Vendor Due Diligence Draft PWS.pdf

Attachment 1 – Performance Work Statement Page 1 of 20

PERFORMANCE WORK STATEMENT (PWS)

U.S. Army Special Operations Command Capabilities Protection Cell

Vendor Due Diligence Contract

Part I

General Information

1. GENERAL: This is a non-personal services contract to provide Vendor Due Diligence support to the United States Army Special Operations Command (USASOC) enterprise. The Government shall not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn is responsible to the Government. The Contractor, in turn, shall be accountable to the Government for Contractor or subcontractor personnel.

1.1. Description of Services/Introduction: The Contractor shall provide all personnel, supervision, equipment, supplies, tools, materials, and other items and non-personal services necessary to perform full spectrum vendor due diligence research and analysis in order to assist the Government with assessing risk and/or the possible vendor concerns of U.S. Government (USG) acquisition at the vendor level as defined in this Performance Work Statement (PWS), except for those items specified as Government furnished property and services. The Contractor shall perform in accordance with (IAW) the terms and conditions of the contract and consistently with the established standards in this PWS and contract.

1.1.1. The Contractor shall acquire and analyze available data and information to conduct full spectrum due diligence of a vendor in order to identify potential vulnerabilities in a vendor’s organization that may present a risk to USASOC. The contractor’s due diligence efforts will include but are not limited to, evaluating a vendor’s supply chain, inter-commercial relationships, digital architecture access, record of legal/regulatory compliance, financial stability, general business reputation, potential for Foreign Ownership, Control or Influence (FOCI).

1.2. Background: The DoD works with other U.S. Government departments and agencies, as well as other allied and partner nations, to use applicable authorities to deny, disrupt, defeat, or degrade adversaries’ potential ability to introduce national security risks and threats through contracts, grants, and cooperative agreements with the U.S. Government, allies, and partners. This contract will support USASOC’s efforts to identify, vet, and address potential threats posed by vendors.

1.3. Objective: The objective of this contract is to vet vendors that seek to do business with the Government or are related to Army Special Operations Forces (ARSOF) interests, modernization, acquisitions in order to identify possible concerns posed by these vendors.

1.4. Scope: The Contractor shall provide all personnel, supervision, equipment, supplies, tools, materials, and other items and non-personal services necessary to perform full spectrum vendor due diligence research and analysis in order to assist the government with assessing risk and/or the possible compromise of USG acquisition at the vendor level. Full spectrum due diligence includes, but is not limited to, evaluating a vendor’s supply chain, inter-commercial relationships, digital architecture access, record of legal/regulatory compliance, financial stability, general business reputation, potential for Foreign Ownership, Control or Influence (FOCI).

1.5. Period of Performance: The government anticipates an award of a Firm Fixed Price (FFP) one year (12 months) contract. The period of performance is estimated to be from 30 September 2025 to 29 September 2030 (base + 4 years).

1.6. General Information

Attachment 1 – Performance Work Statement Page 2 of 20

1.6.1. Quality Control: Quality Control is the responsibility of the Contractor. The Contractor is responsible for the delivery of quality services/supplies to the Government (see FAR 52.246-1 Contractor Inspection Requirements).

1.6.1.1. Quality Control Program: The Government is committed to a highly interactive relationship between quality control by the Contractor and quality assurance by the government recipient of services.

This relationship shall be achieved through an effective Prevention Based Quality Control Program dedicated to ensuring the best possible products and services to end users. The Contractor shall provide their final written Quality Control Plan (QCP) to the Contracting Officer 15 days after contract award for approval. The Contractor shall provide one (1) paper copy and one (1) digital copy of the QCP to the KO. Changes to the QCP, as they occur throughout the term of the contract, shall be sent to the Contracting Officer for approval. The Contractor shall notify the Contracting Officer within five (5) working days.

The QCP shall be always available for review/inspection by the Government.

1.6.1.1.1. The Contractor’s QCP shall demonstrate its prevention-based outlook by meeting the objectives stated in the PWS throughout all areas of performance. The QCP shall be developed to specify the Contractor’s responsibility for management and quality control actions to meet the terms of the contract.

The QCP as a minimum shall address continuous process improvement; procedures for scheduling, conducting and documentation of inspection; discrepancy identification and correction; corrective action procedures to include procedures for addressing Government discovered non- conformances; procedures for root cause analysis to identify the root cause and root cause corrective action to prevent re-occurrence of discrepancies; procedures for trend analysis; procedures for collecting and addressing customer feedback/complaints.

1.6.1.1.2. Inspections. The Contractor shall establish a comprehensive inspection system/process covering all the performance evaluation attributes iterated throughout this PWS. The QCP shall specify the areas to be inspected on either a scheduled or unscheduled basis, the frequency of inspections and the title of the individual(s) to perform the inspections.

1.6.1.1.3. Deficiencies. Identity the methodologies for identifying and preventing deficiencies in the quality of service performed before the level of performance and performance quality becomes unacceptable/unsatisfactory, as well as a method of correcting the deficiencies (e.g., retraining, recertification, etc.).

1.6.1.1.4. Record Keeping. On-site records of inspection techniques by the Contractor shall be utilized to initiate, record, and report corrective action procedures. The Contractor shall provide, all reports generated because of the Contractor’s quality control efforts. This shall include any summary information used to track quality control, including any charts/graphs.

1.6.1.1.5. All Contractor QCP documentation regarding contract performance metrics and performance quality shall be available at any time upon request for review by the COR or KO.

1.6.1.1.6. The Contractor’s QCP shall be incorporated into and become part of this contract after the plan has been accepted by the Government. Proposed changes made after KO acceptance shall be submitted in writing through the COR to the KO for review and acceptance prior to implementing any revision. The Contractor’s QCP shall be maintained throughout the life of the contract and shall include the Contractor’s procedures to routinely evaluate the effectiveness of the plan to ensure the Contractor is meeting the performance standards and requirements of the contract.

1.6.1.1.7. Performance Evaluation Meetings. The Contractor Representative shall be required to meet periodically with the COR and other Government representatives during contract performance. These meetings shall be conducted to ensure acceptable/satisfactory Contractor performance, performance quality, and address any performance issues. The Contractor may request a Performance Evaluation Meeting in the event a Contract Discrepancy Report (CDR) or other report of substandard performance or performance quality is issued. The COR will document the meeting in a written report within five (5) workdays. The minutes of Performance Evaluation Meetings shall be signed by the Contractor

Attachment 1 – Performance Work Statement Page 3 of 20

Representative, the COR, and any other meeting attendees. Should the Contractor not concur with the minutes, the Contractor shall so state and submit a formal written response regarding any areas of non-concurrence to the Contracting Officer within five (5) workdays of receipt of the signed minutes.

1.6.1.2. Contractor Discrepancy Report (CDR): When the Contractor's performance is unsatisfactory, a CDR will be issued. The Contractor shall reply in writing within five (5) workdays from the date of receipt of the CDR, giving the reasons for the unsatisfactory performance, corrective action taken, and procedures to preclude recurrence.

1.6.1.3. Quality Assurance: The COR will evaluate the product produced by the Contractor under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan is primarily focused on what the COR must do to ensure that the Contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s). When an observation indicates defective performance, the COR will require the Contractor or designated on-site representative to initial the observation to acknowledge the defective performance. The acknowledgement of the observation does not necessarily constitute Contractor concurrence with the observation, only that the Contractor has been made aware of the defective performance.

1.6.2. Property Management System: Not Applicable. Contractor will not be furnished government equipment or property.

1.6.3. Recognized Federal Holidays: The Contractor shall not be required to perform services on recognized federal holidays. The recognized federal holidays include:

New Year’s Day Labor Day Martin Luther King Jr.’s Birthday Columbus Day Washington’s Day Veteran’s Day Memorial Day Thanksgiving Day Juneteenth Christmas Day Independence Day

1.6.3.1. When a holiday occurs on a Saturday, Federal employees are normally granted the previous Friday as the holiday observance. When a holiday occurs on a Sunday, Federal employees are normally granted the following Monday as the holiday. The contractor shall provide reports on the days the Government is scheduled to work.

1.6.3.2. When an unforeseen installation closure occurs on a regularly scheduled day of work, the Contractor will have the following options:

1.6.3.2.1. Reschedule the work so it is performed the following day unless the following day falls on a weekend.

1.6.3.2.2. Reschedule the work on any day that is mutually satisfactory.

1.6.4. Hours of Operation: The Contractor shall be responsible for providing services, interacting with the customer, between the hours of 7:30 AM – 4:30 PM, Eastern Standard Time Monday through Friday, except federal holidays or when the government facility is closed due to local or national emergencies, administrative closings or similar government directed facility closings.

1.6.4.1. The software shall remain fully operational 24 hours a day, 365 days a year. During nights, weekends, and holidays the contractor shall provide adequate technical support to overcome emergent issues and to ensure that the software can continue to function. Within 24-hours of any reported software issue, the Contractor shall contact via phone or email the COR or other identified Government personnel with technical solution.

Attachment 1 – Performance Work Statement Page 4 of 20

1.6.5. Place of Performance: N/A. Except for occasional meetings with the COR, work will not be performed at Government facilities. The work to be performed under this contract shall be accomplished at the Contractor’s facility. Meetings with the COR will occur at the United States Special Operations Command (USASOC), 2929 Desert Storm Drive, Fort Liberty, North Carolina, 28310.

1.6.6. Security Requirements: Not applicable.

1.6.6.2. Physical Security: Not applicable.

1.6.7. Key Control: Not applicable.

1.6.8. Special Qualifications.

1.6.8.1.1. Contractor personnel performing work under this contract shall be U.S. citizens unless the provisions of Army Regulation 25-2, Information Assurance have been fully completed and approval has been granted by the Government for the non-U.S. citizen to perform the required support.

1.6.8.1.2. Access and General Protection/Security Policy and Procedures: When visiting the USASOC, all Contractor personnel performing work under this contract shall comply with applicable installation, facility and area Commander installation/facility access, local security policies and security procedures provided by the Security Manager Government representative. Contractor personnel shall provide all information required for background checks to meet installation access requirements to be accomplished by the installation Provost Marshal Office, Director of Emergency Services or Security Office. Contractor personnel shall comply with all personal identity verification requirements as directed by Department of Defense (DoD), HQ Department of Army (DA) or local policies. In addition to the changes otherwise authorized by this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in Contractor and subcontractor security matters or processes.

1.6.8.1.3. Anti-Terrorism Program

1.6.8.1.3.1. AT Level I Training: The Contractor will not have routine access and will be escorted by the COR during periodic meetings. Therefore, AT Level I training is not required.

1.6.8.1.3.2. iWATCH Training: The Contractor will not have routine access and will be escorted by the COR during periodic meetings. Therefore, iWATCH training is not required.

1.6.8.1.3. Handling / access to classified information. Not applicable.

1.6.8.1.4. Contract employees Requiring Access to Government Information Systems: Contractor will not have access to classified information.

1.6.8.1.5. OPSEC Training: The Contractor will not have routine access and will be escorted by US Government personnel during periodic meetings. Therefore, OPSEC training is not required.

1.6.8.1.6. Information Assurance (IA)/Information Technology (IT) training: The Contractor will not have network access. Therefore, IA/IT training is not required.

1.6.8.1.7. National Crime Information Center (NCIC) and terrorist threat data base screening: For contractors that do not require a CAC, but require access to a DoD facility or installation: Contractor and all associated subcontractor employees shall comply with adjudication standards and procedures using the National Crime Information Center Interstate Identification Index (NCIC-III) and Terrorist Screening Database (Army Directive 2014-05/AR 190-13); applicable installation, facility and area commander installation and facility access and local security policies and procedures (provided by Government representative); or, at OCONUS locations, in accordance with status-of-forces agreements and other theater regulations.

Attachment 1 – Performance Work Statement Page 5 of 20

1.6.8.1.8. Contractor to obtain a Facility Clearance and individual clearances at the appropriate level: Not applicable. The Contractor will be escorted when delivering reports

1.6.8.1.9. Pre-screen applicants using E-Verify Program: Not applicable. The Contractor will be escorted when delivering reports.

1.6.8.1.10. Reporting Requirements. The Contractor shall comply with the security guidance found in AR 195-1, Army Criminal Investigations Program. Contractor personnel shall report to an appropriate authority any information or circumstances of which they are aware may pose a threat to the security of DoD personnel, Contractor personnel, resources, and classified or unclassified defense information. Contract employees shall be briefed by their immediate supervisor upon initial on-installation assignment and as required thereafter.

1.6.8.1.11. Threat Awareness and Reporting Program (TARP) Training. Not applicable. The Contractor will be escorted when delivering reports.

1.6.8.1.12. For contractors requiring Common Access Card (CAC). The Contractor shall not be granted a

CAC..

1.6.9. Post Award Conference/Periodic Progress Meetings: The Contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation (FAR) Subpart 42.5. The KO and/or COR may meet periodically with the Contractor to review the Contractor's performance. At these meetings the KO and/or COR will apprise the Contractor of how the Government views the Contractor's performance and the Contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the Government.

1.6.10. Contracting Officer Representative (COR): The COR will be identified by separate letter of appointment. The COR monitors all technical aspects of the contract and assists in contract administration.

The COR is authorized to perform the following functions: Assures that the Contractor performs the technical requirements of the contract; performs inspections necessary in connection with contract performance; maintains written and oral communications with the Contractor concerning technical aspects of the contract; issues written interpretations of technical requirements, including government drawings, designs, specifications; monitors Contractor's performance and notifies both the KO and Contractor of any deficiencies; coordinates availability of government furnished property, and provides site entry of Contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the Contractor, states the responsibilities and limitations of the COR, especially regarding changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting contract.

1.6.11. Key Personnel: Not applicable.

1.6.12. Contractor Personnel:

1.6.12.1. Identification of Contractor Personnel: The Government will provide temporary badges on a as needed basis.

1.6.13. Contractor Travel: Contractor shall be required to travel CONUS during the performance of this contract to deliver required reports. Contractor will be authorized travel expenses consistent with FAR 31.205-46, and the limitation of funds specified in this contract.

1.6.13.1. Travel Authorization: All Contractor personnel travel requires advanced authorization by the COR at least 72 hours prior to travel date.

Attachment 1 – Performance Work Statement Page 6 of 20

1.6.13.2. Requests for Travel: The Contractor shall coordinate personnel travel with the COR by submitting a request for travel via unclassified email no later than 72 hours prior to travel date. The request for travel shall include at a minimum name of traveler(s), purpose for travel, travel to location(s), itemized estimated cost of travel (airline ticket, lodging per day, meals & essentials per day, rental car per day, fuel for rental car, airport parking & baggage handling, additional Contractor processing fees), the contract line item travel billed against, and the appropriate contractor representative's signature approving travel.

1.6.13.3. Travel Arrangements: The Contractor shall be responsible for making all necessary travel arrangements for assigned contractor employees. When traveling on Government business, the Government will reimburse Contractor travel. Variations to previously authorized travel shall be coordinated and authorized by the COR. All Contractor travel will be coordinated and conducted in the most efficient and cost-effective manner possible.

1.6.13.4. Invoices: The Contractor shall submit monthly invoices for reimbursement citing the appropriate travel contract line item. Each individual travel instance must be captured; copies of receipts, travel vouchers, etc. shall be attached to the invoice to support charges. Original receipts shall be maintained by the Contractor and made available to Government auditors upon request.

1.6.14. Other Direct Costs (ODC): Contract ODC are supplies tied directly to support of Vendor Due Diligence functions and are items whose costs are not allocated to a line item in the contract's schedule.

The following Other Direct Costs may be permitted:

(A) Special Tooling and Equipment

(B) Computer Services (i.e. only offsite, not in a Government facility)

(C) Packaging and Shipping Equipment

(D) Preproduction Costs

1.6.14.1. The Contractor shall submit requests for all ODCs required IAW Technical Exhibit 2 – Deliverables Schedule. All expenditures for ODCs shall be procured from Government sources first. Any ODCs that are unavailable through Government sources may be procured from the open market by the Contractor. Contractor shall ensure all ODCs are pre-approved by the COR prior to expenditure of funds.

Items purchased and charged against the contract's ODC line item must specifically support a Performance Work Statement (PWS).

1.6.14.2. The Contractor shall also submit monthly invoices for reimbursement citing the appropriate CLIN and PWS reference. Copies of receipts, etc. shall be attached to the invoice to support charges. Original receipts shall be maintained by the Contractor and made available to Government auditors upon request.

All ODCs will be evaluated in accordance with FAR Part 31, and charges shall not exceed the amount allocated in the ODC Line Item.

1.6.14.3. Contractor shall submit an Actual ODC Cost Report template IAW Technical Exhibit 2 – Deliverables Schedule for COR approval and shall contain, at a minimum the following: Purchasers name, position, reason for the purchase and associated PWS reference, method of purchase, cost of purchase, and signature block.

1.6.14.4. Actual ODC Cost Reports must clearly identify the specifics of the costs (e.g., who, what, where, when) and shall be submitted IAW Technical Exhibit 2 – Deliverables Schedule.

1.6.14.5. ODC Requests: The Contractor shall submit requests for ODCs to the Government via NIPR email (preferably at least one day prior to need date, but exceptions are permitted based on urgency). The request for ODCs shall include at a minimum; costs, item description, vendor/merchant, requirement date, purpose and applicable PWS reference, contract line item billed against, and signature block for approving the ODC. The Contractor shall provide to the COR a copy of the purchase order or invoice after order completion.

Attachment 1 – Performance Work Statement Page 7 of 20

1.6.14.6. The Contractor shall provide the COR records/receipts of office supply and equipment orders charged to the contract line item associated with this PWS within 24 hours of order.

1.6.14.7. Invoices submitted through Wide Area Workflow must clearly identify the specifics of the ODC costs (e.g., who, what, where, when).

1.6.15. Data Rights: The government has unlimited rights to all documents/material produced under this contract to the extent permitted by the data rights clauses. The parties mutually acknowledge their understanding that this is the government’s intent. All documents and materials, to include the source codes of any software, produced under this task order shall be government owned and are the property of the government with all rights and privileges of ownership/copyright belonging exclusively to the government.

These documents and materials may not be used or sold by the contractor without written permission from the contracting officer. All materials supplied to the government shall be the sole property of the government and may not be used for any other purpose. This right does not abrogate any other government rights.

1.6.16. Organizational Conflict of Interest: The provisions of FAR Subpart 9.5, Organizational and Consultant Conflicts of Interest, concerning organizational conflicts of interest govern this contract. The Contractor shall notify the Contracting Officer immediately whenever it becomes aware that such access or participation may result in any actual or potential OCI and shall promptly submit a plan to the Contracting Officer to avoid or mitigate any such OCI. The Contractor’s mitigation plan will be determined to be acceptable solely at the discretion of the Contracting Officer and in the event the Contracting Officer unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the Contracting Officer may affect other remedies as he or she deems necessary, including prohibiting the Contractor from participation in subsequent contracted requirements which may be affected by the OCI.

PART 2

DEFINITIONS & ACRONYMS

Attachment 1 – Performance Work Statement Page 8 of 20

2. DEFINITIONS AND ACRONYMS:

2.1. DEFINITIONS:

2.1.1. BUSINESS ECOSYSTEM. Network of organizations, including suppliers, distributors, customers, competitors, government agencies, and so on, involved in the delivery of a specific product or service through both competition and cooperation.

2.1.2. CONTRACTOR. A supplier or vendor awarded a contract to provide specific supplies or service to the Government. The term used in this contract refers to the prime.

2.1.3. CONTRACTING OFFICER (KO). A person with authority to enter, administer, and/or terminate contracts, and to make related determinations and findings on behalf of the Government. Note: The only individual who can legally bind the Government.

2.1.4. CONTRACTING OFFICER'S REPRESENTATIVE (COR). An employee of the U.S. Government appointed by the contracting officer to administer the contract. Such appointment shall be in writing and shall state the scope of authority and limitations. This individual has authority to provide technical direction to the Contractor, if that direction is within the scope of the contract, does not constitute a change, and has no funding implications. This individual does NOT have authority to change the terms and conditions of the contract.

2.1.5. CONTRACTOR PERSONNEL. Contractor and subcontractor employees performing working under this contract.

2.1.6. DEFECTIVE SERVICE. A service output that does not meet the standard of performance associated with the Performance Work Statement (PWS).

2.1.7. DELIVERABLE. Anything that can be physically delivered, but may include non-physical things, such as meeting minutes or reports.

2.1.8. FULL SPECTRUM DUE DILIGENCE. A complete evaluation of a vendor’s supply chain, inter-commercial relationships, digital architecture access, record of legal/regulatory compliance, financial stability, general business reputation, and potential for Foreign Ownership, Control or Influence (FOCI).

2.1.9. GOVERNMENT-FURNISHED PROPERTY (GFP) OR GOVERNMENT PROPERTY (GP). Not applicable.

2.1.10. KNOW YOUR CUSTOMER. The set of processes financial institutions use to verify the identity of their customers and ensure they are acting legally. Designed to protect financial institutions against fraud, corruption, money laundering and terrorist financing.

2.1.11. SUPPLIER ECOSYSTEM ILLUMINATION. The act of mapping the companies, people, and products involved in an organization’s supply chain.

2.1.12. PERFORMANCE PREQUIREMENT SUMMARY (PRS). A listing of the service outputs under the contract that are to be evaluated by the COR on a regular basis, the surveillance methods to be used for these outputs, and the performance requirement of the listed outputs.

2.1.13. PHYSICAL SECURITY. Actions that prevent the loss or damage of Government property.

2.1.14. QUALITY ASSURANCE. A planned and systematic pattern of all actions necessary to provide confidence that adequate technical requirements are established; products and services conform to established technical requirements; and satisfactory performance is achieved. For the purposes of this document, quality assurance refers to actions by the Government.

Attachment 1 – Performance Work Statement Page 9 of 20

2.1.15. QUALITY ASSURANCE SURVEILLAND PLAN (QASP). The Government’s organized written document specifying the surveillance methodology to be used for surveillance of Contractor performance.

2.1.16. QUALITY CONTROL. All necessary measures taken by the Contractor to assure that the quality of an end product or service shall meet contract requirements.

2.1.17. SUBCONTRACTOR. One that enters a contract with a prime Contractor. The Government does not have privity of contract with the subcontractor.

2.1.18. WORKDAY. Standard workday is 7:30 AM – 4:30 PM, Eastern Standard Time. The length of time during a day in which the Contractor provides services, in accordance with the contract. Also referred to as Business Day.

2.1.19. WORK WEEK. Monday through Friday, unless otherwise specified.

2.2. ACRONYMS:

ARSOF Army Special Operations Forces AR Army Regulation COR Contracting Officer Representative CPC Capabilities Protection Cell DA Department of the Army DFARS Defense Federal Acquisition Regulation Supplement DISS Defense Information Security System DMDC Defense Manpower Data Center DOD Department of Defense FAR Federal Acquisition Regulation FOCI Foreign Ownership, Control or Influence FPCON Force Protection Condition KO Contracting Officer MA&D Merger, Acquisition & Divestiture NDAA National Defense Authorization Act OCI Organizational Conflict of Interest ODC Other Direct Costs POA&M Plan of Action and Milestones POC Point of Contact PRS Performance Requirements Summary PWS Performance Work Statement QA Quality Assurance QAP Quality Assurance Program QASP Quality Assurance Surveillance Plan QC Quality Control QCP Quality Control Plan SAM System of Award Management SCR Service Contract Reports SOFARS Special Operations Federal Acquisition Regulation Supplement TE Technical Exhibit USG United States Government USASOC United States Army Special Operations Command VDD Vendor Due Diligence VTM Vendor Threat Mitigation

Attachment 1 – Performance Work Statement Page 10 of 20

PART 3

GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICES

3. GOVERNMENT FURNISHED ITEMS AND SERVICES:

Not Applicable.

Attachment 1 – Performance Work Statement Page 11 of 20

PART 4

CONTRACTOR FURNISHED ITEMS AND SERVICES

4. CONTRACTOR FURNISHED ITEMS AND RESPONSIBILITIES:

4.1. General: The Contractor shall furnish all supplies, equipment, facilities and services required to perform work under this contract that are not listed under Part 3 of this PWS.

Attachment 1 – Performance Work Statement Page 12 of 20

PART 5

SPECIFIC TASKS

5. Specific Tasks:

5.1. Basic Services. The Contractor shall provide services and perform full spectrum vendor due diligence research and analysis in order to assist the government with assessing risk and/or the possible compromise of USG acquisition at the vendor level. Full spectrum due diligence includes, but is not limited to, evaluating a vendor’s supply chain, inter-commercial relationships, digital architecture access, record of legal/regulatory compliance, financial stability, general business reputation, potential for Foreign Ownership, Control or Influence (FOCI). Contractor services are intended to assist the government with assessing risk and/or the possible compromise of United States Government (USG) acquisition at the vendor level.

5.2. As needed, the Contractor shall provide up to 120 (tier 1 depth) initial vendor due diligence reports in accordance with USASOC prioritization. Tasks include:

5.2.1. The Contractor shall provide digital and hard-copy full-spectrum due diligence assessment reports for commercial, non-profit, or hybrid entities with quick-turn initial look option and deep dive diligence/assessment options dependent on timeline, maturity of initiative, and prioritization of request. The Contractor shall maintain capacity to process six assessments in parallel.

5.2.2. The Contractor shall provide supplier ecosystem illumination as requested for those entities that definitively supply goods or services to the original equipment manufacturer, system integrator, manufacturer, or formulary that occupies the top tier of the supplier ecosystem.

5.2.3. The Contractor shall provide business ecosystem analysis. A business ecosystem includes those entities critical to the financial, operational, commercial, human capital, legal, technology, or governance functions of the target entity, which DO NOT supply goods or services to the target entity critical to the core functionality of the product or service the target entity would provide to the Command.

5.2.4. The Contractor shall apply advanced network analysis theory to mathematically isolate the most critical and influential entities within the supplier and business ecosystems.

5.2.5. The Contractor shall provide detailed commercial, financial, and operational diligence execution commensurate in both depth and breadth with confidential Merger, Acquisition & Divestiture (MA&D) private sector engagements; diligence will include Beneficial Ownership Analysis, Know Your Customer Analysis, investor and owner relationships.

5.2.6. The Contractor shall provide detailed information regarding corporate structure, corporate patrilineage, and delineation of subsidiaries, affiliates, and veiled commercial interrelationships.

5.2.7. The Contractor shall provide comprehensive reporting on supplier Foreign Ownership, Control, or Influence (FOCI) risk and other mutually agreed-upon decision rules.

5.2.8. The Contractor shall provide comprehensive reporting on entities and lists such as those found in National Defense Authorization Act (NDAA) sections 5949, 1260H, 889, and 1634.

5.2.9. The Contractor shall provide detailed information regarding compliance as it pertains to the presence of restricted companies, company subsidiaries, and/or commercial affiliates in the target supplier ecosystems that are related to vendor of which due diligence research is being conducted.

5.2.10. The Contractor shall provide available information concerning the key management personnel and people (founders, lead technical executives, investors, financiers, board members) that are associated to the vendor of which due diligence research is being conducted.

Attachment 1 – Performance Work Statement Page 13 of 20

5.2.11. The Contractor shall provide clear, unambiguous characterization of nation-state adversaries’ presence and actions within the target supplier and business ecosystems, and their relevance to one or more geo-strategic objectives codified in five-year plans, government-sponsored programs, and manifestos relevant to industrial base and supply matters.

5.2.12. The Contractor shall identify the specific lines of commercial operation and the tactics, techniques, & procedures employed by nation-state adversaries.

5.2.13. The Contractor shall provide detailed, actionable risk characterizations with mitigation recommendations, to include alternative sources of supply where available.

5.2.14. The Contractor shall conduct continuous monitoring & alerting of any substantial changes to the vendor’s business structure, ownership, legal/regulatory compliance, negative media that will affect a vendor’s business reputation, and any other data point that could negatively affect.

5.3. As needed the Contractor shall provide up to 60 (tier 2 depth) deep-dive vendor due diligence reports in accordance with USASOC prioritization. If the Government determines an initial due diligence report requires a more in-depth evaluation, a deep-dive vendor due diligence reports will be requested by the Government. The report will be delivered to the Government within 30 calendar days of tasking.

5.4. As needed, the Contractor shall provide up to 15 supplier ecosystem illuminations (tier 3 depth) with corresponding vendor due diligence reports in accordance with USASOC prioritization. The Government may request a supplier ecosystem illumination report when the Government determines an in-depth evaluation of a vendor’s supply network is needed to more accurately assess the overall risk. The report will be delivered to the Government within 60 calendar days of tasking- tier 3.

5.5. The Contractor shall provide a Plan of Action & Milestones (POA&M) to detail the development of a repository infrastructure for all vendor due diligence products. This shall be a federated, centralized data repository of vendor due diligence products with enterprise search functionality to identify and summarize relevancy, date of information, and overlaps in the enterprise to inform acquisition and contractual courses of action.

5.5.1. The Contractor shall provide a maintenance plan for the vendor due diligence product repository, within 15 days after award.

5.5.2. The Contractor shall produce all reports to the COR in digital Microsoft compatible and PDF format along with a hard copy upon request.

5.5.3. The Contractor shall issue log-in credentials to U.S. Government and associated contractor personnel to conduct research and data inquiries.

5.6. The Contractor shall develop and maintain a federated, centralized data repository of vendor due diligence products with enterprise search functionality to identify and summarize relevancy, date of information, and overlaps in the enterprise to inform acquisition and contractual courses of action.

5.7. The Contractor shall provide annual software license to support vendor due diligence reports.

5.8. System for Award Management (SAM) Service Contract Report (SCR): The Contractor will report ALL contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract for the United States Army Special Operations Command via a secure data collection site. The contractor is required to completely fill in all required data fields using the following web address: https://www.sam.gov. Reporting inputs will be for the labor executed during the period of performance during each Government FY, which runs from October 1 through September 30. While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year. Contractors may direct questions to the help desk by clicking “View Assistance for SAM.gov” which

Attachment 1 – Performance Work Statement Page 14 of 20 is located at the top of the SAM.gov website. From there, you can the select “Contact Our Service Desk” which will allow you to contact SAM.gov directly. If contract period of performance ends prior to September 30, the Contractor has 30 calendar days from end date of the contract to complete the SAM SCR requirement.

Attachment 1 – Performance Work Statement Page 15 of 20

PART 6

APPLICABLE PUBLICATIONS

6. APPLICABLE PUBLICATIONS (CURRENT EDITIONS):

6.1. The Contractor shall abide by all applicable regulations, publications, manuals, and local policies and procedures.

AR 25-2 Information Assurance

AR 530-1 Operations Security (OPSEC)

DoDD 3000.16 Vendor Threat Mitigation, 06 JUL 2022

DODD 5230.11 Disclosure of Classified Military Information to Foreign Governments and International Organizations, 16 JUN 1992

DODI 5200.01 DoD Information Security Program and Protection of Sensitive

Compartmented Information (SCI), C2, EFF 01 OCT 2020

DODI 5200.48 Controlled Unclassified Information (CUI), 06 MAR 2020

DODD 5148.13 Intelligence Oversight, 26 APR 2017

DODD 5240.01 DoD Intelligence Activities, C3, 09 NOV 2020

DODI 2030.08 Implementation of Trade Security Controls (TSCs) for Transfers of DoD

Personal Property to Parties Outside DoD Control, C1, 24 MAY 2017

DODI 2040-02 International Transfers of Technology, Articles, and Service, C1, 31 JUL

CJCS Manual 3105.01A Joint Risk Analysis Methodology, 12 OCT 2021

Attachment 1 – Performance Work Statement Page 16 of 20

PART 7

TECHNICAL EXHIBIT LISTING

7. Technical Exhibit List:

7.1. Technical Exhibits:

Technical Exhibit 1 Performance Requirements Summary Technical Exhibit 2 Deliverables Schedule

Attachment 1 – Performance Work Statement Page 17 of 20

TECHNICAL EXHIBIT 1

Performance Requirements Summary

The contractor service requirements are summarized into performance objectives that relate directly to mission essential items. The performance threshold briefly describes the minimum acceptable levels of service required for each requirement. These thresholds are critical to mission success.

Performance Objective

Standard Performance

Threshold Method of

Surveillance Proportion of Required Service

Contract Price

PRS # 1

The Contractor shall ensure that the software is functional 24 hours a day, 365 days a year. Within 24-hours of any reported software issue, the Contractor shall contact via phone or email the COR or other identified Government personnel.

As detailed in the PWS section 1.6.4.1.

100% Periodic and monthly Surveillance

Performance reported in CPARS as less than Satisfactory & a remedy of no more than 10% may be applied against the monthly invoice

PRS # 2

The Contractor shall establish and maintain a work order system to track all issues with software performance.

100% accurate with time/date resolution.

95% Periodic and monthly Surveillance as less than Satisfactory

PRS # 3

The Contractor shall provide digital and / or hard copy reports in a Microsoft compatible or PDF format.

As detailed in the PWS section 5.5.2.

100% Periodic and monthly Surveillance

Performance reported in CPARS as less than Satisfactory

PRS # 4

The Contractor shall administer Quality Control Program in accordance with QCP.

Compliance with QCP 97% of the time

99% Random and periodic inspections, observations

Performance reported in CPARS as less than Satisfactory

PRS # 5

The Contractor shall provide up to 120 initial (tier 1) vendor due diligence reports in accordance with USASOC prioritization and all associated tasks within 30 days of tasking.

As detailed in the PWS section 5.2

100% Random and periodic inspections, observations

Performance reported in CPARS as less than Satisfactory

PRS # 6

The Contractor shall provide up to 60 (tier 2) deep-dive vendor due diligence reports in accordance with USASOC prioritization and associated tasks listed in 5.2 within 60 days of tasking.

As detailed in the PWS section 5.3

100% Random and periodic inspections, observations

Performance reported in CPARS as less than Satisfactory

PRS # 7

The Contractor shall provide up to 15 supplier ecosystem illuminations (tier 3 depth) with corresponding vendor due diligence reports in accordance with USASOC prioritization.

As detailed in the PWS section 5.4

100% Random and periodic inspections, observations.

Attachment 1 – Performance Work Statement Page 18 of 20

PRS # 8

The Contractor shall provide a Plan of Action & Milestones (POA&M) to detail the development of a repository infrastructure for all vendor due diligence products

As detailed in the PWS section 5.5

100% Random and periodic inspections, observations

Attachment 1 – Performance Work Statement Page 19 of 20

TECHNICAL EXHIBIT 2

DELIVERABLES SCHEDULE

Deliverable Frequency # of Copies

Medium/Format Submit To

PWS

Paragraph Quality Control Plan

(QCP)

Original: Within 15 days of contract award.

Modifications:

Within 5 working days of change.

One Electronic Copy

QCP delivered via email

Contracting Officer &

COR

Para. 1.6.1.1

Performance meetings and Contractor Discrepancy Report

Within five (5) working days from receipt.

1 Electronic delivered via email

Contracting Officer

Para.

1.6.1.1.7.& 1.6.1.2.

Travel Advance Authorization

At least 72 hours prior to travel date.

1 Electronic via email

COR Para. 1.6.13.1.

Travel Invoices The Contractor shall submit monthly invoices for reimbursement.

1 Electronic via email

COR Para. 1.6.13.4.

ODC Requests At least one day prior to need date, but exceptions are permitted based on urgency.

1 Electronic via email

COR Para. 1.6.14.5.

ODC Reports Template

Copy of the purchase order or invoice after order completion.

1 Electronic via email

COR Para. 1.6.14.3.

ODC Records Receipt

Within 24 hours of order

1 Electronic via email

COR Para. 1.6.14.6.

Software License Yearly 1 Electronic delivered via email

COR Para 5.7.

120 (tier 1) Due Diligence Reports

As needed 1 Electronic delivered via email and / or hardcopy in-person

COR Para 5.2.

60 (tier 2) Due Diligence Deep Dive Reports

As needed 1 Electronic delivered via email and / or hardcopy in-person

COR Para 5.3

Attachment 1 – Performance Work Statement Page 20 of 20

Deliverable Frequency # of Copies

Medium/Format Submit To

PWS

Paragraph 15 Supplier Ecosystem Illuminations (tier 3) depth

Upon Request 1 Electronic delivered via email and / or hardcopy in-person

COR Para 5.4

Plan of Action and Milestones (POA&M)

With all vendors due diligence reports

1 Electronic delivered via email and / or hardcopy in-person

COR Para 5.5

Maintenance Plan Original: Within 15 days of contract award.

Modifications:

Within 5 working days of change.

1 Electronic delivered via email

COR Para 5.5.1

TECHNICAL EXHIBIT 1