SAM RFI Attachment 1 PWS.docx

Attachment 1 - PWS

Defense Counterintelligence and Security Agency Industrial Security (IS) & Counterintelligence (CI) Directorates Entity Vetting Support Services

Part 1 General Information

1. General: This is a non-personal services contract to provide entity vetting support under Public Law 116-92, otherwise known as Section 847, and other authorities, in addition to and Arms, Ammunition, and Explosives (AA&E) support services. The Government must not exercise direct supervision or control over the contract service providers performing the services herein. Such contract service providers must be accountable solely to the Contractor who, in turn is responsible to the Government.

1.1 Description of Services/Introduction: The Contractor must provide all personnel, equipment, supplies, transportation, tools, materials, supervision, and other items and services necessary to perform support services as defined in this performance work statement (PWS) except for those items specified as Government furnished property and services. The Contractor must perform to the standards in this contract.

The worked performed for DCSA’s Industrial Security (IS) Entity Vetting (EV) must include review and triage of Government customer and industry submitted packages to ensure content is acceptable and identify risk indicators requiring further review business and security-related due diligence analysis of risk indicators using all-source information risk treatment determination and implementation measures to address risk indicators and related program management support. The worked performed for DCSA’s Counterintelligence (CI) must include threat research, reporting, and analysis, and related program management support. The work performed for IS International and Special Programs (ISP) must include operational data analytics and project management services related to the area of AA&E to establish, implement, and sustain AA&E program processes and procedures to manage and provide oversight of the protection, storage, manufacturing, production, testing, and transportation of sensitive Department of Defense (DoD) AA&E at Contractor-owned and operated facilities. The AA&E analysts must participate in daily AA&E program management operations, recommend design methodologies for collecting and data mining AA&E contracts and operate and improve existing data streams to improve operational execution of DCSA’s AA&E mission.

The Contractor must have knowledge of Code of Federal Regulations (CFR) 32, Part 117 (National Industrial Security Program Operating Manual (NISPOM)), Executive Order 12829 as amended, Department of Defense Instruction (DoDI) 5220.32, Volumes 1 and 2 DoDI 5205.85 and Public Law 116-92, Section 847.

1.2. Background: DCSA, as a newly designated Defense Agency is undergoing a multi-year transformation that includes a significant expansion of predecessor Agencies’ authorities and responsibilities. Mission accretion and associated growth in personnel and resources requires deliberate coordination and planning across operations and support activities to achieve effective outcomes while simultaneously establishing and integrating new activities, initiatives, and projects. The new organization will be comprised of nearly 13,000 Government and Contractor personnel operating throughout the United States and overseas supporting stakeholders across the Federal Government.

As part of its recent reorganization, DCSA centralized the administration of its AA&E program at Headquarters (HQ), under ISP. DCSA is in the process of developing AA&E program management processes and procedures to fully develop the AA&E program, capture, organize, report, and forecast future AA&E operational requirements. DCSA intends to expand and increase outreach and interagency partnerships while it fully professionalizes its AA&E cadre, develops standardized training, and expands interagency contacts to enable the tracking of DoD AA&E contracts awarded involving sensitive AA&E at Contractor-owned and operated facilities. In addition to facilitating coordination with procuring commands and the Defense Contract Management Agency (DCMA), the Contractor must assist in the development of plans for executing additional liaison and coordination with Alcohol, Tobacco, and Firearms Bureau (ATF) offices at the field and HQs levels.

IS and CI supports the DCSA mission to protect classified and sensitive information and materials in the hands of industry by ensuring compliance with Code of Federal Regulations (CFR) 32, Part 117 (National Industrial Security Program Operating Manual (NISPOM)), Executive Order 12829 as amended, Department of Defense Instruction (DoDI) 5220.32, Volumes 1 and 2 DoDI 5205.85 and Public Law 116-92, Section 847. Additionally, IS works in partnership with Government customers, facility security officers, and other industry partners to ensure the protection of information released under contractual obligations or research and development efforts. To continue to perform this mission in an evolving and increasingly complex environment, DCSA must continuously review, analyze, and update processes, procedures, organizational structure, and methods. DCSA continues to develop and implement initiatives that will drive consistency, improve performance, and provide for a more effective and efficient workforce. This contract requires Contractors to provide operational support to include program management, technical support, research, analysis, communication, task management, identifying risks to facilities, collating data sets, increased oversight of the process, risk, and risk management (i.e. foreign ownership, control, or influence (FOCI)), and other support.

IS EV consists of three mission areas: Verification and Triage Unit (VTU), Due Diligence Unit (DDU), and Risk Management Unit (RMU). EV is responsible for producing timely, relevant, and actionable triage, business and security-centric due diligence research, reporting, analysis, and risk management products, recommendations, and decisions throughout to evaluate risk and FOCI, to negotiate and sustain risk management strategies and FOCI action plans, and to provide end-to-end management support of the processes. CI performs an essential function for the related processes above through its Threat Integration Branch (TIB), which provides timely, relevant, and actionable threat reports that allow EV decision-makers to determine what actions are prudent in a particular case.

1.3 Objectives:

1.3.1 The objectives for the required services supporting vetting and AA&E include:

· Ensure execution of entity vetting reviews are in line with timeliness and quality requirements.

· Document processes and procedures for internal and external stakeholders.

· Produce individual and group metrics to understand program health.

· Assist with strategic and operations field support portfolio and programs.

· Produce internal and external briefings and other publications as required.

· Support the development and day-to-day operations of DCSA’s Vetting and AA&E programs.

1.4 Scope: The services to be provided as part of this requirement include:

1.4.1 The Contractor must provide support professionals who are trained in various degrees in security, intelligence, counterintelligence, and business, and who are knowledgeable of Executive Orders, DoD regulations and directives that govern NISP, DESP, and Section 847 implementation. DCSA will provide baseline classroom instruction to support professionals the Contractor provides supporting the NISP, DESP, and Section 847 missions. Classroom instruction will be graded on knowledge checks, practical exercises, participation, and a capstone exercise. Completion of the classroom instruction is mandatory to begin or continue work in EV. Failure to complete the mandatory classroom training will result in immediate offboarding unless an exception is granted by the Deputy Assistant Director, Office of Entity Vetting or another designated individual on a case-by-case basis. (CDRL A013)

The following will result in failure to complete the mandatory classroom training:

· Failing the capstone exercise

· Failing 50 percent or more of the knowledge checks and practical exercises The following may result in failure to complete the mandatory classroom training:

· Three or more absences

· Chronic tardiness

1.4.1 The Contractor must be able to provide personnel who can work with limited supervision to assess a Contractor's dependency upon foreign interests, assess a Contractor’s initial and continuing overall eligibility for the NISP, DESP, or Section 847, to include customer service support, and review security arrangements for the import and export of classified information that is being transferred under the Direct Commercial Sales (DCS) program.

1.4.2 The Contractor must understand the Cognizant Security Agencies (CSAs) associated with special program contracts and be able to analyze data related to security review reports associated with these programs. The scope of work includes evaluating the quality of reports prepared for release outside DCSA and advising the DCSA Government project manager (GPM), task managers, or Contracting Officer’s Representative (COR) as to the findings.

1.4.3 The Contractor must manage AA&E database, as well as assist with the management of the FOCI database and report repositories.

1.4.4 The Contractor must assist in the preparation of various internal and external policies and directives concerning the safeguarding and protection of classified information and submit the results to the appropriate COR or task manager for coordination and evaluation.

1.4.5 The Contractor must support the analysis and development of risk management processes and execution procedures. Contractor personnel must be proficient in using Microsoft Office products.

1.5 Period of Performance: The period of performance (PoP) is for one 9-month base period, four 12-month option periods, and an optional six-month extension IAW FAR 52.217-8 Option to Extend Services.

The anticipated PoP is as follows:

Six-Month Extension May 1, 2031 – November 31, 2027

1.6 General Information:

1.6.1. Quality Control (CDRL A001): The Contractor must develop and maintain an effective quality control program, including a Quality Control Plan (QCP), to ensure services are performed in accordance with this performance work statement. The Contractor must develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The Contractor’s quality control program is how the Contractor that work complies with the requirement of the contract. The Contractor must deliver an electronic copy of the QCP within 30 calendar days of contract award. After acceptance of the QCP the Contractor must receive the COR’s acceptance in writing of any proposed change to it, thereafter.

1.6.2. Quality Assurance: The Government must evaluate the Contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). The QASP is a Government developed document and is primarily focused on what the Government must do to ensure that the Contractor has performed in accordance with the performance standards. The QASP details how the performance standards identified in the PWS will be measured, who will perform the measurement, the frequency of surveillance, and the acceptable defect rate(s). The QASP may be updated from time to time by the Government.

1.6.3. On-Site Working Conditions, Holidays, and other Closures:

1.6.3.1. DCSA facilities are smoking restricted workplaces. Due to the nature of the work, facilities, and requirements, Contractor staff may only smoke outside in designated smoking areas.

Ad hoc/situational telework may be allowed but must be approved and coordinated with the COR and the respective task manager. This provides the Contractor flexibility to continue work without disruption due to limited space or when operations are down due to circumstances outside the control of the Contractor.

1.6.3.2. The Government expects the Contractor will establish normal operating hours under this contract between 6:00 a.m. to 6:00 p.m. Eastern Time (ET) Monday through Friday, with consideration for flexible start and end times at the discretion of the Government. The Contractor’s Program Manager (PM) and the Government’s COR must consult and coordinate on any proposed alternate work schedules that may be arranged depending on the operational tempo/needs of the mission.

1.6.3.3. Government personnel observe the following days as holidays and the Government facilities will be closed and unavailable to Contractor personnel on the following days:

*If the date falls on a Saturday, the Government holiday is the preceding Friday. If the date falls on a Sunday, the Government holiday is the following Monday.

1.6.3.4. In addition to the days designated as holidays, the Government observes the following days:

· Any other day designated by Federal Statute

· Any other day designated by Executive Order

· Any other day designated by the President’s Proclamation

1.6.3.5. It is understood and agreed between the Government and the Contractor that observance of such days by Government personnel must not otherwise be a reason for an additional PoP, or entitlement of compensation except as set forth within the contract. In the event the Contractor's personnel work during the holiday, they may be reimbursed by the Contractor, however, no form of holiday or other premium compensation will be reimbursed either as a direct or indirect cost, other than their normal compensation for the time worked.

1.6.3.6 When the Federal, State, Local or other Governmental entity grants excused absence to its employees, assigned Contractor personnel may also be dismissed. The Contractor agrees to continue to provide sufficient personnel to perform critical tasks already in operation or scheduled, and must be guided by the instructions issued by the KO or COR.

1.6.3.7 If Government personnel are unavailable due to furlough or any other reason, the Contractor must contact the KO or the COR to receive direction. It is the Government's decision as to whether the contract price/cost will be affected. Generally, the following situations apply:

1.6.3.7.1 Contractor personnel who can continue contract performance (either on-site or at a site other than their normal workstation), must continue to work and the contract price must not be reduced or increased.

1.6.3.7.2 Contractor personnel who are not able to continue contract performance (e.g., support functions) may be asked to cease their work effort. This may result in a reduction to the contract.

1.6.3.8 It is understood and agreed between the Government and the Contractor that in the event Contractor personnel wish to attend DCSA social events, such as the annual picnic, holiday parties, etc., they must co- ordinate their work schedules with the COR and obtain approval of their company’s supervisor prior to the event. The Government is not responsible for reimbursing any expenses to the Contractor for attending any DCSA social event.

1.6.4 Hours of Operation: The Contractor is responsible for conducting business, between the hours of between 6:00 a.m. to 6:00 p.m. ET Monday through Friday except Federal holidays and must adhere to COR instructions when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. For other than firm fixed price contracts, the Contractor will not be reimbursed when the Government facility is closed for the above reasons. The Contractor must always maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons. When hiring personnel, the Contractor must keep in mind that the stability and continuity of the workforce are essential. The Contractor is expected to set their own eight-hour shift within the timeframe specified above as long as it provides continued support and does not disrupt business operations. The Contractor’s Program Manager (PM) and the COR must consult and coordinate on any proposed alternate work schedules that may be arranged depending on the operational tempo/needs of the mission.

1.6.5 Place of Performance: The work to be performed under this contract will be performed primarily at DCSA headquarters, the Russell-Knox Building (RKB) and Stafford, VA, and occasionally at regional field office locations as requested by DCSA IAW section 1.6.15 Travel of this PWS. Contractor personnel may telework upon an agreed schedule with the COR.

1.6.5.1 DCSA Headquarters, RKB: 27130 Telegraph Road

Quantico, VA 22134

1.6.5.2 Regional Field Office Locations:

1.6.5.2.1 Mid-Atlantic Region:

· Alexandria, VA

· Herndon, VA

· Virginia Beach, VA

· Stafford, VA

· Hanover, MD

1.6.5.2.2 Eastern Region:

· Andover, MA

· Mt. Laurel NJ

· Parsippany, NJ

· Philadelphia, PA

· Sewickley, PA

· Harrisburg, PA

· Westbury, NY

· Syracuse, NY

· Norwood, MA

· Groton, CT

· Atlanta, GA

· Melbourne FL

1.6.5.2.3 Central Region:

· Irving, TX

· Huntsville, AL

· Livonia, MI

· Dayton, OH

· Fairview Heights, IL

· Minneapolis, MN

· Downers Grove, IL

· Gulfport, MS

· Hurlbert Field, FL

· San Antonio, TX

1.6.5.2.4 Western Region:

· San Diego, CA

· Colorado Springs, CO

· Denver, CO

· Alaska

· Pasadena, CA

· Phoenix, AZ

· Tucson, AZ

· Albuquerque, NM

· Hawaii

· Cypress, CA

· Fremont, CA

· Suisun City, CA

· Tacoma, WA

1.6.6. Type of Contract: The Government will award a firm fixed price contract.

1.6.7. Security Requirements: The Contractor must possess and maintain a TOP SECRET facility clearance granted by the DCSA. The Contractor's employees, performing work in support of this contract must be United States (US) citizen and require TOP SECRET security clearance/eligibility with sensitive compartmented information (SCI) eligibility determination based on a favorably adjudicated Tier 5 (T5) or Tier 5 Reinvestigation (T5R) with SCI eligibility be within investigation scope and/or currently enrolled in Continuous Evaluation CE and Continuous Vetting at the time of contract award and throughout the life of the contract to include all potential option years identified in this PWS.

1.6.7.1 The DD Form 254 Contract Security Classification Specification, referred to as the DD 254, (CDRL A002) must be completed within the Defense Counterintelligence and Security Agency National Industrial Security Program (NISP) Contracts Classification System (NCCS) (https://tesseract.cloud.dcsa.mil/nccs) at contract award. The DD 254 will be housed within the NCCS through the life of the contract. The Contractor must be required to be registered within NCCS at time of award to gain access to the DD 254. It is incumbent upon the Contractor to ensure that the necessary security paperwork is submitted in sufficient time to enable everyone to be cleared prior to beginning work on this contract. If the NCCS is superseded by another System of Record, the same requirements apply. The KO will maintain the DD 254 in the official DCSA contracts records. The Contractor is required to maintain a copy in their records and to ensure distribution to their Cognizant Security Office. Subcontracting on this effort requires an approved subcontracting Plan (CDRL A003) by the KO and if approved, Contractor shall provide copies of all subcontract DD254s to the GCA and KO. For accesses which require prior written authorization from the GCA, KO, the Contractor must submit a draft subcontract DD 254 to the GCA and Contracting Officer for review and concurrence with coordination of the DCSA Industrial Security Program Manager.

1.6.7.2 Contractor personnel performing or assigned under this contract must be U.S. persons. Security Classification Guide requests should be presented to the Government Sponsor, if required, after contract award. All classified information received or generated under this contract is the property of the U. S. Government. The U. S. Government shall provide disposition instructions. No release of classified information or controlled unclassified information under this contract is authorized. All requirements for control and accounting of original documentation and copies apply. All applicable provisions of the NISPOM and its supplements and 32 CFR, part 117 apply. Any classified information shall be transmitted IAW DOD Manual 5200.01, Volumes 1-3. DOD Information Security Program Regulations. The Contractor shall adhere to 32 CFR Part 117.18 (NISPOM), which applies to non-DoD IT systems.

1.6.7.3 Within 10 business days of contract award, prime Contractor shall submit a Visit Authorization Request (VAR) (CDRL A005) to DCSA Security Office to validate that all management, supervisory, and other personnel assigned to this contract meet the clearance requirements. Failure to provide security eligibility information shall delay and/or deny the individual access to DCSA, and DoD facilities and information. It is the responsibility of the prime Contractor to maintain either an owning or servicing relationship in DISS with all personnel supporting this contract, this includes Prime Contractor personnel, subcontractor personnel, and any consultants. All VARs submitted to the host Government locations must be sent via the Defense Industrial System for Security (DISS) and must come from the prime Contractor's SMO in DISS. For visits to DCSA, Collateral and SCI Visit Authorization Requests should be sent to SMO DCSAHQSEC. Refer to PWS Section 1.6.16.1 for additional Contractor Onboarding instructions.

1.6.7.4 Contractor is not authorized to subcontract on this effort without an approved subcontracting plan (CDRL A003) with written GCA/KO authorization.

1.6.7.5 All Common Access Cards (CACs), building access badges, and parking passes must be returned immediately at the end of the period of performance date.

1.6.7.6 The Contractor shall comply with (1) Security Agreement (DD Form 441/DD Form 441-1), including the National Industrial Security Program Operating Manual (NISPOM), DoD 5220.22-M and any revisions and (2) 32 CFR, Part 117. Provisions of the Privacy Act apply to all records and reports maintained by the Contractors.

1.6.7.7 All programs and materials developed at Government expense during the performance period of this contract are the property of the US Government (USG).

1.6.7.8 Prior to granting an employee access to classified information and/or materials, the Contractor shall brief employees regarding their obligation to comply with the NISPOM, to include any changes and/or amendments, and 32 CFR, Part 117. The Contractor’s employees shall be debriefed when access to the material is no longer needed or is terminated. A list of all employees who have had access to classified information during the period of this contract shall be maintained by the Contractor company and be available for Defense Counterintelligence and Security Agency inspection.

1.6.7.9 Access to General Protection/Security Policies and Procedures. All Contractor employees, including subcontractor employees stationed or assigned on a USG facility shall comply with applicable installation, facility access procedures and local security policies (provided by the USG security personnel). The Contractor workforce shall comply with all personal identification verification requirements as directed by DCSA and/or local policy. In addition to the changes otherwise authorized by the changes clause in this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the USG may require changes in the Contractor security processes or procedures.

1.6.7.10 Contractors requiring access to USG Information Technology (IT) systems must adhere to all USG requirements. All Contractor employees and any associated subcontractor employees shall annually complete the DoD Information Assurance Training and sign an Acceptable Use Policy (AUP). The training certificate and AUP must be provided to the designated personnel at USG facilities before issuance of network access and annually thereafter.

1.6.7.11 Contactor employees shall abide by USG Security Regulations and Security Standard Operating Procedures when working on-site at USG facilities/installations and shall annually attend Government mandatory training including Operational Security, Security Awareness, Subversion and Espionage, Ethics and Prevention of Sexual Harassment, and any/all other training as directed by the USG.

1.6.7.12 Common Access Cards (CACs) are authorized for Contractor employees that work on-site at DCSA Government facility. CACs are the property of the USG and shall be giving to the Contractor Facility Security Officer (FSO) or its designee upon termination of employment with the company, expiration of the CAC, replacement of a CAC, or upon contract completion. The FSO must immediately return the CACs to the DCSA Government Contracting Officer or Contracting Officer Representative. The loss of a CAC shall be reported on the first business day following the discovery of the lost CAC to your chain of command and to the issuing agency. Unauthorized possession of a CAC can be prosecuted criminally under section 701, title 18, United States Code. Photocopying of USG Identification (CAC) is a violation of Title 18, US Code Part 1, Chapter 33, Section 01 and punishable by both fine and imprisonment. Although the asking for military/Government identification is totally permissible by commercial establishments, there is a prohibition on duplication of Government identification. A state issued driver license or other form of photo identification should be provided to be photocopied if an establishment insists on a photocopy of the traveler’s identification. Contractor is required to ensure that all employees are aware of this law.

1.6.7.13 Contractor personnel shall utilize USG or official company e-mail for transmitting official USG business. Official USG business must not be transmitted via personal, private, and/or commercial e-mail accounts, i.e., Yahoo, Hotmail, Gmail, Juno, AOL, Comcast, Knology, Verizon, etc.

1.6.7.14 Contractor is prohibited from using reference to this contract, classification, clearances, accesses (collateral and/or SCI), even by unclassified acronyms, in advertisements, websites, capabilities fliers, promotional efforts, or recruitment of employees.

1.6.7.15 Government Notice for Additional Labor Hours: The Government must provide written notice to the Contractor when additional labor hours beyond those required at the time of contract award are deemed necessary. The written notification will be provided 30 calendar days prior to the required onboarding date. The Contractor must not provide or bill for any additional labor hours without prior written authorization from the Contracting Officer. The total labor hours billed must not exceed the amount specified within the applicable CLIN and CLIN ceiling (CLIN 0001 for the base period and CLIN 1001 for option period 1). Refer to PWS Section 1.6.16.1 for onboarding instruction. If the 30th day falls on a weekend; the onboarding package must be submitted the Friday before the weekend. If the holiday falls on a weekday, the onboarding package must be submitted the business day prior to that work week holiday.

Example dates for the 30-calendar day notice:

· Notification Date: March 15, 2024

· Onboarding Date: April 12, 2024* *April 15, 2024 is the actual onboarding date, however the 15th falls on a weekend and the onboarding date would fall to the prior Friday.

1.6.8. Physical Security: The Contractor must be responsible for safeguarding all classified and controlled unclassified information (CUI), Government equipment, information, and property to which they obtain access. At the close of each work period, Government facilities equipment, and materials shall be appropriately secured. The Contractor shall safeguard and secure the identified equipment, information, property, facilities, and materials in accordance with the DoDI 5220.22-M (National Industrial Security Program Operation Manual (NISPOM), The DoDI 5200.48 “Controlled Unclassified Information (CUI) and the 32 Code of Federal Regulation Federal Regulation Part 117 (32 CFR, part 117).

1.6.8.1 Key Control: The Contractor must establish and implement methods of making sure all keys/key cards issued to the Contractor by the Government are not lost or misplaced and are not used by unauthorized persons. NOTE: All references to keys include key cards. No keys issued to the Contractor by the Government must be duplicated. The Contractor must develop procedures covering key control that must be included in the QCP. Such procedures must include turn-in of any issued keys by personnel who no longer require access to locked areas. The Contractor must immediately report any occurrences of lost or duplicate keys/key cards to the KO.

1.6.8.1.1 In the event keys, other than master keys, are lost or duplicated, the Contractor must, upon direction of the KO, re-key or replace the affected lock or locks however, the Government, at its option, may replace the affected lock or locks or perform re-keying. When the replacement of locks or re-keying is performed by the Government, the total cost of re-keying or the replacement of the lock or locks must be deducted from the monthly payment due the Contractor. In the event a master key is lost or duplicated, all locks and keys for that system must be replaced by the Government and the total cost deducted from the monthly payment due the Contractor.

1.6.8.1.2. The Contractor must prohibit the use of Government issued keys/key cards by any persons other than the Contractor’s employees. The Contractor must prohibit the opening of locked areas by Contractor employees to permit entrance of persons other than Contractor employees engaged in the performance of assigned work in those areas, or personnel authorized entrance by the KO.

1.6.9 Special Qualifications: All Contractor employees, to include subcontractor employees, must complete DCSA annual training within the mandated timelines within the Security Training Education and Professionalization Portal (STEPP). The following training is required for onsite Contractor personnel:

The following training is required for Contractor personnel:

· DoD Cyber Awareness Challenge (CAC) Training: All Contractor personnel, to include subcontractor personnel, requiring access to DoD Information Technology (IT) resources must complete the DoD CAC training in accordance with DoDD 8140.01.

· Operations Security (OPSEC) Awareness Training: All Contractor personnel must complete OPSEC Awareness training in accordance with DoDM 5205.02.

· Intelligence Oversight Awareness Training: All Contractor personnel working in DoD facilities must complete Intelligence Oversight training in accordance with DoDD 5148.13 and DCSAI 19-1.

· Insider Threat Awareness Training: Contractor personnel granted eligibility for access to classified information or eligibility to hold a sensitive position must complete this training in accordance with DoDD 5205.16.

· Privacy Act and Personally Identifiable Information (PII) Training: Contractor personnel performing activities associated with maintaining a system of records on behalf of a DoD component must complete PII training in accordance with DoDI 5400.11, DoD 5400.11-R, and OMB Circular A-130.

· Unauthorized Disclosure of Classified Information Training: DoD Contractor personnel requiring access to classified information must complete Unauthorized Disclosure of Classified Information training in accordance with DoDD 5210.50.

· Information Security Training: DoD Contractor personnel with access to classified information who work at a DoD facility must complete Information Security training in accordance with DoDM 5200.01, Volume 3.

· Preventing Workplace Violence Training: Contractor personnel must complete Preventing Workplace Violence training in accordance with DoDI 1438.06 and DSSR 11-851.

· Derivative Classification Training: Contractor personnel with access to classified information must complete Derivative Classification training in accordance with Under Secretary of Defense for Intelligence (USDI) Memorandum Subject: Derivative Classification Training dated 31 Jan 2019.

· Cybersecurity Training and Certification: Contractor personnel performing cybersecurity functions as defined in DoDD 8140.01 must complete Cybersecurity training and obtain certifications prior to commencement of duties in accordance with DoDM 8140.03 and DFARS 252.239-7001 Information Assurance Contractor Training and Certification. Delivery method is https://public.cyber.mil or as specified by the COR, if/when cybersecurity training is applicable.

· Antiterrorism Level I Training: Contractors requiring routine physical access to a Federally controlled facility or military installation must complete Antiterrorism Level I training in accordance with DoDI O-2000.16, Volume 1 and DFARS 252.204-7004 Antiterrorism Awareness Training for Contractors.

· DoD Mandatory Controlled Unclassified Information (CUI) Training: Contractor personnel with access to controlled unclassified information must complete CUI training in accordance with DoDI 5200.48.

· Counterintelligence Awareness and Reporting (CIAR) Training: All DCSA Contractor personnel must complete CIAR training in accordance with DoDD 5240.06.

· Prevention of Sexual Harassment Training (Highly recommended Not required): To facilitate and ensure compliance with DCSAI 08-14, Contractor personnel may complete Prevention of Sexual Harassment training in accordance with DoDI 1020.04.

· No Fear Act/Whistleblower Protection Training: Contractor personnel are required to complete No Fear Act/Whistleblower Protection training in accordance with the Notification and Federal Employee Antidiscrimination and Retaliation Act (No FEAR Act) of 2002 (Public Law No. 107-174).

The Contractor must retain certificates of completion for each affected Contractor employee and subcontractor employee, for the life of the contract. This training must be completed and reported to the COR within 30 calendar days of contract assignment and annual refresher training for the remaining contract duration, except for the No Fear Act/Whistleblower Protection Training which is required every two years. This information must be reported as part of the Monthly Status Report (CDRL A008). The Cybersecurity Training and Certification is the only training exempt from the 30 days and annual refresher requirements as it is a one-time certification prior to commencement of duties.

1.6.10. Post Award Conference and Periodic Progress Meetings (CDRL A004):

1.6.10.1 Post Award Conference: The Contractor agrees to attend any post award conference convened by the Government in accordance with FAR subpart 42.5.

1.6.10.2 Contractor/Government Meetings – Quarterly Contract Performance Review Meetings (PRM) : The KO, COR, and other Government personnel (as determined appropriate by the COR and the KO) will meet quarterly at the primary place of performance, or using other approved teleconference capabilities, with the Contractor’s PM (other Contractor personnel are permitted to attend but attendance shall be coordinated with the COR) to review the Contractor's performance. The Contractor shall coordinate and schedule the meeting for all required/approved attendees. The Contractor shall be prepared to present on topics related to performance, achievements, and issues associated with the work performed under this effort. The Contractor shall present their performance as compared against the performance standards established in the contract. The COR, in conjunction with the KO (or assigned CS), will apprise the Contractor of how the Government views the Contractor's performance and the Contractor shall apprise the Government of problems, if any, being experienced. Material the Contractor plans to present or discuss with during the meeting shall be submitted to the COR at least five (5) business days in advance of the meeting. The Government may request additional reports independent of the meetings to address management issues. The Contractor shall provide meeting minutes within five (5) business days after the conclusion of the scheduled meeting. To the extent practical, the meeting minutes should be a recap of the meeting, discussion, and include any attachments. These quarterly program review meetings shall be at no additional cost to the Government.

1.6.10.2.1 Deliverable:

· Quarterly Contract PRM brief and presentation may include, at minimum, the following tasks:

· Detailed brief on topics related to performance, achievements, and issues associated with the work performed under this effort.

· Provide all the data normally provided for within the Monthly Status Report (CDRL A008) as compared against the performance standards established in the contract. Each performance standard should be reported.

· Reconciliation of deliverables required against deliverables received.

· Summary of current priorities and future tasks.

· Contractor/Government Meeting Minutes shall include a list of attendees, topics discussed, actions agreed to, open items and the date of the next meeting.

1.6.11 Contracting Officer: A person with authority to enter, administer, and or terminate contracts, and make related determinations and findings on behalf of the Government. Note: The only individual who can legally bind the Government.

1.6.12 Contracting Officer’s Representative: The COR will be identified by a separate, appointment letter. The COR monitors all technical aspects of the contract and assists in contract administration. The COR is authorized to perform the following functions: assure that the Contractor performs the technical requirements of the contract: perform inspections necessary in connection with contract performance: maintain written and oral communications with the Contractor concerning technical aspects of the contract: issue written interpretations of technical requirements, including Government drawings, designs, specifications: monitor Contractor's performance and notifies both the KO and Contractor of any deficiencies coordinate availability of Government furnished property, and provide site entry of Contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the Contractor, states the responsibilities and limitations of the COR, especially regarding changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting order.

1.6.13 Service Contract Reporting (SCR): The Contractor must report all Contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract for the DCSA via a secure data collection site. The Contractor is required to completely fill in all required data fields using the following web address: https://www.sam.gov. Reporting inputs will be for the labor executed during the period of performance during each Government fiscal year (FY), which runs October 1 through September 30. While inputs may be reported any time during the FY, all data must be reported no later than October 31 of each calendar year. Contractors may direct questions to the help desk at: https://www.sam.gov (see FAR Clause 52.204-14 – Service Contract Reporting Requirements).

1.6.14 Identification of Contractor Employees: All Contractor personnel attending meetings, answering Government telephones, and working in other situations where their Contractor status is not obvious to third parties are required to identify themselves as such to avoid being mistaken as Government officials. They must also ensure that all documents or reports produced by Contractors are suitably marked as Contractor products or that Contractor participation is appropriately disclosed. Contractor personnel shall observe all local sign-in, badge wearing, and security requirements.

1.6.15 Contractor Travel: The Contractor will be required to travel CONUS and within the National Capital Region (NCR) during the performance of this contract to attend meetings, conferences, and training. The Contractor may be required to travel to off-site training locations and to ship training aids to these locations in support of this PWS. Reimbursement of transportation, lodging, meals, and incidental expenses are allowable subject to the limitations contained in Federal Acquisition Regulation (FAR) 31.205-46 and the limitation of funds specified in this contract. All travel requires Government approval/authorization and notification to the COR.

All travel within 100 miles of the Contractor personnel’s assigned work office (field, regional, or HQ Quantico) is included in the price of this contract. When movement of Contractor personnel is required locally, (i.e., metro) costs will be borne by the Contractor.

1.6.16 Contractor Onboarding, Resignations, and Terminations

1.6.16.1 Contractor Onboarding: The Contractor shall provide no less than 10 business days advanced notice of Contractor personnel arriving to their designated place of performance. Advanced notice is defined as the Contractor Facility Security Officer adding the contracting personnel to the VAR (CDRL A005) in the Defense Information System for Security (DISS) and an e-mail to the COR. The email to the COR must include the list of information at PWS Section 1.6.16.1.1. The Contractor employee will then have no more than two (2) business days once the Contractor receives the Trusted Associate Sponsorship System (TASS) application from DCSA’s Security office to complete required information to obtain a Common Access Card (CAC) (CDRL A005).

1.6.16.1.1 The following onboarding Contractor employee’s information must be emailed to the COR:

1. Name (Last, First, Middle Initial)

2. Position

3. Position Location

4. Personal email (TASS) Application/CAC Process (Refer to https://www.cac.mil/common-access-card/getting- your-cac/for-Contractors/)

5. EDIPI/DoD Identification Number (if known)

6. Start Date

7. Date added to VAR

8. DoD Cyber Awareness Challenge (CAC) Training Certification

9. DCSA 261, Information System User Agreement/Acceptable Use Policy

1.6.16.2 Required information is based on IT and Security onboarding requirements. The Government will notify the Contractor regarding any changes to the required information.

1.6.16.3 Contractor personnel will not report to their duty location prior to obtaining a CAC and the appropriate building access (i.e., building badge), at a minimum.

1.6.16.4 Contractor Resignations/Terminations: The Government expects that the Contractor will mitigate the impacts of Contractor personnel resignations/terminations on the Government. The Contractor's ability to vet applicants early in the process is viewed by the Government as key to maintaining a reliable pipeline of qualified candidates. The Government may grant the Contractor up to ten (10) business days to ramp-up in the event of an unexpected resignation/termination. This will be granted on a case-by-case basis, with COR and KO approval. The Contractor will ensure all resignations/terminations are closely pre-coordinated with the Government Task Manager, the COR, and DCSA Security to mitigate potential impacts to the Government and ensure the proper handoff of all GFE. This includes but is not limited to CACs, access badges, keys, and laptops.

1.6.16.5 Per the Defense Intelligence Agency (DIA) Solutions for Intelligence Analysis (SIA) 3 Ordering Guide Section 3.3.6, “SIA 3 prime Contractors may add new team members at any point in the task order. The prime contractor must complete the Notice of Intent to Add Sub-Contractor form on behalf of the IDIQ CO.” The Notice of Intent to Add Sub-Contractor form is located in Section J.1.1.8 Attachment 08 and in Appendix J of the DIA SIA 3 Ordering Guide. In addition to the requirement to complete and submit the form to the IDIQ CO, the DCSA KO must be informed via email prior to the commencement of subcontractor performance. The subcontractor must not perform until receipt of a certified DD Form 254 from the DIA Industrial Security Office (SEC-1A) is received and a DD Form 254 is completed via NCCS for DCSA (refer to Section 1.6.7.1).

1.6.17 Organizational Conflict of Interest: Contractor and subcontractor personnel performing work under this contract may receive, have access to or participate in the development of proprietary or source selection information (e.g., cost or pricing information, budget information or analyses, specifications, or work statements, etc.) or perform evaluation services which may create a current or subsequent Organizational Conflict of Interests (OCI) as defined in FAR subpart 9.5. The Contractor must notify the KO immediately whenever it becomes aware that such access or participation may result in any actual or potential OCI and must promptly submit a plan to the KO to avoid or mitigate any such OCI. The Contractor’s mitigation plan will be determined to be acceptable solely at the discretion of the KO and in the event the KO unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the KO may affect other remedies as he or she deems necessary, including prohibiting the Contractor from participation in subsequent contracted requirements which may be affected by the OCI.

1.6.18 Phase-In/Phase-Out Period: The Contractor must provide sufficient experienced personnel during the phase-in, phase-out period to ensure that the services called for by this contract are maintained at the required level of proficiency.

1.6.18.1 Phase-in Period: During the phase-in period, the Contractor must become familiar with performance requirements to commence full performance of services on the contract start date. To minimize any decreases in productivity, maintain continuity of operations, and to prevent possible negative impacts on additional services, the Contractor must have personnel on board within 30 calendar days from the date of award. A phase in transition plan is required by the KO, but the Contractor must keep the Government fully informed of status throughout a transition period. Throughout a phase-in period, it is essential that attention be given to minimize interruptions or delays to work in progress that would impact the mission. The Contractor must plan for the transfer of work control and delineating the method for processing and assigning tasks during the phase-in period in addition to addressing how the following will be handled: Government furnished property, logistics, security, staffing, and training.

1.6.19 Phase-out Period: The phase-out transition period is anticipated to last for thirty 30 calendar days from the end of the final period of performance phase out must begin 30 calendar days immediately prior to contract end. Upon the KO’s written notice, the Contractor must create and submit a phase-out transition plan, within 10 business days of request, for approval by the Government. The Contractor must keep the Government fully informed of status throughout the transition period. Throughout the phase-out period, it is essential that attention be given to minimize interruptions or delays to work in progress that would impact the mission. The Contractor must plan for the transfer of work control and delineating the method for processing and assigning tasks during the phase-out periods.

1.6.20 Section 508 Compliance: Information and Communication Technology (ICT) Accessibility Requirements Statement per the Revised Section 508 of the Rehabilitation Act:

Section 508 of the Rehabilitation Act, as amended by the Workforce Investment Act of 1998 (P.L. 105- 220) requires that when Federal agencies develop, procure, maintain, or use information and communication technology (ICT), it shall be accessible to people with disabilities. Federal employees and members of the public who have disabilities must have access to, and use of, information and data that is comparable to people without disabilities.

E206.1 General. Where components of ICT are hardware and transmit information or have a user interface, such components shall conform to the requirements in Chapter 4.

1.6.21 Management Plan (CDRL A006): The Contractor must provide a management plan within 30 calendar days after contract award and subsequent updated submissions annually. The management plan must include the following: effective risk mitigation to include identifying potential risks associated with support services, mitigation strategies cost and schedule monitoring and proven processes established to correct any issues that arise. The Contractor’s management plan must also include the proposed lines of responsibility, and communication through which this requirement will be managed. The Contractor must propose policies, procedures for managing, directing the effort for productivity, quality, cost control, and early identification and resolution of problems. The Contractor must provide its proposed approach for delivering high quality program and business support services as defined in the PWS. The approach must address the period of transition from the current contract as well as operations under the new contract.

1.6.22 Staffing Plan (CDRL…