RFI HQ BSC Shredding Services FY 27 Requirement Statement of Work.pdf

Statement of Work (SOW)

FY27 Shredding Service Naval Supply Systems Command, Headquarters

Naval Supply Systems Command, Business Systems Center (BSC) 5450 Carlisle Pike

Mechanicsburg, PA 17050-2411

1. Background:

The purpose of this Performance Work Statement (PWS) is to obtain secure documents and media destruction services for NAVSUP Headquarters. The contractor shall provide all personnel, equipment, transportation, containers, and other resources necessary to securely collect, transport, destroy, and dispose of designated materials in accordance with applicable federal, Department of Defense, Department of the Navy, and local requirements.

2. Requiring Organization:

5450 Carlisle Pike Mechanicsburg, PA 17050-2411

Naval Supply Systems Command, BSC 5450 Carlisle Pike

3. Scope:

The contractor shall provide recurring secure destruction services for materials identified by the Government for destruction. Materials may include paper records and other approved media containing sensitive information. Services shall include:

• Furnishing secure, lockable collection containers.

• Scheduled pickup and/or on-site destruction.

• Secure handling and accountability of material from Government custody through final destruction.

• Destruction to a condition that prevents reconstruction or recovery of the information.

• Appropriate recycling or disposal of destroyed material.

• Providing a Certificate of Destruction following each service.

4. Information Protection Requirements:

The contractor shall safeguard all Government information and materials encountered during performance of this contract.

Material designated for destruction may contain information requiring protection, including Controlled Unclassified Information (CUI), Personally Identifiable Information (PII), Privacy Act information, acquisition information, proprietary information, and other sensitive Government information. The contractor shall not:

• Review, photograph, copy, reproduce, retain, transmit, disclose, or otherwise use Government information except as necessary to perform the contracted destruction service.

• Remove material from approved containers or Government-controlled locations except as specifically authorized.

• Discuss or disclose information observed during contract performance to unauthorized individuals.

• Use Government information for any commercial, personal, or other unauthorized purpose.

Any suspected or confirmed loss, compromise, unauthorized disclosure, or mishandling of Government information shall be reported immediately to the designated Contracting Officer’s Representative (COR) and appropriate Government security representative.

5. Controlled Unclassified Information:

When CUI is included in materials provided for destruction, the Government organization responsible for the information remains responsible for identifying and appropriately marking the information prior to transfer for destruction. The contractor shall protect CUI received during contract performance from unauthorized access or disclosure and shall perform destruction in accordance with applicable CUI safeguarding and destruction requirements.

CUI shall not be released to the public or transferred to unauthorized subcontractors, recycling facilities, or other third parties before it has been destroyed to the point that the information is unreadable, indecipherable, and irrecoverable.

6. Chain of Custody:

The contractor shall maintain positive control of materials designated for destruction throughout the destruction process.

• Material shall remain secured during transportation.

• Vehicles used to transport materials shall prevent unauthorized access.

• Material shall not be left unattended in an unsecured location.

• Access shall be limited to authorized contractor personnel.

• The contractor shall maintain a documented chain of custody from Government pickup through final destruction.

7. Destruction Requirements:

Information must be disposed of by shredding or pulverizing/disintegrating in a manner that precludes the information from being read or reconstructed. The maximum particle size of cross-cut shredded document cannot exceed 1 x 5 mm. Pulverization/Disintegrator machines must be equipped with a security screen not to exceed 3/32 in. (2.4 mm). These are the new standards for the destruction of Controlled Unclassified Information (CUI). All shredding will occur on site with designated security representative present.

8. Deliverables:

a) Shredding barrels

i) NAVSUP HQ: The Contractor shall provide a quantity of 35, 64-gallon secure shredding barrels to various locations in Bldg. 309. The contractor shall collect and remove designated shredding bins every other Tuesday (biweekly) at 1:00 PM or coordinated time if required to be changed.

ii) NAVSUP BSC: The Contractor shall provide a quantity of 19, 64-gallon secure shredding barrels to various locations in Bldg 312 and 409. BSC only requires barrels to be emptied every other month (six times per year)

Contractor will comply with installation, facility, physical-security, access-control, and escort requirements.

The Government reserves the right to deny facility access to any contractor employee who does not meet applicable security or access requirements.

b) Certificate of Destruction:

Following each destruction service, the contractor shall provide documentation certifying that the material was destroyed in accordance with contract requirements. The Certificate of Destruction should include, at a minimum:

• Date of destruction.

• Location or facility where destruction occurred.

• General description or quantity of material destroyed.

• Method of destruction.

• Contractor representative responsible for certification.

• Certification that the material was rendered unreadable and irrecoverable.

10. OPSEC Requirements:

Contract performance shall be conducted in a manner that minimizes unnecessary exposure of NAVSUP operations, personnel, facilities, organizational information, schedules, and other operational indicators.

Contractor personnel shall not photograph, record, post, publish, or disclose information concerning Government facilities, personnel, operations, destruction schedules, container locations, security procedures, or other information observed during contract performance unless specifically authorized by the Government.

Only information necessary to accomplish the contracted requirement shall be provided to contractor personnel.

11. Contractor Responsibilities:

The contractor shall:

• Provide all required destruction services and equipment.

• Maintain accountability and security of Government material.

• Protect information from unauthorized access or disclosure.

• Immediately report security incidents.

• Provide required destruction documentation.

• Comply with all applicable Government security, privacy, CUI, OPSEC, installation-access, and information-protection requirements.

12. Period of Performance:

Estimated 28 December 2026 to 27 December 2027 plus four (4) 12-month option periods.

13. Place of Performance:

5450 Carlisle Pike, Buildings 214, 407 and 309

Naval Supply Systems Command, BSC

5450 Carlisle Pike, Buildings 409 and 312

14. Point of Contact:

TBD

15. SECURITY

ON-BOARDING PROCESS

All contractor resource onboarding documents must be submitted via the prime contractor. An employee is considered to be “productive” upon completion of the following items:

a. OF-306 signed by contractor employee

b. Electronic Fingerprint Submission

c. Completed SF-85 (eAPP) within 20 days after contract award

d. All contractor resource(s) must have an active Defense Information System for Security (DISS) profile within 20 days after contract award

e. DBIDS

f. Controlled Unclassified Information Certification

g. Antiterrorism Level I Certification

h. OPSEC Awareness Training Certification

i. User Access Request (UAR) Only applies when contractor requires access to ERP/SAP (Contractor does not require this access.)

j. TWMS profile for each contractor (IA/Security training compliance System of Record) (if applicable)

Note (1): Invoicing by the contractor will begin as of the commencement of the performance period of services.

Note (2): Dual Citizenship and Foreign Nationals are not allowed access to the functional/system side of

ERP/SAP.

Contractor and subcontractor employees performing under this task order are required to sign a Non-disclosure Agreement (NDA) as part of their onboarding process. Refer to DFARS 252.204-7000, Disclosure of Information, and DFARS 252.204-7003, Control of Government Personnel Work Product.

SUPTXT204-9400(4-22) CONTRACTOR UNCLASSIFIED ACCESS TO FEDERALLY

CONTROLLED FACILITIES, SENSITIVE INFORMATION, INFORMATION TECHNOLOGY

SYSTEMS OR PROTECTED HEALTH INFORMATION

This local text does not apply to non-United States (U.S.) Nationals (foreign nationals) who are contactor employees performing work overseas. The local text is applicable to the U.S. Nationals living in the U.S.

or overseas who are performing work on a Navy contract.

The investigation of a non-U.S. national at a foreign location must be consistent with a National Agency Check with Written Inquiries (NACI), to the extent possible and include a fingerprint check against the Federal Bureau of Investigation (FBI) criminal history database, an FBI investigations file (name check) search and a name check against the terrorist screening database. Also, the above cited reference notes that Foreign Nationals may not be granted CAC credentials until completion of their investigation and not in the interim.

Per Department of Defense Memorandum (DoDM) 5200.2, Department of Defense (DoD) components must initiate and ensure completion of a background investigation before applying the credentialing standards to a non-U.S. national at a foreign location. The background investigation must be favorably adjudicated before a CAC can be issued to a non-U.S. national at a foreign location. The type of background investigation may vary based on standing reciprocity treaties concerning identity assurance and information exchanges that exist between the U.S. and its allies or agency agreements with the host country.

CONTRACTOR UNCLASSIFIED ACCESS TO FEDERALLY CONTROLLED FACILITIES,

SENSITIVE INFORMATION, IT SYSTEMS OR PROTECTED HEALTH INFORMATION

Executive Order 13467, Reforming Processes Related to Suitability for Government Employee, Fitness for Contractor Employees and Eligibility for Access to Classified National Security Information, Homeland Security Presidential Directive (HSPD)-12, requires government agencies to develop and implement Federal security standards for Federal employees and contractors. The 5 CFR 32 Part 157 in concert with DoD Manual 1000.13, Vol 1, implements the Federal Standards.

APPLICABILITY

This text applies to all DoD sponsored individuals who require CAC eligibility (or login and P/W if acceptable per contract) for: Physical access to DoD facilities or non-DoD facilities on behalf of DoD;

Logical access to information systems (whether on site or remotely); or remote access to DoD networks that use only the CAC logon for user authentication, or access to sensitive and protected information. This applies to the Office of the Secretary of Defense (OSD), the Military Departments, the Office of the Chairman of the Joint Chiefs of Staff and the Joint Staff, the Combatant Commands, the Office of the Inspector General of the DoD, the Defense Agencies, the DoD Field Activities and all other organizational entities within the DoD (hereinafter referred to collectively as the "DoD Components").

ACCESS TO FEDERAL FACILITIES

Definition. As used in this clause - Military installation means a base, camp, post, station, yard, center, or other activity under the jurisdiction of the Secretary of a military department or, in the case of an activity in a foreign country, under the operational control of the Secretary of a military department or the Secretary of Defense (see 10 U.S.C. 2801(c)(4)).

Per HSPD-12 and implementing guidance, all contractor employees working at a federally controlled base, facility or activity under this clause will require a DoD CAC. When access to a base, facility or activity is required contractor employees shall in-process with the Command's Security Manager (CSM) upon arrival to the command and shall out-process prior to their departure at the completion of the individual's performance under the contract.

Training. Contractor employees who require routine physical access to a Federally controlled facility or military installation shall complete “Level I Antiterrorism Awareness Training” prior to gaining access to a facility and annually thereafter in accordance with DoDI O-2000.16 Vol I. In accordance with Department of Defense Instruction O-2000.16 Volume 1, DoD Antiterrorism (AT) Program Implementation: DoD AT Standards, Level I Antiterrorism Awareness Training shall be completed by:

1. Completion of “Level I Antiterrorism Awareness Training” available at https://jkodirect.jten.mil/pdf/atl1/launch.html; or

2. Under the instruction of a qualified Level I Antiterrorism Awareness instructor; or

3. Providing a training certificate for “Level I Antiterrorism Awareness Training” training showing completion within the last calendar year in accordance with DoDI O-2000.16 Vol I.

The contractor will submit certificates of completion for each affected contractor employee and subcontractor employee to the COR or to the contracting officer, if a COR is not assigned, prior to being granted access to a Federally controlled facility or military installation.

Subcontracts. The Contractor shall include the substance of this clause, including this paragraph (d), in subcontracts, including subcontracts for commercial items, when subcontractor performance requires routine physical access to a Federally-controlled facility or military installation.

OPERATION SECURITY (OPSEC)

It is DoD policy according to DoD Directive 5205.02E, “DoD Operations Security (OPSEC) Program,” June 20, 2012, as amended to establish and maintain OPSEC programs to ensure national security-related missions and functions are protected.

No information, reports, dashboards, metrics, or data relative to the work performed under this contract shall be released to the public, media, or any external entity by the contractor or any subcontractor without prior written approval from the Contracting Officer (KO) and formal clearance by the Government Public Affairs Office (PAO) and OPSEC Officer. This includes, but is not limited to, academic papers, marketing materials, press releases, website case studies, or online professional profiles.

The contractor shall adhere to the NAVSUP Critical Information and Indicators List (CIIL) provided when in-processing in. Contractor personnel shall not publicly disclose, discuss, or aggregate unclassified indicators.

Training: Contractor employees shall comply with all DoD OPSEC requirements and complete “OPSEC Awareness for Military Members, DoD Employees and Contractor” training within 30 days of onboarding the contract and annual refresher training thereafter. Training shall be completed through a DoD sponsored and certified computer or web-based learning instruction available at https://securityawareness.dcsa.mil/opsec/index.htm.

The contractor will submit certificates of completion for each affected contractor employee and subcontractor employee to the COR or to the contracting officer, if a COR is not assigned, within 30 calendar days after training is completed by all employees and subcontractor personnel.

DENIAL OR TERMINATION OF ACCESS

The potential consequences of any requirement under this clause including denial or termination of physical or system access in no way relieves the contractor from the requirement to execute performance under the contract within the timeframes specified in the contract. Contractors shall plan ahead in processing their employees and subcontractor employees. The contractor shall insert this clause in all subcontracts when the subcontractor is permitted to have unclassified access to a federally controlled facility, federally-controlled information system/network and/or to government information, meaning information not authorized for public release.

ACCESS TO CONTROLLED UNCALSSIFIED INFORMATION

Safeguarding sensitive unclassified information is critical to achieve NAVSUP Modernization efforts and deliver cutting-edge and uncompromised capabilities. The Secretary of Defense’s operations security (OPSEC) campaign plan stresses the importance of protecting controlled unclassified information (CUI).

CUI encompasses OPSEC, critical technology, intelligence, and personally identifiable information that, if not properly identified, marked, and controlled, could impair NAVSUP’s ability to conduct its mission.

Contractor employees with access to Controlled Unclassified Information (CUI) shall comply with DoDI

5200.48 - Controlled Unclassified Information (CUI) and complete DoD approved initial and annual refresher CUI training https://securityawareness.dcsa.mil/cui/index.html.

a. Whenever Government provides CUI to, or CUI is generated by, non-DoD entities, all CUI records must be handled as required by the approved mandatory disposition authority.

b. All CUI records must follow the approved mandatory disposition authority whenever the Government provides CUI to, or CUI is generated by, non-DoD entities in accordance with Section 1220-1236 of Title 36, CFR, Section 3301a of Title 44, U.S.C., and the DoDI 5200.48.

c. Contractor employees shall monitor CUI aggregation and compilation based on the potential to generate classified information pursuant to security classification guidance addressing the accumulation of unclassified data or information.

d. Contractor employees shall submit unclassified government information for review and approval for release in accordance with the Standard DoD Component Processes, DoDI 5230.09, and DoDM 5205.07, Volume 1

BACKGROUND INVESTIGATION REQUIREMENTS AND SECURITY APPROVAL PROCESS FOR

CONTRACTORS ASSIGNED TO OR PERFORMING NON-SENSITIVE DUTIES

Contractor employee whose work is unclassified and non-sensitive (e.g., performing certain duties such as lawn maintenance, vendor services, etc...) and who require physical access to publicly accessible areas to perform those duties shall meet the following minimum requirements:

• Must be either a U.S. citizen or a U.S. permanent resident with a minimum of 3 years of legal residency in the U.S. (as required by the Deputy Secretary of Defense DTM 08-006 or its subsequent DoD Instruction (INST)) and

• Must have a favorably completed T1 investigation or equivalent including a FBI fingerprint check prior to installation access.

To be considered for a favorable trustworthiness determination, the CSR must submit for all employees each of the following:

• SF-85 Questionnaire for Non-Sensitive Positions

• Electronic fingerprint submission

• Original Signed Release Statements

The contractor shall ensure each individual employee has a current favorably T1 or equivalent investigation, or ensure successful FBI fingerprint results have been gained and investigation has been processed with OPM.

Failure to provide the required documentation at least thirty (30) days prior to the individual's start date may result in delaying the individual's start date.

Contractor and all Contractor employees with access to or responsibility for operations and sustainment of this contract shall comply with DoD Directive 8500.1E IA, DoDI 8510.01 Risk Management Framework (RMF) for DoD IT, DoD Directive 5400.11 DoD Privacy Program, DoD 5200.2-R Personnel Security Program and HSPD 12

All contractor personnel must:

a. Be citizens of the U.S

b. Be CAC ready at the properly designated IT System Level

If at any time, any contractor employee requiring a Common Access Card (CAC) is unable to possess/maintain the required adjudicated background investigation, the contractor shall immediately notify the NAVSUP COR to coordinate removal of such a person from work under this contract.

Contractor employees with access to or responsibility for nonpublic government data under this contract must comply with HSPD-12 Personal Identity Verification (PIV) issuance requirements, known as the

CAC.

16. Performance Standard:

The contractor shall provide secure, timely, and reliable destruction services with zero unauthorized disclosures, losses, or compromises of Government information.

The desired end state is that material identified for destruction is securely controlled from collection through final destruction and cannot be reconstructed, recovered, or accessed by unauthorized individuals.