TSCM_DRAFT_SOW_20260325.pdf

UNCLASSIFIED

STATEMENT OF WORK (SOW)

Technical Surveillance Countermeasures (TSCM) and Technical Development Support Services

TABLE OF CONTENTS

1.0 INTRODUCTION

1.1 BACKGROUND

1.2 SCOPE

1.3 Organizational Conflict of Interest (OCI) Requirement

2.0 APPLICABLE DOCUMENTS

3.0 DESCRIPTION OF WORK

3.1 Security Support Service Requirements

3.2 Labor Categories (LCAT) and Skill Levels

3.3 DELIVERABLES

4.0 GENERAL PROVISIONS

5.0 SECURITY

6.0 TRAVEL and OTHER DIRECT COSTS (ODCs)

7.0 QUALITY CONTROL

8.0 NON-DISCLOSURE AGREEMENTS

9.0 ANNUAL MANDATORY TRAINING

APPENDIX A: ANTICIPATED SUPPORT REQUIREMENTS

APPENDIX B: POSITION DESCRIPTIONS

APPENDIX C: REFERENCE DOCUMENTS

APPENDIX D: ACRONYMS

THE REMAINDER OF THIS PAGE IS INTENTIONALLY LEFT BLANK

1.0 INTRODUCTION

The Contractor shall provide all personnel, supervision, and other items necessary to perform services to support the National Geospatial-Intelligence Agency (NGA), Office of Counterintelligence (SIC) as defined in this Task Order (TO) Statement of Work (SOW), except for those items specified as government furnished property and services. This SOW describes the non-personal services contract required to support the mission of NGA for the Office of Counterintelligence. The Government shall not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the Contractor, who is responsible to the Government for accountability of Contractor and subcontractor personnel.

1.1 BACKGROUND

The Department of War is responsible for providing the most advanced technical security and countermeasures capabilities to protect sensitive facilities, information, and communications from unauthorized access or exploitation. The DOW Technical Security program is responsible for detecting, deterring, and neutralizing technical surveillance threats directed against DOW facilities and personnel.

The Technical Security program implements DOW and Intelligence Community (IC) direction to integrate, enhance, and optimize technical security and signals countermeasures programs in support of the protection of national intelligence, sources, and methods, including sensitive compartmented information, and the facilities, systems, and networks that house them.

1.2 SCOPE

Except for those items specified as government furnished property and services, the contractor shall provide technical security support services to the Office of Counterintelligence necessary to complete associated tasks and responsibilities in the following functional areas outlined below and defined in this

SOW:

• Technical Surveillance Countermeasures (TSCM): Pre-Construction Surveys, Emergency Surveys, Routine Surveys, In-Place Monitoring

• Data Engineering: Database design, implementation, and management

• Software Development: Application design, coding, testing, and maintenance

• Front-End Development: User interface design and implementation

• Back-End Development: Server-side logic and API development

• Technical Security and Signals Countermeasures (TSSC) Analysis: Technical security assessments and analysis

1.3 Organizational Conflict of Interest (OCI)

Prime Contractors are hereby informed that an actual and/or perceived OCI may arise in the performance of this requirement. This support, as fully described in Section 3.0, Appendix A and

Appendix B, provides technical security support to DOW. These efforts may include access to existing technical security performance contract information and will include supporting all technical security areas, including but not limited to analyzing and documenting the following: requirements, existing and proposed technical solutions, financial data and estimates as well as any supporting documentation for future technical security services. All personnel assigned to this task order will be required to sign the standard Non-Disclosure Agreement.

Should an OCI arise under this contract, the contractor will be required to notify the Contracting Officer immediately and then provide an OCI Mitigation Plan for the Contracting Officer's review and approval within 48 hours from time of notification to the CO.

2.0 APPLICABLE DOCUMENTS

In addition to the documents listed in this SOW, a list of applicable reference documents is provided for reference. See Appendix C.

3.0 DESCRIPTION OF WORK

3.1 Security Support Service Requirements

The contractor shall provide services necessary to complete associated tasks and responsibilities of the

SOW in the functional areas listed and described below, which is inclusive of Appendix A: Anticipated

Support Requirements that identify Labor Categories (LCAT) and Skill Levels, and Appendix B: Position

Descriptions that identify government-defined labor.

3.1.1 Technical Surveillance Countermeasures (TSCM)

Functional Description: The TSCM functional area refers to the procedures and techniques implemented to detect, identify, and neutralize electronic eavesdropping devices or other technical threats that compromise the security and confidentiality of sensitive information. This includes:

• Pre-Construction Surveys: Evaluating plans and designs for new facilities to identify and mitigate potential technical security vulnerabilities

• Emergency Surveys: Responding to suspected technical security breaches or incidents

• Routine Surveys: Conducting scheduled examinations of facilities to detect unauthorized surveillance devices

• In-Place Monitoring: Continuous monitoring of sensitive areas for unauthorized signals or activities

• The TSCM functional area refers to the procedures and techniques implemented to detect, identify, and neutralize electronic eavesdropping devices or other technical threats that compromise the security and confidentiality of sensitive information. This area is led by a Senior

TSCM Lead who ensures team compliance with all TSCM activities and standards.

Expected Outcomes:

• Successful detection and neutralization of all unauthorized surveillance devices in NGA facilities

• Comprehensive documentation of technical vulnerabilities in pre-construction designs with specific mitigation recommendations

• Emergency response to suspected technical security breaches within 24 hours of notification

• Complete and thorough routine surveys conducted according to established periodicity

• Effective continuous monitoring of sensitive areas with prompt alert response within established timeframes

• Detailed survey reports documenting findings and recommendations delivered within 10 business days of completion

• Implementation of effective countermeasures that successfully mitigate identified threats

• Compliance with ICD 705 and NGA standards for all TSCM activities

3.1.2 Data Engineering

Functional Description: The Data Engineering functional area encompasses the design, implementation, and management of databases and data pipelines to support TSSC operations and analysis. This includes:

• Database design and optimization for TSSC data collection and analysis

• Development of data pipelines for processing TSSC data

• Implementation of data storage solutions for long-term analysis

• Creation of data models to support analytical requirements

Expected Outcomes:

• Optimized database schemas that enhance TSSC data collection and analysis capabilities

• Secure, efficient data pipelines with robust validation procedures that ensure data integrity

• Properly implemented data storage solutions compliant with classified environment requirements

• Comprehensive data models that effectively support analytical requirements

• Documented database architecture that meets security and performance standards

• Weekly data engineering status reports that track progress and identify issues

• Data quality reports that demonstrate the effectiveness of data validation procedures

• Secure integration with existing government systems and databases

3.1.3 Software Development

Functional Description: The Software Development functional area covers the design, coding, testing, and maintenance of custom software applications to support TSSC operations. This includes:

• Development of TSSC analysis tools

• Creation of reporting and visualization applications

• Implementation of signal processing algorithms

• Integration with existing government systems

Expected Outcomes:

• Functional, secure software tools for analyzing TSSC data that meet user requirements

• Effective algorithms for signal processing and analysis that enhance threat detection capabilities

• Intuitive visualization tools that enhance understanding of TSSC data

• Customized reporting interfaces that meet user requirements and streamline workflows

• Secure integration with existing government systems with proper documentation

• Weekly software development status reports that track progress and identify issues

• Thoroughly documented code and technical specifications that facilitate maintenance

• Applications that successfully pass security testing before deployment

3.1.4 Front-End Development

Functional Description: The Front-End Development functional area focuses on creating user interfaces for TSSC applications that are intuitive, responsive, and effective. This includes:

• Design and implementation of user interfaces for TSSC applications

• Development of interactive data visualization components

• Creation of responsive web applications for field use

• Implementation of user authentication and authorization interfaces

Expected Outcomes:

• Intuitive user interfaces for TSSC applications that enhance productivity and user satisfaction

• Interactive data visualization components that effectively display technical security data

• Responsive web applications optimized for field use by technical security personnel

• Secure login interfaces with appropriate role-based access controls

• User interfaces that comply with government accessibility standards

• Weekly front-end development status reports that track progress and identify issues

• User interface style guides that ensure consistency across applications

• Usability testing reports that document user feedback and implemented improvements

3.1.5 Back-End Development

Functional Description: The Back-End Development functional area encompasses server-side logic, API development, and system integration for TSSC applications. This includes:

• Development of RESTful APIs for TSSC data access

• Implementation of server-side business logic

• Integration with government authentication systems

• Development of automated data processing workflows

Expected Outcomes:

• Secure, well-documented APIs for TSSC data access with appropriate authentication controls

• Robust server-side components with appropriate error handling and logging capabilities

• Successful integration with government authentication systems

• Efficient automated data processing workflows that enhance analytical capabilities

• Server architecture that meets security and performance requirements

• Weekly back-end development status reports that track progress and identify issues

• API documentation that facilitates integration with other systems

• Performance testing reports that demonstrate system efficiency and scalability

3.1.6 TSSC Analysis

Functional Description: The TSSC Analysis functional area covers the technical assessment and analysis of potential security vulnerabilities and countermeasures. This includes:

• Analysis of RF signals and electromagnetic emissions

• Assessment of physical security measures

• Evaluation of technical security controls

• Development of countermeasures recommendations

Expected Outcomes:

• Accurate identification and characterization of potential threat signals from RF analysis within

48 hours of signal collection

• Comprehensive evaluation of physical security controls with documented vulnerabilities delivered in standardized assessment reports

• Thorough assessment of technical security control effectiveness with specific recommendations for improvement

• Identification of gaps in technical security coverage with prioritized remediation recommendations

• Tailored countermeasures recommendations with detailed implementation plans and resource requirements

• Cost-benefit analysis for recommended countermeasure options to support decision-making

• Detailed signal analysis reports delivered within 10 business days of analysis completion

• Physical security assessment reports with actionable recommendations that comply with ICD

705 standards

• Technical security evaluation reports identifying specific vulnerabilities with mitigation strategies

• Quarterly summary reports that track trends and emerging threats to inform proactive security planning

• Annual technical security threat assessments that inform strategic planning and resource allocation

3.1.7 Functional Area Responsibility Matrix

The following matrix identifies the primary (P) and supporting (S) responsibilities across the six functional areas defined in this SOW:

P = Primary Responsibility S = Supporting Role

Task

TSCM

Pract.

Data

Engineer

Software

Develop.

Front-End

Development

Back-End

Development

TSSC

Analysis

Senior

TSCM

Practitioner

Pre-Construction

Surveys P S P

Emergency Surveys P S P

Routine Surveys P S P

In-Place

Monitoring P S S S P

RF Signal Analysis S P S

Database Design P S S S

Data Pipeline

Development P S S S

Data Storage

Solutions P S S

Task

TSCM

Pract.

Data

Engineer

Software

Develop.

Front-End

Development

Back-End

Development

TSSC

Analysis

Senior

TSCM

Practitioner

Data Modeling P S S S

TSSC Analysis Tools S P S S S S

Reporting

Applications P P S S S

Signal Processing

Algorithms P S S

Government

System Integration S P S P S

User Interface

Design S P S

Interactive Data

Visualization S S P S S

Responsive Web

Applications S P S S

Authentication

Interfaces P P S

RESTful API

Development S P S

Server-Side

Business Logic S S P S

Authentication

System Integration S P S

Automated Data

Processing S P S

Physical Security

Assessment S P P

Task

TSCM

Pract.

Data

Engineer

Software

Develop.

Front-End

Development

Back-End

Development

TSSC

Analysis

Senior

TSCM

Practitioner

Technical Security

Evaluation S P P

Countermeasures

Recommendations S P P

TSCM Team

Compliance P

Standard

Operating

Procedures P

Training Program

Management P

TEMPEST

Coordination S S P

3.2 Labor Categories (LCAT) and Skill Levels

The Government has estimated the labor categories, skill levels, and locations for all Contractor Full-

Time Equivalents (CFTEs) required for accomplishing the mission of this task order-reference each function for specific information. The Government reserves the right to make adjustments, as necessary, to the CFTE labor category mix, level, and quantity to LCATs throughout the term of performance as reflected in Appendix A.

This SOW requires a total of seven (7) positions as detailed in Table 1 of Appendix A. These positions include one (1) TSCM Practitioner, one (1) Senior TSCM Practitioner, one (1) TSSC Analyst, one (1) Data

Engineer, one (1) Software Developer, one (1) Front-End Developer, and one (1) Back-End Developer.

Complete position descriptions for each role are provided in Appendix B. Any discrepancy between the number of positions referenced elsewhere in this document should be resolved in favor of these seven specified positions.

3.2.1 Required Task Qualifications

If additional qualifications, certifications, skills, experience, etc., apply to certain positions supporting this SOW, the Task Descriptions in the LCAT/Family and SOW Job Title (Appendix B) for each task area will identify those requirements.

3.2.2 Complete Staffing Requirements

The table below provides detailed staffing requirements for all positions identified in Appendix A:

Position

Number Position Title

Labor

Category

Skill

Level Required Qualifications

FTE

Count

Primary

Location

XXX-XX-CI-

TSCM

Practitioner

Technical CI

Officer

ITC TSCM Certification, 40 hrs annual training, IAT2 certification

NGA

Washington

XXX-XX-CI-

Senior TSCM

Practitioner

Technical CI

Officer

ITC TSCM Certification, 40 hrs annual training, IAT2 certification

NGA

Washington

XXX-XX-CI-

TSSC Analyst

Technical CI

Officer

7+ years technical security experience, 40 hrs annual training

NGA

Washington

XXX-XX-CI-

Data Engineer

Technical CI

Officer

BS in Computer Science, 8+ years data engineering experience

NGA

Washington

XXX-XX-CI-

Software

Developer

Technical CI

Officer

BS in Computer Science, 8+ years software development experience

NGA

Washington

XXX-XX-CI-

Front-End

Developer

Technical CI

Officer

BS in Computer Science, 8+ years front-end development experience

NGA

Washington

XXX-XX-CI-

Back-End

Developer

Technical CI

Officer

BS in Computer Science, 8+ years back-end development experience

NGA

Washington

3.2.3 Staffing Plan Requirements

The Contractor shall submit a detailed staffing plan within 10 workdays after contract award that includes:

1. Names and resumes of proposed personnel for each position

2. Verification of required certifications and clearances

3. Transition timeline for onboarding personnel

4. Contingency plans for addressing potential staffing gaps

5. Training plans to maintain required certifications

3.2.4 Government Approval of Staff Assignments

The following procedures shall be followed for government approval of staff assignments:

1. The Contractor shall submit proposed personnel qualifications to the COR for review

2. The COR shall review qualifications within 5 business days

3. The COR shall provide written approval or rejection with justification

4. For rejected candidates, the Contractor shall provide alternative candidates within 10 business days

5. No personnel shall begin work without written COR approval

6. Changes to approved personnel require advance notice and COR approval

3.3 Phase-In Transition Plan

The Contractor shall provide a detailed Phase-In Transition Plan within 10 workdays after contract award with the following specific milestones and deliverables:

Week 1-2 Milestones:

• Complete initial staffing plan with identified personnel

• Conduct kickoff meeting with government team

• Begin security clearance verification process

• Establish communication protocols

Week 3-4 Milestones:

• Complete personnel onboarding (minimum 50%)

• Begin knowledge transfer sessions with incumbent

• Inventory and document all GFE/GFI to be transitioned

• Begin system access requests

Week 5-6 Milestones:

• Complete personnel onboarding (100%)

• Complete knowledge transfer from incumbent

• Finalize standard operating procedures

• Establish quality control processes

Week 7-8 Milestones:

• Conduct parallel operations with incumbent

• Perform capability demonstration

• Address any identified gaps

• Finalize transition documentation

Acceptance Criteria:

• All required personnel are onboarded with appropriate clearances

• All required training is completed

• All GFE/GFI properly inventoried and transferred

• All required system accesses granted

• Knowledge transfer sessions documented and completed

• Capability demonstration successfully completed

• Government acceptance of transition completion

To minimize any decreases in productivity, and to prevent possible negative impact on additional services, the Contractor shall ensure that all key personnel are on-board within the sixty (60) day phase-in period. During that period, the Contractor shall become familiar with performance requirements to commence full performance of services on the start of the base period of performance. Contractor employees shall obtain required IC badges, Common Access Cards (CAC), all other forms of government identifications, all specific government training, and will conduct inventory and transfer of

GFP/GFE/GFM during the phase-in period.

3.3.2 Phase-Out

Thirty (30) days prior to contract completion, a phase-out period shall begin, during which team management personnel from the incoming Contractor may observe operations and Government observation may also occur. This will allow for orderly turnover of facilities, equipment, and records and will help to ensure continuity of services. The outgoing Contractor is ultimately responsible for performing full services IAW with contract, during the phase-out period, and shall not defer any requirements for the purpose of avoiding responsibility or of transferring such responsibility to the succeeding Contractor. The outgoing Contractor shall fully cooperate with the incoming Contractor and the Government to prevent interference with their work or duties.

To minimize decreases in productivity and prevent possible negative impacts on additional services, the outgoing Contractor shall maintain its personnel in an active working status at the government site(s) during the phase-out period. The outgoing Contractor shall transition the workload to the newly selected Contractor within 30 days of contract completion at which time the phase-out period ends.

The outgoing Contractor shall develop a written phase-out plan, and effect a smooth and orderly transfer of contract responsibility to the incoming contractor. At a minimum, the plan shall fully describe the outgoing Contractor's approach to the following:

• Inventories and turn-over of government property and information

• Removal of any Contractor property

• Reconciliation of all property accounts

• Turn-in of excess property

• Data and information transfer

• Clean-up of Contractor work areas

• Security debriefings in accordance with policies and IC directives for incumbent personnel holding security clearances

• Any other actions required to ensure continuity of government mission and operations

The outgoing contractor shall provide the plan to the COR thirty (30) days prior to contract completion.

3.4 DELIVERABLES

This table lists the deliverable requirements for the task order:

Title 1st Submission Updates Delivered to Format

Non-Disclosure

Agreements As Required

As

Required

PM/CO

Contractor Defined, Govt approved

Quarterly Program

Management Reviews*

(see note below)

Award +120 days Quarterly PM/CO/COR

Contractor Defined, Govt approved

Monthly Financial, Staffing/Vacancy and

Activity Report

Task Order Start

+30 Days Monthly COR/TM

Contractor Defined, Govt approved

Non-local travel request, travel log, and trip report templates

10 days after contract award

As

Required

COR

Contractor Defined, Government

Approved

Local and Non-local

Travel Request

10 days prior to travel

As

Required

COR/TM

Contractor Defined, Government

Approved

Trip Reports

NLT 5 business days after return

As

Required

COR/TM

Contractor Defined, Government

Approved

Title 1st Submission Updates Delivered to Format

Travel Log

NLT 5 business days after return from first trip

As

Required

COR/TM

Contractor Defined, Government

Approved

Transition Plan

5-10 days after

Task Order award

As

Required

PM/CO/COR

Contractor Defined, Government

Approved

Reports, Briefings, Evaluations, Technical

Assignments, White

Papers Etc.

As Required As

Required

COR/TM

Contractor Defined, Government

Approved

Organizational Conflict of Interest Mitigation

Plan

As Required

(see SOW

Section 1.3)

As

Required

CO

Contractor Defined, Government

Approved Immediately and then provide an OCI Mitigation Plan for the CO's review and approval within 48 hours from time of notification to CO

Quality Control Plan

NLT 10

Workdays after

Task Order award

As required

COR/TM

Contractor Defined, Government

Approved

Monthly TSCM Activity

Reports

NLT 5th day of each month Monthly Govt lead

Contractor Defined, Government

Approved

Quarterly TSCM

Summary Reports

NLT 5th day of

January, April, and July

Quarterly Govt lead Contractor Defined, Government

Approved

Annual Technical

Security Assessment

NLT 1

December Annually Govt lead

Contractor Defined, Government

Approved

Software Development

Status Reports Weekly Weekly Govt lead

Contractor Defined, Government

Approved

Title 1st Submission Updates Delivered to Format

Data Engineering Status

Reports Weekly Weekly Govt lead

Contractor Defined, Government

Approved

Front-End Development

Status Reports Weekly Weekly Govt lead

Contractor Defined, Government

Approved

Back-End Development

Status Reports Weekly Weekly Govt lead

Contractor Defined, Government

Approved

Application Release

Documentation

Prior to each release

As required Govt lead

Contractor Defined, Government

Approved

Data Model

Documentation

Upon completion

As required Govt lead

Contractor Defined, Government

Approved

Phase-Out Plan

NLT 30 days prior to contract end

One Time PM/CO/COR Contractor Defined, Government

Approved

*Note: The contractor will deliver a single quarterly review that addresses all active task orders.

4.0 GENERAL PROVISIONS

Period of Performance: The period of performance for this Task Order is estimated to be as follows: One twelve-month base year, plus four twelve-month options.

Primary Place of Performance: The primary place(s) of performance for this Task Order are DOW facilities in Washington, DC. As required, place of performance may include other DOW facilities and partner facilities within a 50-mile radius of primary locations. For a breakout of positions by location, see

Appendix A, Anticipated Support Requirements. The Contractor shall have routine access to government-provided sites (GPS) and all work shall be completed at a government provided site.

Government-Furnished Equipment / Information (GFE/GFI) The Government expects that the

Contractor will complete all work under this task order at GPS, as noted in Place of Performance section.

Government-Furnished Equipment Inventory NGA Washington Facility

1. Workstations with appropriate classified network access

2. Office furniture (desk, chair, storage)

3. Telephones with secure communication capabilities

4. Access to SCIF-approved printers and scanners

5. TSCM specialized equipment for Position 1 (TSCM Practitioner) duties

6. Technical analysis workstations with specialized software for Position 2 (TSSC Analyst)

7. Development environments for software and data engineering positions

8. Common office supplies

Other NGA Facilities (within 50-mile radius)

1. Temporary workstations with appropriate network access

2. Access to secure communication equipment

3. Access to printing/scanning facilities

4. Temporary storage for equipment and materials

Contractor-Furnished Equipment

1. Personal protective equipment appropriate for work environment

2. Contractor credit cards for travel-related expenses (as specified in Section 6.0)

3. Personal passports for potential OCONUS travel (as specified in Section 6.0)

4. Any specialized tools or equipment not provided by the government but required for task completion

Equipment Request Procedures

1. For additional equipment needs, the Contractor shall submit a written request to the COR detailing:

o Equipment description and specifications o Justification for the requirement o Duration of need o Impact on mission if not provided

2. The COR will review the request and provide a written response within 5 business days.

3. If approved, the government will provide the equipment within a mutually agreed timeframe.

4. The Contractor shall maintain an inventory of all government-furnished equipment and report any damage, loss, or malfunction to the COR within 24 hours.

5. Upon contract completion, all government-furnished equipment shall be returned in the same condition as provided, normal wear and tear excepted.

Contractor Furnished Items and Safety Compliance

The Contractor shall furnish all supplies, equipment, facilities and services required to perform work under this task order that are not listed under Government Furnished Items and Services. The contractor shall ensure all contractor personnel comply with all local, state, and federal ordinances, statutes, and regulations regarding personal safety in work or construction areas. The contractor is responsible for the costs associated with the safety compliance program and will not be reimbursed for those costs.

The contractor must provide the CO and/or COR documentation of the insurance policy and confirm that the policy covers the aforementioned requirements.

Contractor Facility Space: It is anticipated that all work under this task order will be performed at

Government facilities.

Work Hours: During normal operations, contractor personnel are authorized to work a flexible work schedule within the 80-hour work period, as coordinated with Government leads.

Authorized daily hours fall between 6:30AM and 6:30PM, Monday through Friday, except when the government facility is closed due to federal holiday, local or national emergencies, administrative closings or similar government directed facility closings. The contractor shall maintain an adequate workforce for the uninterrupted performance of all tasks defined within this SOW when the government facility is not closed for the above reasons. When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the workforce are essential to successful performance under this contract.

Between core hours of 8:00AM and 4:00PM, the contractor shall have at least one FTE on-site at a DOW facility. At the request of the customer and with prior approval of the COR, contractors may be required to work hours outside of standard workday or on weekends. Examples of these situations include working before or after specific construction activities, limited access during standard hours due to uncleared personnel, security incidents that may preclude standard hours.

5.0 SECURITY

Classified Work Performance Security Requirements

Contractors must abide by the DD Form 254 - Contract Security Classification Specification (referred to as DD254 hereafter), the National Industrial Security Program Operating Manual (NISPOM 32 CFR Part

117), and all other applicable security policies and regulations including operational security (OPSEC) requirements.

Some personnel may need to obtain access to Special Access Program (SAP), and/or Control Access

Program (CAP) and/or Alternate Compensatory Control Measures (ACCM) Information as required for the execution of NGA's sensitive program missions. Access will not be granted without written permission from the COR.

Defense Counterintelligence and Security Agency (DCSA) remains the Cognizant Security Agency (CSA) for individuals performing work with collateral (SECRET or TOP SECRET) security clearances. As such, Security Executive Agent Directive (SEAD) 3 reporting should continue to be provided to the Contractor's

Facility Security Officer (FSO) for reporting to DCSA via Defense Information Security System (DISS).

DCSA will also dictate mandatory security training as the CSA for the collateral cleared community.

Personnel Security Requirements

Contractor personnel performing Top Secret/Sensitive Compartmented Information (TS/SCI) work on the contract are required to have active TS/SCI clearances for access to TS/SCI facilities, when performing duties within TS/SCI environments, and for access to TS/SCI computer systems for the performance of this contract. Contractors are subject to a Counterintelligence-Scope Polygraph examination, as requested by NGA. As a condition of employment and assignment, contractors who have not successfully completed polygraph testing within the last five years must immediately schedule a polygraph examination and must complete the process, in no more than three test sessions, within 90 days.

All Contractor personnel shall possess a current Top Secret Personnel Security Clearance and be eligible for favorable NGA adjudication for SCI access. The government will be responsible for verifying security clearances/SCI eligibility of the Contractor personnel in accordance with (IAW) SEAD 7: "Reciprocity of

Background Investigations and National Security Adjudications". If needed, NGA will sponsor SCI accesses at its sole discretion. NGA will provide badges, Common Access Cards (CAC) and other items

(e.g., parking hangtags) when applicable, for required Contractor personnel.

Cleared Contractor personnel will be enrolled into Director of National Intelligence (DNI) Continuous

Evaluation System (CES) throughout the lifecycle of the contract while at NGA IAW SEAD 6: "Continuous

Evaluation". Cleared Contractor personnel must self-report security issues, foreign contacts, and other applicable information IAW SEAD 3: "Reporting Requirements for Personnel with Access to Classified

Information or Who Hold a Sensitive Position" and NGA Instruction 5205.3, "Security Reporting

Requirements". In addition, cleared Contractors will be required to submit electronic fingerprints and be enrolled into NGA's Report of Arrest and Prosecution Background (RAP Back) program, which supports

CES.

Cleared Contractor personnel, who are designated as Tier 3 Privileged Users or holding enhanced access through a Special/Controlled Access Program (SAP/CAP), will be required to participate in NGA's annual

Security Financial Disclosure Program (SFDP) as directed by D/NGA in the 20 November 2020 memorandum titled "Designation of NGA Personnel Required to Participate in the Security Financial

Disclosure Program".

The Contractor shall inform NGA as soon as practicable when its employees will no longer support the contract (see DD254). NGA desires notification prior to the day the individual no longer supports the contract, but requires notification no later than the day that contract support ends. If Contractor personnel will no longer be supporting NGA via an NGA contract, NGA shall take all appropriate action, up to and including debriefing the contractor from SCI access and terminating logical and physical access to NGA IT systems and facilities.

Upon notifying NGA that a Contractor will no longer support the contract, the Contractor must return all

NGA Badges, CAC, hangtag, and any other government furnished property. These items can be returned to the NGA Workforce Support Center, NGA Site Security Office, or the Contracting Officer

Representative (COR) as soon as practicable, but no later than four (4) business days from the date of

Contractor departure.

When Contractor personnel are unable to turn these items into the NGA Workforce Support Center, NGA Site Security Office, or COR then it is the responsibility of the Contractor's FSO to collect the items from the individual and return them to NGA as soon as practicable, but no later than four (4) business days from the date of Contractor departure.

If the FSO debriefs their employee, the FSO shall provide a copy of the debriefing statement, plus all applicable Government-furnished items (e.g., NGA Badge, CAC, Courier Card, parking hangtags, etc.) to the NGA Site Security Office or the NGA Workforce Support Center as soon as practicable, but no later than four (4) business days from the date of Contractor departure.

Physical Security Requirements

All classified work performed at a non-NGA facility must be approved by the COR. Any classified work performed at contractor sites must be performed in either an NGA accredited SCIF, Other Government

Agency (OGA) SCIF, or an approved secure collateral space that has either a Memorandum of

Agreement (MOA), Memorandum of Understanding (MOU), Joint Use Agreement or Co-Use Agreement with NGA for this contract. SCIF or secure facility accreditation shall be at least the level commensurate with the level of safeguarding required by the contract DD254.

Pursuant to "IC Technical Specifications for Construction and Management of Sensitive Compartmented

Information Facilities Version 1.5.1; IC Tech Specs for ICD/ICS 705", the NGA accrediting official, or designee, shall conduct periodic security inspections/reviews to ensure the efficiency of NGA accredited

SCIF operations, identify deficiencies, and document corrective actions taken. Inspections/reviews of

NGA accredited SCIFs shall be conducted based on threat, facility modifications, sensitivity of programs, past security performance, or at least every five years. Technical Surveillance Countermeasures (TSCM) activities in NGA accredited SCIFs will only be conducted by NGA TSCM teams consisting of NGA military, civilian, or contractor personnel who have successfully completed approved TSCM training. Authorized inspectors shall be admitted to a SCIF without delay or hindrance when inspection personnel are properly certified to have the appropriate level of security clearance and SCI indoctrination for the security level of the SCIF.

Contractor personnel are forbidden from bringing prohibited or unauthorized items into any NGA installation or other secure facility covered under this contract. These items include weapons, cell phones, cameras, two-way pagers, laptops, recording devices of any kind, flash drives, or any other removable media. Exceptions may be granted by NGA Security upon the Contractor's request. If granted, Contractor personnel must bring documentation showing approval prior to entering with the item(s).

Violations may subject the Contractor and its offending personnel to civil and/or criminal liability IAW applicable laws and regulations governing access to secure Government facilities.

Unclassified Work Performance Security Requirements

If applicable, and after discussion with the COR, and the COR has provided written approval, uncleared

Contractor personnel are authorized to work on this contract at the Unclassified level, with access up to

DOW Controlled Unclassified Information (CUI) at the Contractor site without the requirement of a security clearance.

Uncleared Personnel Security Requirements

If applicable, and after discussion with the COR, and the COR has provided written approval, any

Contractor personnel working with CUI information must receive a favorable HSPD-12 and/or HSPD-12

Tier 1 adjudication prior to accessing CUI information. Contractor personnel who require access to CUI for 60 days or less must receive a favorable HSPD-12 adjudication. Contractor personnel who require

CUI access for more than 60 days must receive a favorable HSPD-12 Tier 1 adjudication. NGA will sponsor the HSPD-12 and HSPD-12 Tier 1 background investigation for Contractor personnel as needed.

Foreign nationals are not permitted to perform unclassified work under the terms of this contract without prior written approval from the Contracting Officer (CO) or the COR. Should NGA identify the use of unauthorized personnel, the CO may direct the Contractor, at its own expense, to remove and replace any unauthorized Contractors, Subcontractors, or other personnel performing on the contract.

Such action may be taken at the NGA's discretion without prejudice to its rights under any other contract provision, e.g., termination for default.

Uncleared Contractor personnel visiting NGA facilities or other sites may receive the appropriate visitor badge and be escorted, as appropriate. The Contractor will return the visitor badge at the end of each visit day.

Information Security Requirements

NGA shall have the sole authority to determine whether, and to what extent, protected information shall be provided to the Contractor under the terms of the contract. Access to classified information will be pursuant to the security requirements established in the DD254. The Contractor shall not access, download, print, or further disseminate any classified information outside the execution of the defined contract requirements without the guidance and written permission from the COR.

When the Contractor receives protected information under the terms of this contract, the Contractor will comply with all applicable NGA, DOW, and IC information security policies (including the

Consolidated NGA (CONGA) Security Classification Guide) for the proper marking, handling, processing, storing, and safeguarding of classified and unclassified material. The Contractor will ensure that document markings are given the lowest possible security classification to maximize dissemination while still maintaining the information's confidentiality and integrity as necessary.

Access to CUI will be pursuant to DFARS clause 252.204.7012. The prime contractor shall include this clause, including paragraph (m), in subcontracts, or similar contractual instruments, for operationally critical support or for which subcontract performance will involve covered defense information, including subcontracts for commercial items, without alteration, except to identify the parties. The

Contractor shall determine if the information required for Subcontractor performance retains its identity as covered defense information and will require protection under this clause. Contractor personnel shall not release any unclassified information, regardless of medium (e.g., film, tape, document), pertaining to any part of this contract or any program related to this contract, unless the

COR has given prior written approval or in performance of a project that has been scoped and negotiated by NGA.

NGA will assess and authorize Contractors to process classified information on government-owned information systems, conduct oversight of such information system processing, and provide information system security guidelines IAW with FAR clause 52.204-21 and other information system security control policies, standards, and procedures. Contractor will be responsible for executing specific provisions under the contract for the accreditation of classified information systems, and upon request, shall provide the COR a written statement confirming accreditation compliance with the minimum information systems requirements established in the DD254. The Contractor shall include the substance of FAR clause 52.204-21 in subcontracts under this contract (including subcontracts for the acquisition of commercial products or commercial services, other than commercially available off-the-shelf items), in which the Subcontractor may have federal contract information residing in or transiting through its information system.

In accordance with FAR Part 4.7 and FAR clause 52.215-2, the Contractor may retain one archival copy of any Government-furnished information provided to the Contractor during the course of performance of the contract, subject to Contractor following relevant data safeguarding practices and CUI restrictions.

The disposition of such Government-furnished information is otherwise solely at the discretion of the

Government. As directed by the NGA CO or COR, the Contractor will destroy or return to NGA all

Government-furnished information upon contract termination or when no longer required for contract performance.

In situations when electronic transmission is not practicable, Cleared Contractor personnel may hand-carry contract-related classified information when authorized by the COR in writing. Approved

Contractor personnel must obtain NGA courier authorization prior to hand-carrying of classified contract-related information. Only classified information related to the performance of this contract may be hand-carried. Contractor personnel will be limited to hand-carrying classified information between approved Contractor facilities and US Government facilities unless the COR approves other circumstances in writing, when applicable, on a case-by-case basis.

Cybersecurity Requirements

The Contractor must, at a minimum, implement 10 U.S.C. Sections 391 and 393 along with National

Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, "Protecting Controlled

Unclassified Information in Nonfederal Information Systems and Organizations" requirements.

If the Contractor intends to use an external cloud service provider to store, process, or transmit any covered defense information in performance of this contract, the Contractor shall require and ensure that the cloud service provider meets security requirements equivalent to those established by the

Government for the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline (https://www.fedramp.gov/resources/documents/)

In the event that the Contractor discovers a cyber incident that affects a covered Contractor information system or covered defense information residing therein, or that affects the Contractor's ability to perform the requirements of the contract that are designated as operationally critical support and identified in the contract, the Contractor shall—

1. Notify the DOW Cyber Crime Center (DC3) and the COR in writing within 72 hours of incident discovery

2. Conduct a review for evidence of compromise of covered defense information, including, but not limited to, identifying compromised computers, servers, specific data, and user accounts.

This review shall also include analyzing covered Contractor information system(s) that were part of the cyber incident, as well as other information systems on the Contractor's network(s), that may have been accessed as a result of the incident in order to identify compromised covered defense information, or that affect the Contractor's ability to provide operationally critical support.

https://www.fedramp.gov/resources/documents/

In the event the Contractor discovers and isolates malicious software in connection with a reported cyber incident, the Contractor shall submit the malicious software to DC3 in accordance with instructions provided by the COR. The Contractor should NOT send the malicious software to the COR.

Insider Threat Requirements

Contractor will establish and maintain an insider threat program to gather, integrate, and report relevant and available information indicative of a potential or actual insider threat, consistent with E.O.

13587 "Structural Reforms to Improve the Security of Classified Networks and the Responsible Sharing and Safeguarding of Classified Information" and Presidential Memorandum "National Insider Threat

Policy and Minimum Standards for Executive Branch Insider Threat Programs." As soon as practicable, Contractor shall report to the COR events that may have an effect on the status of the entity's or an employee's eligibility for access to classified information; report events that indicate an insider threat to classified information or to employees with access to classified information; report events that affect proper safeguarding of classified information; and report events that indicate classified information has been, or is suspected to be, lost or compromised.

6.0 TRAVEL AND OTHER DIRECT COSTS (ODCs)

Travel is anticipated in support of work requirements described in SOW sections. Each discrete function or task, including non-local travel, will identify the specific requirements for ODC's. All non-local travel requires advanced approval and authorization in writing by the COR 10 business days prior to requested travel dates.

For all positions, CONUS/OCONUS TDY may be required. However, the government reserves the right to require TDY travel as necessitated by future circumstances. NGA has a global presence so all positions shall have the ability to support equities world-wide and to travel with a minimum of 8 hours' notice.

Short notice travel is typically associated with the most critical incident response; most travel is anticipated to have at least 72 hours' notice. Due to the potential for OCONUS travel, contractors are required to maintain personal passports.

Travel Notification Requirements

The following tiered notification requirements shall apply to all travel:

1. Emergency Travel: Minimum 8 hours' notice for mission-critical incident response

2. Priority Travel: Minimum 48 hours' notice for high-priority but non-emergency travel

3. Standard Travel: Minimum 72 hours' notice for routine travel requirements

4. Planned Travel: 10 business days' notice for scheduled, non-urgent travel

Travel Frequency and Duration Reporting

The Contractor shall maintain historical data on travel frequency and duration by position and location to better estimate resource requirements. This data shall be provided to the COR quarterly and shall include:

1. Number of trips by location and position

2. Average duration of trips

3. Percentage of emergency vs. standard travel

4. Travel costs by location

Emergency Travel Reimbursement

For travel required with less than 24 hours' notice, the following special provisions apply:

1. Reasonable premium transportation costs may be reimbursed with COR approval

2. Actual lodging expenses may exceed standard per diem rates with COR approval

3. Documentation of emergency nature must accompany all reimbursement requests

4. All emergency travel expenses must still comply with Federal Travel Regulation (FTR) and FAR

31.205-46

Contractors are not allowed to charge the government for business or first-class travel. Contractors may use frequent flier miles for upgrades, but will not expense this to the government. The contractor will be limited to Government approved lodging and per diem rates. All travel shall be reimbursed consistent with the substantive provisions of the Federal Travel Regulation (FTR), FAR 31. 205-46, according to COR approval, and according to fund limitations specified in this contract.

Authorization and use of Government vehicles by contract personnel.

Pursuant to 41 CFR §102-34.215, contract personnel are allowed the use of government motor vehicles when authorized in accordance with the Federal Acquisition Regulation (FAR) and GSA Fleet Procedures, and must:

1) Establish and enforce suitable penalties against employees who use, or authorize the use of, Government motor vehicles for unofficial purposes or for other than in the performance of the contract;

and

2) Pay any expenses or cost, without Government reimbursement, for using Government motor vehicles other than in the performance of the contract.

During authorized travel, contractor personnel are exempt from the requirement in Section 4.0 that 'all work shall be completed at a government provided site.' When traveling, contractor personnel shall:

1. Perform work at government-designated facilities at the travel destination whenever possible.

2. When work at government facilities is not possible, contractor personnel shall follow established security protocols for remote work, including: a. Using only government-furnished equipment

(GFE) for accessing classified information b. Ensuring all work is conducted in appropriately secure environments c. Following all applicable security procedures for handling, transmission, and storage of sensitive information

3. Contractor personnel shall document all work performed during travel in accordance with the reporting requirements in Section 3.4.

4. For emergency travel with less than 24 hours' notice, the COR may provide additional specific guidance on…