PWS.pdf

Attachment 1 – Performance Work Statement Page 1 of 45

PERFORMANCE WORK STATEMENT (PWS)

WAMC Security Maintenance Service Contract Part I

General Information

1.0 GENERAL: This is a non-personal services contract to provide Womack Army Medical Center (WAMC) security services on and to Lenel OnGuard system, indoor/outdoor security cameras, access control locks, magnetic door locks, cabling, monitors, Dell made server running Lenel software, and displays that are vital to the Lenel OnGuardTM security system. The Government shall not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn is responsible to the Government. The Contractor, in turn, shall be accountable to the Government for Contractor or subcontractor personnel.

1.1. Description of Services/Introduction: The Contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform security maintenance services, as defined in this Performance Work Statement (PWS), except for those items specified as government furnished property and services. The Contractor shall perform in accordance with (IAW) the terms and conditions of the contract and consistently with the established standards in this PWS and contract.

1.2. This contract to service WAMC’s Lenel OnGuard® system requires a one (1) year warranty to be provided for any installed hardware and workmanship whereby the MEDCEN may request call-backs if services do not function as they were designed. Servicer shall:

• Secure a twenty four (24) hour customer servicing representative who can be contacted to arrange for emergency repairs or technical troubleshooting (travel to and from base of operations shall be the responsibility of the contractor and not billed to the government directly, all travel will be included in the price of service that is provided prior to the award of this contract and not after).

• Perform all tasks with due diligence and ensure the installed or repair devices prior to leaving each day. All installed devices shall be compatible and able to feed back to the WAMC EOC (Emergency Operations Center) and OnGuard system. Lenel based products are the expected level of quality but substitutions are acceptable as long as compatibility is assured.

• The Contractor shall provide one (1) Lenel certified, security technician, two days (16 hours) per week at minimum, an estimated total of 832 hours per year, additional 83 hours of scheduled and unscheduled corrective action per year, 96 hours yearly of integration time (8 hours per month) [time used by systems engineer for systems maintenance (such time if not used maybe be used towards scheduled and unscheduled hours], 12 hours per year of administrative time (1 hour per month), The technician will maintain all WAMC and Fort Bragg security requirements, and be able to maintain continuity each week for purposes of ensuring the security for on-post and off post assets, in addition to troubleshooting.

• Under this contract additional service hours for emergency calls and repairs will be assessed for criticality. Any additional hours will be reviewed and added as a contract modification requiring signatures of both Contracting Officer and contractor with adjusted hour balance placed as a purchase order or itemized quote with justifiable documentation. Contractor may not take orders to perform tasks that would add additional costs or go beyond the hours as mentioned from any persons other than what is granted in writing from the KO. Contractor

Attachment 1 – Performance Work Statement Page 2 of 45 shall note that any activity not directly authorized by the KO or what is granted in this contract is an unauthorized commitment and the US government has no responsibility to pay for such tasks that were not directly authorized.

1.2.1. This non-personal service and fixed purchased price contract may be awarded to any vendor with the qualifying features as follows. Contractor shall:

• Be local (100 geographical miles from the place of service) as WAMC desires rapid response times for service.

• Must have a minimum of 2 years of experience with DOD and government contracts with an overall favorable evaluation from their prior contracts with the US Government.

• Must be certified with Lenel Technologies, and able to service their equipment without voiding any warranties.

• Contractor must maintain a Secret level of security clearance throughout the duration of the contract. Contractor must be able to supply sufficient testing and repair equipment to provide service. Contractor should abide by all provisions in the contract as noted.

1.2.2. All work for this project will be performed at the WAMC campus, and all outlying clinics and buildings which have CCTV and Access Control components that are connected to WAMC’s Lenel OnGuard System, Fort Bragg, NC. These installations include:

• WHSC building

• Robinson Health Clinic

• Clark Health Clinic

• Byars Health Clinic

• Joel Health Clinic

• National Center of the Intrepid Spirit building

• Fayetteville Medical Home

• Linden Oaks Medical Home

• Hope Mills Medical Home

• Smoke Bomb Hill Dental Clinic

• Joel Dental Clinic, Laflamme Dental Clinic

• CPAS building

• Embedded behavioral health clinics, Blood Donor Center, Refill Pharmacy, BSL building, Occupational Medicine buildings, Preventative Medicine buildings, Fayetteville Rehabilitation Clinic, and other installations designated by COR and acquired under the purview of WAMC’s physical security. (A complete list can be referenced in Exhibit 3)

1.2.3. COMPATIBILITY. All equipment, software and hardware must be compatible with the existing equipment and software. All equipment software and hardware must possess the capability to feed back to the WAMC’s Lenel OnGuard system security suite whereby security in the WAMC EOC may monitor equipment functionality and monitor all feeds from the installed cameras. Contractor has 24 hrs post installation to verify that the item is fully functional with the Lenel OnGuard system. Items found to be noncompatible will be replaced by the persons who installed it at no additional cost to the government.

1.3. Background: WAMC has a mission to serve the family and soldiers of Fort Bragg and the 82nd Airborne division that makes Fort Bragg the largest Army installation on the east coast.

Attachment 1 – Performance Work Statement Page 3 of 45

WAMC additionally serves all local military retirees and their Tricare recipients. It is the MEDCEN’s mission to ensure the health and wellbeing of all those who come, use, or work within or on WAMC campus or satellite facilities. To avoid security failures and blind spots from occurring in addition to ensuring the secrecy and level of trust in the servicers, WAMC desires Lenel OnGuard compatible products, technicians that are Lenel certified, and those who service them to hold and maintain their SECRET level security clearance.

1.4. Objectives: The basic service objective includes the following based off the requirements as noted in Par. 1.1.1.:

1.4.1. Provide: Contractor shall provide one (1) Lenel certified, security technician two days (16 hours) per week, a total of 832 hours per year, additional 83 hours of scheduled and unscheduled corrective action per year. The technician shall arrive on scheduled and set prearranged days each week to provide services as requested. Technician shall main continuity with the MEDCEN and holds a Secret level security credentials. Technician will be responsible for servicing items on any part of the WAMC campus and purview of the EOC. Technician shall in addition to his regular duties provide preventative maintenance information, such as identifying areas that could potentially lead to system failures in the near future and identifying best practice procedures.

1.4.2. Provide: Contractor shall provide one (1) Lenel, certified, systems engineer once per month, 8 hrs per day, for a total of 96 hours yearly for integration time and systems maintenance.

If this time is not utilized than it can be used towards scheduled and unscheduled hours per customer request once it has been approved bilaterally.

1.4.3. Provide: Contractor shall provide 12 hours per year of administrative time (1 hour per month).

1.4.4. The Government will provide a lift as required to repair or replace cameras or equipment.

1.4.5. Contractor must ensure that all equipment meets WAMC requirements and thus must maintain regular communication with WAMC’s IMD (Information Management Department) service to ensure all computers or software related requirements are met in order to prevent delays or down-times in services. Due to the secure nature of the network at WAMC, when the contractor updates all server licenses, camera licenses, and performs Lenel OnGuard System updates, they must perform this task in person using a CD with all updated information contained within the disc. The Contractor may be given permission to be unescorted while working in the communication closets and data centers with in the hospital only after being approved by the Chief Information Officer to perform such tasks.

During times where server and updates are required, Contractor must coordinate with IMD to ensure that server and software requirements and security are being met. Contractor is not allowed to work on any server unaccompanied unless written consent is given to the contractor and memo held by both physical security, and COR. Contractor must hold a Secret level security clearance to work on in any communication closet or server room. Those not meeting this requirement are not authorized to work on or to WAMC servers or network per MEDCEN policy.

Contractor must ensure that all technicians have performed HIPAA, Informational Assurance, Informational Security, and Operational Security training prior to accessing any MEDCEN network, server, or communication closet per MEDCEN policy.

Contractor shall provide as part of service all camera, access control, and server licenses

Attachment 1 – Performance Work Statement Page 4 of 45 renewals as part of the services provided. License renewals is only applicable to newly installed equipment. Items not requiring license renewal shall not need license renewed. Those items requiring renewals shall be done as part of the services and maintenance offered under this service maintenance contract. If renewals come at additional cost then such shall be placed as a purchase ordered and made as an attachment to the contract.

1.4.6. Contractor will not take orders to perform tasks that would add additional costs or go beyond the hours as mentioned from any persons other than what is granted in writing from the KO. Contractor shall note that any activity not directly authorized by the KO or what is granted in this contract is an unauthorized commitment and the US government has no responsibility to pay for such tasks that were not directly authorized.

1.4.7. This contract holds the right for the replacement of failing or faulty equipment. This CLIN line shall be left unfunded until which time it shall be utilized. Annual estimated replacements are 5 – 10 cameras, 5 – 10 card readers, 3-5 door latches, 1 matrix per year thus estimating a cost of $4,000.00 annually. Any substituted equipment must be compatible with the Lenel OnGuard System. This CLIN shall be activated by quote and request presented from MEDCEN to the COR and approved by KO. No other requests may be utilized using this unfunded CLIN line item.

1.4.8. Provide: Contractor must provide a technician that must be dispatched from an operational center or locality within 100 miles of the MEDCEN with a two (2) hour response time to an emergency service request. If technician is dispatched from a further location they still must meet the two hour response time and extra cost of travel shall not be sent as an additional cost to the government.

1.4. Scope: This contract covers all service in regards to the Lenel OnGuard system at WAMC and the surrounding clinics and campus. This contract includes both item replacements and service with full scope as outlined in section 1.3 and period performance below.

1.5. PERIOD OF PERFORMANCE. The period of performance shall be for a one (1) Base Year period of 12 months.

1.6. Quality Control: Quality Control is the responsibility of the Contractor. The Contractor shall develop, implement, and maintain a Quality Control Program (QCP) to ensure all work described in this contract is performed at or above the standard defined in the Performance Requirements Summary (PRS). The QCP is developed by the contractor to ensure that it performs and delivers high-quality service and products. And it shall include methods of documenting and enforcing quality control operations of both prime contractor and or subcontractor work; including inspection and testing.

1.6.1. Quality Control Program. The Government is committed to a highly interactive relationship between quality control by the Contractor and quality assurance by the government recipient of services. This relationship shall be achieved through an effective Prevention Based Quality Control Program dedicated to ensuring the best possible products and services to end users. The Contractor shall submit the final written Quality Control Plan (QCP) no later than 10 days after the awarding of the contract and no later than 5 days of any proposed changes to the KO. All QCP proposals must been seen and approved by the COR and KO prior to implementation. The Quality Control Plan shall address as a minimum:

Attachment 1 – Performance Work Statement Page 5 of 45

1.6.2. Inspection system. The contractor shall develop, implement, and maintain a system to inspect their services as well as their sub-contractors services and products to ensure compliance with PWS requirements, and applicable laws and regulations. It shall specify task or areas to be inspected on a schedule or unscheduled basis, the manner in which inspections are to be conducted, the titles of the individuals who will perform the inspections, and the percentage of the work that will be inspected on a recurring basis.

1.6.2.1. The Contractor’s QCP shall demonstrate its prevention-based outlook by meeting the objectives as stated in the PWS throughout all areas of performance. The QCP shall be developed to specify the Contractor’s responsibility for management and quality control actions to meet the terms of the contract. The QCP as a minimum shall address continuous process improvement;

procedures for scheduling, conducting and documentation of inspection; addressing Government discovered non-conformances; procedures for root cause analysis to identify the root cause and root cause corrective action to prevent re- occurrence of discrepancies; procedures for trend analysis; procedures for collecting and addressing customer feedback/complaints. Contractor as part of their QCP shall provide metrics reporting of functionality of the servers and workstations with comparisons to functionality, hindrances, and customer complaints with corrective actions.

1.6.2.2. Within 24 hrs. of request from the COR or KO, the contractor shall provide, all reports generated as a result of the QCP. This shall include any summary information used to track quality control, including any charts/ graphs.

1.6.2.3. The Contractor’s QCP shall be incorporated into and become part of this contract after the plan has been accepted by the KO. Proposed changes made after KO acceptance shall be submitted in writing through the COR to the KO for review and acceptance prior to implementing any revision. The Contractor’s QCP shall be maintained throughout the life of the contract and shall include the Contractor’s procedures to routinely evaluate the effectiveness of the plan to ensure the Contractor is meeting the performance standards and requirements of the contract.

1.6.2.4. The Contractor’s quality program shall demonstrate its prevention-based outlook by meeting the objectives stated in the PWS throughout all areas of performance.

The QCP shall be developed to specify the Contractor’s responsibility for management and quality control actions to meet the terms of the contract. The QCP as a minimum shall address continuous process improvement; procedures for scheduling, conducting and documentation of inspection; discrepancy identification and correction; corrective action procedures to include procedures for addressing Government discovered non-conformances; procedures for root cause analysis to identify the root cause and root cause corrective action to prevent re-occurrence of discrepancies; procedures for trend analysis; procedures for collecting and addressing customer feedback/complaints.

1.6.2.5. Within Twenty four (24) hours of completion & upon request from the COR, the Contractor shall provide, all reports generated as a result of the Contractor’s quality control efforts. This shall include any summary information used to track quality control, including any charts/graphs.

1.6.2.6. The Contractor’s QCP shall be incorporated into and become part of this contract after the plan has been accepted by the KO. Proposed changes made after KO acceptance shall be submitted in writing through the COR to the KO for review and acceptance prior to implementing any revision. The Contractor’s QCP shall be maintained throughout the life of the contract and shall include the Contractor’s procedures to routinely evaluate the effectiveness of the plan to ensure the Contractor is meeting the performance standards and requirements of the contract.

Attachment 1 – Performance Work Statement Page 6 of 45

1.6.3. Inspection Files. The contractor shall document all inspections conducted, and the necessary corrective and preventive actions taken.

1.6.4. Deficiency Identification, Prevention and Correction. The QCP shall include a method of identifying and preventing deficiencies in the quality of services performed before the level of performance becomes unacceptable as defined in the PWS, without dependence upon Government direction. The contractor shall identify and prevent defects in quality of products and services performed before the level becomes unacceptable and before they are provided to the Government.

1.6.5. The contractor shall keep records on-site of all inspections conducted by the Contractor and necessary corrective action taken. These documents shall be available for inspection by the Government during the term of the contract.

1.6.6. The QCP at a minimum shall address process control and continuous process improvement; procedures for scheduling, conducting and documentation of inspection;

discrepancy identification; procedures for root cause analysis; corrective and preventive action procedures to include procedures for addressing Government discovered non-conformances;

procedures for trend analysis; and procedures for collecting and addressing customer feedback/complaints. The QCP shall document process control and process performance measurement procedures that shall include how the Contractor shall implement preventive corrective actions. The Contractor shall demonstrate that it has designed quality into the delivery of services thereby mitigating the risk(s) associated with delivery of deficient or nonconforming services.

In the development of and maintenance of the QCP, the contractor shall maintain at least a biweekly contact with the COR where by all performance standards can be reviewed. Any changes or delays need to be relayed to the COR and KO with a 3 to 5 day lead upon discovery of the delay. At least bimonthly formal meetings shall be held to insure full understanding and to uphold the expectations of service.

1.6.7. The Contractor must ensure continual quality improvements by inspecting and informing in regards to areas that will require preventive maintenance. Contractor will sustain focus throughout the QCP and report monthly via a Process Improvements Tracker (PIT), undergoing initiatives to streamline processes, improve service and detail benefits to the Government.

1.6.8. Upon request from the COR, the Contractor shall provide, all reports generated as a result of the Contractor’s quality control efforts. This shall include any summary information used to track quality control, including any charts/graphs.

1.7. Contractor Discrepancy Report (CDR): When the Contractor's performance is unsatisfactory, a CDR will be issued. The Contractor shall reply in writing within five (5) work days from the date of receipt of the CDR, giving the reasons for the unsatisfactory performance, corrective action taken, and procedures to preclude recurrence.

1.8. Quality Assurance: The COR will evaluate the Contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan is primarily focused on what the COR must do to ensure that the Contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s). When an observation indicates defective performance, the COR will require the Contractor or designated on-site representative to initial the observation to acknowledge the defective performance. The

Attachment 1 – Performance Work Statement Page 7 of 45 acknowledgement of the observation does not necessarily constitute Contractor concurrence with the observation, only that the Contractor has been made aware of the defective performance. Clauses of FAR 52.246-1, Inspection of Supplies – Fixed Price and FAR 52.246- 4, Inspection of Services – Fixed-Price shall be followed as an assisting means of determination for the quality of worked performed.

1.9. Property Management System: The Contractor shall establish a system to manage Government Furnished Equipment (GFE) in its possession to control, use, preserve, protect, repair and maintain. The Property Management System (PMS) must be adequate to satisfy the requirements of Property Management in accordance with (IAW) FAR clause 52.245-1 Government Property.

1.10. Other Property Management Requirements.

INSTALLATION ACCESS.

The Contractor shall fully comply with all vehicle inspections and verifications of identification at all Fort Bragg Access Control Points (ACPs). Contractors shall obtain appropriate passes to be permitted onto Fort Bragg. Fort Bragg Travel Passes may be obtained at the All-American Freeway Guardhouse after successfully passing a background check. All passes obtain shall be for a year duration unless otherwise stated. All vehicles which lack such a pass will not be allowed on post and thus turned around at the gate.

Failure to gain access onto post shall not be a legitimate reason to be late or deficient with any works. It is up to the Contractor to ensure that this pass is held and maintained during the course of the contract.

CONSERVATION OF UTILITIES.

The Contractor shall instruct employees in utilities conservation practices and be responsible for operating under conditions which preclude the waste of utilities as follows:

Lights shall be used only in areas where and when work is actually being performed.

Employees shall not adjust mechanical equipment controls for heating, ventilation and air conditioning systems.

If used, water faucets or valves shall be turned off after the required usage has been accomplished.

1.10.1. SAFETY REQUIREMENTS. The Contractor shall comply with OSHA and all pertinent provisions of the publication 29 CFR 1910 and EM 385-1-1 and all local, State and Federal safety laws, rules and regulations, including environmental. Any apparent conflict with the requirements of the contract and above shall be immediately brought to the attention of the Contracting Officer or his authorized representative for final resolution. The Contractor shall be liable for all fines, penalties, and costs which result from violations of, or failure to comply with, rules and regulations.

1.10.1.1. Equipment Safety. Any equipment used in performance of this contract may be inspected by the COR at any time. If the equipment is at any time deemed unsafe or

Attachment 1 – Performance Work Statement Page 8 of 45 unserviceable by the COR, the Contractor shall remove equipment from the area immediately.

The Government does not assume and hereby specifically disavows any duty to inspect the equipment in order to assure safe operation. The Contractor or subcontractor(s) at any tier are at all times responsible for assuring equipment is used in a safe, responsible manner. The Contractor shall in all cases ensure any equipment used in the performance of this contract is in a safe and serviceable condition.

1.10.1.2. Personnel Safety. The Contractor shall provide safety barriers or tape to show work area. The Contractor shall immediately correct all safety deficiencies upon findings or notification of the deficiencies. Contractor shall notify the COR of the corrective action to be taken. The Contractor shall not leave equipment unattended while in use or unsecured while at the work site.

1.10.1.3. Accident Protection and Emergency Medical Treatment. All work crews, office personnel and the COR shall be provided with information pertaining to the Contractor's arrangement for emergency medical treatment. This information shall include the following:

Local Hospital: Name Phone No:

Local Ambulance: Name Phone No:

Local Doctor: Name Phone No:

1.11. Recognized Federal Holidays. The Contractor is normally not required to perform services on recognized federal holidays. However, that requirement is subject to mission execution requirements. The recognized federal holidays include:

New Year’s Day Labor Day Martin Luther King Jr.’s Birthday Columbus Day Washington’s Day Veteran’s Day Memorial Day Thanksgiving Day Independence Day Christmas Day

1.11.1. When a holiday occurs on a Saturday, Federal employees are normally granted the previous Friday as the holiday observance. When a holiday occurs on a Sunday, Federal employees are normally granted the following Monday as the holiday. The contractor shall work on the days the Government is scheduled to work.

1.11.2. When an unforeseen installation closure occurs on a regularly scheduled day of work, the Contractor will have the following options:

1.11.2.1. Reschedule the work so it is performed the following day unless the following day falls on a weekend.

1.11.2.2. Reschedule the work on any day that is mutually satisfactory.

1.11.3. Hours of Operation: The Contractor shall be responsible for providing services, between the hours of 07:30 AM to 04:30 PM; Monday through Friday, except federal holidays or when the government facility is closed due to local or national emergencies, administrative closings or similar government directed facility closings. The Contractor shall at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the government facility is not closed for the above reasons. When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the workforce

Attachment 1 – Performance Work Statement Page 9 of 45 are essential to successful performance under this contract. No overtime (OT) or compensatory time (CT) is authorized. Contractor personnel shall not exceed a 40 hour work week; flexible work schedule may be considered. Any deviation from this time period will be coordinated with the COR and a minimum of 48 hours in advance.

1.11.3.1. Performance of work by Contractor personnel under the terms of this contract shall have minimal to no interference with regularly scheduled government operational activities.

1.11.4. Place of Performance: IAW PARC Policy Alert 14-33, Homeland Security Presidential Directive 12 (HSPD-12) issued 31 Dec 13. Contractor shall have routine access to Government-controlled facilities. All work for this project will be performed at the WAMC campus, and all outlying clinics and buildings which have CCTV and Access Control components that are connected to WAMC’s Lenel OnGuard System, Fort Bragg, NC. These installations include WHSC building, Robinson Health Clinic, Clark Health Clinic, Byars Health Clinic, Joel Health Clinic, National Center of the Intrepid Spirit building, Fayetteville Medical Home, Linden Oaks Medical Home, Hope Mills Medical Home, Smoke Bomb Hill Dental Clinic, CPAS building, embedded behavioral health clinics, Blood Donor Center, Refill Pharmacy, BSL building, Occupational Medicine buildings, Preventative Medicine buildings, Fayetteville Rehabilitation Clinic, and other installations designated by COR and acquired under the purview of WAMC’s physical security.

1.12. Security Requirements

1.12.1. Security Clearance:

Contractor personnel shall have (all contractor personnel to include technical personnel, personnel working on programming/configuration of the OnGuard system or requiring access into Womack Army Medical Center Local Area Network (WAMC LAN) shall have a SECRET level of security clearance and signed non-disclosure agreement with WAMC.

Personnel must maintain and hold a SECRET level of security and must match the requirement’s DD254. Secret level security clearance must be held at the time of application and must maintain the level of security required for the duration of the contract. The security requirements are in accordance with the attached DD254. Contractor personnel shall comply with all applicable security and safety regulations, guidance, and procedures, including local, referenced in this PWS and in effect at the work sites. All personnel must meet requirements IAW DODD 8140.01. Personnel Security Clearances must be kept to an absolute minimum based on contractual needs.

1.12.1.1. Originate the request through your Contractor Company Facility Security Officer (FSO) based on bona fide contractual occupational requirement. Individuals cannot apply for a personnel security clearance application on their own. The security clearance process begins when a company determines that an employee or candidate for employment requires a personnel security clearance to access classified information in order to perform the duties of his or her position. If the applicant has never held a personnel security clearance, or if their previous clearance was terminated more than 24 months ago, this is referred to as an initial clearance. The employee must complete an Electronic Questionnaire for Investigations Processing (e-QIP), signature pages and submit fingerprints electronically for all initial investigation requests.

Contractor personnel shall have a favorable National Agency Check (NACI) with inquiry in accordance with Security definition for personnel who occupy “ADP (Automated Data Processing) Sensitive” positions, as per AR 380-67, paragraph 3-601, “The Personnel Security https://www.us.army.mil/suite/doc/41924024 https://www.us.army.mil/suite/doc/41924024

Attachment 1 – Performance Work Statement Page 10 of 45

Program” no later than 10 days after award of contract.

Personnel Security Clearances must be kept to an absolute minimum based on contractual needs; for more information please visit http://www.dss.mil/psmo- i/indus_psmo-i_process_applicant.html.

1.12.2. Common Access Card Issuance:

All Contractor personnel performing work under this contract shall obtain a Department of Defense (DOD) Common Access Card (CAC). In addition to CAC, contractors must obtain a Womack Army Medical Center (WAMC) contractor access badge and access card key. The CAC and other required badges shall be worn at all times, when performing work under this contract, to include attending government meetings and conferences. Unless otherwise specified this contract, Contractor personnel shall wear the CAC and other required badges in conspicuous place on the front of exterior clothing and above the waist, except when safety or health reasons prohibit such placement or when used for computer access. Reference CAC Issuance and Revocations: DODI 5200.46, September 9, 2014.

Contractor personnel shall be required to obtain a CAC at least ten (10) work days prior to start of base contract period or prior to performance under this contract, whichever comes first.

The Contractor shall develop, maintain, and provide to the COR an updated roster which shall include names and positions of all Contractor personnel as well as indicating which employees were issued CAC or other forms of government identification cards. The Contractor shall submit initial roster to the COR within ten (10) calendar days after commencement of base period of performance.

The Contractor shall immediately report any lost CAC or government issued identification cards to the COR and Military and/or DoD police agencies. The Contractor shall immediately collect the CAC and other government issued forms of identification upon termination of employee, or at the end of the contract performance period. The CAC and other government issued forms of identification shall be returned to the COR within one (1) hour of employee termination, or at the end of contract performance period, whichever comes first. Final payment may be delayed if Contractor fails to comply with these requirements.

CAC Issuance and Revocations: DoDI 5200.46, September 9, 2014

A CAC will not be issued (or maintained) by a person if there is a reasonable basis to believe, based on the individual’s criminal or dishonest conduct, that issuance of a CAC poses an unacceptable risk.

a. An individual’s conduct involving questionable judgment, lack of candor, dishonesty, or unwillingness to comply with rules and regulations can raise questions about his or her reliability or trustworthiness and may put people, property, or information systems at risk. An individual’s past criminal or dishonest conduct may put people, property, or information systems at risk.

b. Therefore, conditions that may be disqualifying include:

(1) A single serious crime or multiple lesser offenses which put the safety of people at risk or threaten the protection of property or information. A person’s convictions for burglary may indicate that granting a CAC poses an unacceptable risk to the U.S. Government’s physical assets http://www.dss.mil/psmo-

Attachment 1 – Performance Work Statement Page 11 of 45 and to employees’ personal property on a U.S. Government facility.

(2) Charges or admission of criminal conduct relating to the safety of people and proper protection of property or information systems, regardless of whether the person was formally charged, formally prosecuted, or convicted.

(3) Dishonest acts (e.g., theft, accepting bribes, falsifying claims, perjury, forgery, or attempting to obtain identity documentation without proper authorization).

(4) Deceptive or illegal financial practices such as embezzlement, employee theft, check fraud, income tax evasion, expense account fraud, filing deceptive loan statements, or other intentional financial breaches of trust.

(5) Actions involving violence or sexual behavior of a criminal nature that poses an unacceptable risk if access is granted to federally-controlled facilities and federally-controlled information systems. For example, convictions for sexual assault may indicate that granting a CAC poses an unacceptable risk to the life and safety of persons on U.S. Government facilities.

(6) Financial irresponsibility may raise questions about the individual’s honesty and put people, property or information systems at risk, although financial debt should not in and of itself be cause for denial.

(7) Deliberate omission, concealment, or falsification of relevant facts or deliberately providing false or misleading information to an employer, investigator, security official, competent medical authority, or other official U.S. Government representative, particularly when doing so results in personal benefit or which results in a risk to the safety of people and proper safeguarding of property and information systems."

Compliance with HSPD-12: On 07 Mar 14 the Secretary of the Army published Army Directive 2014-05, which establishes HSPD-12 investigative and adjudicative policy and procedures to support credentialing determinations for the issuance of CACs to eligible Army Contractor personnel. HSPD-12 mandates a Government wide standard for secure and reliable forms of identification issued by the Federal Government for physical access to federally controlled facilities and/or logical access to federally controlled information systems. The CAC is the DoD federal personal identity verification credential.

The purpose of security screening is to ID those persons who may pose a threat to good order and discipline on Fort Bragg by either denying them access or placing restrictions on their movement. The following criteria will be used as a guideline for determining denial of access to Fort Bragg:

(1) (U) Any record of a felony conviction for a crime (includes murder, rape, sale of illegal drugs, grand theft, arson, and kidnapping).

(2) (U) Three or more misdemeanor convictions within the past five years (includes assault, theft of $500 or less, and excludes traffic violations).

(3) (U) VCC personnel will NOT relay the source of the information to the visitor (e.g.

visitors will not be told that the information comes from the Bars and Suspension List or from NCIC screening). Subjects are not authorized to view the information under any circumstances.

Attachment 1 – Performance Work Statement Page 12 of 45

(4) (U) The SC is the final approval authority for any adjudication request for access denial.

If Contractors meet access control standards of Army Directive 2014-05 (Policy and Implementation for Common Access Card Credentialing and Installations Access for Uncleared Contractors, dated 7 Mar 14) then DoD Consolidated Adjudications Facility (CAF) will conduct centralized adjudications of favorable HSPD-12 background investigations. The DoD CAF will forward investigations that cannot be favorably adjudicated to the Defense Office of Hearings and Appeals (DOHA) for a final credentialing determination. The Contractor shall complete the Updated Personal Identity Verification of Contractor Personnel for Common Access Cards (CACs) form contained as Technical Exhibit H which will be provided to the COR NLT the 10th day of each month.

The Contractor shall immediately report any lost CAC or Government issued identification cards to the COR and Military and/or DoD police agencies. The Contractor shall immediately collect the CAC and other Government issued forms of identification upon termination of employee, or at the end of the contract performance period. The CAC and other Government issued forms of identification shall be returned to the COR within one (1) hour of employee termination, or at the end of contract performance period, whichever comes first. Final payment may be delayed if

(1) In the event a contractor employee separates without advance notice (either quits or is terminated), the contractor shall immediately notify the Trusted Agent (TA) who will ensure CAC permissions are revoked the same day. In various instances a contractor employee may not be on task (working) due to furloughs, suspensions pending the outcome of an investigation, or the contract reaches the end of the period of performance (POP) and renewal is anticipated but not yet complete. During these occurrences, the TA or a representative from the contractor (TA’s choice) will collect and retain the CACs of the affected contractor personnel residing in the local area however; CAC permissions will not be revoked in the Trusted Associate Sponsorship System (TASS). Collecting CACs however, may not be feasible for contractor personnel located in remote locations. When contractor personnel return to work under the contract, they will retrieve their CAC from the responsible party who collected it.

(2) The contractor shall include a monthly report listing contractor employees who departed during the previous month and the date their CACs were turned in using the format listed below.

Employee Name

Contract Number

TO

Number

Company Name

Office Symbol

TA

Name

Termination Date

Date CAC returned to

RAPIDS

Remarks

1.12.3. National Industrial Security Program (NISP).

The Contractor shall implement and maintain a security program for control of personnel, Attachment 1 – Performance Work Statement Page 13 of 45 property, and information, including, unclassified and classified materials, documents, and records. Contractor shall comply with FAR 52.204-2, Security Requirements. This clause involves access to information classified “Confidential,” “Secret,” or “Top Secret” and requires Contractors to comply with—(1) The Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (DoD 5220.22-M); any revisions to DOD 5220.22-M, notice of which has been furnished to the Contractor. In addition, the Contractor’s security program shall include provisions for, but not limited to:

--Initial and Annual Operations Security (OPSEC) awareness training IAW AR 530-1.

--Receiving, storing, disseminating, transmitting, transporting, and protecting items classified as CONFIDENTIAL or SECRET by the Government, including the use of courier cards.

--In-processing and out-processing Contractor personnel for security matters.

--Obtaining Contractor personnel security clearances.

--Documenting and reporting actual and potential security problems.

--Initiating proper procedures to correct documented problems and implementing corrective procedures in the Contractor's security program.

--Filing Classified Documents. All Government-furnished classified and unclassified files in existence at the contract performance start date and those generated under this contract shall be maintained in accordance with AR 25-400- 2 or other applicable regulations. Files shall be transferred to the KO or designated representative upon completion of the contract period or last day of contract performance, whichever comes first. Such files are the property of the U.S. Government. The Contractor shall provide security of classified documents in accordance with AR 380-5 and DOD 5200.1-R, NISP Operating Manual.

Contractor personnel shall be required to obtain a CAC at least 10 work days prior to start of base contract period or prior to performance under this contract, whichever comes first.

Contractor shall develop, maintain, and provide the COR an updated roster which shall include names and positions of all Contractor personnel as well as indicating which employees were issued CAC or other forms of government identification cards. The contractor shall submit initial roster to the COR within 10 calendar days after commencement of base period of performance.

The Contractor shall immediately report any lost CAC or government issued identification cards to the COR and Military and /or DOD police agencies. The contractor shall immediately collect the CAC and other government issued forms of identification upon termination of employee, or at the end of the contract performance period. The CAC and other government issued identification shall be returned to the COR within 1 hr of employee termination, or at the end of the performance period whichever comes first. (IAW PARC Policy Alert 14-33, Homeland Security Presidential Directive 12, issued 31 Dec 13.) Final payment may be delayed if

1.12.3.1 Access and General Protection / Security Policy and Procedures:

All Contractor personnel performing work under this contract shall comply with applicable installation, facility, and area commander installation/facility access, local security policies and security procedures, and security procedures provided by the Security Manager Government representative. Contractor personnel shall provide all information required for installations Provost Marshal Office, Director of Emergency Services or Security Office. Contractor personnel shall comply with all personal identification verification requirements as directed by Department of Defense (DoD), HQ Department of the Army (DA) or local policies. Sponsoring organizations, activities, and persons will be responsible for monitoring contractor access by submitting a

Attachment 1 – Performance Work Statement Page 14 of 45 complete and approved DES Form 118 to the Installation All American VCC 5 detailing the contracted services to be performed, location of services, and duration of the contract.

Contractors requesting access for less than one year may receive an AIE visitor card on a case by case basis, or a temporary vehicle pass for less than 90 days. Contractor cards will be issued for periods of one to three years depending on the terms of their contract. AIE cards expirations may be updated to reflect a new contract period by submitting an approved DES Form 118 to the All American VCC 5 guard post. Renewed short term passes must be reprocessed at the All American VCC. In addition to the changes otherwise authorized by this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in Contractor and subcontractor security matters or processes.

1.12.3.2. Key Control. The Contractor shall include in the physical security section of the Contractor’s security program a key control plan IAW applicable regulations, policies and directives ensuring keys/key cards issued to the Contractor by the Government are not lost or misplaced and are not used by unauthorized persons. The key control plan shall include requirements of AR380-5, Fort Bragg 380-5, if classified materials are being stored. NOTE: All references to keys include key cards. No keys issued to the Contractor by the Government shall be duplicated. Such procedures shall include turn-in of any issued keys by personnel who no longer require access to locked areas. The Contractor shall immediately report any occurrences of lost or duplicate keys/key cards to the COR.

In the event keys are lost or duplicated, the Contractor shall, upon direction of the KO, re-key or replace the affected lock or locks; however, the Government, at its option, may replace the affected lock or locks or perform re-keying. When the replacement of locks or re-keying is performed by the Government, the total cost of re-keying or the replacement of the lock or locks shall be deducted from the monthly payment due the Contractor. In the event a master key is lost or duplicated, all locks and keys for that system shall be replaced by the Government and the total cost deducted from the monthly payment due the Contractor.

The Contractor shall prohibit the use of Government issued keys/key cards by any persons other than the Contractor’s employees. The Contractor shall prohibit the opening of locked areas by Contractor employees to permit entrance of persons other than Contractor employees engaged in the performance of assigned work in those areas, or personnel authorized entrance by the KO.

1.12.3.3. Lock Combinations. The Contractor shall establish and implement methods of ensuring that all lock combinations are not revealed to unauthorized persons. The Contractor shall ensure that lock combinations are changed when personnel having access to the combinations no longer have a need to know such combinations. These procedures shall be included in the Contractor’s security program.

1.12.4. Information Security Plan. The Contractor shall develop and implement an Information Security Plan IAW AR 380-5 AR 380-67, Fort Bragg regulation 380-5, FB 380-67, and FORSCOM supplement 1) to AR 380-5 for the control of classified information. The contractor’s information. The Contractor information security program shall include applicable provisions of AR 380-series regulations.

Information assurance (IA)/information technology (IT training: The Contractor employees working IA/IT functions shall comply with DoD and Army training requirements in DoDD8570.01, DoDD 8570.01 and AR 25-2 within 180 days of employment.

Safeguarding For Official Use Only (FOUO) Information. During normal duty hours, the Contractor shall place information determined to be FOUO in an out- of-sight location, if

Attachment 1 – Performance Work Statement Page 15 of 45 visitors, casual traffic, and other non- Government/Non-Contractor personnel have access to the work area. During non-duty hours and at the close of business, the Contractor shall store FOUO records, so as to preclude unauthorized access. The transmission, termination of, and disposal of, FOUO documents will be consistent with Army Regulations (AR) 380-5, Protection of FOUO, Information and Installation Policy.

Network Access. Contractor personnel requiring access to Government-owned computer networks must obtain the proper background level of investigations, with favorable results, at the Contractor’s expense, prior to being issued a user identification and password IAW AR 380-67 and AR 380-5. Additionally, Contractor employees and associated subcontractor employees must complete the DoD IA, Information Awareness training, before issuance of network access, and annually thereafter.

ATCTS REGSISTRATION. All contractor employees who require access to a government information system must be registered in the ATCTS (Army Training Certification Tracking System) at commencement of service, and must successfully complete the DOD Information Assurance Awareness prior to access to the information systems and then annually thereafter.

1.13. Anti-Terrorism Program. Contractor shall insure all security policies are followed and obtain a long-term visitor’s pass or acquire a CAC card per the policy of the MEDCEN.