180129_DRAFT_RFP_W91151-17-R-0039.docx

W91151-17-R-0039

Section SF 1449 - CONTINUATION SHEET

CLIN STRUCTURE

BASE LINE SERVICES IM DIRECTOR YEAR 1

FFP

FOB: Destination

PURCHASE REQUEST NUMBER: 0011138651

MAX

NET AMT

ABOVE BASE LINE YEAR ONE

MAX

CONTRACTOR MANPOWER YEAR ONE

MAX

CONTRACT TRANSITION (PHASE-IN)

MAX

TRAVEL YEAR ONE

MAX

OVERTIME YEAR ONE

MAX

BASE LINE SERVICES IM DIRECTOR YEAR 2

MAX

ABOVE BASE LINE YEAR 2

MAX

CONTRACTOR MANPOWER YEAR 2

MAX

TRAVEL YEAR 2

MAX

OVERTIME YEAR 2

MAX

BASE LINE SERVICES IM DIRECTOR YEAR 3

MAX

ABOVE BASE LINE YEAR 3

MAX

CONTRACTOR MANPOWER YEAR 3

MAX

TRAVEL YEAR 3

MAX

OVERTIME YEAR 3

MAX

BASE LINE SERVICES IM DIRECTOR YEAR 4

MAX

ABOVE BASE LINE YEAR 4

MAX

CONTRACTOR MANPOWER YEAR 4

MAX

TRAVEL YEAR 4

MAX

OVERTIME YEAR 4

MAX

BASE LINE SERVICES IM DIRECTOR YEAR 5

MAX

ABOVE BASE LINE YEAR 5

MAX

CONTRACTOR MANPOWER YEAR 5

MAX

TRAVEL YEAR 5

MAX

OVERTIME YEAR 5

MAX

WSMR ISOSS 5 YEAR RQMT PWS

PERFORMANCE WORK STATEMENT (PWS)

Information Systems Operations Service Support (ISOSS)

Part 1

General Information

1. GENERAL: This is a non-personnel services contract the Government shall not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn is responsible to the Government.

1.1 Description of Services/Introduction: The contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to provide Information Technology (IT) Management Support Services to maintain the Army’s Information System (IS) infrastructure, including to the desktop, and the Fast Burst Reactor (FBR) electronic security system (ESS) throughout the White Sands Missile Range (WSMR), New Mexico, as defined in this Performance Work Statement (PWS) except for those items specified as government furnished property and services. The contractor shall perform to the standards in this contract. The WSMR Information Management Directorate (IMD) leverages information technology to provide its staff and customers with the tools needed to efficiently perform their duties and contribute to WSMR’s mission success. The link between Information Technology and people is clear and the success of the organization depends greatly on its ability to integrate these two resources. IMD has a mission to provide network support to the White Sands Test Center, Garrison and various tenant commands, and future growth commands. To accomplish this mission, multiple IT disciplines are required to support the IT Infrastructure throughout WSMR.

1.1.1 Road Closures: Access roads to and within the boundaries for WSMR are subject to closing for live missile firings or other military operations. Roadblocks are normally one to two hours in duration. This does not relieve the contractor from performance of contractual responsibilities. Occasional rescheduling of work requirements may result due to missile firings or other military operations. It is the contractor’s responsibility to reschedule any and all work requirements due to roadblocks and evacuations. Roadblock information may be obtained by calling (575) 678-1178; information is recorded and subject to change without notice.

1.2 IT Background: One of the major missions of the WSMR IMD is to manage and maintain the IT infrastructure and manage the IT assets including but not limited to servers, workstations, notebook computers, tablets, switches, routers, Virtual Private Networks (VPN), Communications Security (COMSEC), public facing and internal web services, Information Assurance (IA), Cyber Security (CS), Intrusion Detection Systems (IDS), and a wide variety of IT services.

1.3 Objectives: The objective of the WSMR IT program is to provide a reliable, secure, efficient, effective, and technologically current IT infrastructure to support WSMR Directorates and other Tenants. WSMR desires a contractor who brings a mission focus to this program that can continuously identify methods for applying information technology to improve WSMR’s mission capabilities. WSMR requires a contractor at a maturity level that can bring not only the capability to install, operate, and maintain IT hardware and software components.

· Provide under a performance-based, fixed-price engagement, secure, highly reliable, and available IT infrastructure services.

· Continuously review, analyze, and take proactive measures to ensure that the Treasury IT infrastructure stays current with technological advances in the industry, while validating that infrastructure investments are aligned with the Treasury Strategic Plan and Treasury mission objectives.

· Develop and provide innovative solutions.

· Achieve and maintain compliance with Federal and Treasury IT management standards and requirements at all times throughout performance.

· Provide an efficient Help Desk solution for tier I through IV support.

1.4 Scope: The Incumbent shall provide all management, tools, material, equipment and labor necessary to provide non-personal services for IS operation and support services (ISOSS) to WSMR as defined in this Performance Work Statement (PWS).The technical scope of this PWS requires all technicians obtain and maintain commercial certification in accordance with DoDI 8570.1-M, Information Assurance Workforce Improvement Program, latest edition including any follow-on revisions, at the level consistent with duties assigned by the contractor management. Any individual filling a position under this PWS shall be fully certified before assuming duties under this PWS. The Information Systems Operations Service Support (ISOSS) PWS includes all networks located on WSMR including:

· Defense Research Evaluation Network (DREN)

· Secret DREN (SDREN)

· Test Support Network (TSN)-Red

· Test Support Network (TSN)-Black

· Secret Internet Protocol Router Network (SIPRNET)

· Non-Secure Internet Protocol Router Network (NIPRNET)

· Implement Operational Orders (OPORDS), Security Technical Implementation Guide (STIG), and other required updates/changes to system/security configurations as directed by government personnel.

1.5 Period of Performance: The total period of performance using a multiple year contract is 5 (five) years. The contract will not include option periods but does include FAR 52.217-8, Option to Extend Services.

1.6 General Information

1.6.1 Quality Control: The contractor shall develop and maintain an effective quality control program to ensure services are performed in accordance with this PWS. The contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The contractor’s quality control (QC) program is the means by which the contractor assures itself that their work complies with the requirement of the contract. A comprehensive Quality Control Plan (QCP) supporting the PWS requirements shall be required after award of the initial Task Order contract. The QCP shall be delivered to the COR for delivery to the Contracting Officer’s (KO) within 30 calendar days of contract award. In the event revisions are required, the contractor shall return the revised QCP within five (5) working days of receipt of notification to revise. After acceptance of the QCP, the contractor shall receive the KO’s acceptance in writing of any proposed change to the contractor’s QC system.

1.6.2 Quality Assurance: The government shall evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan. This plan is focused on what the Government must do to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

1.6.3 Recognized Holidays: The contractor is not required to perform services on these holidays unless specifically stated in assigned Task Orders (TO).

1.6.4 Hours of Operation: The majority of the WSMR workforce (both Civilian and Contractor) operate under a compressed work schedule consisting of four 9-hour days with core hours between 0700 – 1630 Monday thru Thursday and one 8 hour day on either the first or second Friday of the pay period with the alternate Friday as a non-work day. At a minimum, the Contractor is responsible for conducting business between the hours, 0700 – 1700, except Federal holidays or when the Government facility closes due to local or national emergencies, administrative closings, or similar Government directed facility closings, or as specified in section 5 of the PWS. Outside the core working hours noted herein, some facilities may not be accessible and reduced Government oversight may limit Contractor access. The contractor will not receive reimbursement when the Government closes facilities for the reasons stated herein. Exceptions shall be worked through the COR and where necessary the KO. No contractor employee shall work more than nine hours per day without written authorization for Overtime from the COR. Personnel providing direct test support shall work a variable tour of duty as identified by Range Mission. The Contractor at all times shall maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS. The PWS defines above baseline services as reimbursable and therefore no cross-utilization of personnel between Baseline and Above Baseline Staffing or between Above Baseline Staffing to other Above Baseline sections is authorized without prior approval from the COR/KO.

1.6.5 Place of Performance: The primary location for the performance of this contract will be the cantonment area at White Sands Missile Range, NM. However, responsibility for support under this PWS covers the entire WSMR area. This also includes support for System of Systems Engineering and Integration (SOSE&I) offices located at Fort Bliss, TX.

1.6.6 Type of Contract: The Government will award an Indefinite Delivery Indefinite Quantity (IDIQ) contract with five yearly ordering periods, concurrently, with the first funded Task Order for ISOSS requirements. Subsequent Task Orders will be issued as required.

1.6.7. Security Requirements: Contractor personnel must obtain an appropriate security clearance, depending on assigned positions, prior to assignment and maintain eligibility for the designated clearance level throughout their tenure. For instance, Systems Administrator or other personnel with elevated privileges must possess a Secret Clearance. See Army Regulation (AR) 25-2, Information Assurance for details. The security requirements are in accordance with the attached DD254.

1.6.7.1. Classified Information: Questions regarding CLASSIFIED information shall be handled through the White Sands Test Center Security (WSTC) Office. Specifically, any entity wanting to ask a question regarding CLASSIFIED information shall send an email to the WSTC Security Office, the Technical POC and the Business POC stating that the entity would like to ask a question regarding CLASSIFIED information. DO NOT EMAIL ANY QUESTIONS THAT MAY CONTAIN CLASSIFIED I NFORMATION. The Security POC will contact the entity and arrange for the question pertaining to CLASSIFIED information be asked through a secure method of communication.

1.6.7.2. Access and general protection/security policy and procedures: Contractor and all associated sub-contractors employees shall provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services or Security Office. Contractor workforce must comply with all personal identity verification requirements (FAR clause 52.204-9, Personal Identity Verification of Contractor Personnel) as directed by DOD, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

a. Installation Exercises and Scheduling: The Contractor shall work closely with the KO and/or the COR regarding who has access to the Installation training schedule. The Contractor shall schedule work/deliveries accordingly. Contractors shall as part of the exercise be required to provide an accountability of personnel to the KO and/or the COR of numbers of employees on hand and locations.

b. Unauthorized weapons/firearms: No Contractor, sub-contractor, or affiliate shall bring Privately Owned Weapons/Firearms on the Installation.

c. Search and Seizure: Contractor personnel and property shall be subject to search and seizure in areas the Contractor is providing official support duties and upon entering, while on, or upon leaving the confines of WSMR.

d. Operational Delays Because of Threat, Disaster, Weather, or Operational Testing: The Senior Mission or Garrison Commander, because of an increase in threat, disaster, inclement weather or operational testing, may require the installation to curtail operations, limiting access to essential government employees only, block/restrict movement on major roads on or leading to WSMR, or close the installation. The contractor cannot hold the US Government or the Command at the installation responsible for cost overruns because of these operational decisions.

1.6.7.3. Issuing New Common Access Card (CACS): Before CAC issuance, the Contractor employee requires, at a minimum, a favorably adjudicated Tier 1 (T1) or an equivalent or higher investigation in accordance with Army Directive 2014-05. The Government will issue a Contractor a CAC only if duties involve one of the following:

a. Both physical access to a DoD facility and access, via logon, to DOD networks on-site or remotely

b. Remote access, via logon, to a DOD network using DOD-approved remote access procedures

c. Physical access to multiple DOD facilities or multiple non-DOD federally controlled facilities on behalf of the DOD on a recurring basis for a period of 6 months or more.

At the discretion of the sponsoring activity, an initial CAC may be issued based on a favorable review of the FBI fingerprint check and a successfully scheduled T1 investigation at the Office of Personnel Management.

1.6.7.3.1. CAC Issuance: The contractor, through their human resources or personnel office, will send the government COR a request for a CAC card if required. The application for the CAC card is normally obtained through the Trusted Associate Sponsorship System (TASS) website. The on-line application will be submitted in the TASS by the contractor to the COR. Contractor CAC card and WSMR Network access require an NACI (National Agency Check with Written Inquiries) Investigation using the SF 85P form. The COR will approve the application and process for issuance. In order to acquire the CAC card the contractor employee shall present a current Federal or State photo identification (such as a driver’s license) and proper identification with their social security number. The contractor is responsible for accountability of the CAC card and must return it to the COR upon request or when the employment for an individual ends. Lost CAC cards must be reported to the COR with an account of the circumstances and explanation of actions to prevent reoccurrence prior to issuance of a replacement card.

1.6.7.3.2. Access Without a CAC: For Contractors that do not require a CAC, but require access to a DOD facility or installation, the Contractor and all associated sub-contractor employees shall comply with adjudication standards and procedures:

a. National Crime Information Center Interstate Identification Index (NCIC-III)

b. Terrorist Screening Database (TSDB) (Army Directive 2014-05/AR 190-13)

c. Applicable Installation, facility and area commander installation/facility access

d. WSMR security policies and procedures

e. Status of forces agreements and other theater regulations while in OCONUS locations

1.6.7.3.3. Alternate Credential Issuance: All contractor employees that will not require CAC will be required to possess an alternate form of installation access ID credential. The specific list of approved credentials and procedures for obtaining them are identified in Memorandum for See Distribution, Subject White Sands Missile Range Visitor Control Program and attached annexes, Dated 29 January 2015 or subsequent updates. This publication may be provided at the contractor’s request.

1.6.7.3.4. Departing Employees: The Contractor shall ensure all permanently (and temporarily when in excess of 30 days) departing Contractor or subcontractor employees return security photographic identification cards, permits, CAC’s, Government property, keys, photo passes, and range passes. The Contractor shall request cancellation of Local Area Network (LAN) email access for departing personnel at the completion of their employment. The Contractor shall utilize a company / Installation clearance (out-processing) form to include a signature block for the COR to certify that an employee has returned all required badges, CACs, keys, and other accountable items. The Contractor shall return keys to the issuing key custodian prior to the employee departing. Depending on the position, information access, and clearance level, a Contractor may require a security debriefing prior to departure.

1.6.7.4. Initial, Annual, and Program Specific Security Training: Government furnished and required security training includes Initial (New Hire) and Annual Information Assurance, iWATCH, Antiterrorism, OPSEC, Threat Awareness and Reporting Program (TARP) Training, and any other command mandated training. The mentioned training is at no cost to the contractor.

Contractors shall complete the following Security training within 30 calendar days of contract award and within 15 calendar days of new employees commencing performance with the results reported to the KO Representative no later than 45 calendar days after contract award.

a. iWATCH Program

b. AT Level 1 annual training

c. OPSEC Awareness annual training These trainings shall be tracked or documented using either hard copy sign in sheets, online-automated tracking programs, or Common Access Card (CAC) Verification. The method of tracking will be identified to the Contractor through the COR prior to start of the training activity. There are program specific trainings in the area of AA&E, INFOSEC, COMSEC and other security disciplines that shall be identified and tracked by the Program/Project Manager.

a. ATEC Contractor Security Training Tracking: Part and full time permanent employees requiring either WSMR Network access, installation access in excess of six months or both shall be required to complete all security-mandated trainings assigned and tracked through the ATEC Training Tracker Module (ATTM). The COR and the Government Training Coordinator log Contractor personnel and training requirements.

b. NON-ATEC Contractor Security Training Tracking: Casual, temporary, and those employees that do not have WSMR Network access shall be required to complete all assigned security trainings assigned through the ATTM to those employees identified above. The FSO and the G-2 Industrial Security Officer (ISO) shall coordinate the delivery and tracking method. Annually (last week of August) a report of all such employees, identifying the completion date of each training event by each employee shall be provided to the WSTC ISO.

c. New Employee Orientation: New Contractor employees require security training within thirty (30) days of start date. For the purposes of security training events, a new hire shall be defined as an employee that is newly hired to the Contractor or is returning after a break in employment in excess of one year. If an employee was previously a service member, civil servant, or employed with another Contractor assigned to or contracted by the WSMR/ATEC Command and did not have a break in service in excess of one year they shall not be considered a new hire. The Contractor, the Government Training Coordinator, the COR, the FSO, and the ISO are responsible for tracking Contractor security training requirements.

d. AT Awareness Training for Contractor Personnel Traveling Overseas: The Contractor and associated sub-contractor employees shall receive Government provided area of responsibility (AOR) specific AT awareness training as directed by AR 525-13. When OCONUS, the Contractor shall participate in specific AOR training content as directed by the Combatant Commander with the unit ATO being the local point of contact.

1.6.7.5. Threat Awareness Reporting Program: Per AR 381-12 Threat Awareness and Reporting Program (TARP), contractor employees must receive annual TARP training by a CI agent or other trainer as specified in 2-4b of AR 381-12.

1.6.7.6. Facility Clearance: The approved Contract Security Classification Specification, DD Form 254 governs on-site activities performed under the organization's facility clearance. The DD Form 254 issued to the Contractor with this PWS provides instructions for the safeguarding of classified information. The Contractor shall comply with FAR 52.204‐2, Security Requirements. This clause involves access to information classified Top Secret and requires Contractors to comply with:

a. The Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (DoD 5220.22‐M); any revisions to DoD 5220.22‐M, notice of which has been furnished to the contractor.

b. The Contract Security Classification Specification (DD Form 254).

c. DoD 5200.1, Volumes 1-4. DoD Information Security Program

d. AR 380-5, Department of the Army Information Security Program

1.6.7.7. Personnel Security Clearance: The Contractor shall apply for security clearances for Contractor personnel within ten (10) workdays after contract award for all personnel that are required to perform services at the confidential level or above. The Contractor shall initiate security clearance action in accordance with the National Industrial Security Program Operating Manual (DOD 5220.22.M). Employees with security clearances shall maintain the clearance level throughout the duration of their employment. Failure of the Contractor to manage or maintain personnel with proper security clearances does not relieve the Contractor from providing sufficient personnel with expertise to perform the services required by the PWS. Personnel who have not received security clearances shall not:

a. Be granted access to classified information

b. Be allowed to perform classified work

c. Be granted access to restricted areas, unless escorted by a person having proper clearance and authorization

d. Handle Arms, Ammunition, and Explosives (AA&E) material, keys, or data Failure of the contractor to manage or maintain personnel with proper security clearances does not relieve the contractor from providing sufficient personnel with expertise to perform the services required by the Performance Work Statement.

1.6.7.8. Facility Security Officer: The FSO shall have at least 4 years industrial security experience, hold a minimum of a secret security clearance, and meet training qualifications IAW the Defense Security Service.

1.6.7.8.1. The FSO shall provide the WSMR Personnel Security Manager (PSM) with a list of all personnel, "Owned" or "Serviced" through the Joint Personnel Adjudication System (JPAS) and assigned to this contract within ten (10) workdays after contract award. The Contractor shall provide a monthly update to the COR and PSM by the first Wednesday of each month. The FSO will maintain an "Owning" relationship with all personnel employed by the prime contractor and a "Servicing" relationship with all sub-contractor personnel. The Government maintains these relationships for personnel in possession of a security clearance and those with a NACI T1 background check investigation for the purposes of CAC issuance.

1.6.7.9. Antiterrorism Requirements: The Contractor shall comply with Antiterrorism/Force Protection (AT/FP) requirements IAW:

a. AR 525-13, Antiterrorism

b. WSMR Installation AT Plan,

c. OCONUS Travel Briefs

d. Preparation of the Contractor’s Organizational Consolidated Force Protection, Security, and Evacuation Plans

e. Conduct of the WSMR Random Antiterrorism Measure Program

1.6.7.9.1. AT Level I Training: All contractor employees, to include subcontractor employees, requiring access Army installations, facilities and controlled access areas shall complete AT Level I awareness training within 30 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee, to the COR or to the KO (if a COR is not assigned), within 30 calendar days after completion of training by all employees and subcontractor personnel. AT level I awareness training is available at the following website: http://jko.jten.mil

1.6.7.9.2. AT Awareness Training for Contractor Personnel Traveling Overseas: Reserved

1.6.7.9.3. iWATCH TRAINING: The contractor and all associated sub-contractors shall brief all employees on the local iWATCH program (training standards provided by the requiring activity ATO). This locally developed training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the appropriate personnel. This training shall be completed within 30 calendar days of contract award and within 15 calendar days of new employees commencing performance with the results reported to the COR no later than 45 calendar days after contract award.

1.6.7.10. Foreign Interaction and/or Disclosure: The Contractor shall comply with:

a. AR 380-10, Foreign Disclosure and Contacts with Foreign Representatives

b. DOD 5230.11, Disclosure of Classified Military Information to Foreign Governments and International Organizations

c. DOD 5230.20, Visits, Assignments, and Exchanges of Foreign Nationals

d. WSMR Standard Operating Procedures, Foreign National Personnel Visits/Foreign Disclosure Under no circumstances shall the Contractor disclose data or information gathered in the execution of this contract without express written direction or permission from the Government.

1.6.7.11. Performance or Delivery in a Foreign Country: Reserved

1.6.7.12 Reserved

1.6.7.13. OPSEC Requirements: The Contractor shall comply with the Operations Security (OPSEC) requirements IAW:

a. AR 530-1, Operations Security

b. US ATEC Policy Bulletin 14-12

c. WSMR OPSEC Standard Operating Procedure

d. WSMR OPSEC Plan,

e. OPSEC review and approval of Government / Research, Development, Test and Evaluation (RDT&E) information prior to its public release

1.6.7.13.1. OPSEC Training: Per AR 530-1 Operations Security, the contractor employees must complete Level I OPSEC Awareness training. New employees must be trained within 30 calendar days of their reporting for duty and annually thereafter.

1.6.7.14. Physical Protection of Government Assets: The Contractor shall comply with conventional key and lock requirements under AR 190-51, Security of Unclassified Army Property (Sensitive and Non-sensitive) and WSMR Reg. 190-6 for those facilities, areas, and equipment not governed by AA&E or NISPOM guidance (e.g., office space that does not process or store classified or AA&E material).

1.6.7.15. Arms, Ammunition, and Explosives (AA&E) Material: Reserved

1.6.7.16. Requirements for Unclassified//For Official Use Only (FOUO) Handling Instructions. (If not present on a DD Form 254) / Protecting "For Official Use Only” (FOUO) Information: Reserved

1.6.7.17. CyberSecurity Training / Certification:

1.6.7.17.1. CyberSecurity (CS) Training (User Level Access):

a. All Contractor personnel with access to Government information systems and networks shall successfully complete all required CS awareness training as specified in AR 25-2 and as specified by the Government requiring activity. This includes training mandated in Army CIO / G6 ALARACT message 293/2007, Subject: Implementation of Standard DoD IA Awareness Training, dated 261800Z Dec 07. Training is available at https://ia.signal.army.mil.

b. Contractor employees and subcontractor employees performing work under this contract who have access to Government information systems and networks shall create a user account and profile in the Army Training and Certification Tracking System website (ATCTS) at https://atc.us.army.mil, in the unit container managed by the COR. Certificate of successful completion of CS training (DoD Cyber Awareness Challenge Training), Acceptable Use Policy (AUP), and DD Form 2875 – System Authorization Access Request (SAAR), shall be uploaded to the ATCTS and provided to the COR for continuous compliance monitoring and reporting.

c. The Contractor shall ensure that all contractor employees and subcontractor employees requiring CS awareness training, DoD Cyber Awareness Challenge Training, complete the training at the start of work performance on this contract and annually thereafter for the duration of this contract and require employees to maintain their information in a ‘current’ status at the ATCTS website.

d. The Contractor shall ensure that all contractor employees and subcontractor employees performing work under this contract who have access to Government information systems and networks, upon having completed the above referenced requirements for User Level Access, have been issued common access cards (CAC) and / or SIPR tokens for user authentication. Violations of the individual use of the issued and authorized means of authentication will be treated as a security violation and may terminate the contract.

1.6.7.17.2. CyberSecurity (CS) Training / Certification (Technical Level Access):

a. All Contractor personnel with access to Government information systems and networks shall successfully complete all required CS awareness training, DoD Cyber Awareness Challenge Training, as specified in AR 25-2 and as specified by the Government requiring activity. This includes training mandated in Army CIO / G6 ALARACT message 293/2007, subject: Implementation of Standard DoD IA Awareness Training, dated 261800Z Dec 07. Training is available at https://ia.signal.army.mil.

b. Contractor employees and subcontractor employees performing work under this contract who have access to Government information systems and networks shall create a user account and profile in the Army Training and Certification Tracking System website (ATCTS) at https://atc.us.army.mil, in the unit container managed by the COR. A certificate of successful completion of CS training (DoD Cyber Awareness Challenge Training), Acceptable Use Policy (AUP), DD Form 2875 – System Authorization Access Request (SAAR)s, Privileged Access Agreement (PAA), Appointment Orders, applicable baseline and computing environment certifications, and continuing professional education credits, as required by DoD 8570.01-M, shall be uploaded to the ATCTS and provided to the COR for continuous compliance monitoring and reporting.

c. The Contractor shall ensure that all contractor employees and subcontractor employees requiring CS awareness training, DoD Cyber Awareness Challenge Training, complete the training at the start of work performance on this contract and annually thereafter for the duration of this contract and require employees to maintain their information in a ‘current’ status at the ATCTS website.

d. The Contractor shall ensure that all contractor employees and subcontractor employees performing work under this contract who have elevated access to Government information systems and networks, upon having completed the above referenced requirements for Technical Level Access, have been issued common access cards (CAC) and / or SIPR tokens for user authentication and secondary authentication tokens tied to their technical level permissions. Violations of the use of the issued and authorized means of authentication will be treated as a security violation and may terminate the contract.

e. DFARS clause 252.239-7001 (Cyber Security Contractor Training and Certification) applies to this contract. This contract is subject to the mandates of DoD 8570.01-M, which establishes baseline technical and management CS skills for personnel performing CS functions within DoD. Functions spanning multiple levels require certification of the highest-level functions. Contractor personnel performing functions in multiple categories or specialties shall hold certifications appropriate to the functions performed in each category or specialty.

f. The Contractor shall ensure its IT (CS) workforce members have the baseline certifications corresponding to their IT (CS) functions, as defined in Chapters 3, 4, 5, 10, and 11, and Appendix 3 of DoD 8570.01-M at work performance start date. Contractors will obtain all required Computing Environment (CE) certificates within 6 months of being engaged. The IAT Level I baseline certification is the minimum requirement for unsupervised privileged access. The Contractor shall ensure that all employee certifications remain active and are renewed prior to expiration.

g. The Contractor shall ensure that all employees’ CS certifications are released to the Department of Defense through the Defense Workforce Certification Application at https://www.dmdc.osd.mil/appj/dwc/index.jsp.

h. Table 1 reflects the Personnel Security (IT Level) and CS Workforce Specialty requirements, aligning the CS functional responsibilities and access levels to the contract tasks, in accordance with DoD 8570.01-M.

Table 1. Information Technology (IT) Access and CS Certification Requirements.

(IAW AR 25-2)

Minimum Security Clearance

i. All personnel responsible for implementing the IAVM process will join the Army IAVM Community Group on Army Knowledge Online (AKO) or current notification group to receive vulnerability and patching messages.

j. The interim assignment of contractor personnel fulfilling IT positions will be restricted and implemented only upon documentation in the Risk Management Framework (RMF) Security Authorization Package (SAP) and acceptance of the Authorizing Official (AO) and the KO evaluations on a case‐by‐case basis.

k. Contractor personnel occupying an IT position will be subject to a periodic reinvestigation according to existing contract, labor relations, or personnel security policy.

l. Contractors supporting CS functions will meet the background investigation requirements in accordance with AR 25‐2 (see Table 2 and Table 3).

Table 2. Investigative levels for users with privileged access (IT‐I) to ISs

Privileged access — IT‐I 1

CTR

Conditions or examples

SSBI

With CIO/G‐6 written approval, contractors may continue as CS personnel until replaced

SSBI

Contractor may not fill MSC, installation, or post ISSM position

SSBI

Contractor may not fill MSC, installation, or post ISSO/ISNO/ISNE position (if created)

Table 3. Investigative levels for users with limited privileged access (IT‐II) to ISs

Limited privileged access — IT‐II 1

(see note 2)

Supervisor of IT I or IT II positions

Notes:

1. Investigative levels are defined in DOD 5200.2‐R. FN refers to all individuals who are non‐U.S. citizens, including U.S. military personnel, DOD civilian employees, and contractors.

2. FN — under the immediate supervisor of a U.S. citizen.

m. Contractor personnel supporting CS functions in accordance with DoD 8570.0‐ M shall provide verification to the Defense Eligibility Enrollment System (DEERS). In addition, all contractor positions supporting CS functions will be assigned a CS workforce Category, Specialty and IT Level code in the contract. These codes must be identified by the contractor to Defense Manpower Data Center (DMDC). Contractor personnel must also have their CS certification and function level documented in DMDC supported applications. They will also register for an ATCTS account in accordance with current guidelines.

1.6.7.18. Non-Government-owned Computing Systems or Devices:

The Contractor shall comply with AR 25-1 and AR 25-2. The Contractor shall not install or connect non-Government-owned computing systems or devices to Government networks without the COR's coordinating and obtaining proper authorization from the appropriate Command or Local level Information Systems Security Manager (ISSM), ensuring that all software has a Government Certificate of Networthiness. The non-Government-owned computing systems or devices include, but are not limited to, personal or Contractor-owned thumb drives (e.g., memory sticks, flash drives, Universal Serial Bus (USB) drives, jump drives, pen drives), removable or external hard drives, Personal Digital Assistants (PDA), PC Cards / Express Cards, MP3 players, cell phones, digital media, floppy disks, compact disc (CD) / digital video disk (DVD) burners, optical recordings, photo flash cards, laptops, cameras or any devices that can store data.

1.6.7.19. Protection of Sensitive Unclassified Data / Personally Identifiable Information (PII): The Contractor shall ensure any sensitive information, including, but not limited to, Personally Identifiable Information (PII) and For Official Use Only (FOUO), proprietary, and Law Enforcement (LE) Sensitive information residing on Mobile Computing Devices (MCD) or other external media, is protected in accordance with current Data at Rest (DAR) guidelines and requirements. The Contractor shall use an authorized, approved, and prescribed DAR solution. The MCDs include, but are not limited to, laptop, netbook, notebook, or tablet computers, and Blackberry or equivalent devices. External media include optical disk media such as CDs, DVDs, USB drives (also referred to as flash or thumb drives) (when authorization to use them is restored), floppy disks, and other portable digital storage devices. Guidance for protecting DAR information appears in DoD Policy Memorandum, 3 Jul 07, subject: Encryption of Sensitive Unclassified Data-at-Rest on Mobile Computing Devices and Removable Media and in DoD Component implementing instructions.

1.6.7.20. Appropriate Appearance/Conduct: Contractor personnel shall conform to standards of conduct and code of ethics, which are consistent with those applicable to Government employees as provided in the Joint Ethics Regulation 5500.7.R. Contractor personnel shall present a neat professional appearance and be easily identified. This shall be accomplished by wearing distinctive clothing bearing the company name or by wearing appropriate badges that contain the company name and employee’s name.

1.6.7.21. Conduct of Personnel: The contractor and their employees, to include subcontractors, shall observe and support all policies, rules and regulations issued by the local installation commander pertaining to safety, fire prevention, sanitation, severe weather, use of tobacco, admission to the installation, and conduct of operations. The Government may require the contractor to remove any employees from the work site based on misconduct, security violations, use of incapacitating agents, or any other reason determined to be in the Government’s best interest. The installation commander has the authority under 18 U.S.C. § 1382: US Code - Section 1382: Entering military, naval, or Coast Guard Property, to bar individuals from the installation.

1.6.7.22. Reserved

1.6.8. Special Qualifications:

1.6.8.1. Cyber Security/Information Assurance Contractor Training and Certification: The Contractor shall ensure that personnel accessing information systems have the proper and current information assurance certification (IAT Level II or IAT Level III) to perform information assurance functions in accordance with DoD 8570.01-M, Information Assurance Workforce Improvement Program. The Contractor shall meet the applicable cyber security / information assurance certification requirements, including:

a. DoD-approved CS / IA workforce certifications appropriate for each category and level as listed in the current version of DoD 8570.01-M; and

b. Appropriate operating system certification for information assurance technical positions as required by DoD 8570.01-M.

c. Upon request by the Government, the Contractor shall provide documentation supporting the CS / IA certification status of personnel performing information assurance functions.

Contractor personnel who do not have proper and current certifications shall be denied access to DoD information systems for the purpose of performing information assurance functions

1.6.8.2. Personnel Security Standards (AR 25-2): The following standards designate positions requiring access to IT and for processing information within IT systems.

These security designations are required to distinguish potential adverse effects on Army functions and operations and, therefore, the relative sensitivity of functions performed by individuals having certain privileges. These positions are referred to as IT and IT-related positions. The requirements of this section will be applied to all IT and IT-related positions, whether occupied by DA civilian employees, military personnel, consultants, contractor personnel, or others affiliated with the DOD (for example, volunteers). Additional guidance is available in DOD 5200.2–R.

1.6.8.2.1. Basic Requirements: Personnel requiring access to ISs to fulfill their duties must possess the required favorable security investigation, security clearance, or formal access approvals, and fulfill any need-to-know requirements.

1.6.8.2.2. IT-I:

Defined as:

a. Personnel in CS/IA positions (for example, SAs/NAs for infrastructure devices, IDSs, VPNs, routers; SAs/NAs for classified systems and devices) with privileged-level access to control, manage, or configure CS / IA tools or devices, individual and networked IS and devices, and enclaves.

b. Favorable completion of a National Agency Check (NAC) (current within 180 calendar days).

c. Initiation of a Single Scope Background Investigation (SSBI) and favorable review of SF 85P - Questionnaire for Public Trust Positions, SF 86 - Questionnaire for National Security Positions, and Supplemental Questionnaire.

1.6.8.2.3 IT-II:

Defined as:

a. Personnel in CS/IA positions (for example, operating system administration of common network applications or enclaves, back-up operators) with limited privileged-level access to control, manage, or configure ISs and devices, with very limited (single device) or no IA device access or management.

b. A favorable review of local personnel, base/military, medical, and other security records as appropriate.

c. Initiation of a National Agency Check with Credit Check and Written Inquiries (NACIC) (for civilians) or a National Agency Check with Local Agency and Credit Checks (NACLC) (for military and contractors), as appropriate or favorable review of SF 85P and Supplemental Questionnaire.

1.6.8.2.4. IT-III:

Defined as:

a. Personnel in CS / IA positions, for example, power users or a SA on individual systems for configuration or management with limited privileged-level access to that IS(s) or device(s). This is a position of higher trust.

Personnel with roles, responsibilities, and access authorization of normal users with non-privileged level access to the IS or device.

Personnel with non-privileged level access authorization in the role of official or statutory volunteers. The provisions for statutory volunteers are covered in AR 608–1.

b. A favorable review of local personnel, base and military, medical, and other security records, as appropriate.

c. Initiation of a NACIC (for civilians) or national agency check (NAC) (for military and contractors), as appropriate and favorable review of SF 85P and Supplemental Questionnaire.

1.6.8.3. Reserved

1.6.9 Post Award Conference/Periodic Progress Meetings: The Contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation Subpart 42.5. The KO, Contracting Officers Representative (COR), and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor's performance. At these meetings the KO will apprise the contractor of how the government views the contractor's performance and the contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the government.

1.6.10 Contracting Officer Representative (COR): The (COR) will be identified by separate letter. The COR monitors all technical aspects of the contract and assists in contract administration The COR is authorized to perform the following functions: assure that the Contractor performs the technical requirements of the contract: perform inspections necessary in connection with contract performance: maintain written and oral communications with the Contractor concerning technical aspects of the contract: issue written interpretations of technical requirements, including Government drawings, designs, specifications: monitor Contractor's performance and notifies both the KO and Contractor of any deficiencies; coordinate availability of government furnished property, and provide site entry of Contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the Contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting order.

1.6.11 Key Personnel:

a. Program Manager - The Program Manager plans, conducts, oversees, and is responsible for all work performed under this contract. The Program Manager shall be a responsible company official with authority to obligate the company with regard to contractual and financial matters. The Program Manager is the primary liaison with designated Government Representatives, and must have a technical and administrative grasp of all contractual requirements. The Program Manager organizes, plans, schedules, and controls all support and engineering work.