PWS_ACES_Draft_-_31_Oct_2015.pdf

Army CIO/G6 Cyber Security Directorate PWS

PERFORMANCE WORK STATEMENT (PWS) FOR

Army Cybersecurity Enterprise Support

Army CIO/G6 Cyber Security Directorate October 31, 2015

Contents

1. GENERAL INFORMATION AND SCOPE……………………………………………...3

1.1 Period of Performance (POP)………………….……………………………………...3

1.2 Budget Limitations: TBD………………………….………………………………….3

1.3 Contractor Manpower Equivalent (CME) Limitations….…………………………….3

1.4 Overview………………………………………………….…………………………...3

1.5 Location of Performance………………………………….…………………………...3

1.5.1 Subtasks 2 and 3………………………………….………………………….3

1.5.2 Subtask 4………………………………………….…………………………3

1.6 Government Points of Contact……………………………….………………………..3

1.6.1 HQDA CIO/G6 Contract Officer Representative (COR)…………………...3

1.6.2 Procuring Contracting Officer (PCO)……………………………………….3

2. OVERVIEW OF WORK TO BE PERFORMED………………………………………...4

2.1 Subtask 1………………………………………………………………………………4

2.1.1 Program Management (PM) Services……………………………………….4

2.1.2 Management of Contracted Personnel………………………………………4

2.1.3 Quality Assurance (QA) Services…………………………………………...4

2.1.4 Meetings and Briefings……………………………………………………...4

2.2 Subtask 2………………………………………………………………………………5

2.2.1 CAC/PKI Support…………………………………………………………...5

2.2.2 Registration Authority System Service Support…………………………….6

2.2.3 Qualifications………………………………………………………………..8

2.3 Subtask 3………………………………………………………………………………9

2.4 Subtask 4……………………………………………………………………………..11

2.5 Subtask 5……………………………………………………………………………..12

3. SECURITY REQUIREMENTS…………………………………………………………13

3.1 Security Clearances…………………………………………………………………..13

3.1.1 Non-Disclosure Statement…………………………………………………13

3.1.2 Information Technology (IT) Systems……………………………………..13

3.1.3 Additional Security Requirements…………………………………………13

3.1.4 Number of SCI Access Required…………………………………………..13

3.1.5 Access to Government Property and Facilities…………………………….13

4. KEY PERSONNEL...……………………………………………………………………14

5. GOVERNMENT FURNISHED EQUIPMENT/INFORMATION (GFE/GFI)…………14 5.1

GFE…………………………………………………………………………………..14 5.2

GFI…………………………………………………………………………………...14

6. PERSONNEL REQUIREMENTS………………………………………………………14

7. TRAVEL…………………………………………………………………………………14

8. DELIVERY SUMMARY………………………………………………………..………14

9. ANTI-TERRORISM (AT)/FORCE PROTECTION REQUIREMENTS……………….15

9.1 AT Level 1 Training…………………………………………………………………15

9.2 Access and General Protection/Security Policy and Procedures…………………….15

9.3 AT Awareness Training for Contractor Personnel Traveling Overseas……………..16

9.4 Army Training Certificate Tracking System (ATCTS)……………………………...16

9.5 DoD and Army Training Requirements……………………………………………...16

9.6 FAR 52.204-2………………………………………………………………………..16

10. Contractor Manpower Reporting………………………………………………………...16

1. GENERAL INFORMATION AND SCOPE

1.1. Period of Performance (POP):

12 November 2015 – 12 May 2016 with two-month option through 12 July 2016

1.2. Budget Limitations: TBD

1.3. Contractor Manpower Equivalent (CME) Limitations: 36-41 CMEs on annualized basis.

1.4. Overview: The Contractor is to provide planning, analytical, operational and technical services to the Headquarters, Department of the Army (HQDA) CIO/G6 Cyber Security

Directorate CAC/PKI Division for Network 2020 planning.

1.5. Location of Performance: The presence of the Contractors supporting this PWS varies by subtask.

1.5.1. Subtasks 2 and 3 and 5 support is required "on-site" in a government facility located in the National Capital Region (NCR) and throughout the U.S. Contractor employees (including subcontractors and consultants) are authorized to work at an alternate location (Contractor's Corporate Headquarters, home, etc.) with Contract

Officer Representative (COR) approval in the event of an unobserved Federal holiday, Government emergency or inclement weather closure per the Office of

Personnel Management (OPM).

1.5.2. Subtask 4 support is required "on-site" in government facilities at the following locations:

Hawaii/Fort Shafter (2)

San Antonio/Fort Sam Houston (2)

Newport News/Fort Eustis (2)

Fayetteville/Fort Bragg (2)

Miami/SOUTHCOM (1)

1.6. Government Points of Contact:

1.6.1. HQDA CIO/G6 Contract Officer Representative (COR)/Program Manager

Mr. Desmond Adams

Chief, CAC/PKI Branch

Army CIO/G6 Cyber Security Directorate

5850 23 rd

Street, Building 220 Fort Belvoir, VA 22060

CML: (703) 545-1637

Email: desmond.f.adams.civ@mail.mil

2. OVERVIEW OF WORK TO BE PERFORMED

mailto:desmond.f.adams.civ@mail.mil

2.1. Subtask 1 - Program Management, Administrative & Quality Assurance Services

2.1.1. Program Management (PM) Services: Contractor shall provide program management to ensure efficient and effective accomplishment of all work detailed in this PWS. Contractor shall track costs at the contract level showing labor, travel and material costs separately and showing monthly labor budgets, monthly labor expenditures, monthly labor invoices, amounts funded, and Estimates at Completion in the Monthly Cost and Performance Report (CDRL A003). Contractor shall summarize significant events and findings, activities, cost or funding concerns, performance that exceeded contract requirements, performance that failed to meet contract requirements and corrective actions in Monthly Status Reports (CDRL

A001). In the event of cumulative cost underruns or overruns exceeding 3% of budgeted cost, contractor shall e-mail the KO, COR, & PM to explain corrective action plan. Contractor shall accomplish Contractor Manpower Reporting monthly until the end of the contract. Contractor shall perform all supervisory tasks concerning contractor employees.

2.1.2. Management of Contracted Personnel: The contractor will manage, oversee, and supervise the activities of all contracted personnel serving on this contract to include task management, time card and leave approval. Contractor is to take direction only from the contracting officer or contracting officer's representative and only when such direction is routed through the contractor's designated manager or supervisor.

In no case will contactor's employees take direction directly from Government employees other than from the contracting officer or contracting officer's representative.

2.1.3. Quality Assurance (QA) Services: Contractor shall provide Quality Assurance services to ensure that all deliverables and products are of the highest quality and meet the standards established by the contract Quality Assurance Surveillance Plan

(QASP).

2.1.4. Meetings and Briefings: Contractor shall conduct meetings and coordination efforts at times commensurate with the complexity and status of the effort required to support the work and meet the identified requirements. Contractor shall support monthly teleconferences and quarterly Technical Interchange Meetings with the PM and task order COR, as required, to discuss contents of program management reports, providing materials and agendas, as required via Presentation Material

(CDRL A004). The contractor shall participate in Technical Interchange Meetings

(TIMs) upon request of the KO, the CIO/G6 PKI PM, or CORs to discuss and evaluate contractor efforts and accomplishments in direct relation to specific Task

Orders. During these meetings, the contractor shall present necessary data to enable a joint review of assigned tasks, schedules, and resource expenditures. The contractor must be able to conduct meetings at the secret level and over SIPRNet when required. The contractor shall present and participate in technical discussions and shall inform the COR, the CIO/G6 PKI PM and KO of any problems with contract execution and any proposed solutions. Contractor shall schedule and conduct contract-wide Program Management Review (PMR) meetings as coordinated with the PM, monthly from the time of contract award.

Coordinate executive-level meetings and video teleconferences (VTCs) including maintaining attendance lists, developing seating arrangements, reserving facilities, and distributing read-ahead materials.

Perform protocol duties including organizing or assisting with the organization and conduct of ceremonies including award ceremonies, promotions, and retirements.

Manage the Director’s schedules/calendars.

Manage the Deputy Director’s schedules/calendars.

Manage the Information Assurance Division Chief’s schedules/calendars.

Manage the Program Integration Division Chief’s schedules/calendars.

Manage incoming telephone calls.

Ensure proper reception and escorting of visitors, ensuring the proper security procedures are followed.

Maintain current personnel rosters, organizational charts, etc.

Provide administrative/technical support to the Cyber Security Directorate

Property Book Officer (PBO)

Provide administrative/technical support to the Cyber Security Directorate

Information Management Officer (IMO)

Provide administrative/technical support to the Cyber Security Directorate

Information Management Security Officer (ISSM)

Track suspense/process staff actions/assist with monitoring workflow, to include:

Review and edit staff packages, military and civilian appraisals, awards and decorations, and other written documents IAW AR 25-50 (Preparing and

Managing Correspondence), DA Memo 25-52 (Staff Action Process and

Correspondence Policies) and/or other applicable Army publications and policies;

Serve as the point of contact for incoming/outgoing correspondence and distribution;

Update the status of actions in the appropriate workflow management tracking system, based on inputs from AOs;

Provide feedback on observed process problems and suggest improvements to the Staffing Process POC;

Maintain pertinent data (electronic or hard copies) necessary for the effective function of the offices, following applicable Records Management guidance.

The material will include both classified and unclassified information;

Prepare routine correspondence for the Director and Deputy Director with minimum guidance; and manage the assignment of incoming tasks, anticipate and assign suspense dates based on external demands and availability of key personnel, track and report on progress and completion of tasks daily

(reporting issues to the Director and Staff Action Control Office POC, as appropriate), and forward completed documents to appropriate internal and external agencies with a copy to the Action Officer.

The Contractor is fully responsible for tracking and complying with all DoD, Army and other relevant and applicable regulatory and policy documents relating to the work on this contract. A significant number of Army regulations that govern the conduct of the required work are listed below. The PWS may set a higher standard of performance than an applicable Army regulation or policy document. When it sets a higher standard, the PWS will take precedence over the regulations unless a particular PWS provision is in direct conflict with the applicable provision of the

Army regulation, which should be brought to the attention of the contracting officer immediately. Many of the relevant documents and publications can be accessed from the internet site www.apd.army.mil. The Government can provide copies of those publications that are not available on a government web site. The Contactor shall comply with changes to publications. The Contractor shall inform the

Contracting Officer and COR of any cost impacts created by changes to a publication or regulatory document that impact the cost of the contract.

AR 25-1 Army Knowledge Management and Information Technology

AR 25-2 Information Assurance

AR 25-50 Preparing and Managing Correspondence

AR 25-55 Department of the Army Freedom of Information Act Program

AR 25-400-2 The Army Records Information Management System (ARMIS) Joint Travel

Regulation (JTR) http://www.apd.army.mil/

AR 380-5 Department of the Army Information Security Program

AR 380-67 Personnel Security

AR 381-12 Subversion and Espionage Directed Against the U.S. Army (SAEDA)

AR 530-1 Operations

DoD 5220.22-M National Industrial Security Program Operating Manual (NISPOM)

DoD 8110.1 Multinational Information Sharing Networks Implementation

DoD 8260.2 Implementation of Data Collection, Development and Management for

Strategic Analyses

DoD 8500.2 Information Assurance (IA) Implementation

DoDI 8510.01 Risk Management Framework (RMF) for DoD Information Technology (IT) formally DIACAP

DoD 8520.2 Public Key Infrastructure (PKI) and Public Key (PK) Enabling

DoD 8530.2 Support to Computer Network Defense (CND)

DoD 8551.1 Ports, Protocols and Services (PPSM)

DoD 8570.01-M Information Assurance Workforce Improvement Program

DoD 8580.1 Information Assurance (IA) in The Defense Acquisition System

DoD Local Registration Authority (LRA) Reference Certificate Practice Statement (CPS) DoD

Registration Authority (RA) Reference Certificate Practice Statement (CPS)

FIPS 140 Federal Information Processing Standards Publication

FISMA Federal Information Management Security Act

HSPD-12 Homeland Security Presidential Directive 12

JTF-GNO Communications Tasking Order 06-02 JTF-GNO Communications Tasking Order 07-015

NISTISSP 11 National Security Telecommunications and Information Systems Security Policy

SP800-73 National Institute of Standards and Technology Special Publication

SP800-78-1 National Institute of Standards and Technology Special Publication

SP800-79-1 National Institute of Standards and Technology Special Publication

BBP 05-PR-M-0002 Information Assurance (IA) Training and Certification

Be a U.S. citizen.

2.2. Subtask 3 - Network 2020 Support Task

2.2.1. The contractor shall support the Army CIO/G-6 in coordination of Network 2020 initiatives across the Army for both the generating and operating force in the areas of Identity, Credential and Access Management, Information Assurance, Secure

Mobile Computing, Cloud Computing, Network Operations, Continuous

Monitoring, Risk Management and other capabilities identified to achieve improved

Cyber Security. The contractor will support the Government in development of resource requirements and policies for same. In addition, the contractor will assist the Government in development of strategic plans and objectives to effectively implement DoD, NSA, Joint and Army IA goals and initiatives in the out-years.

Support activities include the following:

Participation in DoD/DISA/DMDC/NSA/Joint Staff and Joint Information

Environment working groups supporting Army interests and shaping, Planning, coordinating and facilitating Cross-Army Integrated Project

Teams for both Identity and Access Management and Network

Operations, Maintaining a shared area on the Network for document sharing and collaboration, Support to the Network Operations and Security Domain lead within the CIO/G-6.

Support the development and coordination of Army Regulation 25-2.

Support activities defined in the Risk Management Framework (RMF) for DoD

Information Technology DoDI 8510.01; formally known as DIACAP. The contractor shall provide support to the Cyber Security Directorate to address the cyber security requirements for DoD information technologies which shall be managed through the RMF consistent with the principals established in the

National Institute of Standards and Technology (NIST) Special Publication

(SP) 800-37 (Reference (c)). Maintain and manage the Certification and

Accreditation (C&A) database.

Information Assurance MilSuite Site. The contractor shall support the Army

Cyber Security Directorate Strategic Communications Branch responsible for adopting and employing an array of communication approaches, ranging from policy advocacy, community collaboration, interpersonal communication, outreach and awareness training to the use of innovative communication techniques and media in order to shape behaviors within the Army and contribute to positive cultural change that is essential to accomplishing the

Cyber Security mission.

A website was established on the Army’s NIPRnet as a “One Stop Shop” for

IA Information in the Army. The contractor shall assist the Government in providing continued updates from IA Subject Matter Experts (SMEs) and management of the site. The contractor will be responsible for quality assurance of the site using the content provided by the Government designated

SMEs. As the DoD and Army toolsets expand or are enhanced the contractor will keep the Government informed and as directed update the Army IA site to take advantage of new or different functionality available. The contractor shall provide the government a monthly MilSuite Website Update Report. (A006)

The contractor shall assist the Army Cyber Security Directorate in developing strategies for the prevention of cyber attacks against DoD’s networks and numerous, varied, and complex information sharing challenges within the

DoD Global Information Grid (GIG), the DoD has established a strategic vision to deliver a Joint Information Environment (JIE) that will enable the

DoD and its mission partners to securely access information and services they require when they need it, from where they need it, and on the DoD approved device of their choice. The envisioned strategic end-state of this strategy is to enhance mission effectiveness, increase security, and to improve information technology efficiencies through the consolidation of costly network resources and infrastructure throughout the DoD.

The contractor shall assist the Army Cyber Security Directorate with relevant

DOTMLPF findings to ensure that “gaps” in IA capabilities are fully documented for review and possible resolution by affected stakeholders. This objective shall include addressing clarification of roles and responsibilities

Cyber Security governance documentation, or reaffirming existing

MOUs/MOAs, or formalizing processes that are currently executed on a less than formal basis. As requested, the contractor will provide SME in one or more of the following IA disciplines: Army Cryptographic Modernization, Key Management Infrastructure (KMI), Army Public Key Infrastructure (PKI)

Credentialing, cyber security and information assurance, Computer Network

Defense (CND), securing the network in a joint environment, secure network operations and tools, Federal Information Security Management Act (FISMA), and the RMF.

The contractor shall provide the Government, as requested, with a follow-up report to any meetings the contractor attends in support of the Government

(A005).

The contractor shall provide a Trip Report to the Government (A002) for any

TDY travel taken in support of this contract.

The contractor shall support the Army CIO/G-6 in coordination with DoD CIO, DISA, and

Services to support the JIE that will be comprised of shared IT infrastructure, enterprise services, and single security architecture to achieve full spectrum superiority, improve mission effectiveness, increase security and realize IT efficiencies. The contractor shall assist the JIE community of interest with developing enforceable standards, specifications, and common tactics, techniques, and procedures (TTPs). Support activities include the following:

Participation in the development of JIE strategic plans and objectives which effectively support the goal of leveraging shared IT infrastructure that will operate the same regardless of service provider and/or use common tactics, techniques, and procedures developed at the enterprise level.

Participation in JIE working groups and support Army interests in areas such as information sharing, enterprise services, and security and architectures across the full range of military operations.

Planning, coordination, and facilitation of Integrated Project Teams (IPTs) that consist of multiple Army Organizations and DoD mission partners for all cyber security JIE activities.

Collection, research on, and analysis of information to provide requirements, architectures, policies, and procedures that enable information sharing across DoD

Components for shared situational awareness of all business, warfighting, and intelligence data.

Participation and support of the JIE workings groups to research and develop criterion for Common enterprise services, applications and tools, and single security architecture for all Services with global availability that’s extendable to the tactical edge.

The contractor shall provide a Trip Report to the Government (A002) for any TDY travel taken in support of this contract.

Qualifications - Contractor employees conducting these activities must meet the following qualifications:

Have not been denied a security clearance or had a security clearance revoked;

Have a current US Secret Security Clearance, at a minimum, prior to the start of work.

Be a U.S. citizen;

2.5 Subtask 5: Network 20/20 Support Task (12 November 2015 – 12 May 2016)

The CIO/G6 has identified the need to define the Army network baseline to include the technical, investment, joint capability areas and the Army policy conformance. The contractor shall work with the government team lead to support this effort. Tasks performed in this area are:

Reviewing and providing inputs and recommendations to Requirements, Architecture, CONOPS, and other documents developed as these capabilities are implemented. The contractor shall also:

Support to the Network Mission Area Integrator and DOMAIN leads for all security related capabilities.

Support to the Network Mission Area Integrator and DOMAIN leads for execution of the NMA Portfolio process. Refinement to the NMA Portfolio

Process document and changes made during execution.

The Army has implemented the Army Portfolio Management Solution (APMS)

Registration to track and manage all Army IT assets. At the request of the government, the contractor shall provide an APMS SME to support System

Owners/PM/PEOs to ensure that all IT investments meeting the criteria established in AKM Guidance Memorandum. Capabilities Based IT Portfolio

Government Implementing Guidance is accurately entered into APMS. The contractor shall request an AKO logon to access implementing guidance.

The POP for work performed under Subtask 5 will cover 12 November 2015 – 12 May 2016. All other work required under this subtask will move to the Army’s Architectures, Operations, Networks and Space Division effective 1 October 2014.

3. SECURITY REQUIREMENTS

3.1. Security Clearances - A SECRET level clearance, at a minimum, is required of all

Contractor personnel supporting this PWS and therefore must be able to obtain and retain a SECRET level security clearance, as a condition of employment. The IAO and

SA positions require a Top Secret SSBI clearance at the start of employment. Other

Contractor personnel may require a Top Secret/SCI (TS/SCI) that will be identified by the Government. The Army will provide a DoD building pass that will provide employees daily, unescorted access to the work site (to include after business hours

(24x7) and allow the Contractors the ability to escort visitors conducting official government business. The contractor may require access to COMSEC information, and will require access to FOUO information. The contractor will require access to the

SIPRNet. In addition, determined by the COR, the contractor may be required to have unescorted access to the Pentagon to conduct assigned tasks.

In performing this Contract, the contractor will have access to classified information only when working at the Government Activity’s location.

3.1.1. Personnel must sign a Non-Disclosure Statement. Personnel must perform within the security limitations of AR 381-10, USSID 1800, and other appropriate security regulations.

3.1.2. All individuals requiring access to information technology (IT) systems will have the appropriate security clearance and will be granted access according to their security clearance, need-to-know and their IT position/category. Additional position category and investigation guidance is available in DOD 5200.2-R. As referenced from AR 25-2, personnel requiring access to information systems processing classified information to fulfill their duties will possess the required favorable security investigation, security clearance, formal access approval (DoD Directive

8570) and need to know. ADP/IT tier level positions are detailed in the task orders.

3.1.3. Additional Security Requirements. This effort requires access to classified

Government information at U.S. Government locations only. Additional requirements are contained in the DD Form 254. Additional security requirements may be added at the task order level. Security information will be uploaded and available to the government security manager through Joint Personnel Adjudication

System (JPAS).

3.1.4. Number of SCI Access Required. May require SI/TK billets.

3.1.5. Access to Government Property and Facilities. The Contractor shall request

“No Escort Required” access badges to Government buildings at the locations identified above consistent with task order requirements. Contractor personnel may also enter other facilities where escorted access is mandatory by requesting such access and escort from COR, in advance, as required. Access to government facilities, documents, and systems shall be in accordance with DD Form 254, and

Department of Defense Contract Security Classification Specifications.

4. KEY PERSONNEL

The Government has identified specific Key Personnel Positions critical to the successful accomplishment of this PWS. The contractor shall provide the Government a copy of candidate resume for any Key position for approval prior to being assigned to this contract.

Key Personnel Positions are the PM and the RA Support Task Lead. No personnel are considered “mission essential.”

5. GOVERNMENT FURNISHED EQUIPMENT / INFORMATION (GFE/GFI)

5.1. GFE: The Army will provide adequate physical work space and will furnish; desk, file storage, computer equipment to include necessary hardware & software, an electronic mail (e- mail) account, use of the government telephone, facsimile machine, copier usage, and all necessary office supplies, paper, pens, etc., as required. No other

Government equipment will be furnished. Government furnished information will consist, when available, of historical documents and working papers that may be related to the work set forth herein.

5.2. GFI: Government will provide access to all required data sources necessary to provide required services, including training, as required. The Contractor shall make every effort to utilize existing products and briefings to the extent practicable before developing new materials and briefings. The Contractor is responsible for ensuring that no copyright infringements or other such violations occur when developing products and briefings.

6. PERSONNEL REQUIREMENTS

All personnel on the Contractor team (regardless of whether a contractor employee, consultant or subcontractor), performing in all labor categories and functional areas, must meet IA certification requirements mandated by the DoD Information Assurance Workforce

Improvement Program, for their IA level. These requirements are pursuant to DoD

Instruction 8570.1-M, “DoD Information Assurance Workforce Improvement Program” and

Army IA Training and Certification Best Business Practice (BBP) BBP 05-PR-M-0002. All personnel performing on the contractor team must hold the required certifications as indicated in Section 9 below for their respective functional area, no later than 60 days after contract award.

7. TRAVEL

The contractor shall provide any anticipated travel costs, if known, to include:

origination; destination; number of trips; number of persons; and a breakdown of lodging, meals, transportation, and related costs. Actual expenses are limited by the Government Travel

Regulations and must be pre-approved by the COR.

The Government estimates the following Local Travel Trips:

Ft. Belvoir: 9 trips per month for the next 4 months: 36 Total

Ft. Eustis: 4 trips per month for the next 4 months: 16 Total

Ft. Bragg: 4 trips per month for the next 4 months: 16 Total

Ft. Sam Houston: 12 trips per months for the next 4 months: 48 Total

Ft. Shafter: 4 trips per month for the next 4 months: 16 Total

USSOUTHCOM: 4 trips per month for the next 4 months: 16 Total

8. DELIVERY SUMMARY

8.1. The following table provides further guidance and PWS specific clarifications.

Deliverable dates shall be as established in the CDRL unless otherwise stated below. The COR shall perform final inspection and acceptance of deliverables.

Block 10 indicates “Frequency”, Block 11 “As of Date”, Block 12 “Date of First

Submission,” and Block 13 “Date of Subsequent Submission.” ASREQ and ASGEN requirements are due 48 hours after notification of requirement, unless otherwise agreed to by the COR. Some deliveries may need to be accelerated, based on urgency of tasking. Addresses of Contracting Officer, Program Manager, and COR are located in paragraph 1.6 of this PWS.

CDRL DELIVERABLE Blk 10 Blk 11 Blk 12 Blk 13

A001 Monthly Status Reports MTHLY O 45DAC 10DARP

A002 Trip Reports ASREQ N/A ASGEN ASREQ

A003 Costs and Performance Report MTHLY N/A ASGEN 10DAPR

A004 Presentations, Tech Rpt–Study/Services ASREQ N/A ASGEN ASREQ

A005 Report, Record of Meeting/Minutes ASREQ N/A ASGEN ASREQ

A006 MilSuite Website Updates MTHLY N/A ASGEN ASREQ

9. ANTI-TERRORISM (AT)/FORCE PROTECTION REQUIREMENTS

9.1. AT Level 1 Training: All contractor employees, to include subcontractor employees, requiring access to Army installations, facilities and controlled access areas shall complete AT Level I awareness training as part of the initial and annual IA Cyber

Awareness Training prior to obtaining Network access. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee, to the COR or to the contracting officer, if a COR is not assigned, within 5 calendar days after completion of training by all employees and subcontractor personnel.

IA Cyber Awareness training is available at the following website:

https://ia.signal.army.mil/DoDIAA/t.

9.2. Access and General Protection/Security Policy and Procedures: Contractor and all associated sub-contractors employees shall comply with applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by government representative). The contractor shall also provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency

Services or Security Office. Contractor workforce must comply with all personal identity verification requirements as directed by DOD, HQDA and/or local policy, in addition to the changes otherwise authorized by the changes clause of this contract.

Should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may also require changes in contractor security matters or processes.

9.3. AT Awareness Training for Contractor Personnel Traveling Overseas: US based contractor employees and associated sub-contractor employees shall obtain Government provided area of responsibility (AOR) specific AT awareness training, as directed by AR

525-13. Specific AOR training content is directed by the combatant commander with the unit ATO being the local point of contact.

9.4. Army Training Certification Tracking System (ATCTS): All contractor employees with access to a government info system must be registered in the ATCTS (Army

Training Certification Tracking System) at commencement of services, and update records to reflect their IA training and certifications.

9.5. DoD and Army training requirements: All contractor employees working IA/IT functions must comply with DoD and Army training requirements in DoDD 8570.01, DoD 8570.01-M, DFARS 252.239.7001 and AR 25-2 within six months of employment.

9.6. FAR 52.204-2: Contractor shall comply with FAR 52.204-2, Security Requirements.

This clause involves access to information classified “Confidential,” “Secret,” or “Top

Secret” and requires contractors to comply with— (1) The Security Agreement (DD

Form 441), including the National Industrial Security Program Operating Manual (DoD

5220.22-M); any revisions to DOD 5220.22-M, notice of which has been furnished to the contractor.

10. CONTRACTING MANPOWER REPORTING

10.1 The contractor shall report ALL contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract for the Cyber and RA Support Services via a secure data collection site. The contractor is required to completely fill in all required data fields using the following web address:

http://www.ecmra.mil/, and then click on "Department of the Army CMRA" or the https://atlevel1.dtic.mil/at http://www.ecmra.mil/ http://www.ecmra.mil/ icon of the DoD organization that is receiving or benefitting from the contracted services.

Reporting inputs will be for the labor executed during the period of performance during each Government fiscal year (FY), which runs October 1 through September

30. While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year, beginning with 2013. Contractors may direct questions to the help desk by clicking on "Send an email" which is located under the Help Resources ribbon on the right side of the login page of the applicable

Service/Component's CMR website.