RFQ 832267259 DoD OIG IT Org_20220727.pdf

DEFENSE INFORMATION SYSTEMS AGENCY

DEFENSE INFORMATION TECHNOLOGY CONTRACTING ORGANIZATION

2300 East Drive, Building 3600

Scott Air Force Base, Illinois 62225-5406

July 27, 2022

Department of Defense (DoD) Enterprise Software Initiative (ESI) Blanket Purchase Agreement

(BPA) Holder, Gartner, Inc.

1. This sole source request for quotation (RFQ) is to support the Department of Defense (DoD) Office of

Inspector General (OIG)’s requirement for information technology (IT) organizational change consulting services. The Government reserves the right to cancel this solicitation, either before or after the closing date. In the event the Government cancels this solicitation, the Government has no obligation to reimburse an offeror for any costs.

The specifics are as follows:

Table 1 – RFQ Specifics

Tracking Number 832267259

Task/Delivery Order Title DoD OIG IT Organizational Change Consulting Services

Small Business Set-aside No

Order Type Firm Fixed Price (FFP)

Other Direct Costs

(ODCs) / Travel Not applicable (N/A)

Period of Performance Estimated: September 1, 2022 through August 31, 2023

Incumbent Contractor Yes, Gartner, Inc.

Maximum # of Government

Seats Available To be determined

Section 508 Applicable Yes

Method of Evaluation Sole Source Negotiated Procurement

Performance Based Yes

DD254 Required No

Quotation Due Date 3:00 p.m. CT; August 3, 2022

2. You are requested to submit a written technical and price quotation in response to the attached

Performance Work Statement (PWS) (Attachment 1). The initial Quality Assurance Surveillance Plan

(QASP) (Attachment 2) is also attached for contractor reference. Quotations should be prepared in accordance with (IAW) the contractor’s DoD ESI BPA. Further information on submission of your quotation is provided throughout this document.

a. The offeror shall specifically identify in its quotation, whether or not any potential or actual

Organizational and Consultant Conflicts of Interest (OCCI) as described in Federal Acquisition

Regulation (FAR) Subpart 9.5 exists for this instant procurement. The OCCI language is contained along with the FAR/DFARS provisions/clauses as H1, Organizational and Consultant Conflicts of Interest

(OCCI). If the offeror believes that no OCCI exists, the OCCI response shall set forth sufficient details to support such a position. If an offeror believes that an actual or perceived OCCI does exist on the instant procurement, the offeror shall submit an OCCI plan with the quotation, explaining in detail how the

OCCI will be mitigated and/or avoided.

b. As stated under Place of Performance in the PWS, and above, the maximum number of

Government seats available for this effort are to be determined. The contractor shall specifically identify in its quotation the amount of Government seats their solution will require.

c. If you have questions about the Government Furnished Property (GFP) attachment (Attachment 3) or there is a need to exceed the maximum quantity of the listed items noted in the attachment for performance-based acquisitions, you must request clarification from the contracting officer prior to the due date for receipt of questions. You shall define the quantity of GFP within the range on the GFP attachment at quotation submission. If you fail to define a quantity of a GFP item in your quotation, you may only receive the minimum quantity of GFP listed in the attachment. Upon issuance of award, items identified in the GFP attachment will be issued as GFP via the GFP Module in the Procurement Integrated

Enterprise Environment (PIEE) suite and stored in Electronic Document Access in PIEE.

3. Basis for Award Determination: The Government will evaluate your quotation to determine your ability to accomplish the tasks set forth in the PWS. Section 508 Accessibility Standards do apply to this requirement. Section 508 requirements are listed in the attached PWS (Attachment 1). The technical quotation shall be submitted in Microsoft (MS)Word 2007 or newer file. The page format shall have a 1 inch margin using no smaller than an 11 point Arial, Times New Roman, or Courier New font for all text to include any text contained in a table. The price quotation spreadsheet shall be a separate document from the technical quotation and shall be submitted in MS Excel 2007 format. All formulas shall remain present in the spreadsheet for verification. The file size of each document shall not exceed 20MB. It is the sole responsibility of the offeror to ensure that the electronic files submitted are virus free and can be opened and read by the Government. Quotation submissions shall not be locked, encrypted, or otherwise contain barriers to opening. The technical quotation shall be limited to seven (7) pages.

a. The technical quotation will be evaluated to determine if it meets the technical requirements as stated in the PWS.

b. The price quotation will be evaluated using one or more of the techniques defined in FAR Part

15.404 in order to determine if it is reasonable and complete. Reasonableness is established through cost and price analysis techniques as described in FAR 15.404. For a price quotation to be complete, all solicitation requirements must be priced, figures correctly calculated, and prices presented in in a clear and useful format. You shall submit pricing for the base period, including option pricing for an additional

6-month period that may be authorized IAW FAR 52.217-8. See FAR 52.217-8 which authorizes the

Government to require continued performance of any services within the limits and at the rates specified in the contract. The CLIN Pricing Worksheet should include a separate line item for the additional 6-month period IAW FAR 52.217-8. These prices shall be identical to the proposed pricing in the 6 months prior to expiration of the base period, or the final option period, if option periods are present. The total evaluated price will consist of the contractor’s proposed price for the base period, all option periods, the option pricing for the additional 6-month period, and surge pricing as requested below.

The Government is requesting discounts to the labor rates currently on contract/schedule. The reduced labor rates will apply only to the respective task order and will not change the fixed rates in the contract/schedule.

The Government may require surge support in accordance with DITCO Special Contract Requirement H6

– Option To Exercise Surge Support. The Government is providing a percentage value to be used when proposing surge. Surge support will not exceed 25% of the contractor’s total proposed price for the base and all option periods, excluding any 6-month extension of services pursuant to FAR 52.217-8. The contractor is instructed to propose this EXACT percentage for Surge CLIN 9999. Pricing for optional

CLIN 9999 shall be quoted as a cost reimbursable, not-to-exceed CLIN. The Government will not conduct a cost realism analysis on optional surge CLIN 9999 if all other labor CLINs under the contract/task order are fixed price.

4. A fixed price payment plan commensurate with the value of the deliverables and/or significant milestones in the PWS must be submitted with your quotation. A fixed price payment plan with the total dollar amount divided into 12 equal monthly payments will not be accepted unless you provide justification for this plan that the Government subsequently deems adequate. If justification is provided and deemed adequate, you shall ensure your monthly price (total price divided by 12), comes to no more than two decimal places. You will be authorized to invoice monthly for all approved travel costs incurred and approved by the COR.

5. Attachment 6 contains provisions that apply to this solicitation and clauses that will be applicable to the resulting award. Some of the provisions and additional DITCO instructions require a response from the offeror and will need to be submitted along with your quotation. The plan required by DFARS

252.237-7024, Notice of Continuation of Essential Contractor Service, will be evaluated for acceptability based on the requirements of DFARS 252.237-7024 (2)(i-v).

6. By submitting a quotation in response to this solicitation, you are submitting an offer that the

Government may accept, and you agree that if the Government awards you the order, the award document sent by the Government to the contractor is a binding and enforceable contract. The contractor has a legal obligation to perform in compliance with all aspects of the PWS if awarded the order.

7. Portions of the offeror’s quotation may be incorporated into the order.

8. Quotations are due no later than August 3, 2022 at 3:00 p.m. (CT) and should be submitted to the contract specialist at DITCO via the following email address: rebecca.d.mooney.civ@mail.mil with a copy to the Contracting Officer at tamara.j.norrenberns.civ@mail.mil.

Sincerely, TAMARA J. NORRENBERNS

Contracting Officer

Attachment 1, PWS

Attachment 2, Initial QASP

Attachment 3, Government Furnished Property (GFP)

Attachment 4, CLIN Pricing Worksheet

Attachment 5, Mission-Essential Contractor Services

Attachment 6, FAR/DFARS Provisions/Clauses

Attachment 7, Justification and Approval, Redacted

PERFORMANCE WORK STATEMENT (PWS)

Award/Mod

Version Date

Award

Contract Number:

To be determined (TBD)

Task Order Number:

To be determined (TBD)

Contractor Name

To be determined (TBD)

Tracking Number:

832267259

Follow-on to Previous Contract and Task Order Number:

N66001-19-A-0049; HC102821F0503

1. Contracting Officer’s Representative (COR).

Name:

To be provided upon award

Organization:

To be provided upon award

Department of Defense Activity Address Code:

To be provided upon award

Address:

To be provided upon award

Phone Number:

To be provided upon award

Fax Number:

To be provided upon award

E-Mail Address:

To be provided upon award

2. Contract or Task Order Title. DoD OIG Information Technology (IT) Organizational Change Consulting Services

3. Background. The DoD OIG mission is to detect and deter fraud, waste, and abuse in DoD programs and operations; promote the economy, efficiency, and effectiveness of the DoD; and help ensure ethical conduct throughout the DoD. The DoD OIG keeps the Secretary of Defense and the Congress informed of fraud, waste, abuse, and program deficiencies identified through its oversight work. The DoD OIG’s administrative and criminal investigators, auditors, evaluators, and support staff operate globally, conducting investigations, audits, evaluations, and mission support activities to accomplish the DoD OIG’s mission.

The DoD OIG Office of the Chief Information Officer (OCIO) is responsible for installing, maintaining, operating, and supporting all DoD OIG IT systems and communications capabilities for approximately 1,800 end users and 65 locations around the globe. Due to the independence of the DoD OIG, the OCIO provides the full spectrum of IT services necessary to support the OIG mission including network security, infrastructure, enterprise architecture, business system development, unified communications, asset management, project management and budget, help desk support and their supporting Information Technology Service Management (ITSM) processes.

From July 2021 through January 2022, a comprehensive assessment of the DoD OIG OCIO was performed, to include roles and responsibilities, organizational structure, government and contractor staffing, business activities, and supporting processes. This assessment defined the “as is” environment and made recommendations for organizational improvement based on existing requirements and information gathered through research, previous OCIO assessments, and interviews with DoD OIG personnel.

4. Objectives. The DoD OIG OCIO requires IT organizational change consulting services to implement the abovementioned organizational change recommendations in order to improve the efficiency and effectiveness of DoD OIG OCIO’s IT business operations and capabilities. The objective to this follow-on includes:

· Accelerate organizational change to achieve organizational and performance requirements as defined by the OIG.

· Engage workforce and change leaders to help identify and manage risks and issues associated with implementing the approved recommendations from the previous consultation services.

· Increase employee confidence and readiness for changes by preparing them for their role and responsibilities in the new organizational structure.

· Develop more mature and consistent processes contributing to highly stable and available IT services.

· Increase customer satisfaction for all IT services being delivered and supported.

· Increase organizational trust in OCIO teams to develop and deliver new IT solutions and services.

5. Scope. The IT organizational change consulting services will use the results of an organizational assessment conducted from July 2021 through January 2022 to improve the efficiency and effectiveness of OIG IT business structure, operations, and capabilities. This will be accomplished by linking the organizational and operational recommendations from the results of the organizational assessment to a well-defined mitigation strategy.

The Government may require surge support during this task order, and surge modifications will be within the scope of the task order and provide increased support for the defined task areas of this PWS. Surge support over the life of the task order will not exceed 25% of the total task order value, excluding any six-month extension of services pursuant to Federal Acquisition Regulation (FAR) 52.217-8.

6. Performance Requirements.

6.1 Task 1: OCIO Organizational Change Support: The contractor shall finalize the approved target OCIO organizational structure and roles/responsibilities; map contractor staffing/skill requirements to current and target organizational structure; define and support execution of organizational change plan and communications plan; assist OCIO staff with documenting target roles/responsibilities; refine OCIO governance model (e.g., boards, members, responsibilities or decisions to govern); and perform other tasks as required to implement the organizational changes.

6.1.1 Subtask 1: Initiate and Manage Project. The contractor shall:

• Conduct kick-off with sponsor and project team

• Review project objectives, scope and tasks

• Identify appropriate stakeholders to collaborate with throughout project

• Establish project management and status reporting cadence

6.1.2 Subtask 2: Finalize Target OCIO Organization Structure and Change Plan. The contractor shall:

• Work with OIG executive leadership to identify and document the final OCIO target organizational structure

• Work with Strategic Planning and Performance to define overall plan / milestones

• Develop an OCIO target organizational change management plan

• Support OIG communication and execution of the transition (reorganization, case for change, required actions, change plan / milestones

• Collaborate with OCIO to map individuals into target organizational structure

• Validate future full time equivalent (FTE) staffing needs and contractor staffing/skill requirements

6.1.3 Subtask 3: Prepare for OCIO Organizational Change. The contractor shall:

• Conduct stakeholder analysis

• Collect OCIO staff input via survey or other methods to help enable change success

• Develop organizational change communication plan

• Conduct OCIO staff impact analysis and identify potential individual needs to enable change (e.g., specific guidance, training, leadership/human resources discussions, etc.)

• Develop and maintain organizational change risk/issue tracker

6.1.4 Subtask 4: Enable OCIO Organizational Change and Transition. The contractor shall:

• Update OCIO target state organizational roles and responsibilities

• Refine OCIO governance model (e.g., boards, members, responsibilities) and associated documentation

• Conduct one-to-one or group sessions with OCIO staff to review and discuss target roles and responsibilities

• Draft input and modify OCIO job descriptions

• Conduct OCIO staff change readiness assessment via survey or other methods

• Support development of other materials associated with communication plan (as needed)

Deliverables:

PWS Task

Deliverable Title

Description

Format

Distribution

Due Date

6.1.1

Project Kickoff Materials

· High-level view of contractor’s understanding of project for stakeholder validation, including a review of project team, approach, deliverables, timeline, assumptions, interview targets, and data collection needs. The contractor shall provide coaching and support to the OCIO Transformation Lead to implement approved recommendations from the previous engagement.

Government Approved, Contractor Determined Format

Standard Distribution*

5 business days after date of award

Bi-Weekly Status Reports

· High-level review (at least bi-weekly) of completed and planned activities. Meetings will be scheduled, as necessary.

Government Approved, Contractor Determined Format

Standard Distribution*

2 weeks after date of award then on-going every 2 weeks

6.1.2

Final Target Organizational Structure and Change Plan

Series of work products that will finalize the target OCIO organizational structure and organizational change plan:

· Case for Change – used by leadership to communicate goals and objectives of re-organizing.

· Organizational Change Plan – planned schedule in which to transition to new organizational structure and manage progress against.

· Final Target OCIO Organizational Structure – collaboratively designed and agreed upon target state organizational structure with staff and reporting assignments identified.

· OCIO FTE Staffing Gaps / Contractor Organizational Needs – Identification and validation of staffing gaps by OCIO division chiefs and OIG leadership validation and support to address.

Government Approved, Contractor Determined Format

Standard Distribution*

8 Weeks after date of award

6.1.3

Organizational Change Preparation Support

Series of work products that will prepare for OCIO organizational change:

· Stakeholder Analysis – Identifies various stakeholder groups and potential communication needs.

· Organizational Change Communication Plan – Defines the “what,” “when,” “how,” and “by whom” in which to communicate to per the results of the stakeholder analysis and in which to manage moving forward during organizational change.

· OCIO Staff Impact Analysis & Needs – identifies level and degree of impact on OCIO staff as a result of organizational change and resulting implications or needs such as training for new position/role, update to job title or job description, new manager, etc.

· Risk / Issue Tracker – Establish and produce an issue tracker to identify, track, and manage risks and issues that may impact the Organizational Change Plan (schedule) from 6.1.3.

Government Approved, Contractor Determined Format

Standard Distribution*

10 weeks after date of award

6.1.4

Organizational Change Transition Support

Series of work products that will enable final OCIO organizational change and transition to new target state:

· Final Target OCIO Organizational Roles & Responsibilities – Detail IT division/team/position roles and responsibilities (e.g., Responsible, Accountable, Consulted, and Informed charts) to inform stakeholders and training.

· Target OCIO Governance Model and Charters – Update existing governance committees or boards with respect to what IT decisions are being governed and by whom.

· Updated OCIO Job Descriptions – update existing job descriptions to more accurately reflect roles and responsibilities of target state to leverage existing staff and future talent.

· OCIO Staff Change Readiness Assessment Results – Survey results or other artifacts from IT staff to provide OIG and IT leadership additional input and indication that staff are fully prepared and ready to implement reorg and take on new responsibilities.

Government Approved, Contractor Determined Format

Standard Distribution*

36 weeks after date of award

*Standard Distribution: 1 copy of the transmittal letter without the deliverable to the Contracting Officer; 1 copy of the transmittal letter with the deliverable to the Primary COR.

6.2 Task 2: ITSM Program Maturation Support: The contractor shall coordinate with the OCIO to establish an ITSM governance and program for implementation across OIG, develop and implement tactical recommendations for foundational ITSM processes and alignment to the new organization and contractor structure. The contractor shall clearly define roles, responsibilities, and integration points between OIG and vendors for incident, problem, and change management. The contractor shall provide tactical recommendations and actions for the supporting processes with workshops to provide OIG coaching, follow-on support, and provide roadmap and action plan scenarios.

This effort will focus on the seven (7) targeted and the eleven (11) integrated processes as covered within the scope of the IT organizational assessment:

Key “Target” Processes (7)

“Integrated” Processes (11)

Service Desk

Business Relationship Management

Request Fulfillment

Service Portfolio

Incident Management

Service Catalog

Problem Management

IT Service Continuity

Change Management

Knowledge Management

IT Asset Management

Transition Planning and Support

Demand Management

Release & Deployment

Configuration Management

Service Level Management

Event Management

Access Management

6.2.1 Subtask 1: Initiate and Manage Project. The contractor shall:

• Conduct kick-off with sponsor and project team

• Review project objectives, scope and tasks

• Identify appropriate stakeholders to collaborate with throughout project

• Establish project management and status reporting cadence

6.2.2 Subtask 2: Develop ITSM Governance and Strategy. The contractor shall:

• Collect and review existing documentation and conduct follow-on interviews to design and implement the ITSM governance structure

• Conduct Governance review workshop and update documents

· Identify key process integration points for tactical implementation

· Review Standard Operating Procedure library to identify gaps and areas for improvement

6.2.3 Subtask 3: Develop Targeted Processes. The contractor shall:

• Plan and identify tactical actions to support implementation of approved recommendations from the previous consultation services that align with the key ITSM processes and organizational changes

• Define roles and responsibilities and key process integration points

• Develop process maps and policies that align with the key ITSM processes

• Continue coaching and template development to achieve the business benefits across the processes

6.2.4 Subtask 4: Identify Process Improvement Opportunities. The contractor shall:

• Identify new potential process improvement opportunities while executing operational task and organizational change to target state

• Establish regular working groups (minimum of monthly meetings) within OCIO to review recommendations, refine or develop the process improvement roadmap, and implement improvements.

• Measure and report on process team’s progress

• Develop roadmap for improvement areas & action plans

6.2.5 Subtask 5: ITSM Maturation Roadmap and Final Briefing Provide Refining. The contractor shall:

· Conduct final presentation

· Present roadmap for optimization initiatives

Deliverables:

PWS Subtask

Deliverable Title

Description

Format

Distribution

Due Date

6.2.1

Project Kickoff

Materials

· High-level view of the contractor’s understanding of project for stakeholder validation, including a review of project team, approach, deliverables, timeline, assumptions, interview targets, and data collection needs.

Government Approved, Contractor Determined Format

*Standard Distribution

5 business days after award

Bi-Weekly Status Reports

· High-level review (at least bi-weekly) of completed and planned activities. Meetings will be scheduled, as necessary.

Government Approved, Contractor Determined Format

*Standard Distribution

2 weeks after date of award then on-going every 2 weeks

6.2.2

ITSM Governance and Strategy Report

· Completed ITSM governance and strategy structure identified to permit rollout of an ITSM program.

Government Approved, Contractor Determined Format

*Standard Distribution

6 weeks after date of award

6.2.3

ITSM Process Maps

· Tactical recommendations identification and planned rollout for the target processes

· Key process integration points across all processes for Information Technology Support Services 2 (ITSS2) support and to mature the target processes.

· High level process activity maps with integration points for ITSS2 support and cross functional processes.

Government Approved, Contractor Determined Format

*Standard Distribution

8 Weeks after date of award

6.2.4

ITSM Process Improvement and

Optimization Plan

· Focused individual process improvement workshops, materials/templates and action plan for addressing the recommendations and integration points across the target processes and the integration points across the integrating processes. The contractor shall provide coaching and support to the Process Lead for the implementation of the process recommendations.

Government Approved, Contractor Determined Format

*Standard Distribution

40 Weeks after date of award

6.2.5

ITSM Maturation Roadmap and Final Briefing

· High level realized benefits after the focus recommendations are implemented and a road map for each process to continue the improvement effort.

· Recommendation for the next set of processes to be tactically improved

· Final report and executive briefing

Government Approved, Contractor Determined Format

*Standard Distribution

3 Weeks after date of award

*Standard Distribution: 1 copy of the transmittal letter without the deliverable to the Contracting Officer; 1 copy of the transmittal letter with the deliverable to the Primary COR.

7. Performance Standards.

Performance Standards

Acceptable Quality Level

Method of Calculation

Bi-Weekly Status/Progress Reports

98% of the status/progress reports are delivered on time with the remaining reports delivered at a later date, upon approval by the COR.

100% inspection of bi-weekly status/progress report.

The Government will calculate the number of calendar days after report is due.

The Government will count the number of errors made by the contractor. At the Government’s discretion, the contractor may be given a period of time to make the corrections.

Remaining Deliverables PWS Task 6.1

90% of the deliverables are submitted on time and error free IAW the deliverable table in paragraph 6.1. Remaining reports delivered at a later date, upon approval by the COR.

100% inspection of PWS task 6.1 deliverables.

The Government will calculate the number of calendar days after deliverable is due.

The Government will count the number of errors made by the contractor. At the Government’s discretion, the contractor may be given a period of time to make the corrections.

Remaining Deliverables PWS Task 6.2

90% of the deliverables are submitted on time and error free IAW the deliverable table in paragraph 6.2. Remaining reports delivered at a later date, upon approval by the COR.

100% inspection of PWS task 6.2 deliverables.

The Government will count the number of errors made by the contractor. At the Government’s discretion, the contractor may be given a period of time to make the corrections.

8. Incentives. For both positive and negative performances, ratings shall be recorded in the Contractor Performance Assessment Reporting System. Further, the contractor shall prepare all deliverables and other contract documentation utilizing contractor resources. The contractor shall provide the required level of performance as stated in the PWS. In the event the services are impacted, reduced, compromised, etc., the Contracting Officer or the contractor may request an equitable adjustment pursuant to the Changes clause of the task order.

9. Place of Performance. The primary place of performance will be at the Mark Center, 4800 Mark Center Drive, Alexandria, VA 22350 and the contractor’s site. Travel in and around the primary place of performance may be required throughout the period of performance.

Alternate Place of Performance - Contingency Only. As determined by the Contracting Officer’s Representative (COR), contractor employees may be required to work at an alternate place of performance (e.g., home, the contractor's facility, or another approved activity within the local travel area) in cases of unforeseen conditions or contingencies (e.g., pandemic conditions, exercises, government closure due to inclement weather, etc.). Additionally, the contractor may be required to account for the whereabouts of their personnel should this information be requested by the COR. Non-emergency/non-essential contractors should not report to a closed government facility. Contractor shall prepare all deliverables and other contract documentation utilizing contractor resources. To the extent possible, the contractor shall use best efforts to provide the same level of support as stated in the PWS. In the event the services are impacted, reduced, compromised, etc., the Contracting Officer or the contractor may request an equitable adjustment pursuant to the Changes clause of the task order.

10. Period of Performance (PoP). The period of performance for this requirement includes one 12-month base period.

11. Security Requirements. This project will not require access to controlled or sensitive information and facilities. In the event the contractor is required to visit DoD OIG personnel at the Mark Center they will be escorted in and out of the building and will remain under the security control of an escort at all times. The contractor shall coordinate site visits with site POCs at least 72 hours prior to requiring any site access. Contractor personnel without security clearances performing any task under this PWS must be escorted by Government personnel who are cleared.

References:

a. DISA Form 786, DISA Statement of Information System Use and Acknowledgement of User Responsibilities

b. DISA Policy Letter, Unauthorized Connections to Network Devices, 11 September 2013

c. DISA Instruction 240-110-8, Information Security

d. DISA Instruction 240-110-36, Personnel Security

e. DISA Instruction 240-110-38, Industrial Security

f. DISA Instruction 240-110-43, Insider Threat Program

g. DISA Instruction 630-230-19, Cybersecurity

h. DoDM 5200.01, Vol 1-4 Information Security Program, 24 February 2012

i. DOD 5200.02, Procedures for the DoD Personnel Security Program, 3 April 2017

j. DoD Instruction 5200.48, Controlled Unclassified Information (CUI), 6 March 2020

k. DOD 5220.22-M, National Industrial Security Program Operating Manual, February 2006 Incorporating Change 02 May 2016

11.1 Security Clearance. N/A

11.2 Investigation Requirements. N/A

11.3 Visit Authorization Letters (VAL). N/A

11.4 Security Contacts. For Center or Directorate-specific security related matters, contact the Directorate or Center Security Manager at:

Name: Shari Spriggs

Phone Number: 703-604-2031

E-mail: shari.spriggs@dodig.mil

11.5 Information Security and other miscellaneous requirements.

11.5.1 Contractor personnel shall comply with all local security requirements including entry and exit control for personnel and property at the Government facility.

11.5.2 Contractor employees shall be required to comply with all Government security regulations and requirements. Initial and periodic safety and security training and briefings will be provided by Government security personnel. Failure to comply with Government security regulations and requirements shall require the company to provide the Government with a written remediation/corrective action plan; furthermore, failure to comply with such requirements can be cause for removal and the contractor will not be able to provide service on this contract/task order.

11.5.3 The tasks performed do not require access to classified material; however, contractor personnel may have access to sensitive, privileged or Privacy Act Information. Contractor personnel shall adhere to the Privacy Act, Title 5 of the United States Code, Section 552a and applicable agency rules regulations.

11.5.4 The contractor shall not divulge any information, classified or unclassified, about DoD files, data processing activities or functions, user identifications, passwords, or any other knowledge that may be gained, to anyone who is not authorized to have access to such information. The contractor shall observe and comply with the security provisions in effect at the DoD facility. Identification shall be worn and displayed as required.

11.5.5 DISA retains the right to request removal of contractor personnel regardless of prior clearance or adjudication status, whose actions, while assigned to this task order, clearly conflict with the interest of the Government.

11.5.6 Contractor personnel will generate or handle documents that contain Controlled Unclassified Information (CUI) or For Official Use Only (FOUO) information at the Government facility. Contractor personnel will generate or handle documents that contain Proprietary, Contract Sensitive, or similarly designated information at the Government facility. Contractor personnel will have access to, generate, and handle CUI only at the location(s) listed in the place of performance section of this document. All contractor deliverables shall be marked in accordance with (IAW) Department of Defense Manual (DoDM) 5200.01, Vol. 3, Vol. 4, Information Security, DoD Instruction 5200.48 Controlled Unclassified Information, DoDM 5400.07, Freedom of Information Act Program, unless otherwise directed by the Government. The contractor shall comply with the pro-visions of the DoD Industrial Security Manual, DoDM 5220.22-M, for handling classified material and producing deliverables. The contractor shall comply with DoD Instruction 8500.01, Cybersecurity.

11.5.7 The contractor shall afford the Government access to the contractor’s facilities, installations, operations, documentation, databases, and personnel used in performance of the contract/task order. Access shall be provided to the extent required to carry out a program of IT inspection (to include vulnerability testing), investigation and audit to safeguard against threats and hazards to the integrity, availability, and confidentiality of data or to the function of information technology systems operated on behalf of DISA or DoD, and to preserve evidence of computer crime.

12. Government Furnished Property (GFP)/Government-Furnished Equipment (GFE)/ Government-Furnished Information (GFI). Contractor personnel performing duties will be provided with GFE, to include Thin-Client workstation(s) and printer(s) access. IAW DoD OIG Computer Network Policy, personally owned workstations, laptop computers, software, and printers will not be connected to the DoD OIG classified and unclassified computer network or allowed in the contractor workspace. This prohibition is a security requirement to protect the DoD OIG classified and unclassified computer networks from the spread of malicious logic (viruses and Trojan Horse programs) and to protect controlled, classified/unclassified information from being compromised. All laptop computers issued to contractors' employees are government property and must be returned to the COR at the conclusion of the task order or when contractor personnel are removed from the project, whichever occurs first. GFE can be shipped to the COR at the following address with prior approval:

Department of Defense Office of Inspector General

ATTN: ALSD/PMD Podium Warehouse HL-02

4800 Mark Center Drive Alexandria, VA 22350-1500

Deliverable:

PWS Task#

Deliverable Title

Format

Due Date

Distribution/Copies

Frequency and Remarks

GFP Inventory

MS Excel spreadsheet

30 days prior to the end of the POP.

Standard Distribution*

Annually

H9

Property Management Plan

Provided template

10 days after award.

COR and PA

At award

*Standard Distribution: 1 copy of the transmittal letter with the deliverable to the Primary COR.

13. Other Pertinent Information or Special Considerations.

13.1 Data Rights. Data rights are governed by the applicable Defense Federal Acquisition Regulation Supplement (DFARS) clauses, including:

a. DFARS 252.227-7013, Rights in Technical Data – Noncommercial Items

b. DFARS 252.227-7014, Rights in Noncommercial Computer Software and Noncommercial Computer Software Documentation

c. DFARS 252.227-7015, Technical Data – Commercial Items

d. DFARS 252.227-7020, Rights in Special Works

e. DFARS 252.227-7021, Rights in Data – Existing Works

The contractor will not have any rights to property (intellectual, written, hardware, software) whose creation was funded by the Government. The Government shall have unlimited rights to all things produced under this contract that were funded by the Government. All records, files, documents, and working papers provided by the Government, generated by the Government, or generated for the Government in performance of this PWS shall be and remain government property and, shall be maintained and disposed of IAW the Government’s instructions and/or applicable markings. The contractor shall not release any data produced in performance of this contract to anyone except personnel working on this contract and respective government personnel, without the express prior written consent of the KO.

The Government has unlimited rights to all documents/material produced under this task order. All deliverables under this task order are to be delivered to the Government with unlimited rights as defined by DFARS 227.7103-5. All documents and materials, to include the source codes of any software, produced and delivered to the Government under this task order shall be delivered to the Government without any restrictions or copyright markings. Any deliverable provided to the Government with copyright restrictions or any restrictions on Government rights will be considered non-conforming and a material breach of the terms of this task order.

13.2 Hardware and Access. The contractor shall be granted limited access to the DoD OIG Network with their GFE laptop computers. Access to the DoD OIG Network will be granted using the DoD OIG sponsored Common Access Card. Contractors are not allowed to change the configuration of the GFE laptops to include, but not limited to installing applications or software, changing hardware configurations, or changing security controls unless written approval is granted from the DoD OIG Authorizing Official.

13.2.1 Before access to the DoD OIG network is granted to specified contractor users, each contractor user must provide the COR with a signed copy of the DoD OIG NIPRNET User Agreement within twenty (20) days of being approved to work on the task order. The contractor shall only connect the GFE laptops to DoD networks. The contractor may also connect to non-DoD networks for the sole purpose of establishing the Virtual Private Network connectivity to the DoD OIG network.

13.2.2 Before access to DoD information is granted to contractor employees, evidence that the training courses listed in paragraph 13.6 have been completed must be provided to the COR. All contractor(s) are required to complete the annual mandatory trainings listed in Table below to comply with the DoD OIG security policy.

13.2.3 Certificates of completion should be provided to the COR no later than twenty (20) business days after being approved to work on a task order. The table includes current trainings whereas other trainings, to include any additional established training deemed mandatory by DoD, may be identified.

13.2.4 The contractor is required to safeguard personally identifiable information (PII) IAW the Privacy Act of 1974, 5 U.S.C. § 552a, and DoD Instruction 5400.11, DoD Privacy and Civil Liberties Program during the period of performance. The DoD OIG management must be informed within 24 hours of learning that DoD PII data was compromised, lost, or stolen. Depending on the nature of information compromised, lost, or stolen, the Government has the right to invoke disciplinary action which may include civil and criminal penalties as outlined in DoD Regulation 5400.11, January 29, 2019.

13.3 Identification of Possible Follow-on Work. There is no expectation for the contractor to perform follow-on work similar in scope to the work described in this PWS.

13.4 Identification of Potential Conflicts of Interest (COI). No COIs, as defined in FAR 9.502, have been identified. If the Contractor is currently providing support or anticipates providing support to the DoD OIG that creates or represents an actual or potential organizational conflict of interest (OCI), the Contractor shall immediately disclose this actual or potential OCI IAW FAR 9.502. The contractor is also required to complete and sign an OCI Statement in which the Contractor (and any Subcontractors, professionals or teaming partners) agree to disclose information concerning the actual or potential conflict with any proposal for any solicitation relating to any work. All actual or potential OCI situations shall be handled IAW FAR 9.502.

13.5 Identification of Non-Disclosure Requirements. All Contractor personnel (to include Subcontractors, teaming partners, and consultants) who will be personally and substantially involved in the performance of the contract issued which requires the Contractor to act on behalf of, or provide advice with respect to any phase of an agency procurement, as defined in FAR 3.104-4, shall execute and submit an “Employee/Contractor Non-Disclosure Agreement” Form. This is required prior to the commencement of any work on such contract and whenever replacement personnel are proposed under an ongoing contract. Contractor personnel will be required to sign a non-disclosure form at time of contract award.

13.6 Training. Contractor employees may be required to take periodic mandatory training courses provided through the agency, such as records management training and other training required by statute, regulation, DoD, or DISA policy.

Training

Web Link

Antiterrorism Awareness Briefing https://jkodirect.jten.mil course # JS-US007

Counterintelligence Awareness and Reporting http://www.cdse.edu/catalog/elearning/CI116.html

Cyber Awareness Challenge https://public.cyber.mil/training/cyber-awareness-challenge/

Personally Identifiable Information (PII) Training https://public.cyber.mil/training/identifying-and-safeguarding-personally-identifiable-information-pii/

Preventing Workplace Violence

Employee link: http://media.cpms.osd.mil/faslerd/employee/menu.htm

Supervisor link: http://media.cpms.osd.mil/faslerd/supervisor/menu.htm

Annual Security Training1

Defense Counterintelligence and Security Agency (DCSA) approved Corporate Annual Security Briefings may be used.

Counterintelligence Awareness and Reporting http://www.cdse.edu/catalog/elearning/CI116.html

Operations Security Training https://lms.dla.mil/content/dla/opsec/2010/download.htm

Insider Threat Awareness training (INT101.16) https://cdse.usalearning.gov/course/view.php?id=373

1All contractor firms shall be responsible for providing their own organizationally sponsored Annual Security training, either internally or from a vendor to all of their employees assigned to a task order.

No other training of contractor personnel shall be provided by the Government unless authorized by the Contracting Officer.

14. Section 508 Accessibility Standards. The following Section 508 Accessibility Standard(s) (Technical Standards and Functional Performance Criteria) are applicable (if box is checked) to this acquisition.

Technical Standards

|_| 1194.21 - Software Applications and Operating Systems

|_| 1194.22 - Web Based Intranet and Internet Information and Applications

|_| 1194.23 - Telecommunications Products

|_| 1194.24 - Video and Multimedia Products

|_| 1194.25 - Self-Contained, Closed Products

|_| 1194.26 - Desktop and Portable Computers

|X| 1194.41 - Information, Documentation and Support

The Technical standards above facilitate the assurance that the maximum technical standards are provided to the offerors. Functional performance criteria are the minimally acceptable standards to ensure Section 508 compliance. This block is checked to ensure that the minimally acceptable information and communication technology products are proposed.

Functional Performance Criteria

|X| 1194.31 - Functional Performance Criteria

Enclosure 4a, PWS

Page 1 of 11 Pages

2015/Version 9

PWS

832267259: OIG IT Organizational Change Consulting Services image1.emf

NonDisclosure Agreement for DISA Contractors v8 - 19 Sep 2017.docx

DEFENSE INFORMATION SYSTEMS AGENCY

NON-DISCLOSURE AGREEMENT FOR CONTRACTOR PERSONNEL

THIS CERTIFICATION CONCERNS A MATTER WITHIN THE JURISDICTION OF AN AGENCY OF THE UNITED STATES AND THE MAKING OF A FALSE, FICTICIOUS, OR FRAUDULENT CERTIFICATION MAY RENDER THE MAKER SUBJECT TO PROSECUTION UNDER TITLE 18, UNITED STATES CODE, SECTION 1001.

I, (print or type name), as an employee of

(insert employer name) (“the Company”), a contractor or subcontractor for the Defense Information Systems Agency/Defense Information Technology Contracting Organization (DITCO) or other relevant DoD entity, performing under Contract Number (insert contract number), understand that as a result of my assignment under this contract, I may have access to, become aware of, or possess information/data that is considered sensitive or proprietary and may be protected by law from unauthorized use or disclosure.

I agree not to disclose to any individual, business entity, organization, or anyone within or outside of the Company who has not signed a non-disclosure agreement for the purposes of performing this contract: (1) any planning, programming, and budgeting system information; (2) any contractor bid or proposal information or source selection information as defined in Federal Acquisition Regulation (FAR) 3.104-4; (3) any information exempt from disclosure under the Freedom of Information Act, 5 U.S.C. § 552(b), including any trade secrets, proprietary, or financial information protected under § 552(b)(4); (4) any personally-identifiable information or protected health information; and (5) any other sensitive information considered Confidential or For Official Use Only (FOUO). I also agree to use such information/data solely for the purposes of performing this contract, and not to use such information/data to obtain anything of value or to provide a financial benefit or a competitive advantage to any third party and/or my employer.

I continue to be bound by the obligations of this Agreement after my performance under the contract has ended, and after the contract has been terminated or closed, until such time as the information/data protected by this Agreement is approved by the United States Government for public release. Any sensitive or proprietary information/data in my possession at the end of my performance under this contract must be returned to the Government. I understand that I may be subject to administrative, civil, and criminal sanctions for violating this Agreement, and any violation of this Agreement may result in my removal from assignment to this contract.

This Agreement does not bar disclosures to Congress or to an authorized official of an executive agency or the Department of Justice that are essential to reporting a substantial violation of law, and this Agreement does not prohibit disclosures which are required under order of a court of competent jurisdiction. These provisions are consistent with and do not supersede, conflict with, or otherwise alter the obligations, rights, or liabilities created by existing statutes or Executive orders relating to (1) classified information, (2) communications to Congress, (3) the reporting to an Inspector General of a violation of any law, rule, or regulation, or mismanagement, a gross waste of funds, an abuse of authority, or a substantial and specific danger to public health or safety, or (4) any other whistleblower protection. The definitions, requirements, obligations, rights, sanctions, and liabilities created by controlling Executive orders and statutory provisions are incorporated into this agreement and are controlling. These controlling Executive orders and statutory provisions include Executive Order No. 13526, as amended; Section 7211 of Title 5, United States Code (governing disclosures to Congress); Section 1034 of Title 10, United States Code, as amended by the Military Whistleblower Protection Act (governing disclosure to Congress by members of the military); Section 2302(b)(8) of Title 5, United States Code, as amended by the Whistleblower Protection Act (governing disclosures of illegality, waste, fraud, abuse or public health or safety threats); the Intelligence Identities Protection Act of 1982 (50 USC 3121 et seq.) (governing disclosures that could expose confidential Government agents); and the statutes which protect against disclosure that may compromise the national security, including Sections 641, 793, 794, 798, and 952 of Title 18, United States Code, and Section 4(b) of the Subversive Activities Act of 1950 (50 USC 783(b)).

My execution of this Agreement shall not nullify or affect in any manner any other Confidentiality or Non-Disclosure Agreement, including any Standard Form 312 or 4414, which I have executed or may execute with the United States Government or any of its departments or agencies.

I have carefully read this Agreement and understand my obligations under it.

Signature of Contractor Employee Date

QUALITY ASSURANCE SURVEILLANCE PLAN (QASP)

1. Contract or Task Order Title: Department of Defense Office of Inspector General Information Technology Organizational Change Consulting Services (Contract number to be determined.)

2. Purpose:

This QASP provides a systematic method to evaluate performance for the stated contract. This QASP explains the following:

· What will be monitored?

· How monitoring will take place.

· Who will conduct the monitoring?

· How monitoring efforts and results will be documented.

This QASP does not detail how the contractor accomplishes the work. Rather, the QASP is created with the premise that the contractor is responsible for…