PWS Assessment and accreditation Support for DOD.pdf

Performance Work Statement (PWS)

Assessment and Accreditation Support for DoD SCIF (via

DIA)

1.0 PURPOSE

This Performance Work Statement (PWS) outlines the requirements for contractor support in the assessment, documentation preparation, and final accreditation support of a Sensitive Compartmented Information Facility (SCIF) in accordance with Intelligence Community Directive (ICD) 705 and applicable Department of Defense (DoD) policies.

2.0 BACKGROUND

The Center for Countermeasures (CCM) has constructed a SCIF facility to support national security missions. Accreditation must be obtained through the DIA Accrediting Official. The SCIF must meet all applicable security construction, physical security, TEMPEST, and technical security requirements.

In order to support mission-critical operations, CCM requires the SCIF to achieve full accreditation through DIA no later than Fall 2026. Timely accreditation is essential to ensure operational readiness and to enable secure handling and analysis of classified information in support of upcoming national security priorities.

3.0 SCOPE

This PWS defines the requirement for technical inspection, assessment, documentation development and review, and support services necessary to achieve full DIA accreditation of an ICD 705 SCIF facility. Services shall include on-site assessments, evaluation of ICD 705 construction elements, and support for the preparation and completion of accreditation documentation.

4.0 APPLICABLE DOCUMENTS

• ICD 705: Sensitive Compartmented Information Facilities

• ICS 705-01, Physical and Technical Security Standards for

SCI Facilities

• ICS705-02, Standards for Accreditation and Reciprocal Use of SCI Facilities

• ICD 705 Technical Specifications for Construction and

Management of SCI Facilities V 1.5.1

• TEMPEST standards

5.0 TASKS

5.1 SCIF Facility Assessment

The contractor shall perform an inspection and assessment of an existing ICD 705 facility to determine deficiencies from Intelligence Community Directive (ICD) 705 standards. The assessment will include:

• Review of as-built and record blueprints

• Review of pre-accreditation documentation

• Conduct a physical, on-site inspection of the site, with specific emphasis on ICD 705 construction requirements including but not limited to:

1. High security doors and hardware

2. Intrusion detection systems (IDS)

3. Access control systems (ACS)

4. CCTV systems design and installation locations

5. Physical hardening, e.g., Anti-Terrorism Force

Protection (ATFP)

6. Acoustical protection (Sound Transmission Class or

Noise Isolation Class)

7. Radio Frequency (RF)/Electromagnetic (EM) shielding, doors, and/or window film (as applicable).

8. TEMPEST requirements, including but not limited to dielectric/non-conductive breaks, grounding, filtering, and physical separation (CNSSAM TEMPEST 1/13).

9. Attend/participate in virtual meetings for project

All findings shall be documented in a facility assessment report identifying discrepancies, corrective actions, and recommendations.

5.2 SCIF Accreditation Support

The contractor shall provide both on-site and remote support to assist with preparation and finalization of required DIA accreditation documentation for successful accreditation of the ICD 705 space, including but not limited to:

• Completion of Final Fixed Facility Checklist, with associated supporting documentation

• Completion of Final TEMPEST Checklist, with associated supporting documentation

• Standard Operating Procures (SOPs) required for accreditation

• Emergency Action Plans (EAPs) required for accreditation

• Organization and compilation of the complete SCIF

Accreditation Binder per DIA guidelines

• Provide remote and/or on-site assistance for any required accreditation and remediation documentation re-submission requirements.

5.3 MONTHLY STATUS REPORTS

The contractor shall submit a written Monthly Status Report (MSR) by the 5th day of the month following the reporting period.

Each MSR must summarize activities completed during the reporting month; identify any issues encountered along with recommended or proposed solutions; and outline planned activities for the upcoming reporting period. Reports shall be delivered electronically to the Contracting Officer’s Representative (COR), the CCM Security Manager and the CCM Security Specialist.

6.0 TRAVEL

Travel is anticipated for this effort. The contractor shall be required to travel during the performance of this contract to perform ICD 705 facility inspections and assessments or to provide support in the development and review of SCIF accreditation documents.

The contractor will be authorized travel expenses consistent with the substantive provisions of the Joint Travel Regulation (JTR) and the limitation of funds specified in this contract. The Government anticipates two (2) trips will be required to support this contract.

7.0 PLACE OF PERFORMANCE

Work in support of this effort will be performed at the SCIF site location, at the contractor’s facilities, or other locations, as required.

The Government will provide access to the facility, all documentation, facility schematics, and necessary systems required to perform duties under this contract.

8.0 PERIOD OF PERFORMANCE

The contractor shall provide support for a period of twelve (12) months commencing upon contract award.

9.0 PERSONNEL QUALIFICATION AND SECURITY

REQUIREMENTS

Contractor personnel shall possess an active Top Secret security clearance with eligibility for access to Sensitive Compartmented Information (SCI). All work shall be performed in compliance with applicable security directives, regulations, and guidance.

The contractor shall provide personnel with appropriate experience and expertise in ICD 705 compliance, SCIF construction assessment, TEMPEST standards and SCIF accreditation.

• Resumes of all proposed SCIF assessment and accreditation experts and support personnel shall be submitted with the proposal for Government review.

• Personnel shall have demonstrable experience in ICD 705 facility assessments, TEMPEST standards, RF/EM shielding, and STC/NIC acoustic testing.

• SMEs shall include at least one individual with documented experience in ASTM E336 STC testing procedures and CNSSAM TEMPEST 1/13 compliance.

9.1 For contractors that do not require CAC, but require

access to a DoD facility or installation.

Contractor and all associated subcontractors employees shall comply with adjudication standards and procedures using the National Crime Information Center Interstate Identification Index (NCIC‐III) and Terrorist Screening Database (Army Directive 2014‐05/AR 190‐13), applicable installation, facility and area commander installation/ facility access and local security policies and procedures (provided by government representative); or, at

OCONUS locations, in accordance with status of forces agreements and other theater regulations.

9.2 Controlled Unclassified Information (CUI).

Include DFARS clause 252.204-7012, which requires the contractor to comply with NIST 800-171. Also include DFARS provision 252.204-2019 into solicitations. Acquisition officials should follow procedures outlined in DFARS 204.73 and verify vendors have an adequate NIST SP 800-171 summary assessment score within the Supplier Performance Risk System (within PIEE).

If the score doesn't show a medium- or high-level assessment with a score of 110 or better (as described in the "NIST SP 800-171 DoD Assessment Methodology"), include clause 252.204-7020 and obtain the vendor's "system security plan" and "plan of action" for NIST SP 800-171 verification and assurance by Army security officials.

10.0 GOVERNMENT FURNISHED INFORMATION

The Government will provide:

• Site access and escort as required

• Existing blueprints and all associated documentation

• Points of Contact for coordination

11.0 DELIVERABLES SUMMARY

The Contractor shall transmit all written deliverables electronically via email to the CCM Security Manager and the CCM Security Specialist.

Deliverable Description Due Date Monthly Status Report

Written report (Word, PDF) summarizing activities accomplished during the reporting

Emailed to the COR and CCM Security Manager and CCM Security Specialist on or before the fifth (5th) calendar

Deliverable Description Due Date

Resumes

Facility Assessment and Report

Accreditation Documentation Package period, issues, and planned work for the upcoming month

Resumes of proposed SCIF assessment and accreditation experts that would perform on this effort

Inspection of current facility construction with written report documenting the results of the assessment, to include identified deficiencies, compliance gaps with applicable ICD/DoD security standards, and recommended corrective actions/mitigation measures

Written Final FFC, Final TEMPEST day of the month following the reporting period.

With proposal submission and, if any changes occur, submit updated documents within 15 calendar days following the contract start date

Within 60 days of contract award

Prior to DIA submission

Deliverable Description Due Date

Checklist, SOP, EAP and all associated supporting documentation

Final Accreditation Support

Final remediation & coordination support (as needed)

Within 30 days of DIA decision

12.0 QUALITY ASSURANCE AND PERFORMANCE

Products and services provided to the Government under this task will be assessed and measured using the Quality Assurance Surveillance Plan (QASP).

13.0 PERFORMANCE REQUIREMENTS SUMMARY

The following performance objectives will be monitored and assessed in accordance with the following performance requirements summary and the QASP:

Performance Objective

Performance Standard

Performance Threshold

Incentive/ Disincentive

Security Clearances

All personnel hold active TS clearance with SCI eligibility

100% of staff cleared and approved for access

Access denied if not cleared;

replacement required

Monthly Status Reporting

PWS Paragraph 5.3

Submitted by the 5th day of the following month, includes required content

≥ 95% of monthly reports fully complete and submitted and ≤ 3

Any deficiencies noted are corrected within 3 days unless calendar day late in any month the CCM Security Manger, CCM Security Specialist or COR grants additional time for corrections

Compliance with DIA and

ICD 705

Standards

All work complies with DIA guidance, ICD 705, and applicable security directives.

100% compliance with DIA guidance, ICD 705, and applicable security directives.

Any deficiencies noted are corrected within 7 days unless the CCM Security Manger, CCM Security Specialist or COR grants additional time for corrections

SCIF

Assessment

PWS Paragraph 5.1

Provide full report with findings, discrepancies, and corrective actions

100% of available documentation reviewed, completion of inspection of ICD 705 facility and report all findings with recommended solutions to CCM Security Manager

Any deficiencies noted are corrected within 7 days unless the CCM Security Manger, CCM Security Specialist or and CCM Security Specialist within 60 days of contract award

COR grants additional time for corrections

Accreditation Documentation Package

PWS Paragraph 5.2

Provide written Final FFC, Final

TEMPEST

Checklist, SOP, EAP and all associated supporting documentation in compliance with DIA guidance, ICD 705, and applicable security directives.

100% of required contents included

Rework required if found to be incomplete, and any deficiencies noted are to be corrected within 15 business days unless the CCM Security Manger, CCM Security Specialist or COR grants additional time for corrections

Final Accreditation Support

PWS Paragraph 5.2

Provide final remediation and coordination support for final

DIA

accreditation in compliance with DIA guidance, ICD 705, and applicable

Assist CCM in responding to all

DIA AO/CSA

remediation requests, with all responses completed within Government timelines

Delays or omissions are corrected within 7 days unless the CCM Security Manger, CCM Security Specialist or COR grants security directives.

additional time for corrections