A03_Attachment_1_-_PWS.pdf

Attachment #1

PERFORMANCE WORK STATEMENT (PWS)

Title: FileMaker maintenance and support services

Requiring Activity Name: Veterinary Service Program (VSP) within Walter Reed Army Institute of Research

(WRAIR)

1. INTRODUCTION

The WRAIR aims to conduct biomedical research that is responsive to Department of Defense (DoD) and US Army requirements and delivers life-saving products including knowledge, technology and medical material that sustain the combat effectiveness of the Warfighter.

Our headquarters is dedicated to Senator Daniel E. Inouye and located in Silver Spring, Maryland. The Walter Reed Army Institute of Research is the largest biomedical research facility currently serving the Department of Defense.

Established in 1893, our research and development now reaches around the world from Maryland to Germany, Thailand, and Kenya.

Our vision is to be the premier DoD biomedical research organization, constantly relevant, integrating basic research and advanced technology that protects, projects, and sustains the Warfighter today, invents global medical solutions for the future, and keeps the Warfighter on point for the Nation. We host two Centers of Excellence for Military Psychiatry and Neuroscience Research and for Military Infectious Disease Research, each center ranging from blast induced neurotrauma to malaria vaccine development.

2. PURPOSE AND BACKGROUND

2.1. Purpose

The Purpose of this requirement is to recieve maintenance and support services for FileMaker-based Pathology Database for reporting and archiving pathology-relevant data at WRAIR.

2.2. Background

The VSP provides comprehensive animal care, protocol consultation, support, and pathology services to the WRAIR/NMRC. To meet the following mission:

Provide quality veterinary medical care and environmental enrichment programs for all animals, representing nine different species

Provide guidance for regulatory compliance issues related to animal-based research

Provide comprehensive animal research support through scientific consultation with investigators and medical/surgical care to the research animal colony

Conduct training for laboratory animal techniques and animal handling workshops for investigators, research support staff, veterinary staff, and animal care personnel

Train military veterinarians chosen by a selection board for the DoD Laboratory Animal Medicine Residency Training Program

The Department of Pathology, VSP, WRAIR, plays an integral part in the research vision of WRAIR by providing American College of Veterinary Pathologists (ACVP) board certified support to researchers and their respective animal research protocols. In order to continue meet the mission and the Institutional Animal Care and Use

Committee (IACUC)-approved scientific research protocols, the Department of Pathology has a continuing need for a computer based pathology-oriented database to track the department’s information, materials, and workload.

3. SCOPE

The Contractor shall maintain and provide support for the FileMaker-based pathology database for reporting and archiving pathology-relevant data. Contract support shall include the capability to alter the database to meet the evolving needs of the VSP, WRAIR, and Information Management Division in support of the requirements of the Department of Defense Instruction 8510.01 as it relates to DoD Information Technology, the National Institute of Standards and Technology (NIST) and the Committee on National Security Systems (CNSS).

4. PERIOD OF PERFORMANCE

The periods of performance for this contract are as follows:

Base period 16 April 2018 – 15 April 2019 Option period 1 16 April 2019 – 15 April 2020 Option period 2 16 April 2020 – 15 April 2021 Option Period 3 16 April 2021 – 15 April 2022 Option Period 4 16 April 2022 – 15 April 2023

5. WORK SCHEDULE AND LOCATION

5.1. Work Location

The work location is off-site, with the occasional on-site visits for training purposes only. Reference FAR 7.108, entitled, “Additional Requirements for Telecommuning.”

WRAIR

503 Robert Grant Avenue, Silver Spring, MD 20910

5.2. Federal Holidays

5.2.1. The contractor shall not perform services on days designated as a Federal Holiday by Federal Status, Executive Order, Presidential Proclamation and/or Installation Commander

5.2.2. Federal holidays are an exception to the regular duty hours. Any of the holidays listed below falling on a Saturday will be observed on the preceding Friday; holidays falling on a Sunday will be observed on the following Monday. The following is a list of legal federal holidays that services shall not be performed

The following are Federal Holidays:

New Year’s Day Birthday of Martin Luther King, Jr.

Washington’s Birthday Memorial Day Independence Day

Labor Day Columbus Day Veterans Day Thanksgiving Day Christmas Day

5.3. Post Closure

All non-mission essential contract employees shall not report to work on days the Government or installation is closed due to local determinations relating to safety conditions, inclement weather, national emergencies, and/or energy conservation. During these periods of closure, only mission-essential contractor personnel shall report for work. All positions proposed shall be considered non-mission essential under this requirement.

5.4. Work Schedule

The contractor shall be available during normal business hours of operation, which are defined as Monday through Friday between the hours of 9:00am and 5:00pm eastern, excluding Government holidays and unforeseen closures. Some work outside of normal business hours may be required for routine or emergency support.

6. TRAINING REQUIREMENTS

Training certifications of completion (Deliverable 1). The contractor shall track, complete training annually to remain in training compliance and readiness status. The contractor shall submit training certificates of completion for each affected contractor and subcontractor personnel to the COR within 5 calendar days after completion of training by all personnel and subcontractor personnel.

6.1. Army Training Certification Tracking System (ATCTS) registration for contractor employees who require access to government information systems. All contractor employees with access to a government information system must be registered in the ATCTS (Army Training Certification Tracking System) at commencement of services and must successfully complete the DoD Information Assurance Awareness training prior to access to the information system and then annually thereafter. This required non-residential training on-line at:

https://ia.signal.army.mil/DoDIAA/default.asp. It takes approximately one-hour to complete.

For information assurance (IA/information technology (IT) training). All contractor employees and associated sub-contractor employees must complete the DoD IA awareness training before issuance of network access and annually thereafter. All contractor employees working IA/IT functions must comply with DoD and Army training requirements in DoDD 8570.01, DoD 8570.01-M and AR 25-2 within six months of appointment to IA/IT functions.

6.2. Initial Security Orientation or Annual Security Refresher Training. Per requirements in Office of the Surgeon General (OTSG)/ Medical Command (MEDCOM) Policy Memo 14-004, Standardized Security Training dated 15 January 2014, all contractors shall complete the Initial Security Orientation within 30 calendar days of contract start date, then must complete the Annual Security Refresher due every 365 days. Available on-line at https://www.lms.army.mil.

6.3. Army-Wide Network Security Focus Training (AWSNF). Contractor shall complete this required non-residential training course to include (1) AWNSF-Phishing Awareness, (2) AWNSF-Personally Identifiable Information, (3) AWNSF-Portable Electronic Devices and Removable Storage Media, and (4) AWNSF-Safe Home Computing. Available on-line at: https://iatraining.us.army.mil. All four (4) courses shall be completed; this is a one-time only and is required for the establishment of a government network account. It takes approximately one-hour to complete.

6.4. Emergency Preparedness Response Program. Contractor shall complete this required non-residential training every three (3) years, available on-line at Joint Knowledge Online (JKO) Home Page accessed via https://jko.jfcom.mil. It takes approximately one hour to complete.

7. SECURITY

7.1. Access and General Protection/Security Policy and Procedures. The contractor and all associated subcontractors’ personnel shall comply with applicable installation, facility, and area commander installation and facility access and local security policies and procedures (provided by the Government representative). The contractor shall also provide all information required for background checks to meet installation access requirements to be accomplished by the installation Provost Marshal Office, Director of

Emergency Services, or Security Office. The contractor workforce shall comply with all personal identity verification requirements (FAR clause 52.204-9, Personal Identity Verification of Contractor Personnel) as directed by DoD, HQDA, and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

7.2. Contractors Requiring Common Access Card (CAC). Before CAC issuance, the contractor personnel requires, at a minimum, a favorably adjudicated National Agency Check with Inquiries (NACI) or an equivalent or higher investigation IAW Army Directive 2014-05, Policy and Implementation Procedures for Common Access Card Credentialing and Installation Access for Uncleared Contractors. The contractor personnel will be issued a CAC only if duties involve one of the following:

7.2.1. Both physical access to a DoD facility and access, via logon, to DoD networks on-site or remotely;

7.2.2. Remote access, via logon, to a DoD network using DoD-approved remote access procedures; or

7.2.3. Physical access to multiple DoD facilities or multiple non-DoD federally controlled facilities on behalf of the DoD on a recurring basis for a period of 6 months or more. At the discretion of the sponsoring activity, an initial CAC may be issued based on a favorable review of the FBI fingerprint check and a successfully scheduled NACI at the Office of Personnel Management.

7.3. Contractor Personnel Who Require Access to Government Information Systems. All contractor personnel with access to a government information system shall be registered in the ATCTS (Army Training Certification Tracking System) at commencement of services and shall successfully complete the DoD Information Assurance Awareness training prior to access to the information system and then annually thereafter.

7.3.1. Prior to commencement of services, the contractor shall provide the COR, within seven (7) calendar days in advance of the event, full names, date of birth, place of birth and Social Security numbers (or equivalent identification numbers for non-U.S. citizens) of all personnel who will be entering Army-controlled installation and facilities.

7.3.2. The contractor shall ensure that its personnel entering Army-controlled installations or facilities have obtained access badges and passes IAW facility regulations and that these badges and passes are obtained in advance so as not to delay the accomplishment of contracted services. The contractor shall contract COR or designated Government Trusted Associate Sponsorship System (TASS) Trusted Agent who is responsible to facilitate and sponsoring contractor’s Army Knowledge Online (AKO) registration and TASS in-processing and out-processing, to include approval, rejection and re-verification.

7.3.3. The contractor shall return all issued U.S. Government Common Access Cards, installation badges, access badges to the COR when the contract is completed or when a contractor personnel no longer requires access to the installation and facility.

7.4. Force Protection Condition (FPCON) impact on work levels. The contractor workforce shall comply with all personal identity verification requirements as directed by DoD, Headquarters Department of the Army (HQDA), and local policy. In addition to the changes otherwise authorized by the changes clauses of this contract, should the FPCON at any individual facility or installation change, the Government may require changes in contractor security matters or process. IAW Department of Defense Instructions (DoDI) 2000.16, DoD AT Standards, the FPCON is defined as follows:

FPCON ALPHA. This condition applies when there is a general threat of possible terrorist activity against personnel and facilities, the nature and extent of which are unpredictable, and circumstances do not justify full implementation of FPCON BRAVO measures. However, it may be necessary to implement certain measures from higher the Terrorist Threat Conditions (THREATCONS) resulting from intelligence received or as a deterrent. The measures in this THREATCON must be capable of being maintained indefinitely.

FPCON BRAVO. This condition applies when an increased and more predictable threat of terrorist activity exists. The measures in this THREATCON must be capable of being maintained for weeks without causing undue hardship, affecting operational capability, and aggravating relations with local authorities.

FPCON CHARLIE. This condition applies when an incident occurs or intelligence received indicating some form of terrorist action against personnel and facilities is imminent. Implementation of measures in this THREATCON for more than a short period probably will create hardship and affect the peacetime activities of the unit and its personnel.

FPCON DELTA. This condition applies in the immediate area where a terrorist attack has occurred or when intelligence has been received that terrorist action against a specific location or person is likely.

Normally, this THREATCON is declared as a localized condition. See also anti-terrorism

During FPCONs Charlie and Delta, non-essential services are discontinued. Designated essential service will resume when the FPCON level is reduced to level Bravo or lower.

When contractor personnel are considered mission essential, all contractor personnel are required to report for duty and remain on duty during declared emergencies or elevated FPCON levels unless otherwise directed by the contracting officer via the appropriate COR.

The contractor shall not possess or store classified information at the contractor’s facility; therefore, level of safeguarding required is not applicable to this contract.

7.5. Proprietary Information Assurance and Security. The contractor shall comply with Office of Management and Budget (OMB) Circular A-130, “Management of Federal Information Resources,” which requires Certification and Accreditation (C&A) of all federal information systems every three (3) years at a minimum or as changes that require re-accreditation occur. This C&A requirement ensures the effective safeguarding of sensitive but unclassified (SBU) data against unauthorized modification, disclosure, destruction, and denial of service, as directed by the DoD.

7.5.1. The contractor shall protect all data in the strictest confidence; prevent the unauthorized duplication, use and disclosure of information that is subject to the Privacy Act of 1974, the Health Insurance Portability & Accountability Act (HIPAA) IAW applicable statutory, regulations, local policies and procedures.

7.5.2. All data received, processed, evaluated, loaded, and created as a result of this contract shall remain the sole property of the Government and shall be returned to the Government at the conclusion of the contract unless the contracting officer grants specific exception.

7.5.3. The contractor is prohibited from appropriation, disclosure, or unauthorized use of proprietary information that is acquired in the execution of this contract.

7.5.4. All products including files, software, and other information, which are created, produced or developed during the period of performance is the property of the Government and shall be returned unless the Government grants the contractor permission to retain the materials and products for continued development or publication.

8. LABOR CATEGORY

See SF 1449 Solicitation “Addendum to FAR 52.212-1, “Instructions to Offerors”

9. TRAVEL

Not applicable

10. PERFORMANCE REQUIREMENTS

10.1. Objectives

The System Architecture, Software Requirements, and Performance Parameters of the Pathology Database shall be maintained at the level that meets the WRAIR’s need for managing the pathology-relevant data, tracking pathology materials, and managing pathology technician assignments. The Pathology Database shall also have the ability to be altered in order to meet the evolving needs of the Department’s workflow and record storage requirements.

10.2. Specific Tasks / Requirements

10.2.1. System Management.

The Contractor shall perform duty assignments related to IT management, software application development, sustainment, communication, documentation, network, and information assurance to ensure the continued operation of the FileMaker Pathology Database.

10.2.1.1. The Contractor shall provide for FileMaker Advanced server software maintenance, e.g., installing patches, making configuration changes, upgrading FileMaker server software and related upgrades.

10.2.1.2. The Contractor shall provide technical assistance to mitigate breaks in service due to application conflicts with Government systems.

10.2.1.3. The Contractor shall provide account and group management.

10.2.1.4. The Contractor shall provide database integrity verification.

10.2.1.5. The Contractor shall provide database recovery procedures.

10.3. The Contractor shall mitigate and/or fix software vulnerabilities. If the vulnerability cannot be mitigated within 30 calendar of notification by Government, the contractor shall submit a Plan of Action/Mitigation Plan and Milestones (POA&M) to the government for approval (Deliverable 6). The POA&M shall be in accordance the Federal Information Security Management Act (FISMA) Risk Management Framework (RMF) standards.

10.3.1.1. Information Assurance Contractor Training and Certification. The Contractor shall ensure that personnel accessing information systems have the proper and current information assurance certification to perform information assurance certification to perform information assurance functions in accordance with DOD 8570.01-M, Information Assurance Workforce Improvement Program.

10.3.1.1.1. DoD-approved information assurance workforce certifications appropriate for each category and level as listed in the current version of DoD 8570.01-M; and

10.3.1.1.2. Appropriate operating system certification for information assurance technical positions as required by DoD 8570.01-M.

10.3.1.2. Upon request by the Government, the Contractor shall provide documentation supporting the information assurance certification status of personnel performing information assurance functions.

10.3.1.3. Contractor personnel who do not have proper and current certifications shall be denied access to DoD information systems for the purpose of performing information assurance functions.

10.3.1.4. The Contractor shall maintain the database and related applications within Defense

Information System Agency (DISA) Security Technical Implementation Guidelines (STIG) requirements.

10.3.2. Repair and Support

The Contractor shall provide remedial repair and support services for FileMaker Pro Pathology Database.

10.3.2.1. The Contractor shall provide telephone support available Monday through Friday, 9:00am- 5:00pm eastern. An emergency line shall be available for after-hours calls.

10.3.2.2. The Contractor shall make all repairs or resolutions within five (5) business days from the date of incident report.

10.3.2.3. The Contractor shall maintain a log of all support calls with reported problem and resolutions.

10.3.3. Upgrades and Reconfigurations

The Contractor shall perform upgrades and reconfigurations to the FileMaker Pro Pathology Database.

10.3.3.1. The Contractor shall honor all requests to a maximum of sixty-four (64) hours per year. For any requests over this amount, the contractor shall notify the COR. These requests will be honored at the discretion of the contractor.

10.3.3.2. The Contractor shall perform the upgrades and/or reconfigurations with a mean time of 30 calendar days after the request.

10.3.3.3. The Contractor shall provide software training to include end-user training and updated training materials when changes are made to the application. Training may be conducted via conference call, computer conferences, and/or on-site training.

10.4. Management Reports and Plans

10.4.1. Monthly Report (Deliverable 2). The contractor shall provide a monthly report detailing the following: 1) all work done in support of this PWS, and 2) the log of support calls with reported problems and resolutions. If there were no support calls reported during the month, the log shall state this. This monthly report shall be delivered on the 5th of each month. Also see Section 12.d for GFE reporting.

10.4.2. Quality Control Plan (QCP) (Deliverable 3). The contractor shall provide a QCP no later than

15 calendar days after contract award. The contractor shall prepare and adhere to a QCP describing how the contractor intends to manage the contract to achieve the established standards set forth in the Performance Standards Summary Matrix and the contractor’s QCP. At a minimum, the QCP must include a self-inspection plan, an internal staffing plan, and an outline of the procedures that the Contractor will use to maintain quality, timeliness, responsiveness, and customer satisfaction.

10.4.3. Contract Manpower Reporting Application (CMRA) (Deliverable 4). This is a mandatory requirement IAW Army Federal Acquisition Regulation Supplement (AFARS) 5137.91, Accounting for Contract Services.

The contractor shall report ALL contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract for the WRAIR via a secure data collection site. The contractor is required to completely fill in all required data fields using the following web address: http://www.ecmra.mil.

Reporting inputs will be for the labor executed during the period of performance during each Government fiscal year (FY), which runs October 1 through September 30. While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year, beginning with 2018. Contractors may direct questions to the help desk at:

http://www.ecmra.mil/.

11. DELIVERABLES

The contractor shall complete and submit deliverables in accordance with the “Deliverables Table” below. Unless specified in the PWS within the description of the deliverable, all deliverables will be made to the COR electronically.

DELIVERABLES TABLE

PWS

Ref.

Number Title/Description Due

7.3 5.8

Deliverable 1 Training Certifications (to include registration in the ATCTS (Army Training Certification Tracking System) at commencement of services)

Training Cert - 30 calendar days after contract award

Registration in ATCTS -by contract start date

10.4.1 12.d

Deliverable 2 Monthly Report

5th of each month

10.4.2 Deliverable 3 Quality Control Plan

15 calendar days after start date

10.4.3 Deliverable 4 Contract Manpower Reporting

By October 31annually

7.2 15.8

Deliverable 5 Network Security/NACI Prior to commencement of work

10.3 Deliverable 6 Plan of Action/Mitigation with Milestones

POA&M

30 calendar days of notification by Government

11.1. Reports and Documents

Reports and documents delivered by the contractor in the performance of this contract shall be considered Technical Data as defined in the applicable DFARS clause 252.227-7015, Technical Data –Commerial Items.

All documentation shall reflect the latest version of the work product or activity, unless specifically directed otherwise by the Government. All documentation shall be prepared in accordance with (IAW) standard industry practices, ensuring electronically produced documents which reflect logical flow of material, tables of contents indexes and page numbering. Where applicable, the contractor’s attention is called to the availability of commercial, industry, federal, and military guides, instructions, and standards for many of the topics addressed in this PWS and under this contract.

11.2. Inspection and Acceptance

The COR delegated oversight of specific technical, functional and oversight responsiblities is responsible for inspection and acceptance of all services, deliverables, and documents. HOWEVER THE COR DOES NOT

HAVE THE AUTHORITY TO APPROVE ANY CONTRACTAL CHANGES OR OBLIGATE FUNDING.

Certification by the Government of satisfactory services provided is contingent upon the Contractor performing in accordance with the performance standards contained in the Performance Work Statement and all terms and conditions of this order, including all modifications.

PERFORMANCE REQUIREMENTS SUMMARY MATRIX

The Government intends to utilize a Quality Assurance Surveillance Plan (QASP) to monitor the quality of the Contractor’s performance in relation to performance objectives. The Government will finalize the QASP immediately following award, and a copy will be incorporated into the contract. The QASP is a living document and may be updated by the Government as necessary. Reference Attachment #2 “QASP.”

12. GOVERNMENT FURNISHED PROPERTY/EQUIPMENT

The Government will provide the following equipment/information/property:

Description ID or Serial # Quantity Estimated Value

Laptop Computer TBD 0-1 per FTE $2,500.00 each

FileMaker license/software TBD 1 $150 each

Additional Vendor-proposed Government-furnished equipment, if applicable if applicable if applicable if applicable

a. Laptop. The Government shall provide a laptop computer with remote access as required for off-site database support. The contractor shall be responsible for providing limited, external preventive maintenance of this equipment (i.e., keeping equipment clean and dust- and static-free). The Government shall provide all hardware, support equipment, and software for the computer system used during daily administrative use. The Government will replace Government-provided computer equipment as necessary.

b. CAC. The Government will issue a CAC by a Trusted Agent at WRAIR or the Cotnractor will be required to fill out a Form 25-2 and shall complete all required training to maintain access to the network.

c. License/software. License for FileMaker will be provided by the Government.

d. The Contractor shall maintain a detailed inventory accounting system for Government Furnished Equipment/Material or Contractor-Acquired-Government Owned Property (CAP). The inventory accounting system must specify, at a minimum: product description (make, model), Government tag number, date of receipt, name of recipient, location of receipt, current location, purchase cost (if CAP), and contract/order number under which the equipment is being used. The Contractor shall either: a) attach an update inventory report to each Monthly Progress Report (Deliverable 2), or b) certify that the inventory has been updated and is available for Government review. In either case the Contractor’s inventory listing must be available for Government review within one business day of Contracting Officer’s Representative (COR) request.

12. CONTRACTOR FURNISHED PROPERTY/EQUIPMENT

The contractor shall provide the office space for ALL proposed personnel.

13. CONTRACT MANAGEMENT

13.1. Government Management

The Contracting Officer’s Representative (COR) for this contract will be appointed by the Contracting Officer (KO). The COR will serve as the primary point of contact for all activities and issues that occur under this contract. HOWEVER THE COR DOES NOT HAVE THE AUTHORITY TO APPROVE ANY CONTRACTAL CHANGES OR OBLIGATE FUNDING. Only the KO has the authority to enact changes to this award and commit money.

13.2. Contractor Management

The contractor shall designate a single Contract Manager to be the contractor’s authorized point of contact (POC) with the COR. The Contract Manager shall be responsible for formulating and enforcing performance standards, assigning contractor schedules, reviewing performance quality, communicating policies, purposes, and goals to subordinates. This will include coordination with the KO and the COR to resolve any issues that may arise, trends relating to the contract, or proposed changes or modifications to the contract.

13.3. Contractor Organization

The contractor shall establish clear organizational lines of authority and responsibility to ensure effective management of the resources assigned to the requirement. The contractor shall ensure that all contractor personnel are advised of their chain of command and who they should contact if they have questions.

13.4. Subcontract management

13.4.1. The contractor is responsible for any subcontract management necessary to integrate services performed on this contract.

13.4.2. The contractor is responsible and accountable for subcontractor performance on this contract

13.4.3. The contractor is responsible to manage task distribution to ensure there are no OCI considerations

13.4.4. Contractor my add subcontractors to their team after notification and written approval from the

KO.

13.4.5. Privy of contract is with the contractor and the subcontractor.

13.5. Foreign Nationals

A foreign national can only be hired if they have a special skill that a US Citizen cannot be found to perform. A background investigation must be completed in its entirety before unescorted access to the facility is granted. Government computer access will not be approved until a background check is done in accordance with Section 7 and 15 of the PWS. Typically, a background check cannot be performed on a foreign national unless the individual has lived in the United States for three (3) of the last five (5) years.

14. COMPLIANCE DOCUMENTS

14.1. General Compliance

14.1.1. Federal Law

The services provided under this contract must be conducted in accordance with all Federal law, Department of Defense (DOD), Department of the Army (DA) and Medical Research and Material Command (USAMRMC) laws and command laws, regulations, policies, and procedures that govern the conduct of regulated research.

Federal regulations governing regulations for human subject’s protection are found in 45 CFR 46. The International Convention on Harmonization Guidelines for Good Clinical Practice is the standard governing the conduct of research trials. References for military regulations and policies governing regulated research may be found at https://mrmc.amedd.army.mil/rodorphrpo.asp.

14.2. Information Technology Compliance

14.2.1. Risk Management Framework

Department of Defense (DOD) Instruction 8510.01 Risk Management Framework (RMF) For DOD Information Technology (IT Department of Defense (DoD) Instructions 5400.11-R, Privacy Program http://www.dtic.mil/whs/directives/corres/pdf/540011p.pdf

15. OTHER TERMS, CONDITIONS, AND PROVISIONS

15.1. Non-Personal Services

This PWS identifies services that are strictly non-personal in nature, as defined by Federal Acquisition Regulation (FAR) Part 37, Service Contracting. To ensure there is no appearance of any personal services, the Government shall neither supervise contractor personnel nor control the method by which the contractor performs the required tasks. Under no circumstances shall the Government assign tasks or prepare work schedules for individual contractor personnel. It shall be the responsibility of the contractor to manage its personnel and to guard against any actions that give the perception of personal services. If the contractor believes that any actions constitute, or are perceived to constitute personal services, it shall be the contractor's responsibility to notify the Contractor Officer (KO) immediately.

15.2. Severable / Non-Severable Services

This requirement identifies services that are severable in nature.

15.3. Inherently Governmental Functions

This requirement has been reviewed and contains no services that are inherently governmental functions.

15.4. Dissemination of Information/Publishing

There shall be no dissemination or publication, except within and between the Contractor and any Sub Contractors or specified Integrated Product/Process Team (IPT) members who have a need to know, of information developed under this order or contained in the reports to be furnished pursuant to this order without prior written approval of the COR or the Contracting Officer.

15.5. Contractor Identification

The Contractor shall ensure that Contractor personnel identify themselves as Contractors when attending meetings, answering Government telephones, providing any type of written correspondence, or working in situations where their actions could be construed as official Government acts. Contractors may not use or allude to former or current military rank during the performance of this work.

15.6. Attendance at Meetings

Contractor personnel may be required to attend meetings or otherwise communicate with Government and/or other contract or assistance agreement representatives to meet the requirements of this order. Contractor personnel shall make their contractor status known during introductions.

15.7 Option: FAR 52.217-8 “Option to Extend the Term of the Contract” “The Government may require continued performance of any services within the limits and at the rates specified in the contract. These rates may be adjusted only as a result of revisions to prevailing labor rates provided by the Secretary of Labor. The option provision may be exercised more than once, but the total extension of performance hereunder shall not exceed six (6) months. The Contracting Officer may exercise the option by written notice to the Contractor within thirty (30) calendar days.”

In accordance with FAR 52.217-8, the Offeror shall have the ability to provide continuation of these support services for up to a period of six (6) months after the period of performance end date.

15.8 Network Security (Deliverable 5)

Contractor personnel requiring access to DoD networks to perform work under this contract must have a National Agency Check with Inquiries (NACI) or an open, pending investigation prior to commencement of work. If the Contractor has a pending investigation, the contractor must present a copy of this investigation to the WRAIR Security Manager at the time of in-processing for review and must contain no unfavorable information. The Contractor must maintain this level of security throughout contract performance. Citizenship will be verified by presenting an original birth certificate or a valid US Passport or the original Naturalization certificate to the WRAIR Personnel Security Manager at the time of in-processing for all contractor personnel assigned to the contract.

Contractor personnel shall use only Government-provided computer equipment (see also Section 12); and shall follow all applicable statutes, regulations and policies governing DoD, MEDCOM, USAMRMC, and WRAIR cyber security and information system assets. Personnel must provide proof of applicable training and certifications to include annual Cyber Awareness training. This training must be documented in the Army Training and Certification Tracking System (ATCTS) (Deliverable 1) unless otherwise authorized by applicable policies. DoD Information System, IT service, and IT product acquisition or development must also adhere to applicable policies as described below:

15.6.1. It is DoD policy that Cybersecurity requirements shall be identified and included in the design, acquisition, installation, operation, upgrade, or replacement of all DoD information systems. This includes systems and processes developed within the Defense Acquisition System; systems and processes developed at private expense; outsourced business processes supported by private sector information systems; and outsourced information technologies. Information technology services provided under this contract must comply with statutory and regulatory Information Assurance (IA) policy. The source documents for this policy are (available in the WRAIR regulatory repository for review):

a. The National Security Act of 1947

b. Title 40/Clinger-Cohen Act

c. Executive Order 12333, “United States Intelligence Activities,”

d. National Security Presidential Directive-54/Homeland Security Presidential Directive-23

e. Subchapter III of chapter 35 of Title 44, United States Code (also known as the “Federal

Information Security Management Act (FISMA) of 2002”)

f. National Security Telecommunications and Information Systems Security Policy No. 11, "Revised Fact Sheet National Information Assurance Acquisition Policy" and associated "Frequently Asked Questions"

g. National Institute of Standards and Technology (NIST) Special Publication (SP) 800-39

h. Federal Information Processing Standards

i. DoD Instruction 8500.01, “Cybersecurity,” March 13, 2014

j. DoD Instruction 8500.2, "Information Assurance Implementation"

k. DoD Instruction 8580.1, "Information Assurance in the Defense Acquisition System"

l. DoD Instruction 5000.02, “Operation of the Defense Acquisition System,”

m. DoD Directive 8570.01, "Information Assurance Training, Certification, and Workforce

Management"

n. Chairman of the Joint Chief of Staff Instruction 6510.01E, "Information Assurance (IA) and

Computer Network Defense (CND)"

o. Defense Acquisition Guidebook – Chapter 7 Acquiring Information Technology and

National Security Systems, Section 7.5 Information Assurance

p. DoD Instruction 8510.01, "Risk Management Framework (RMF) for DoD Information

Technologies"

15.6.2. Each proposal under this contract, will be screened for compliance with applicable Cybersecurity statutes, policies, and procedures. Specific requirements will be stated in the performance work statement/statement of objectives. This special contract provision shall be updated by reference for any changes to source documents. Any new laws or policies applicable to Cybersecurity subsequent to issuance of this contract will be incorporated into the basic contract unilaterally without equitable adjustment to the basic contract. Any equitable adjustment shall be assessed by individual contracts that may be affected by the change as applicable.

15.6.3. Non-US citizens are not being adjudicated for WRAIR trustworthiness determinations at this time. Non-US Citizens are not allowed access to DoD IT systems unless approved by an authority designated in Appendix 6, DoD 5200.2-R. Only US citizens shall be granted access and assigned to sensitive duties. Exceptions to these requirements shall be permitted only for compelling national security reasons (DoD 5200.2-R. C2.1.1, AP6.6.1).