W911SR-24-S-RAPID Industry Day.pdf

ARMY CONTRACTING COMMAND, ABERDEEN PROVING GROUND

EDGEWOOD CONTRACTING DIVISION

W911SR-24-S-RAPID

ANNOUNCEMENT OF RAPID INDUSTRY DAY

The Army Contracting Command−Aberdeen Proving Ground (ACC-APG) Contracting Center, Edgewood Contracting Division, Ft Detrick, in support of the Joint Program Executive Office for Chemical, Biological, Radiological, and Nuclear Defense (JPEO CBRND), Joint Program Lead, Enabling Biotechnologies (JPL EB), hereby issues an announcement in advance of a Joint Industry Day for Rapid Access to Products in Development (RAPID) program to be held virtually via MS Teams on 16 Feb 2024. This is not a solicitation and this is not a solicitation requesting proposals at this time.

The purpose of this Industry Day is to identify industry partners and capabilities to develop/deliver a RAPID Database capable of storing and organizing complex data and information related to CBRN MCMs such that it is intuitively accessible by a variety of end users during urgent planning and response situations. The Database is intended to provide actionable information to assist (1) CCMD-level decision makers when evaluating a RAPID MCM for potential administration to US warfighters and (2) JPEO- and CBDP-level decision makers when determining portfolio investment strategies and/or rapid response adjustments based on changing circumstances. Appendix A outlines the draft Statement of Objectives (SOO).

This Industry Day will include presentation by JPL EB as well as opportunities for industry partners to present their capabilities in one-on-one breakout sessions with representatives from the Government agencies. Industry partners will update Government stakeholders, partners, and end users on current efforts and capabilities.

Companies that wish to attend must register at usarmy.detrick.dod-jpeo-cbrnd/mbx.baa@army.mil no later than 12 Feb 2024. Please include company name, individuals attending (please limit to no more than 5) and confirm your interest to present your capabilities to the Government either in a group forum, or separately one on one. Those requesting to register must also provide a capabilities statement encompassing the following:

• Company overview

• Capabilities as they align with Appendix A.

• Questions or comments in advance.

Capabilities statements should be limited to 2 pages (additional pages will not be reviewed) and included with your registration. No extensions will be granted. Proprietary information should be identified as Company Proprietary. Do not use Government security classification markings.

mailto:usarmy.detrick.dod-jpeo-cbrnd/mbx.baa@army.mil mailto:usarmy.detrick.dod-jpeo-cbrnd/mbx.baa@army.mil

This Industry Day notification is released under announcement number W911SR-24-S-RAPID.

The Government is not liable to reimburse any costs incurred by companies or entities that respond in any way to this announcement or participate in the Industry Day. This is industry day is for planning purposes only. It is not to be construed as a commitment by the Government nor will the Government pay for the information solicited. No solicitation document exists or is guaranteed to be issued as a result of this announcement or industry day. There is no Draft Request For Proposal that has been issued.

Additional details on location, times, agenda etc. will be shared with registered participants only.

APPENDIX A

ATTACHMENT 1

STATEMENT OF OBJECTIVES

DESCRIPTION/OBJECTIVE OF THE PROJECT: The Joint Program Executive Office for Chemical, Biological, Radiological, and Nuclear Defense, Enabling Biotechnologies (JPEO- CBRND-EB), develops, manufactures and delivers safe and effective Medical Countermeasures (MCMs) for preparedness, prevention, protection, response, and recovery from CBRN threats.

Today’s chemical and biological threat landscape is diverse, dynamic, and regionally distinct.

Agile and flexible defense systems are required to provide Combatant Commands (CCMDs) and other stakeholders throughout the Chemical and Biological Defense Program (CBDP) with actionable information regarding MCM availability at the speed of relevance.

The Rapid Access to Products in Development (RAPID) program is an integrated defense system composed of both physical MCM storage and fielding capabilities and a readily accessible information warehouse and sharing system (the RAPID Database). Collectively, these components of RAPID work synergistically to provide CBDP decision makers information for determining portfolio investment strategies and CCMDs with direct access to safe and effective, developmental prophylactics and therapeutics that can be advanced and fielded in response to credible intelligence or chemical/biological surprise.

STATEMENT OF OBJECTIVES (SOO):

Prototype Project Objective

The RAPID Database will store and organize complex data and information related to CBRN MCMs such that it is intuitively accessible by a variety of end users during urgent planning and response situations. The Database is intended to provide actionable information to assist (1) JPEO- and CBDP-level decision makers when determining portfolio investment strategies and/or rapid response adjustments based on changing circumstances and (2) CCMD-level decision makers when evaluating a RAPID MCM for potential administration to US warfighters. The RAPID Database will organize developmental MCMs using a Tier-based metric, with Tier 1 representing early discovery development and Tier 4 for MCMs with successful Phase 1 clinical studies and an inventory of available doses. When queried by CBRN threat type, the Database needs to return a list of potential MCMs along with their characteristics, tier data packages, availability, and developmental stage. A dashboard view that allows end users to easily view MCM coverage across individual and families of biological and chemical threats. Multiple user types are envisioned, including but not limited to JPL EB MCM Subject Matter Experts, CBDP stakeholders, CCMD Medical and CBRN leaders and planners, MCM Developers (e.g., pharmaceutical company representatives), US Government Interagency Partners, US-based non-government Partners, and International Partners. Data/information access rights will differ for each user type.

JPEO-CBRND-EB is seeking an interactive database that enables (including but not limited to):

• Streamlined access to a top-level information regarding information and availability of MCMs against specific threat of interest to inform decision regarding potential use

• Streamlined access to in-depth information regarding individual threats, and individual MCMs for use of this information in other EB efforts

• Efficient review of threat space coverage with existing MCMs at different levels of maturity, to include an interactive and user-friendly visualization of threat space coverage.

• Gap assessment to inform decision making process for threat prioritization

Performance Objectives (required results)

Project Objectives

The primary objective of this effort is to develop a RAPID Database to enable stakeholders to make data-driven decisions about fielding and accelerating development of MCMs. The objectives include:

• Compliance:

• Implemented on an approved DOD Cloud Service (i.e. C-Army or PLATFORM- ONE) in accordance with all US Army regulations

• Database will be implemented across multiple security classification levels, to include CUI, Secret, and possibly TS/SCI

• Ensures interoperability with the Global Information Grid (GIG) systems and ground processing infrastructures

• Ability to transfer the database system to USG for long term sustainment

• Development of a transition plan to USG

• Accessibility:

• Broadly accessible via robust user-friendly, intuitive interface

• Accessible by users, via DOD CAC or non-CAC, located anywhere in the world

• Access controls and user interfaces tailored to different user groups (anticipate at least four user types with distinct access profiles)

• Connection with related USG systems, as needed

• Development and deployment of training components, educational materials/presentations, and support for execution of exercises to demonstrate database utility

• Security:

• Performer must have Continuity of Operations Plan to ensure continued support in case of conflict or natural disaster

• All performer personnel must have a minimum of SECRET clearance, and some must have Top Secret/SCI

• Must comply with all current/relevant DOD cyber and information system regulations and be updated to remain compliant

• Data management:

• Ability to provide generalized analytics on user feedback/query history, updated product data inputs, etc. on a regular and/or ad hoc basis

• Ability to periodically ingest data from multiple DoD and non-DoD sources including, but not limited to, government-sponsored websites and databases, open-source scientific/technical literature, open and closed source intelligence reports, and custom data files

• Ability to ingest, clean, assess, and organize data for Subject Matter Expert review prior to publishing information

• Ability to visualize multifactorial data/information in order to enhance MCM situational awareness and support complex decisions about resource allocation and fielding of developmental MCMs

• Ability to input, clean, store, organize and export data packages upon demand per access controls such as but not limited to:

• MCM profiles (parameters to be defined, but likely including dose number, location, and availability; safety data; likely adverse effects, if any; administration information; efficacy data or estimates)

• MCM Tier Data Packages (parameters to be defined, compromising the data that supports entry and exit into each RAPID tier)

• Agile DevOps Phased development via incremental software sprints

• Supports rapid, cost-effective development/modification of the operational system, training system and support components over life of the system

• Mitigates the risks associated with technology obsolescence and proprietary technologies, over the life of the system

• Reduces system life cycle cost and logistics footprint by addressing required quality attributes, such as reliability, maintainability, supportability, safety, security, and human factors

Project Management Objectives

It is anticipated that the offeror will be required to submit a number of documents to capture the progression of the project, post-award. Requirements may include, but are not limited to the following:

A001 Quality Agreement Upon agreement award, the offeror will provide a draft Quality Agreement within 10 calendar days after award. The Government will respond with comments or acceptance 10 calendar days following receipt of the draft Quality Agreement. The final agreement with incorporated changes shall be submitted 5 calendar days after receipt of Government comments. The Government will provide written acceptance. The offeror will submit via e-mail in Microsoft Office format to the Government representatives listed in the RPP.

A002 Meeting/Teleconference Minutes The offeror shall provide meeting minutes within 3 calendar days after all meetings/teleconferences conducted with JPEO-CBRND-EB. Frequency depends on number of meetings and teleconferences.

A003 Monthly Progress Report The Monthly Progress Report shall contain regular status updates of all Intellectual Property (IP) license(s) related to the effort, in order to ensure that all license(s) are in good standing as the project progresses. In the event of any change in IP license(s) status or potentially imminent change in status, the offeror shall immediately contact the Agreements Officer (AO), Agreements Officer’s Representative (AOR) and, by telephone or e-mail communication.

The Monthly Progress Report shall contain the technical progress made during the previous month and the updated integrated master schedule (IMS) in Microsoft Project format. The schedule update shall include the explanation for any changes in the schedule, as well as drivers for the change, as applicable. The report will also address any concerns that would impact the performance, schedule, or cost planned for the effort. The offeror shall report using risk matrix format, to include risk mitigation strategies.

Submission shall be 15 calendar days after the end of each month of performance. The Government will have 10 calendar days to respond to the report with any comments, and the offeror will have an additional 5 calendar days to revise the deliverable or respond to those comments.

These reports will be used by the Government to assess both technical and schedule performance and will serve as milestones to allow invoicing for work executed to date.

A004 Annual Report The annual report shall narrate a complete summary of the project execution and associated results obtained, to include project results and accomplishments, issues encountered and recommended solutions. The report shall also address tasks that were not completed, reasons for non-completion, and a plan to accomplish the tasks or alternative approach to accomplish project goals, and as needed, an updated Statement of Work (SOW).

Submission shall occur within 15 calendar days of the anniversary date of award per annum. The Government will have 30 calendar days to respond to the report with any comments, and the offeror will have an additional 10 calendar days to revise the deliverable or respond to those comments.

A005 Final Report A Final Report shall be prepared at the end of the effort. A final report shall be provided whether any or all of the project Stages are completed. This report takes the place of the last annual report due (a financial report is still required). The report shall narrate a complete summary of the project execution and associated results obtained. The narration will include outstanding problems and their potential solutions, and problems solved during the course of the year(s), along with the solution to the solved problems. The report shall demonstrate how the prototype was advanced.

The offeror shall submit a Draft Final Report by the 30th calendar day following the end of the project period of performance. The Government shall provide comments to the offeror by the 30th calendar day following receipt of the offeror’s Draft Final Report. The offeror shall submit the Final Report on the 30th calendar day after receipt of Government comments.

A006 Master Government Property – Physical Inventory During performance of the agreement, the offeror may purchase material or equipment using Government funds [Contractor Acquired Property (CAP)] if approved by the AO and/or AOR.

The offeror shall perform, record, and disclose physical inventory results of all CAP in the offeror's possession.

A007 Patents – Reporting of Subject Inventions In accordance with the terms and conditions of the agreement.

A008 Expenditure Forecast The offeror shall submit the first expenditure forecast within 30 calendar days after award. An updated forecast shall be submitted within 15 calendar days of any agreement modifications that change the period of performance or the cost of the agreement. The monthly expenditure forecast submission shall include analysis of the cost drivers for Estimate to Complete changes, if any, from the previous month’s projection. All submissions must be provided in Excel format, including all formulas.

The expenditure forecast shall be submitted 15 calendar days from the start of each month, and shall include both the monthly planned accrual and the cumulative total.

A009 Miscellaneous Data Submissions Required submissions include but are not limited to, Point Papers, Briefings, Transition of the system to USG plan and Technical Presentations and Publications.

A010 Work Breakdown Structure (WBS) The offeror shall provide a four-level WBS with costs and schedule (top level is program, level 2 is Stage, level 3 are major tasks, level 4 are subordinate tasks). For the lowest task level, the offeror shall provide a breakdown for labor, material, and other indirect costs.

The WBS shall be updated annually or 30 calendar days after a SOW modification. Government review/approval is 15 calendar days after receipt of first submittal. The offeror shall provide changes to the draft within 10 calendar days of such request. The offeror shall provide the final document within 10 calendar days after approval of changes is received from the Government.

A011 Integrated Master Schedule (IMS) The offeror shall provide within 15 calendar days after agreement award, an IMS in Microsoft Project format. Any updates to the IMS shall be included in the monthly progress reports. Any event that impacts the critical path by more than 30 days shall result in an off-cycle IMS update.

Submission shall be 15 calendar days after the end of each month of performance. The Government will have 10 calendar days to respond to the report with any comments, and the offeror will have an additional 5 calendar days to revise the deliverable or respond to those comments.

Operational Constraints/Limitations/Restrictions: Not Applicable

PERIOD AND PLACE OF PERFORMANCE: The anticipated Period of Performance for this effort is up to 5 years from date of award. Specific dates to be negotiated. It is anticipated that the primary place of performance will be the contractors’ facilities, however this aspect can be negotiated as part of each Offerors’ submission.

DELIVERABLES: The contractor will be required to provide a number of deliverables throughout the course of this project, categorized as either Data or Prototype.

DATA DELIVERABLES: Data deliverables include meeting minutes, financial reports, technical progress reports, annual reports, property inventory, patents and invention reports, technical data packages, forecasts, WBS, IMS, TPP, and any other data necessary to document the product development. In addition, there will be collection, curation, and storage of the data in the Government-issued data format for future transfer to the Government.

Note: Technical data deliverables described herein shall be delivered to the Government with a minimum of Government Purpose Rights.

SPECIAL REQUIREMENTS:

Export Control: In accordance with applicable laws and regulations.

Security and Classified Data: NOTE: Security Clearances are not required for access to unclassified data.

Security Clearances. Personnel performing on this SOO shall obtain a Secret, Top Secret in accordance with the DD 254, Contract Security Classification Specification. The Contractor must possess or obtain a facility security clearance at the level of Secret, Top Secret prior to contract award. The Contractor shall register and request security clearances through the National Industrial Security Program Central Access Information Security System (NCAISS) (https://www.dss.mil/is/ncaiss/). Contractor personnel shall have appropriate clearances prior to contract award unless otherwise approved in writing by the Contracting Officer (CO). If subcontractors are utilized in performance of a classified contract, the Prime Contractor shall create a Subcontract DD 254 in the National Industrial Security Program Contract Classification System (NCCS). The Prime Contractor shall ensure that any teaming partners or subcontractors have the appropriate security clearances prior to contract award.

Per FAR 52.204-2, (a) this clause applies to the extent that this contract involves access to information classified "Confidential," "Secret," or "Top Secret." (b) The Contractor shall comply with (1) the Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (32 CFAR Part 117), and (2) any revisions to that manual, notice of which has been furnished to the Contractor. (c) If, after the date of this contract, the security classification or security requirements under this contract are changed by the Government, and if the changes cause an increase or decrease in security costs or otherwise affect any other term or condition of this contract, the contract shall be subject to an equitable adjustment as if the changes were directed under the Changes clause of this contract. (d) The Contractor agrees to insert terms that conform substantially to the language of this clause, including this paragraph (d) but excluding any reference to the Changes clause of this contract, in all subcontracts under this contract that involve access to classified information.

A SF 312 Non-Disclosure Agreement (NDA) initiated by the company’s Facility Security Officer (FSO) is required for each of the Contractor’s personnel.

Security Manager Appointment. The Contractor shall appoint a security manager. The security manager shall provide employees with training required by DOD 5200.1-R, Information Security Program Regulation. The Contractor will also provide initial and follow-on training to Contractor personnel who work in Army controlled/restricted areas.

Listing of Employees & Clearance Documentation. The Contractor shall maintain a current listing of employees. Within 10 calendar days of contract award, the Contractor shall provide the Contracting Officer’s Representative (COR) a list with the names, location of performance and clearance requirements of all company employees assigned to this effort. The list shall be validated and signed by the company Facility Security Officer (FSO). An updated listing shall be provided when an employee's status or information changes.

Controlled/Restricted Areas. The Contractor shall be compliant with local procedures for entry to ARMY controlled/restricted areas where Contractor personnel will work.

Physical Security. The Contractor shall safeguard all Government property and controlled forms provided for Contractor use and adhere to the Government property requirements contained in this contract. At the end of each workday, all Government facilities, equipment, and materials shall be secured.

All contractor personnel shall conform to all Department of Army, Department of Defense, and US Government policies and procedures relating to workplace security and safety at all times.

The contactor shall report security and safety violations immediately to the Contracting Officer’s Representative (COR)/Contract Manager. Lost Government-issued security badges must be reported immediately to the COR/Contract Manager or appropriate security POC. The contractor shall be responsible for securing all Government owned hardware, software, and the facilities that contractor personnel will be using. The following personal items are prohibited inside classified workspaces at all times: cell phones/ Blackberries, portable USB memory drives, other portable USB devices, external hard drives, cameras, MP3 players, scanning devices, digital flash cards/disks, personal laptop computers, camera/USB watches and wireless transmitters.

Additional Security Requirements: This effort requires access to classified Government information at U.S. Government facilities. Physical, personnel, information, and operational security measures are part of the security specifications as outlined in the DD Form 254 and the contractor shall comply in accordance with DIAM 50-5 and other Government security regulations, manuals, and directives.

Pass and Identification Items. The Contractor shall ensure the pass and identification items required for contract performance are obtained for employees and non-government owned vehicles.

Comply with HSPD-12 Personal Identity Verification (PIV) issuance requirements, known as the Common Access Card (CAC). Be responsible for obtaining CAC or PIV ready status prior to contract start.

Retrieving Identification Media. The Contractor shall retrieve all identification media, including vehicle passes from employees who depart for any reason before the contract expires, e.g., terminated for cause, retirement, etc.

Weapons, Firearms, and Ammunition. Contractor employees are prohibited from possessing weapons, firearms, or ammunition, on themselves or within their contractor-owned vehicle or privately-owned vehicle while on all Army installations.

Controlled Unclassified Information. The Contractor shall comply with DoD 5400.48, Controlled Unclassified Information requirements. This regulation sets policy and procedures for the disclosure of records to the public and for marking, handling, transmitting, and safeguarding CUI material.

Reporting Requirements. Contractor personnel shall report to an appropriate authority any information, or circumstances of which they are aware of, which may pose a threat to the security of DOD personnel, Contractor personnel, resources, and classified or unclassified defense information.

Key Control/Access Badge Control. The Contractor shall establish and implement methods of making sure all keys/badges issued to the Contractor by the Government are not lost or misplaced and are not used by unauthorized persons. The Contractor shall not duplicate any keys issued by the Government.

Government Furnished Equipment (GFE). The Contractor shall establish and implement procedures to ensure all GFE to include laptops and other data processing devices, issued to the Contractor by the Government are not lost or misplaced, are not used by unauthorized persons or are not subject to unauthorized external devices. The Contractor shall immediately report to the COR any occurrences of lost GFE within two (2) hours of discovery of occurrence. If GFE is lost, the Contractor may be required, upon written direction of the CO, to replace the equipment at no additional cost to the Government. The Government may replace the equipment and deduct the cost of such from the monthly payment due the Contractor.

Information System Security. The Contractor shall implement Information System (IS) security protections and ensure the protections are appropriate to the confidentiality, integrity, and availability needs of the Government. Establish appropriate administrative, technical, and physical safeguards to protect any and all nonpublic Government data.

Risk Management Framework (RMF). All Information Systems (IS), Platform Information Technology (PIT) and Information Technology (IT) Services or Products under this requirement, that receive, transmit, store, or process nonpublic government data must be accredited in accordance with Department of Defense (DOD) Instruction (DoDI) 1510.01, Risk Management Framework (RMF) for DoD Information Technology (IT) and comply with annual Federal Information Security Management Act (FISMA) security control testing. IS and PIT systems must be categorized in accordance with Committee on National Security Systems Instruction (CNSSI) 1253, implement a corresponding set of security controls from the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, and use assessment procedures from NIST SP 800-53A with additional DoD-specific assignment values, overlays, implementation guidance, and assessment procedures as required.

All systems subject to RMF must present evidence of authorization in the System Security Plan (SSP), Security Assessment Report (SAR), Plan of Action and Milestones (POA&M), and authorization decision document; or show that the system has a DoD Risk Management Framework (RMF) or equivalent DoD Component PIT system accreditation decision that is current within 3 years. Evidence of FISMA compliance must be presented in the form of a POA&M. Systems must have and maintain an Authority to Operate (ATO) or, if acceptable to the Government, an Interim Authority to Operate (IATO) by contract award.

Information security continuous monitoring (ISCM). ISCM is defined as maintaining ongoing awareness of information security, vulnerabilities, and threats to support organizational risk management decisions. ISCM is a critical part of the risk management process to ensure that IS and PIT operations remain within an acceptable level of risk despite any changes that occur. The Contractor shall maintain ongoing monitoring, analysis, and incident response procedures for all IS and PIT systems under this requirement in accordance with NIST SP 800-137.

Cyber Incident Reporting. Within 41 hours of discovery of any cyber incident the Contractor shall notify the Army Information Management (IM) office by emailing a cyber-incident report to the following organizational box: [list Army/IM email org box here]

The Contractor shall also notify the COR and CO at the time the incident is reported through appropriate Army channels.

The Contractor shall rapidly (within 72 hours) report cyber incidents to the DoD at http://dibnet.dod.mil. Prior to contract award the Contractor shall obtain a medium assurance certificate at http://iase.disa.mil/pki/eca/Pages/index.aspx in order to timely report cyber incidents to the DoD.

System Security Plan (SSP). The Contractor shall develop, document, and periodically update a System Security Plan (SSP) and any associated plans of action developed to satisfy the adequate security requirements of DFARS 252.204-7012, and in accordance with NIST Special Publication (SP) 800-171, “Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations”. The SSP shall describe the Contractor’s unclassified information system(s)/network(s) where covered defense information associated with the execution and performance of this contract is processed, stored, or transmitted. The SSP shall be provided to the Government as part of the proposal.

The Contractor shall provide the Government with access to the SSP (or extracts thereof) and any associated plans of action for each of the Contractor’s tier one level subcontractor(s), vendor(s), and/or supplier(s), and the subcontractor’s tier one level subcontractor(s), vendor(s), and/or supplier(s), who process, store, or transmit covered defense information associated with the execution and performance of this contract.

Identification and Marking of Covered Defense Information (CDI). Identify all covered defense information associated with the execution and performance of this contract. At the post-award conference, the Contractor and the Government/Program Office shall identify and affirm marking requirements for all covered defense information, as prescribed by DoDM 5200.01 Vol 4, Controlled Unclassified Information, and DoDI 5230.24, Distribution Statements on Technical Documents, to be provided to the Contractor, and/or to be developed by the Contractor, associated with the execution and performance of this contract. All newly created, revised, or previously unmarked classified and unclassified DoD technical documents shall be assigned Distribution Statement A, B, C, D, E, or F as described in Enclosure 4 of DoDI 5230.24.

Distribution Statement "X" is superseded by issuance of this Instruction. Subsequent dissemination of formerly Distribution Statement “X” documents shall display Distribution Statement C, with export control as the reason and shall be marked as directed in paragraph 8.a of Enclosure 3 of the Instruction, unless changed by the controlling DoD office.

Tracking CDI. Track all covered defense information associated with the execution and performance of this contract. The Contractor shall document, maintain, and provide to the Government, a record of tier 1 level subcontractors, vendors, and/or suppliers who will receive or develop covered defense information – as defined in DFARS Clause 252.204-7012 and associated with the execution and performance of this contract.

The Contractor shall restrict unnecessary flow down of covered defense information in accordance with marking and dissemination requirements specified in the contract and based on a ‘need-to-know’ to execute and perform the requirements of this contract. This shall be addressed and documented at the post-award conference.

Classification Review for Public Release: Required if contractor employee(s) will handle information that pertains to military matters, national security issues, or subjects of significant concern to the DoD that is intended for public release.

Security Classification Guidance or Guides: Contractors shall, to the extent practicable, advise, and assist in the development of the original Contract Security Classification Specification. It is the contractor’s responsibility to understand and apply all aspects of the classification guidance.

Users of classification guides are also encouraged to notify the originator of the guide when they acquire information that suggests the need for change in the instructions contained in the guide.

Classification guidance is, notwithstanding the contractor’s input, the exclusive responsibility of the GCA, and the final determination of the appropriate classification for the information rests with that activity. The Contract Security Classification Specification is a contractual specification necessary for performance on a classified contract. If a classified contract is received without a Contract Security Classification Specification, the contractor shall advise the

GCA

Security Training: Contract must specify information security training requirements identified in AR 380-5 to satisfy 32 CFAR Part 117 training requirement for contractors on an installation.

Other DA functional and/or security discipline offices may use this training provision for operational efficiency; however, the specific requirements must be identified in DD Form 254 and the security section of the contract document. Any training requirements that the installation or tenant facilities require of the contractors must be added to DD Form 254 and the security section of the contract document. Examples of training requirements include, but are not limited to, information assurance, antiterrorism, and force protection training.

For Contracts that Require an OPSEC Standing Operating Procedure/Plan. This standard language text is for contractor employees with an area of performance for classified contracts or if the contract employee has access or responsibility to protect critical information. The Contractor, in collaboration with RA OPSEC Officer, shall develop an OPSEC Standard Operating Procedure (SOP)/Plan within 90 calendar days of contract award per AR 530-1 (Operations Security). Proposed language: "The Contractor shall develop an OPSEC SOP/Plan within 90 days of contract award. The OPSEC SOP/Plan must be reviewed and approved by the RA OPSEC Officer. The SOP/Plan will include the government's critical information, why it needs to be protected, where it is located, who is responsible for it and how to protect it. In addition, the contractor shall identify an individual who will be an OPSEC Coordinator."

For Contracts that Require OPSEC Training. Per AR 530-1, (Operations Security) contractor employees must complete Level I OPSEC Training within 30 calendar days of contract award.

Proposed language: "All new contractor employees will complete Level I OPSEC Training within 30 calendar days of their reporting for duty. Additionally, all contractor employees must complete annual OPSEC awareness training. The contractor shall submit certificates of completion for each affected contractor and subcontractor employee, to the COR or to the contracting officer (if a COR is not assigned), within 5 calendar days after completion of training. OPSEC awareness training is available at the following websites: https://www.iad.gov/ or http://www.cdse.edu/catalog/operations-security.html; or it can be provided by the RA OPSEC Officer in presentation form which will be documented via memorandum."

For Cybersecurity (CS)/information technology (IT) training This standard language text is for contract employees who need network access and/or working in IA/IT functions. Proposed language: "All contractor employees and associated sub-contractor employees must complete the DoD IA awareness training before issuance of network access and annually thereafter. All contractor employees performing IA/IT functions must comply with DoD and Army training requirements in DoDD 8570.01, DoD 8570.01-M and AR 25-2 within six months of employment.", Threat Awareness Reporting Program. For all contractors with security clearances. Per AR 381- 12 Threat Awareness and Reporting Program (TARP), contractor employees must receive annual TARP training by a CI agent or other trainer as specified in 2-4b. Proposed language: "All new contractor employees will complete annual Threat Awareness and Reporting Program (TARP) Training provided by a Counterintelligence Agent, IAW AR 381-12. The contractor shall submit certificates of completion for each affected contractor and subcontractor employee(s) or a memorandum for the record, to the COR or to the contracting officer (if a COR is not assigned), within 5 calendar days after completion of training. Authorized web-based TARP training for CAC card holders is available at the following website:

https://www.us.Army.mil/suite/page/655474.

Acceptance of Deliverables: The Government will provide acceptance of all data deliverables within 20 days of delivery, or as required elsewhere in the RPP. The Government will provide acceptance of all prototype deliverables within 20 days of delivery.

Travel: Up to 15% in support of Government planning events/demonstrations.

GOVERNMENT FURNISHED PROPERTY: Not Applicable

FUNDING CONFIDENCE LEVEL:

CL-2: Moderately confident funds will be available.