Encl_0002_Army_EITaaS_PersonnelSecurityReq_2019_07_05.pdf

SOO Encl 0002 Page 1 of 3

Army – Enterprise IT as a Service (EITaaS) Statement of Objectives (SOO) Enclosure 0002 - Personnel Security Requirements:

1. All contractor employees, including subcontractor employees, shall comply with all installation and facility access and local security policies and procedures (provided by respective government representatives) and security/emergency management exercises. The contractor shall also provide all information required for background checks to meet installation access requirements to be accomplished by the Installation Provost Marshal Office, Director of Emergency Services, or Security Office. Contractor workforce must comply with all personal identity verification requirements (Code of Federal Regulations (CFR) clause 52.204-9, Personal Identity Verification of Contract Personnel) as directed by DoD, the Capability Owner and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the government may require changes in contractor security matters of processes. During FPCONs Charlie and Delta, services/installation access may be discontinued/postponed due to higher threat.

Services will resume when FPCON level and/or threat is reduced to an acceptable level as determined by the installation commander. Contactor personnel working on an installation are required to participate in the Installation Random Antiterrorism Measures Program as directed. Contractors may be subject to and must comply with vehicle searches, wearing of ID badges, etc.

2. For contractors requiring Common Access Card (CAC): Before CAC issuance, the contractor employee requires, at a minimum, a favorably adjudicated National Agency Check with Inquiries (NACI) or an equivalent or higher investigation in accordance with Army Directive 2014-05. The contractor employee will be issued a CAC only if duties involve one of the following: (1) Both physical access to a DoD facility and access, via logon, to DoD networks on-site or remotely; (2) Remote access, via logon, to a DoD network using DoD-approved remote access procedures; or (3) Physical access to multiple DoD facilities or multiple non-DoD federally controlled facilities on behalf of the DoD on a recurring basis for a period of 6 months or more. At the discretion of the sponsoring activity, an initial CAC may be issued based on a favorable review of the Federal Bureau of Investigation (FBI) fingerprint check and a successfully scheduled NACI at the Office of Personnel Management.

3. iWATCH Training. This standard language is for contractor employees with an area of performance within the Army controlled installation, facility or area. The contractor and all associated sub-contractors shall brief all employees on the local iWATCH program (training standards provided by the requiring activity Authority to Operate (ATO)). This locally developed training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the Contracting Officer’s Representative (COR). This training shall be completed within 30 calendar days of contract award and within 5 calendar days of new employees commencing performance with the results reported to the COR no later than 30 calendar days after contract award.

Army – EITaaS SOO Enclosure 0002 - Personnel Security Requirements (cont.):

SOO Encl 0002, Page 2 of 3

4. Contractor and all associated subcontractor employees shall comply with adjudication standards and procedures using the National Crime Information Center Interstate Identification Index (NCIC-III) and Terrorist Screening Database (Army Directive (AD) 2014-05/Army Regulation (AR) 190-13); applicable installation, facility and area commander installation and facility access and local security policies and procedures (provided by government representative); or, at Outside Continental United States (OCONUS) location, in accordance with status-of-forces agreements and other theater regulations.

5. All contractor employees, including subcontractor employees, will return all issues U.S. government owned equipment with includes travel laptops, mobile devices, Common Access Cards, installation badges, and/or access passes to the COR when the contracts completed or when a contactor employee no longer require access to the installation or facility.

6. The contractor shall be capable of accessing, handling, receiving and storing UNCLASSIFIED documents, equipment, hardware and test items using the applicable standards of FOR OFFICIAL USE ONLY (FOUO) information. All controlled Unclassified Information (documents designated as FOUO and /or LIMITED DISTRIBUTION) shall be submitted by a controlled means using USPS mail, Safe Access File Exchange (SAFE) website and/or DoD Army approved encryption software as per AR 25-1.

7. Per AR 530-1 Operations Security, the contractor employees must complete Level I OPSEC Awareness training. New employees must be trained within 30 calendar days of their reporting for duty and annually thereafter. OPSEC Awareness for Military Members, DoD Employees and Contractors is available at the following website: http://cdsetrain.dtic.mil/opsec/index.html

8. Per AR 530-1 (DoD Manual 5205-02-M), an OPSEC review is required prior to all public releases of information. All government information intended for public release by a contractor will undergo a government OPSEC review prior to release.

9. The contractor shall ensure that all staff possess the required qualifications to perform work as required by the U.S. government, and that those qualification are maintained during the life of the contract. The contractor shall be responsible for approving individual resumes to ensure appropriate assignment of personnel to meet the requirements set forth in DoD 8570.01. It shall be the sole responsibility of the contractor to staff their team properly and abide by the guidelines set forth in the DoD 8570.01. All personnel holding administrative rights will be designated members of the cybersecurity workforce and must meet the additional certification and/or training requirements set forth in DoD 8570.01 prior to beginning to work on the contract.

10. The contractor shall ensure that cybersecurity is provided for information technology in accordance with current federal, DoD and other relevant policies, procedures, and statutes, to include the Clinger-Cohen Act; DoD Instruction 8500.01, Cybersecurity;

DoD Directive 8570.01, Information Assurance Training, Certification, and Workforce Management; and DoD Manual 8570.01-M, Information Assurance Workforce Improvement; AR 25-1, Army Knowledge Management and Information Technology;

http://cdsetrain.dtic.mil/opsec/index.html

Army – EITaaS SOO Enclosure 0002 - Personnel Security Requirements (cont.):

SOO Encl 0002, Page 3 of 3 and AR 25-2, Army Cybersecurity. AR 25-2 requires active duty military, DoD civilian, DoD consultants, and support contractor personnel performing work on sensitive Automated Information Systems (AISs) to be assigned to positions which are designated at one of three sensitivity levels per AR 380-67: Automated Data Processing-Level 1 (ADP-I), ADP-II or ADP-III. The employing contractor will ensure individuals assigned to these sensitive positions have completed the appropriate access request forms.

Per AR 380-67:

“DoD military, civilian personnel, consultants, and contractor personnel performing on unclassified automated information systems may be assigned to one of three position sensitivity designations (in accordance with appendix K of AR 380-67) and investigated as follows:

ADP-I: BI/SBI1

ADP-II: DNACI/NACI2

ADP-III: NAC/ENTNAC/NACI3”

11. All contractor employees, to include subcontractor employees, requiring access to Army installations, facilities and controlled access areas shall complete Antiterrorism (AT) Level I Awareness training within 30 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable and annually thereafter. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee, to the COR or to the contracting officer, if a COR is not assigned, within 5 calendar days after completion of training by all employees and subcontractor personnel. AT Level I Awareness training is available at: https://jko.jten.mil/couses/atl1/launch.html

12. Army Training Certification Tracking System (ATCTS) registration is required for all contractor employees who require access to government information systems. All contractor employees with access to a government information system must be registered in ATCTS at commencement of services, and must successfully complete the annual DOD Cybersecurity Awareness training prior to access to the Information System (IS) and annually thereafter. Register at: https://atc.us.army.mil/iastar

13. All contractor employees working IA/IT functions must comply with DoD and Army training requirements in DoD 8570.01, DoD 8570.01-M and AR 25-2 within six months of appointment to AI/IT functions. DoD Cyber Awareness Challenge training is available at the following website: https://cs.signal.army.mil/DoDIAA/default.asp

14. For Cyber certification (IA/IT), per DoD 8570.01-M, DFARS 252.239.7001 and AR 25-2, the contractor employees supporting Cyber (IA/IT) functions shall be appropriately certified upon contract award. The baseline certification as stipulated in DoD 8570.01-M must be completed or initiated upon award.

** End of Enclosure 0001 **

1 Background Investigation/Special Background Investigation 2 DoD National Agency Check with Inquires/National Agency Check with Inquiries 3 National Agency Check/Entrance National Agency Check/National Agency Check with Inquiries https://jko.jten.mil/couses/atl1/launch.html https://atc.us.army.mil/iastar https://cs.signal.army.mil/DoDIAA/default.asp