costs involved with security investigations, requests for Contractor employee security clearances shall be kept to an absolute minimum necessary to perform contract requirements.

3.4.1. IT Level I positions; Contractor employees shall have one of the following prior to commencing work: A current, valid Tier 5 investigation or equivalent or “Interim” Top Secret eligibility by Defense Industrial Security Clearance Office (DISCO) indicated in JPAS.

3.4.2. IT Level II positions; Contractor employees shall have one of the following prior to commencing work: A favorably completed Tier 3 investigation or equivalent or “Interim” Secret eligibility by DISCO indicated in JPAS.

3.4.3. IT Level III positions: Contractor employees shall have one of the following prior to commencing work: A favorably completed Tier 3 investigation or equivalent or “Interim” Secret eligibility by DISCO indicated in JPAS.

3.5. Unclassified Contracts requiring IT access: All documentation (i.e. SF 85*, etc.) required for their initial security appointment for unclassified contracts to IT Level III shall be processed through the CCAD Security Personnel Security Office prior to entering CCAD facilities.

3.6. IT Level III positions; Contractor employees requiring access to CCAD Local Area Network (LAN) shall have background investigation processed through CCAD Personnel Security Office. If the Contractor employee does not possess the proper investigation, the Government (Contracting Officer Representative) will request one. The Government assumes costs and initiates non-clearance investigation by submitting the appropriate Personnel Security Investigation request to the Army Center of Excellence. Minimum requirements for CAC issuance and access to the LAN is an initiated investigation with favorable FBI fingerprint check. Due to costs and the inherent delays involved with security investigations, requests for Contractor LAN access shall be kept to an absolute minimum necessary to perform contract requirements.

3.6.1. Fitness Issues: CCAD Security will be notify the Contracting Officer Representative (COR) when discovery of adverse information indicates potentially actionable issues that may disqualify the Contractor employee from access.

3.6.2. OPM Memorandum, Final Credentialing Standards for Issuing Personal Identity Verification Cards under HSPD-12 provides government-wide credentialing standards to be used by all Federal departments and agencies in determining whether to issue or revoke personal identity verification (PIV) cards to employees and contractor personnel.

3.6.3. Whether or not to grant access is the sole discretion of the Government. The decision not to grant access will not be grounds for contract modification and shall not constitute an excuse for Contractor performance failure.

3.7. System Authorization Access Request (SAAR): Prior to system access, a SAAR, DD Form 2875, shall be completed by the Contractor employee. The Contractor employee shall complete Part I, the COR shall complete Part II, and CCAD Personnel Security shall complete Part III.

3.8. Unclassified Contracts NOT requiring IT access: Contracts not requiring access to CCAD LAN shall be subject to installation access requirements that include the Defense Biometric Identification System (DBIDS) and/or guest sponsorship. The COR shall provide the appropriate details and contact information.

4. IT/IA Requirements:

4.1. All contract employees with access to the CCAD network must be registered in the Army Training Certification Tracking System (ATCTS) at commencement of services. Contractors and associated subcontractor employees must also complete DoD IA Awareness Training before they can be granted access to the CCAD network and complete the training annually thereafter.

4.2. All contractors working IA/IT functions must comply with DoD and Army training requirements in DoDD 8570.01, DoD 8570.01-M, and AR 25-2 within 6 months of employment.

4.3. Per DoD 8570.01-M, DFARS 252.239.7001, and AR 25-2, the contractor employees’ supporting IA/IT functions shall be appropriately certified upon contract award. The baseline certification, as stipulated in DoD 8570.01-M, must be completed upon contract award.

5. Acquisition: All contracts will include acquisition related documents in accordance with the Federal Acquisition Regulation Subpart 24.1 CFR Part 24 and Part 39.105.

6. Foreign Nationals:

6.1. Official Visits: All official foreign visits (visits sponsored by a foreign government) must be based on a legitimate need, be sanctioned by the appropriate foreign attaché or embassy, and approved through Department of Army channels. Access will be coordinated through the CCAD Foreign Disclosure Officer (FDO), COR, and respective NASCC/CCAD security offices.

6.2. Unofficial Visits: These are visits by foreign nationals that are not endorsed by a foreign government. The Contractor will submit a request for employee access, based on a legitimate need, to the appropriate COR. The COR will in turn notify the FDO of the request. Due to security considerations, requests for these types of visits should be kept to a minimum. Foreign nationals will require a government escort at all times while on CCAD property. The COR will ensure the foreign contractor employee provides a copy of their passport to NASCC and CCAD security offices, to ensure the appropriate background checks are completed. NOTE: Properly validated permanent resident alien registration card holders are exempt from this requirement.

7. Notifications: The following information will be submitted to the COR and the CCAD Security Manager on company letterhead, signed by the Contractor Facility Security Officer (FSO) within 15 days of awarding the contract. An updated listing shall be provided quarterly or when the company or an employee’s status or information changes. Electronic equivalents are acceptable. The notification shall include:

a. Name, address, and telephone number of company representatives.

b. Employee's name, last four of social security number, shift.

c. The contract number and contracting agency.

d. The highest level of classified information to which Contractor employees require access.

e. The location(s) of contract performance.

f. The date contract performance begins and terminates.

8. Security Point of Contact: At no cost to the Government, the Contractor shall appoint a senior Contractor employee to serve as an on-site point of contact for any security concerns at the CCAD location. This may be a full time position or an additional duty position.

9. Security Training:

9.1. All contractor employees, including subcontractor employees, requiring access to Army installations, facilities, or controlled access areas shall complete AT Level I awareness training within 30 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever applies. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee to the COR (or to the contracting officer, if a COR is not assigned) within 30 calendar days after completion of training by all employees and subcontractor personnel. AT Level I awareness training is available at https://atlevel1.dtic.mil/at.

9.2. US-based contractor and subcontractor employees who are required to travel overseas in performance of their duties must receive government provided AT awareness training that is specific to the area of responsibility (AOR), as directed by AR 525-13. Specific AOR training content will be directed by the combatant commander and the unit ATO will ensure an applicable AT foreign travel briefing is provided to the contractor.

9.3. The contractor and all associated subcontractors shall brief all employees on the local iWATCH program. This is a locally developed training is provided by CCAD security and will be used to inform employees of the types of suspicious behavior to watch for and instruct employees to report suspicious activity to the COR. This training shall be completed within 30 calendar days of contract award and within 30 calendar days of new employees’ commencing performance, with the results reported to the COR no later than 30 days after training completion.

8.3.1 Contracts with a scope of work that call for the use of CCAD specific information or equipment at off base locations and facilities must develop an OPSEC Standard Operating Procedure (SOP)/Plan within 90 days of contract award which will be reviewed by the CCAD OPSEC Officer for approval IAW AR 530- 1, Operations Security. The SOP/Plan must identify CCAD's critical information, why it needs to be protected, where it is located, who is responsible, and how the contractor intends to protect it. This plan is “For Official Use Only” and must contain appropriate document controls in accordance with AR 25-55, Chapter 4. The plan must be stored in a secure location such as a lockable container and must be properly destroyed when no longer needed in accordance with local CCAD policy CCADR 25-92, Chapter 1, Section 1-6(j).

9.4. IAW AR 530-1, new contractors and associated subcontractors who require a CAC Card and access to the CCAD network must complete Level I OPSEC training within 30 calendar days of reporting for duty and annual OPSEC contractor refresher training, thereafter.

9.5. Threat Awareness Reporting Program Training: Per AR 381-12 Threat Awareness and Reporting Program (TARP), contractor employees must receive annual TARP training presented by a Counterintelligence Special Agent.

10. Pass and Identification Items: The Contractor shall obtain the pass and identification items for employees and Contractor owned vehicles required for contract performance.

11. Retrieving Identification Media: The Contractor shall retrieve all identification media, including vehicle passes from employees who depart for any reason before the contract expires; e.g. terminated for cause, retirement, etc. and surrender to CCAD security through the COR.

12. Weapons, Firearms, and Ammunition: Contractor employees are prohibited from possessing weapons, firearms, or ammunition, on themselves or within their Contractor-owned vehicle or privately- owned vehicle while on CCAD.

13. Safeguarding Classified or Sensitive Information: Any material marked as Top Secret, Secret, Confidential, For Official Use Only (FOUO) Freedom of Information Act (FOIA), Privacy Act Information, or any other restrictively marked material discovered by the Contractor or Contractor employees will be surrendered at the earliest opportunity to any military or DoD employee of the installation. Under no circumstances will the Contractor retain such material. The Contractor and all Contractor employees will execute a SF 312, Classified Information Non-Disclosure Agreement or equivalent CCAD Non-Disclosure Agreement as directed or required.

13.1. Classified: Visitor Groups will safeguard classified information IAW DoD 5200.1-R, DoD Information Security…