SOL_W15QKN16R0002_PLS_ATTACH_0009_SAMPLE_A_PWS_06FEB2017.pdf

Solicitation W15QKN-16-R-0002

Personnel Life-Cycle Support (PLS) Attachment 0009 – Sample Task A PWS

PERFORMANCE WORK STATEMENT (PWS)

DEERS/RAPIDS MILITARY IDENTIFICATION CARD, COMMON ACCESS CARD AND

PUBLIC KEY INFRASTRUCTURE SUPPORT SERVICES

06 FEBRUARY 2017

PART 1

GENERAL INFORMATION

1. GENERAL. This is a non-personal services task order to provide support at selected installations worldwide. The Government will not exercise any supervision or control over Contractor personnel performing the services herein. Contractor and subcontractor personnel shall be accountable solely to the Contractor who, in turn is responsible to the U.S. Government.

1.1 Description of Services. The Contractor shall perform issuance of Identification (ID) cards, Common Access Cards (CAC), Public Key Infrastructure (PKI), CAC related equipment, and program support services for the United States (U.S.) Army’s Human Resource Command (HRC). Furthermore, the Contractor shall provide program support services by managing site card, stock supplies and equipment in order to ensure no interruption in service. The Contractor shall support site inspections of installations that issue CAC and Identification (ID) Cards to U.S. Army active and reserve component Soldiers worldwide.

1.2 Background. Army HRC serves as the uniformed services executive agent; initiates, develops, coordinates, and publishes uniformed services procedural guidance regarding the Defense Enrollment Eligibility Reporting System (DEERS), the Real-Time Automated Personnel Identification System (RAPIDS), ID cards, and is the director of personnel point of contact for the CAC for the Army Chief Information Officer (CIO)/G6.

HRC also assists the U.S. Army staff with development of Army ID card policy;

developing personnel procedural guidelines; and assisting in publishing Air Force Instruction (AFI) 36-30261P, ID cards for members of the uniformed services, their Family members, and other eligible personnel. HRC integrates uniformed services policy and procedures for worldwide maintenance of the DEERS and RAPIDS programs. Furthermore, HRC responds to all active duty, and army reserve military personnel regarding DEERS enrollment, ID card policy, and procedural interpretations.

HRC provides guidance regarding DEERS/RAPIDS hardware and software issues, and develops guidelines for base-level enrollment of Family members in DEERS. HRC serves as the Army single point of contact for all DEERS/RAPIDS, and ID card activities.

HRC represents the Army as a voting member of the Joint Uniformed Services Personnel Advisory Committee (JUSPAC), and serves as committee chairperson on a rotational basis with the other uniformed Services.

The Department of Defense (DoD) instituted the DoD CAC/PKI program to address the increased need for higher levels of information assurance as well as addressing issues related to identity protection and management. The CAC/PKI program provides the means to achieve secure and efficient physical access to Government facilities, as well as electronic access to secure web sites and electronic mail. The DoD CAC also serves as the standard identification card for all uniformed services' active duty members, selected reserves, DoD civilian employees, non-DoD federal eligible employees, eligible Contractors, and certain eligible “volunteers”. The CAC, with its inherent imbedded technologies, is issued and maintained in part using the DEERS / RAPIDS infrastructure.

Execution of Homeland Security Presidential Directive–12 (HSPD-12) and implementing guidance contained in Federal Information Processing Standard 201 (FIPS 201) for personal identity verification, and other DoD instructions, directive type memorandums (DTMs) have a significant impact on supporting RAPIDS infrastructure as well as modifications to CAC issuance business processes. Compliance with these directives, standards and instructions require a broad range of planning, analysis and coordination between Office of the Undersecretary of Defense- Personnel and Readiness (OUSD (P&R)) and OUSD - Intelligence (OUSD(I)), the Defense Manpower Data Center (DMDC), and the HRC departmental and field organizations to ensure efficient execution of this program.

1.3 Objectives. The Government’s primary objectives for this task order are:

Superior quality customer service to all eligible DoD military, civilian, and Contractor employees; to include their eligible dependents and other eligible personnel.

Cards issued are accurate and fully compliant with regulatory guidance.

Ensure compliance with card issuance applicable regulations throughout Army operation centers.

Support major HRC CAC organizational programs, initiatives and sites.

Ensure quality control evaluation of programs and efforts.

Assist the Government with proposed policies, practices, and implications for human resources (HR) systems; and with doctrine, design, equipment, and other change engineering activities.

1.4 Scope. This task order provides Contractor support services to meet the demands placed on in-house resources resulting from population increase of eligible recipients of military ID cards (military/civilian/Contractor employees, DoD and non-DoD federal agency and other eligible populations). This requirement ensures CAC/PKI related programs are successfully implemented and sustained within the Army. The Contractor shall provide management, research, and advisory services as the principal interface for HRC’s CAC support office, the Adjutant General Directorate (TAGD), Soldier Programs and Services Division (SPSD), and Soldier Programs Branch (SPB). The Contractor shall provide this service as defined in this PWS except for those items specified as Government furnished property and services. The Contractor shall perform to the standards in this task order.

1.5 Period of Performance. The base period of performance for this task order shall be for one (1) year and will include two 12 month option periods. Estimated periods of performance are:

Entrance Transition: 18 October 2017 – 1 November 2017 Base Period: 2 November 2017 – 17 October 2018 Option Period 1: 18 October 2018 – 17 October 2019 Option Period 2: 18 October 2019 – 17 October 2020

1.6 Place of Performance. The Contractor shall perform services under this task order at U.S. Government facilities in both Continental United States (CONUS) and Outside the Continental United States (OCONUS) locations around the world. Contractor personnel providing program management support (PWS section 5.1) shall be located at Fort Knox, KY (with the exception of Europe and Asia regional managers). Regional manager supporting Europe shall be located in Stuttgart, Germany; regional manager supporting Asia shall be located in Yongsan, Korea; CONUS regional managers shall be located in Fort Knox, Kentucky. Contractor personnel supporting tasks in PWS section 5.2, Common Access Card Mobile Assistance Team (CACMAT) support, shall travel to locations in Attachment 0015, “List of Army Sites Requiring Inspection”. Attachment 0012, “Estimated Workload and Places of Performance” provides the places of performance for Contractor personnel supporting tasks in PWS section 5.3.

1.7 Hours of Operation: The Contractor is responsible for conducting business Monday thru Friday during normal business hours except federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. Hours of operation may vary per location, but most locations are open from 7:30 am to 4:00 pm. The Contractor shall coordinate with the Contracting Officer Representative at HR Solutions (COR- HRS) and the COR at the Requiring Activity (COR-RA) to attain approval for modifying the hours of operation and business work week (reference Attachment 0012, “Estimated Workload and Places of Performance”). The Contractor shall at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons. The Contractor shall provide ID/CAC Operator support to sites at all times during business hours (with the exception of lunch and workday breaks). The Contractor shall staff locations to ensure stability and continuity of the workforce. Specific allowances may be made to accommodate situations to adjust operating hours in the event of adverse weather or other situations that risk personal safety and cause installation closure.

1.8 General Information.

1.8.1 Quality Control. The Contractor shall develop, implement, and maintain an effective quality control (QC) program to ensure services are performed in accordance with this PWS. The Contractor shall be responsible for the inspection and quality control of all work performed in the course of accomplishing all activities defined in this PWS.

The Contractor shall ensure subcontractors understand and comply with flow down provisions. The Contractor shall develop, implement, and maintain a written Quality Control Plan (QCP) for this task order (Data Item Description (DID) ISO-10005). The Contractor shall implement standardized procedures / methodologies for monitoring performance and document contract performance to ensure all contract requirements are met. The Contractor’s QC procedures shall address the areas identified in Attachment 0013, “Performance Requirements Summary (PRS)”. The QCP shall also address how the Contractor will ensure proper Contractor employee identification (ID) and badging.

All travel associated with execution of the Contractor’s QCP shall be included as part of the firm fixed price. The initial QCP shall be submitted with the Contractor's proposal and will be reviewed prior to award. The Contractor shall submit an electronic copy of the final comprehensive written QCP to the Contracting Officer’s Representative at the enterprise-level (COR-HRS) and the Contracting Officer (KO) within 5 business days after award and within 5 business days of any changes made thereafter.

1.8.2 Quality Assurance. The Government will evaluate the Contractor’s performance under this task order in accordance with the Quality Assurance Surveillance Plan (QASP). This plan is primarily focused on what the Government must do to ensure that the Contractor has performed in accordance with (IAW) the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

1.8.3 Recognized Federal Holidays. Contractor employees are not required to perform services on legal federal holidays, nor will Government facilities operate during these yearly approved days. Federal holidays include:

New Year’s Day 1st day in January

Martin Luther King, Jr. Birthday 3rd Monday of January

Presidents Day 3rd Monday of February

Memorial Day Last Monday of May

Independence Day 4th day in July

Labor Day 1st Monday of September

Columbus Day 2nd Monday of October

Veterans Day 11th day of November

Thanksgiving Day 4th Thursday of November

Christmas Day 25th day of December

Any federal holiday falling on a Saturday will be observed on the preceding Friday, and holidays falling on a Sunday will be observed on the following Monday. The Department of Labor (DOL) wage determinations applicable to this task order may require additional holidays than those stated above. The Contractor is responsible for complying with wage determination requirements and all other appropriate DOL laws and regulations.

Contractor employees that are located OCONUS are required to work on Host Nation

Holidays that occur during the normal work week. Local Host Nation Holidays occur in the region/state where performance takes place.

1.8.3.1 Training Holidays. Installation commands have historically granted military personnel (enlisted and officers) training holidays (e.g. Friday after Thanksgiving) in addition to the ten federal holidays listed above. Training holidays are not considered a day of excused absence for Contractor employees.

1.8.4 Status of Forces Agreement (SOFA). Contractor shall comply with the provisions of current SOFAs of host nations identified in the PWS.

1.8.4.1 Pre-Outside the Continental United States (OCONUS) Travel File (PRO-FILE).

PRO-FILE is the means by which Army Contractors provide data to Personnel Recovery Mission Software (PRMS) which in turn utilizes this data to create digital Isolated Personnel Report (ISOPREP) files. Individual DA Contractors shall submit their PRO- FILE Survey through Army Knowledge Online (AKO) at https://medinah.sed.apg.army.mil/PRO-File/ within 90 days of OCONUS travel.

Completion of the PRO-FILE survey is mandatory for all DA Contractors traveling OCONUS for official duty purposes. PRMS digital ISOPREP files created through the PRO-FILE survey remain valid for a maximum of one year from date of completion.

1.8.4.2 In completing the PRO-FILE Survey, DA Contractors shall utilize the following Unit Identification Code (UIC) corresponding to the geographic area of employment.

Unit Identification Code

UIC AOR Country

W11111 CENTCOM AFGHANISTAN

W11112 CENTCOM IRAQ

W11113 CENTCOM KUWAIT

W11114 CENTCOM HORN OF AFRICA

W11115 CENTCOM OTHER

W22221 SOUTHCOM ALL COUNTRIES

W33331 EUCOM ALL EXCEPT SETAF

W33332 EUCOM SETAF

W44441 PACOM ALL EXCEPT SOUTH KOREA

W44442 PACOM SOUTH KOREA

W55555 NORTHCOM ALL COUNTRIES

W77777 AFRICOM ALL COUNTRIES

1.8.4.3 PRO-FILE and PRMS management support for this task order will be provided by the COR-RA.

1.8.5 Contracting Officer’s Authority. The Contracting Officer is the only person authorized to direct changes in any requirements under this task order. In the event that the Contractor effects any change at the direction of any person other than the KO, the change will be considered to have been made without authority and solely at the risk of the Contractor.

1.8.6 Contracting Officer’s Representative (COR). At a minimum, two CORs will be identified by separate letter. The KO will appoint a COR at the requiring activity (COR- RA), usually located at the functional program office, and a COR at the enterprise-level, located at the HR Solutions program office (COR-HRS). CORs monitor all technical aspects of the task order and assist in task order administration.

1.8.6.1 COR-RA. The COR-RA is the Government’s technical expert and will be appointed by the KO identified by separate letter. Within the limitations of the appointment, the COR-RA shall provide technical assistance to the COR-HRS, and is authorized to perform the functions as identified in the KO appointment letter. These functions may include: perform or cause to be performed inspections necessary in connection with task order performance and verify that the Contractor has corrected all deficiencies; monitor Contractor's performance and notify the KO, COR-HRS, and Contractor of any deficiencies; coordinate availability of Government furnished property;

and provide site entry of Contractor personnel. The COR-RA will participate in “Interim Progress Reviews” (IPR) with the Contractor and HR Solutions staff. A letter of designation issued to the COR-RA, a copy of which is provided to the Contractor, states the responsibilities and limitations of the COR-RA. The COR-RA is not authorized to change any of the terms and conditions of the resulting task order.

1.8.6.2 COR-HRS. The COR-HRS will be appointed by the KO by separate letter. Within the limitations of the appointment the COR-HRS is authorized to perform the functions as identified in said appointment. These functions may include: assure that the Contractor performs the technical requirements of the task order; perform or cause to be performed inspections necessary in connection with task order performance and verify that the Contractor has corrected all deficiencies; maintain written and oral communications with the Contractor concerning technical aspects of the task order; issue written interpretations of technical requirements, including Government drawings, designs, specifications; monitor Contractor's performance and notify both the KO and Contractor of any deficiencies. A letter of designation issued to the COR-HRS, a copy of which is sent to the Contractor, states the responsibilities and limitations of this COR-HRS, specifically with regard to changes in cost or price, estimates or changes in delivery dates. The COR-HRS is not authorized to change any of the terms and conditions of the resulting order.

1.8.7 Government Technical Monitor (GTM). While a COR is the only officially appointed representative of the KO, given the scope and complexity of some service contracts, other individuals may assist the COR in monitoring a Contractor’s performance against the requirements in the task order. These individuals will be identified as Government Technical Monitors. The most common reason for designating additional technical monitors to support the COR is physical proximity to the Contractor’s worksite, although they may also be appointed because of special skills or knowledge necessary for effective monitoring of the Contractor’s work. When appropriate, the requiring activity will designate GTMs necessary to aid the COR-RA in observing a Contractor’s performance and reporting discrepancies to the COR-RA and/or COR-HRS. The GTM is not authorized to change any of the terms and conditions of the task order.

1.8.8 Type of Contract. This will be a Firm Fixed Price (FFP) task order.

1.9 Security Requirements.

1.9.1 Physical Security. The Contractor shall be responsible for safeguarding all Government equipment, information and property provided for Contractor use. At the close of each work period, Government facilities, equipment, and materials shall be secured in accordance with Army Regulation (AR) 380-5 and AR 25-2. The Contractor shall return all Government Furnished Material (GFM) / Government Furnished Property (GFP) to the COR-RA at the end of the task order period of performance or in the event of a task order termination.

1.9.2 Access and General Protection. The Contractor and all associated subcontractor(s) employees shall comply with applicable installation, facility and area commander installation/facility access and local security policies and procedures. The Contractor shall provide all information required for background checks to meet installation access requirements. The background check will be accomplished by installation Provost Marshal Office, Director of Emergency Services, or Security Office. The Contractor shall comply with all personal identity verification requirements as directed by DoD, Headquarters Department of the Army (HQDA) and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in Contractor security measures or processes.

1.9.3 Personnel Security: Contractor/subcontractor personnel supporting this task order shall have a favorable FBI finger print card check, and initiate a Tier 1 or equivalent investigation (as determined by the Government) before access to Government system can be granted, and shall maintain the level of security required for the life of the task order. U.S. citizens may be granted access to RAPIDS if the security investigation has been initiated through OPM in accordance with DoD Regulation 5200.2-R. Contractors assuming roles as Site Security Managers (SSM)/alternate site security managers (ASSM) must have a Tier 1 investigation completed and adjudicated with favorable results.

1.9.4 Key Control. NOTE: All references to keys include key cards. The Contractor shall establish and implement methods of making sure all keys issued to the Contractor by the Government are not lost or misplaced and are not used by unauthorized persons. No keys issued to the Contractor by the Government shall be duplicated. The Contractor shall develop procedures covering key control that shall be included in the QCP. Such procedures shall include turn-in of any issued keys by personnel who no longer require access to locked areas. The Contractor shall immediately report any occurrences of lost or duplicate keys to the COR-RA. In the event a master key is lost or duplicated, all locks and keys shall be replaced by the Government and the Contractor will be held financially responsible for the total cost.

1.9.4.1 Unauthorized Use. If it is found that Contractors have been misusing keys to gain access, or to gain entrance to the work area during non-duty hours, holidays, or weekends and there is no written requirement for access during non-standard working hours, this will be considered an abuse of Government property security. The Contractor shall prohibit the use of Government-issued keys by any persons other than those authorized to use the keys.

1.9.4.2 Lost Keys. The Contractor shall verbally report any occurrence of lost keys to the COR-RA or the individual designated as responsible for the facility within 30 minutes of discovery of the loss. The Contractor shall provide the COR-RA a written report by close of business the next day. The report shall contain the key number, location(s) accessed by the key, date the key was discovered missing, name of person signing for the key, and any other relevant details. In the event keys are lost or duplicated, the Contractor shall, upon discretion of the KO be required to pay for the re-key or replace the affected lock or locks. When the replacement of locks or re-keying is performed by the Government, the Contractor shall be held financially responsible for the total cost of re-keying or the replacement of the lock or locks.

1.9.4.3 Lock Combinations. The Contractor shall establish and implement methods of ensuring that all lock combinations are not revealed to unauthorized persons and coordinated with the GTM to assure installation compliance for lock combinations. The Contractor shall ensure that lock combinations are changed when personnel having access to the combinations no longer have a need to know such combinations. These procedures shall be included in the Contractor’s QCP.

1.9.5 Operations Security (OPSEC). The Contractor shall develop an OPSEC Standard Operating Procedure (SOP) within 45 calendar days of task order award, to be reviewed and approved by the responsible installation OPSEC officer, per AR 530-1, Operations Security (See DID DI-MGMT-80934C of the base contract). This SOP will include the Government's critical information, why it needs to be protected, where it is located, who is responsible for it, and how to protect it. In addition, the Contractor shall identify an individual who will be the Contractor's OPSEC coordinator. The Contractor shall ensure this individual becomes OPSEC Level II certified per AR 530-1. Per AR 530-1, Operations Security, new Contractor employees must complete Level I OPSEC training within 30 calendar days of their reporting for duty. All Contractor employees must complete annual OPSEC awareness training and provide certificates upon completion within seven calendar days. Contractor personnel shall complete training within 30 calendar days of task order award and within 30 calendar days of new employees commencing performance with the results reported to the HR Solutions Secure Web

Portal (HRSSWP), https://www.hrsolutions.army.mil) no later than (NLT) 45 calendar days after task order award and in Monthly Status Reports (MSR) (see paragraph 1.22) thereafter.

1.9.6 Common Access Card (CAC). Contractor employees that require access to Government systems in order to perform services under this task order shall obtain a CAC. Proof of employment and security clearance / favorable background check is required before an ID CAC will be issued authorizing access to the Installation and Government computer systems. CACs may not be issued to Contractor employees unless a data record authorizing CAC issuance is resident in the Defense Enrollment Eligibility Reporting System (DEERS). The Trusted Agent Sponsorship System (TASS), https://www.dmdc.osd.mil/tass, is a secure and authorized means of entering Contractor data into DEERS in addition to automating the CAC application and approval process. In order to enter Contractor data into TASS, the Contractor's data must be resident in an authorized source database. The Joint Personnel Adjudication System (JPAS) is that authoritative source. The Contractor's Facility Security Office (FSO) shall ensure its employee(s) has a record in JPAS prior to its employee(s) requesting a CAC be issued.

Contractors without JPAS accounts may request accounts by following the instructions provided in the Frequently Asked Questions (FAQ) topic "How do I get a JPAS account (Industry Users)?" found on the JPAS website, https://www.dmdc.osd.mil/psawebdocs/docPage.jsp?p=JPAS. Personnel eligible for a CAC who are not in JPAS (i.e., certain Contractors, Foreign Nationals, and DoD affiliates) will be required to register at a site where an equivalent background vetting will be accomplished In Accordance With (IAW) Federal Information Processing Standards (FIPS) 201, Personal Identity Verification (PIV) of Federal Employees and Contractors.

1.9.6.1 CAC Registration Process. No later than five business days after award of this task order, the Contractor shall begin the CAC registration process for all personnel requiring a CAC. Be advised that CAC issuance is restricted, so should be limited to Contractor personnel directly assigned to support this task order.

1.9.6.2 Homeland Security Presidential Directive-12. The “smart” card or CAC identification system is necessary for access to DoD facilities, physical assets, and/or systems. Furthermore, the Government may require more stringent identification verification media in order to obtain access to sensitive sites and/or assets. In these instances of heightened security requirements, the Contractor shall be aware that extensive employee background checks are time consuming; therefore, there will not be adequate time before the start of a contract to process an alternate employee if the primary fails their security screen. Consequently, it is imperative that the Contractor assign qualified personnel (with reputable backgrounds) to these contracts. Delays in the start of a contract due to the rejection of a Contractor employee’s security clearance application will be deemed the fault of the Contractor, not the Government.

1.9.6.3 Before departure, the Contractor shall retrieve all identification media (CAC, building electronic access cards, etc.) from their employees who depart for any reason;

and coordinate with the COR-RA for return of the Government identification media.

Reference FAR Clause 52.204-9 – Personal Identity Verification of Contractor Personnel

– for specific guidance regarding this requirement. Contractor shall notify the CORs and KO of all lost, stolen, or damaged CACs within 24 hours of issue occurrence.

1.9.7 Systems Access. When requested by the Government, the Contractor shall provide access to and information regarding the systems that the Contractor operates or maintains on behalf of the Government under this task order.

1.9.7.1 Contractor-Owned and Operated Information Systems. The Contractor shall comply with all requirement of AR 25-2, Information Assurance. Installation of non- Government-owned computing systems or devices without prior authorization of the appointed Designated Approving Authority (DAA) including but not limited to universal serial bus (USB) devices, external media, personal or Contractor-owned laptops, and mobile computer devices is prohibited. All Contractor-owned and operated information systems shall meet all security requirements for Government-owned hardware and software when operating on the Army Enterprise Infostructure (AEI) or any DoD or Federal Agency network, managing, storing, or processing Army, DOD, or Federal Agency data or information, or conducting official communications or business.

1.9.7.2 Data Security. The Contractor, Contractor employees, and subcontractors shall physically or electronically protect Government data when not in use and/or under the control of an authorized individual. The Contractor is responsible to abide by, and ensure compliance with, security requirements stipulated in the DoD Verifying Official (VO) certification practice statement (CPS) and the X.509 certificate policy for the United States DoD. Furthermore, the Contractor should anticipate working with DoD information technology (IT) systems that require strict adherence to the DoD, and HRC security investigation policies in effect at the time an employee is assigned to work on the task order. Provisions of the privacy act apply to all records and reports maintained by the Contractor. Contractors hired as VOs DEERS/RAPIDS ID card operators must be able to meet personnel controls stipulated in the DoD VO certification practice statement (CPS) and the X.509 certificate policy for the United States DoD. During the course of task order performance, when Government data is no longer needed or required to be retained under applicable Government records retention policies, the Contractor shall coordinate with the KO to either turn over the Government data to the Government, or destroy it through means that will make the data irretrievable (i.e., permanently unavailable for access by any person). The Contractor shall only use Government data obtained under a task order for purposes of the task order, and shall not collect or use such information for any other purpose without the prior written approval of the KO. At expiration or termination of a task order, the Contractor shall coordinate with the KO to either turn over all Government data managed under the task order that is in its possession to the Government or successor Contractor, or if the Government so directs, destroy the Government data.

1.9.8 Access to systems containing Personally Identifiable Information (PII). The Contractor shall comply with the Privacy Act and all applicable agency regulations on individual privacy, to include DoD Directive 5400.11 “Department of Defense Privacy Program” and DoD 5400.11-R, Department of Defense Privacy Program. Failure to safeguard information which may involve the Contractor or the Contractor’s personnel or to which they may have access may subject the Contractor and/or the Contractor’s employees to criminal liability under 5 U.S. Code § 552a.

1.9.8.1 PII Data Security. The Contractor, unless otherwise authorized by the Government, shall limit access to PII to those employees and subcontractors who require the information in order to perform their official duties under this task order. The Contractor, Contractor employees, and subcontractors shall physically or electronically protect PII when not in use and/or under the control of an authorized individual. During the course of task order performance, when PII is no longer needed or required to be retained under applicable Government records retention policies, the Contractor shall coordinate with the KO to either turn over the PII to the Government, or destroy it through means that will make the PII irretrievable (i.e., permanently unavailable for access by any person). The Contractor shall only use PII obtained under this task order for purposes of the task order, and shall not collect or use such information for any other purpose without the prior written approval of the KO. At expiration or termination of this task order, the Contractor shall coordinate with the KO to either turn over all PII managed under the task order that is in its possession to the Government or successor Contractor, or if the Government so directs, destroy the PII.

1.9.8.2 PII Systems Security. The Contractor shall encrypt all Contractor-owned laptops or other portable media storage devices that process or store PII, in accordance with FIPS 140-2 (or successor). The Contractor shall require FIPS 140-2 (or successor) encryption of any sensitive PII when transmitted electronically across the internet or other public networks.

1.9.8.3 PII Data Breach Response and Notification. The Contractor shall adhere to the reporting and response requirements for PII set forth in Memorandum, Office of the Secretary of Defense, Subject: Safeguarding Against and Responding to the Breach of Personally Identifiable Information (PII), June 5, 2009, ALARCT 050/2009, DoD 5400.11- R, and any amendments. The Contractor or its subcontractor(s) shall immediately notify the COR-RA upon discovery that a suspected or actual breach of PII has occurred. The notification shall include, to the greatest extent possible, the identification of each individual who’s PII has been or possibly has been breached. In addition, the Contractor or its subcontractor shall provide the COR-RA with any other available information that must be included in required breach reporting and notifications. The Contractor shall provide this information at the time of the initial notification to the Government or promptly thereafter as information becomes available. The Government will determine whether a breach of PII has occurred, and whether breach notification to affected individuals is required. If breach notification to affected individuals is required, the Government will determine if the Contractor shall make the required notification. If the

Contractor is to notify the impacted population, it shall submit the notification letters to the COR-RA for review and approval.

1.9.9 Communications Security (COMSEC). All communications with DoD organizations are subject to COMSEC review. The Contractor shall be aware that telephone communications, and IT networks are continually subject to intercept by unfriendly intelligence organizations. DoD has authorized the military department to conduct COMSEC monitoring and recording of telephone calls originating from, or terminating at, DoD organizations. Therefore, the Contractor is advised that any time it places a call or receives a call it is subject to COMSEC procedures. The Contractor shall assume the responsibility for ensuring wide and frequent dissemination of the above information to all employees dealing with DoD information. The Contractor shall be aware of, and abide by, all Government regulations concerning the authorized use of the Government’s computer network (i.e.: viewing pornographic material or restricted/subversive sites on the web), including the restriction against using the network to recruit Government personnel or advertise job openings.

1.10 Training Requirements. The Contractor shall track all training requirements, and ensure that all employees working on this task order are compliant. If the training requirements are not met, the Government (installation or command) may refuse access to systems or work location. The Contractor shall maintain a training file for each employee and make it available for inspection upon request from the Government. Per DoDM 5200.01–M and AR 380–5, as well as any additional DA training requirements such as those in AR 530–1, AR 25–2, and AR 525–13, the Contractor shall comply with and participate in any pertinent Army, command, and installation security training programs when performance or services will occur on a Government installation and the Contractor employee(s) are embedded or integrated into the Government activity or office.

1.10.1 Antiterrorism Awareness and Training. Pursuant to DoD Instruction 2000.16, "DoD Antiterrorism (AT) Standards," dated 02 Oct 2006, each Contractor employee requiring access to a Federally-controlled installation, facility and/or Federally-controlled information system(s) shall complete Level I AT Awareness Training on an annual basis and receive a certificate of completion. The training is accessible from any computer and is available at: https://atlevel1.dtic.mil/at/. The Contractor shall be responsible for ensuring that all applicable employees have completed antiterrorism awareness training and shall certify that their workforce has completed the training through the submission of completion certificate(s) to the COR within five business days after start of entrance transition or prior to access to a federally-controlled installation or information system. In the event that the automated system at https://atlevel1.dtic.mil/at/ is not available (e.g., server problems), Level I AT Awareness Training can be provided by a qualified instructor. However, if the training is not completed online, the Level I AT Awareness Instructor qualification must be coordinated with the Installation Antiterrorism Officer (or Installation Security equivalent) and the resultant name(s) of approved instructors shall be provided to the KO or designee along with all associated cost and schedule impacts to the task order.

1.10.2 AT Awareness Training for overseas travel. The Contractor shall provide area of responsibility specific AT awareness training as directed by AR 525-13 to all Contractor or Subcontractor personnel before traveling overseas. The Contractor shall contact the CORs, or security office to obtain area of responsibility training content.

1.10.3 iWATCH Training. The Contractor shall brief all Contractor and subcontractor personnel performing services under this task order on the local iWATCH program. The Government will provide training standards. This locally developed training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the CORs. This training shall be completed within 30 days of task order award and within 30 days of new employees commencing performance with the results reported to the HRSSWP (https://www.hrsolutions.army.mil) NLT 45 days after task order award and in MSRs thereafter.

1.10.4 Combating Trafficking in Persons (CTIP) Training. Contractor and subcontractor personnel providing services under this task order shall complete the combating trafficking of persons online training within 14 days of start of work/employment and annually thereafter. The Contractor shall include the names of personnel that have completed the training as part of the MSR. The Contractor will find instructions to access this course at http://www.combat-trafficking.army.mil/training.htm. This website also provides a Trafficking in Persons (TIP) Briefing for group briefings or Contractor personnel unable to access the Army Learning Management System (ALMS).

1.10.5 DoD Cyber Awareness Challenge Training. The Contractor shall ensure all Contractor and subcontractor personnel requiring access to Government information systems register in the Army Training Certification Tracking System (ATCTS) and complete the DoD Cyber Awareness Challenge training at http://iase.disa.mil/Pages/index.aspx. The training shall be completed prior to obtaining access to information systems and annually thereafter. The Contractor shall make copies of training certificates available to the Government upon request and post them in the HRSSWP (https://www.hrsolutions.army.mil) within 10 business days of training completion.

1.10.6 Sexual Harassment and Assault Response Prevention (SHARP) Training. In accordance with the National Defense Authorization Act (NDAA) Fiscal Year 2012 (sections 584 and 585), Contractor personnel supporting this task order shall complete SHARP training. The Contractor shall complete the training within seven calendar days after receipt of CAC and within seven calendar days of employee replacement under this task order and annually thereafter. Training can be accessed at the following website:

http://www.sexualassault.army.mil/. The Contractor is responsible for ensuring all applicable employees have completed requisite training annually, and shall include the names of personnel that have completed the training as part of the MSR. NOTE: In the event that the automated system at the listed website is not available (e.g., server problems), the Contractor shall notify the CORs in order to attain resolution of this issue.

1.10.7 VO and requisite RAPIDS training. Contractor shall ensure all Contractor personnel supporting this task order are initially certified, and re-certified yearly in VO and requisite RAPIDS training annually. Contractor employee shall complete training within seven business days after contract start or after a new employee(s) hire.

Contractor shall notify the COR-RA of any issues with obtaining access to the RAPIDS training site within two business days of encountering the issue. The Contractor shall complete RAPIDS training requirement through website:

https://pki.dmdc.osd.mil/appj/vois/toolsTraining.do?group=Tools. The Contractor is responsible for ensuring all applicable employees have completed requisite training yearly, and shall certify that their workforce have completed the training per the instructions listed in paragraph 1.10.

1.11 Contractor and Subcontractor Identification (ID). All Contractor personnel attending meetings and working in other situations where their Contractor status is not obvious to third parties are required to identify themselves as Contractor employees to avoid creating an impression that they are Government officials. This includes telephone and email communication. The Contractor shall ensure that all documents or reports produced by Contractors are suitably marked as Contractor products and that Contractor participation is appropriately disclosed.

1.11.1 The Contractor shall furnish a badge with employee’s name, picture and company information to Contractor personnel providing services at Government facilities under this task order. All Contractor/subcontractor personnel on duty shall wear identification badges on the upper front quadrant of the outer garment at all times when performing work under this contract. If wearing the badge on the upper front quadrant of the outer garment should constitute a safety hazard, the Contractor shall designate an alternate location for display of the badge for the employee affected.

1.11.2 When Contractor or subcontractor personnel send e-mail messages as part of task order performance, each sender shall include his/her first and last name, e-mail address and name of employer. Accounts established in Government e-mail systems for Contractor and subcontractor personnel shall identify individuals as Contractor personnel in the address book display and on individuals’ e- mail. Detailed properties for the account shall include name of employer and customer’s name for the contract. Email accounts shall follow guidance in accordance with FAR 37.114(c). Contractors are prohibited from using their private company emails for Government business as defined in AR 25-2. Contractor workspace (office, laboratory, and/or desk) shall contain a sign signifying the space is occupied by a Contractor employee to ensure that Federal employees and the public know that they are not Federal employees.

1.12 Program Manager (PM). The Contractor shall provide a PM who shall be responsible for the performance of the work, contract compliance and quality control. The

PM shall possess experience in managing large-scale Government projects; be familiar with Government policies and procedures; possess good analytical skills, time management, and be an independent thinker. The Contractor shall provide the name of the PM and an alternate PM to the KO, COR-HRS, and COR-RA within five days of task order award. The PM or alternate shall have full authority to act for the Contractor on all contract matters relating to daily operation of this task order.

1.13 Employee Qualifications and Conduct.

1.13.1 All Contractor employees supporting this task order shall be U.S. Citizens.

1.13.2 All Contractor employees shall speak, read, and comprehend English to the extent that they can read and understand printed regulations, detailed written orders, operating procedures, training instructions and materials and perform the duties assigned.

1.13.3 The Contractor shall ensure that all employees present a professional appearance that is appropriate for their position. Any noted concerns shall be reported to the COR- RA for corrective measure instruction.

1.13.4 Contractor employees shall conduct themselves in a proper, efficient, courteous and business-like manner. The Contractor shall remove from the site any individual whose continued employment is deemed by the Government to be contrary to the public interest or inconsistent with the best interests of National Security.

1.13.5 Disputes with Customers or other Government Contractors. The Contractor shall verbally notify the KO of unresolved disputes in receiving support from or providing support to customers or other Contractors within two work hours from time of dispute.

The Contractor shall provide written notice of dispute resolution(s) to the COR-RA within two business days after resolution.

1.14 Employee recruitment, training, and retention. The Contractor shall have a recruitment, training, and retention program that attracts and retains qualified individuals. A stable workforce is critical to successful performance of this mission.

The Contractor shall report vacancies, new hires, and the cumulative monthly turnover rates as part of the MSR. The Government’s target for the Contractor is to achieve an annual personnel turnover rate of less than 10 percent; however, the Government understands that military Family members often comprise the Contractor’s workforce. Consequently, the Contractor shall articulate to the Government in the event military spouse Permanent Change of Station (PCS) moves are driving the Contractor’s turnover rate above the 10 percent target. The Contractor shall submit an employee roster by the 5th of each month. The roster shall include each employee’s name, location, job title, employment start date, and personnel status (full-time, part-time, anticipated departure dates, position vacant, and etcetera). The Government reserves the right to seek price adjustments if the KO determines that the Contractor is not making reasonable efforts to hire replacement(s) and the lack of personnel is negatively impacting performance of the required task order workload.

1.15 Post Award Kick-Off Meeting. The Contractor shall conduct a project kick-off meeting within five business days of the task order award in accordance with Federal Acquisition Regulation (FAR) Subpart 42.5. During the meeting, the Contractor shall provide an orientation to their proposed support of the program, implementation milestone schedule, and discuss administrative matters. The meeting will be held at Fort Knox, KY with the Army Program Office, COR-RA, COR-HRS, and KO in attendance. The purpose of this meeting is to achieve a clear and mutual understanding of all contract requirements, and to identify and resolve any potential problems. This meeting is not a substitute for the Contractors fully understanding the work requirements at the time offers are submitted, nor is it to be used to alter the final agreement arrived at in any negotiations leading to contract award. The Contractor shall e-mail the COR-RA, COR-HRS, and KO the “meeting minutes” and post a copy to the HRS portal (www.hrsolutions.army.mil) no later than five business days upon completion the meeting.

1.16 Periodic Progress Meeting. In the event the Government deems this meeting necessary, the KO will notify the Contractor no later than five business days prior to the meeting. The KO, COR-HRS, COR-RA, and other Government personnel (as appropriate) shall meet with the Contractor to review the Contractor's performance.

Meetings will be conducted via teleconference (most efficient) or in person (only when directed). The COR shall coordinate these meetings and the KO will serve as the meeting chair. At these meetings, the Government will apprise the Contractor of how the Government views the Contractor's performance and the Contractor shall apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the Government.

1.17 Other Direct Costs (ODCs) and Contractor Travel. The Government will reimburse Contractor for actual travel costs incurred in the performance of tasks associated with policy meetings identified in PWS paragraph 5.1.6, CACMAT site inspection visits identified in PWS section 5.2, and other Government required travel visits in connection with the performance of this task order. The Contractor shall include all other directs costs associated with successful performance of the work requirements as part of the firm-fixed price. The Contractor shall arrange individual Contractor employee travel.

Allowable travel costs will be reimbursed in accordance with FAR 31.205-46, Travel Costs, and limitation of funds specified in the task order. Travel reimbursements that are not approved by the COR-RA shall be at the Contractor’s expense. G&A, overhead, profit or handling fees will not be allowed on travel. The Contractor shall provide receipts for all lodging, rental cars, mileage, and any miscellaneous expenses with the next due invoice after travel is completed. Travel requirements submitted outside of the two week window will be reviewed on a case by case basis to determine if approval is warranted.

Contractor shall utilize travel claim form provided as Attachment 0018, “Contractor

Travel Expense Report” when submitting requests for reimbursement. Contractor shall provide copies of as Attachment 0017, “Contractor Travel Request Authorization” and Attachment 0018, “Contractor Travel Expense Report” with each submitted invoice.

1.17.1 Long Distance Travel. Long distance travel required in the performance of this task order shall be approved in advance by the COR-RA or the COR-HRS.