Attachment 1_Performance Work Statement (3).docx

ID CARD SERVICES PERFORMANCE WORK STATEMENT (PWS)

Fort Bragg, North Carolina

01 May 2026 Version: FINAL

PART 1

GENERAL INFORMATION

1. GENERAL. This is a non-personnel services contract to provide Defense Enrollment and Eligibility Reporting System (DEERS)/ Real Time Automated Personnel Identification System (RAPIDS) Common Access Card (CAC) support services for the Installation Management Command (IMCOM) at Fort Bragg, North Carolina. The Government will not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn is responsible to the Government.

1.1 Description of Services/Introduction. The Contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform the verification and issuance of military identification (USID) and CAC cards for active duty military, Reserve and National Guard members, military retirees, family members, Department of Defense (DoD) civilians and other eligible recipients, as defined in this PWS, except for those items specified as government furnished property and services.

1.2 Background. The DoD CAC is recognized by all DoD components as the official DoD/Federal ID credential that can be used for logical and physical access once access privileges are granted. The CAC also serves as electronic access to secure websites and electronic mail. CAC ID cards are issued to active duty military, Reserve and National Guard members, DoD civilians, DoD Contractors, and other eligible recipients. The DoD also provides USID cards to military retirees, family members, and other eligible recipients. CAC and USID cards are issued and maintained in part using DEERS/RAPIDS workstations. Approximately 79,000 customers are serviced annually in the Soldier Support Center, building number 4-2843 on Fort Bragg. Fort Bragg is located in Cumberland County, North Carolina (NC) and hosts a population of approximately 65,000 military, Government civilian, and contactor personnel, as well as 98,000 resident retirees and family members.

1.3 Scope. This is a non-personal services contract to provide DEERS/RAPIDS USID card and CAC support services for the IMCOM at Fort Bragg, NC. Contractor personnel rendering the services are not subject; either by the contract’s terms or by the manner of its administration, to the supervision and control usually prevailing in relationships between the Government and its employees. Contractor employees shall be accountable solely to the Contractor who, in turn, is responsible to the Government.

1.4 Type of Contract. The Government will award a Firm Fixed Price contract.

1.5 Objectives. The Contractor shall provide positive verification and issuance of USID and CAC cards for active duty military, Reserve and National Guard members, military Retirees, Family Members, DoD civilians and other eligible recipients. The Contractor shall perform to the standards specified in this PWS and ensure all work accomplished in the performance of this PWS meets all applicable Federal, State, and local laws, regulations, and directives to include, but not limited to, the publications in PWS Part 6, “Applicable Publications.”

1.5 Period of Performance. The period of performance shall be for a thirty (30) day phase-in period, an eleven (11) month base period, and four (4) one year option periods as follows:

1.6 General Information.

1.6.1 Quality Assurance. The Contracting Officer’s Representative (COR) will evaluate the Contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan is primarily focused on what the COR must do to ensure that the Contractor has performed IAW the performance standards and contract quality requirements are being met. Contract quality requirements means the technical requirements in the contract relating to the quality of the product or service and those contract clauses prescribing inspection, and other quality controls incumbent on the Contractor, to ensure they are providing products or services that conform to the contractual requirements. It defines how the performance standards will be enforced, the frequency of surveillance, the minimum acceptable defect rate(s), and deductions applied, if applicable. When an observation indicates defective performance, the COR will require the Contractor or designated on-site representative to initial the observation to acknowledge the defective performance. The acknowledgement of the observation does not necessarily constitute Contractor concurrence with the observation, only that the Contractor acknowledges that they have been made aware of the defective performance.

1.6.1.1. Quality Control Plan (QCP). Quality Control is the responsibility of the Contractor. The Contractor is responsible for the delivery of quality services and supplies to the Government The Contractor shall develop, implement, and maintain a QCP to provide delivery of high-quality service and products IAW the requirements of the contract, applicable laws and regulations, and at or above the standards defined in the Performance Requirements Summary (PRS).

1.6.2. Inspection Files. The Contractor shall keep records on-site of all inspections conducted by the Contractor and necessary corrective action taken. Upon request from the KO or COR, the Contractor shall provide, all reports generated as a result of the Contractor’s quality control efforts. This shall include any summary information used to track quality control, including any charts/graphs.

1.6.3. COR/Alternate COR (ACOR): The COR and ACOR monitor all technical aspects of the contract and assists in contract administration. As determined by the KO, a COR and ACOR will be identified and appointed by letter of designation, a copy of which will be provided to the Contractor by the KO. The designation letter states the responsibilities and limitations of the COR and ACOR, especially regarding changes in cost or price, estimates, or changes in delivery dates. The ACOR’s authority shall only be in effect during the absence of the COR.

1.6.3.1. In no event will the COR or ACOR, by virtue of their designation as such, be empowered to execute or agree to any contract changes thereof or authorized to obligate the Government. If the work is not written in the contract, neither the COR nor ACOR are authorized to request new work. The KO retains the ultimate responsibility for the administration of the contract. Any discrepancy resulting from coordination with or advisement from the COR or ACOR shall be addressed, in writing, to the KO.

1.6.3.2. The COR and ACOR are authorized to perform the following functions: Assure that the Contractor performs the technical requirements of the contract; perform inspections necessary in connection with contract performance; and maintain written and oral communications with the Contractor concerning technical aspects of the contract. The COR and ACOR can also issue written interpretations of technical requirements, including government drawings, designs, and specifications; monitor Contractor's performance; notify both the KO and Contractor of any deficiencies; coordinate availability of government furnished property; and provide site entry of Contractor personnel.

1.6.4. Corrective Action Request (CAR). Nonconformance occurs when a Contractor fails to meet Contract or Task Order terms, conditions and/or specifications; the Contractor’s quality control system is found to be inadequate; or the Contractor’s noncompliance has led to substandard performance requiring corrective action. All instances of nonconformance will be documented via a Corrective Action Request. The Contractor shall reply to the KO within the due date established in the issued CAR, giving the reasons for the unsatisfactory performance, corrective action taken, and procedures to preclude recurrence. A CAR will not normally be issued if the Contractor has self-identified a nonconforming condition and has implemented effective corrective actions. However, this does not apply in cases where a Contractor has issued an internal corrective action based on a nonconformance previously identified by the Government.

1.6.5 Recognized Federal Holidays. Contractor services are not required on the Federal public holidays listed below. Holidays occurring on weekends will be observed as directed by the Federal calendar (5 U.S.C. 6103).

Independence Day

1.6.6 Regular Hours of Operation. The Contractor shall work on the days the Government is scheduled to work. The Contractor is responsible for conducting business, between the hours of 0800 - 12:00 and 13:00 – 17:00 hours, Monday thru Friday except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government-directed facility closings. The Contractor shall conduct business during regular hours unless a mission requirement necessitates extended hours of operation in accordance with PWS paragraph 1.6.4.1. The Contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons. When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the workforce are essential.

1.6.6.1 Extended Hours of Operations. Due to mission requirements such as deployments and redeployments of units, there are occasions during which the Fort Bragg ID Card Facilities may need to operate for extended periods before or beyond regular hours of operation, including Federal Holidays. In these instances, the Government will notify the Contractor at least 24 hours in advance to allow the Contractor time to rearrange work schedules leading up to the event and avoid the need for overtime. The Contractor will be authorized to provide a flexible work schedule for its employees who are required to work extended hours on those days in order to meet mission requirements. Prior to performance of services outside the regular hours of operation, the Contractor shall request and obtain, in writing, approval from the Contracting Officer (KO).

1.6.6.2 Installation Closures. When an unforeseen installation or directorate closure occurs on a regularly scheduled day of work, the Contractor shall resume operations on the next business day that the facilities are open.

1.6.6.3 The Contractor shall ensure an adequate workforce is in place for uninterrupted performance of all tasks defined within PWS Part 5 during the hours of operation detailed in this PWS.

1.6.7 Place of Performance. The work implemented under this contract will be performed at the following location:

Soldier Support Center (SSC) Building 4-2843. Normandy Drive Fort, Bragg, NC

1.7 Security Requirements. Contractor personnel performing work under this contract shall have and maintain a favorable National Agency Check with Inquires (NACI) at the time of their performance start date and for the duration of their performance under the contract.

1.7.1 Physical Security. The Contractor shall be responsible for safeguarding all government equipment, information and property provided for contractor use. At the close of each work period, government facilities, equipment, and materials shall be secured.

1.7.2 Key Control. The Contractor shall establish and implement methods of making sure all keys/key cards issued to the Contractor by the Government are not lost or misplaced and are not used by unauthorized persons. NOTE: All references to keys include key cards. No keys issued to the Contractor by the Government shall be duplicated. The Contractor shall develop procedures covering key control that shall be included in the QCP. Such procedures shall include turn-in of any issued keys by personnel who no longer require access to locked areas. The Contractor shall immediately report any occurrences of lost or duplicate keys/key cards to the KO.

1.7.2.1. In the event keys, other than master keys, are lost or duplicated, the Contractor shall, upon direction of the KO, re-key or replace the affected lock or locks; however, the Government, at its option, may replace the affected lock or locks or perform re-keying. When the replacement of locks or re-keying is performed by the Government, the total cost of re-keying or the replacement of the lock or locks will be deducted from the monthly payment due the Contractor. In the event a master key is lost or duplicated, all locks and keys for that system shall be replaced by the Government and the total cost deducted from the monthly payment due the Contractor.

1.7.2.2. The Contractor shall prohibit the use of Government issued keys/key cards by any persons other than the Contractor’s employees. The Contractor shall prohibit the opening of locked areas by Contractor employees to permit entrance of persons other than Contractor employees engaged in the performance of assigned work in those areas, or personnel authorized entrance by the KO.

1.7.3 Lock Combinations. The Contractor shall establish and implement methods of ensuring that all lock combinations are not revealed to unauthorized persons. The Contractor shall ensure that lock combinations are changed when personnel having access to the combinations no longer have a need to know such combinations. These procedures shall be included in the Contractor’s QCP.

1.7.4 For contractors that do not require CAC but require access to a DoD facility or installation. Contractors and all associated sub-contractors employees shall be screened using the National Crime Information Center Interstate Identification Index (NCIC-III) and Terrorist Screening Database (TSDB) (Army Directive 2014-05/AR 190-13), applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by government representative), or, at OCONUS locations, in accordance with status of forces agreements and other theater regulations. Contractors or Contract Leads will coordinate with the COR to receive an entry badge (AIE). All issued badges will not exceed the issuance of three years or the length of the contract. Contractors requiring access to the installation will go to the visitor center to obtain a badge of access. Contractors will turn in the badge to the COR upon expiration of the contract or separation from the contract. Lost, damaged, or stolen badges will be reported immediately to the COR. IAW AR 190-51, at no point will a contractor use a retiree, or other DoD ID to access the installation unless it is a CAC ID, issued by the US Government and sponsored locally.

1.7.5. Operations Security (OPSEC) Requirements: Contractor personnel shall adhere to facility security policies and restrictions. The Contractor shall immediately report suspicious activities to security personnel.

1.7.6 Special Qualifications.

1.7.6.1 Security.

1.7.6.1.1 Access and General Protection/Security Policy and Procedures. The Contractor and all associated subcontractors’ employees shall comply with applicable installation, facility, and local security policies and procedures. The Contractor workforce shall comply with all personal identity verification (PIV) requirements as directed by DoD, Headquarters Department of the Army (HQDA), and local policy. The Contracting Officer’s Representative (COR) and/or Alternate COR (ACOR) will request changes in Contractor security matters or processes if the Force Protection Condition (FPCON) at any individual facility or installation changes.

1.7.6.1.2 The Contractor shall provide all information required for background checks to meet installation access requirements, to be accomplished by the installation Provost Marshall Office, Director of Emergency Services, or Security Office.

1.7.6.1.3 The Contractor shall return CAC cards the same day employment of an individual has expired or has been terminated and shall return them to the issuing office within one day.

1.7.6.1.4 The Contractor shall immediately report any lost or stolen CAC or government issued identification cards to the COR and Military and/or DoD police agencies. The Contractor shall immediately collect the CAC and other government issued forms of identification upon termination of employee, or at the end of the contract performance period. The CAC and other government issued forms of identification (e.g., badges) shall be returned to the COR within one (1) hour of employee termination or at the end of contract performance period, whichever comes first. Final payment may be delayed if Contractor fails to comply with these requirements.

1.7.6.1.5 Physical Security. The Contractor shall safeguard all Government equipment, information, and property provided for Contractor use. The Contractor shall maintain a physical security checklist or log (e.g., Standard Form (SF) 701, Activity Security Checklist), which shall be forwarded to the KO and COR/ACOR, no later than the fifth working day of each month following the month of surveillance. The Contractor shall secure Government facilities, equipment, and materials at the close of each work period. The Contractor shall be solely responsible for any loss or damage of equipment and material. The Contractor shall ensure debris of any type is disposed of according to local policies and directives.

1.7.6.2 Security Training

1.7.6.2.1 iWATCH Training. The Contractor shall brief the local iWATCH program training to all Contractor personnel and associated subcontractors. Training standards will be provided by a Government Anti-Terrorism Officer (ATO). This training is used to inform employees of types of behavior to watch for and instructs employees to report suspicious activity to the COR/ACOR. The Contractor shall furnish, to the KO and COR, certificates of completion for each employee no later than 30 days after the performance start date and annually thereafter.

1.7.6.2.2 Anti-Terrorism Training. The Contractor shall complete Anti-Terrorism Training available at https://jkodirect.jten.mil/. The Contractor shall furnish, to the KO and COR, certificates of completion for each employee no later than 30 days after the performance start date and annually thereafter.

1.7.6.2.3 Level 1 OPSEC training. The Contractor shall complete the training within thirty (30) calendar days of contract performance start date and within five (5) calendar days of new employees commencing performance. Contractor employee training status shall be reported to the KO and COR/ACOR no later than thirty (30) calendar days after contract performance start date. Contractor personnel shall complete OPSEC awareness training annually at https://jkodirect.jten.mil/.

1.7.6.2.4 DoD Cyber Awareness Training. All Contractor personnel with access to a government information system shall be registered in the Army Training Certification Training System (ATCTS) at contract performance start date, and must successfully complete the DoD Information Assurance Awareness training prior to accesses the information systems and then annually thereafter. A certificate of completion shall be furnished to the KO and COR during Phase-in and annually thereafter, no more than 30 days prior to expiration.

1.7.6.2.5 Threat Awareness Reporting Program. Per 2-4b of AR 381-12 Threat Awareness and Reporting Program (TARP), Contractor personnel shall receive live TARP training by a Counterintelligence (CI) agent or other trainer and annually thereafter as specified in 1-10b and 1-10l of AR 381-12.

1.8 Safety

1.8.1 The Contractor shall comply with AR 385-10, The Army Safety and Occupational Health Program and adhere to Occupational Safety and Health Administration (OSHA) standards and all applicable Federal, State, and local laws, regulations, and directives. Provide a verbal notification to the KO as soon as possible of each occurrence of damage to Government property or an accident resulting in death, injury, occupational disease, or adverse environmental impact.

1.9 Contingency Plans.

1.9.1 The Contractor shall establish, maintain, and implement contingency plans for mobilization, disaster, and labor dispute contingencies. The plans shall assume no Government support to the Contractor workforce. The Contractor shall, within thirty (30) days of contract performance start date, designate in writing to the KO and COR, a single point of contact to be the Designated Contingency Coordinator (DCC) within the Contractor’s organization. The DCC shall coordinate with the COR to participate in the installation contingency and mobilization planning activities. The DCC, through coordination with the COR, shall participate in the local installation mobilization planning and execution conferences and shall modify and maintain appropriate Contractor contingency plans to compliment or enhance corresponding installation plans. No travel will be required for the planning activities and conferences referenced in this paragraph.

1.10 Mission Essential Services.

1.10.1 The Government has identified all of the contractor services performed under this contract as essential contractor services that must be executed during emergency and/or crisis events. All tasks listed in PWS Part 5, Specific Tasks, are mission-essential functions. Mission-essential functions means those organizational activities that must be performed under all circumstances to achieve DoD component missions or responsibilities. Failure to perform or sustain these mission essential functions would significantly affect DoD’s ability to provide vital services or exercise authority, direction, and control. The Contractor shall maintain and update the Mission-Essential Contractor Services Plan in accordance with DFARS Clause 252.237-7023, as necessary. Any changes made to the Mission-Essential Contractor Services Plan shall be submitted to the COR and KO no more than 10 days prior to implementation.

1.11 Post Award Conference/Periodic Progress Meetings. The Contractor shall attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation Subpart 42.5. The KO, COR, and other Government personnel, as appropriate, may meet periodically with the Contractor to review the Contractor's performance. At these meetings the KO will apprise the Contractor of how the Government views the Contractor's performance, and the Contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the Government.

1.11 Contracting Officer (KO). The KO is the only person authorized to direct changes in any of the requirements under this contract, and, notwithstanding any provisions contained elsewhere in this contract, said authority remains solely with the KO. In the event the Contractor makes any change at the direction of any person other than the KO, the change shall be considered to have been made without authority and solely at the risk of the Contractor. Communications pertaining to contract administration matters shall be addressed to the KO. No changes in or deviation from the terms and conditions shall be affected without a written modification to the contract, executed by the KO, authorizing such changes.

1.12 Contracting Officer Representative (COR)/ Alternate COR. The COR will be identified by separate letter. The COR and ACOR monitors all technical aspects of the contract and assists in contract administration. The COR and ACOR are authorized to perform the following functions: ensure that the Contractor performs the technical requirements of the contract; perform inspections necessary in connection with contract performance; maintain written and oral communications with the Contractor concerning technical aspects of the contract; issue written interpretations of technical requirements, including Government drawings, designs, specifications; monitor Contractor's performance and notify both the KO and Contractor of any deficiencies; coordinate availability of government furnished property (if required), and provide site entry of Contractor personnel. A letter of designation issued to the COR and ACOR, a copy of which will be sent to the Contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR and ACOR are not authorized to change any of the terms and conditions of the resulting contract.

1.13 Key Personnel. The following personnel are considered key personnel by the government: Program Manager (PM) and Site Security Managers (SSM).

1.13.1 Program Manager (PM): The Contractor shall provide a contract PM who shall be responsible for the performance of the work. The name of the PM who shall act for the Contractor when the PM is absent, shall be provided in writing to the KO on the first day of the Phase-in period. The PM shall have full authority to act for the Contractor on all matters relating to daily operation of this contract. The PM shall be available during regular hours of operation as defined in PWS paragraph 1.6.4. Qualifications for the PM are as follows: The PM shall be able to understand, speak, read, and write the English language. Historically the PM is not located at Fort Bragg NC 28310 and resides at the location of the awarded contractor.

1.13.2 Site Security Managers (SSMs): Serves as the manager for a specific ID card facility. The SSM performs all roles of the VO plus represents the site as the Subject Matter Expert (SME) for DEERS and ID Card policy and procedures. The SSM contacts DMDC and/or APO for elevated DEERS and ID card issues, installs hardware components, troubleshoots equipment and software issues, manages and trains site users, ensures the security of cardstock, consumables, and equipment, runs, and reviews audit reports, and maintains the site’s information for the RAPIDS Site Management Tool (SMT). The SSM also performs RAPIDS security overrides for document and fingerprint support. To perform these responsibilities, the SSM uses Security Online, Inventory Logistics Portal (ILP), Statistical Analysis Software (SAS), SMT, RAPIDS Configuration Tool, and the VOIS. Other requirements of an SSM include:

a. An ID card facility is required to have two RAPIDS certified SSMs always assigned to the site. It is the site’s responsibility that a new SSM is added to the site and RAPIDS certified before an SSM departs.

b. SSMs are responsible for:

(1) User administration and user security

(2) Cardstock and consumables: ordering, management, and accountability

(3) Policy and procedure compliance

(4) Site administration and security

(5) Documentation and training

(6) Installation of hardware components

(7) Validation of the identity of individuals whose fingerprints cannot be captured.

(8) Document overrides in the event a CAC recipient does not have proper identification documents.

c. SSMs must:

(1) Be accountable for maintaining all RAPIDS workstation hardware components. Perform regular maintenance and upgrades to improve equipment functionality and efficiency. All activities to include relocating the RAPIDS hardware must be coordinated through the APO and approved by DMDC. If a site fails to properly follow guidance and inventory is lost, stolen, or misplaced, the site will be responsible for providing funds to DMDC to replace items.

(2) Make sure to receive, accept, and open cardstock shipments in the ILP before attempting to issue them. Keep on-hand cardstock count up-to-date and report any discrepancies using the Cardstock and Consumables Order Form. SSMs can find the order form on the VOIS.

(3) Return all CACs and USID Cards to DMDC. This includes cards that are returned by customers, security officials and HR personnel.

(4) Manually request emergency CAC/USID card shipments and consumables.

(5) Ensure that the RAPIDS system is included in their local Continuity of Operations Plan (COOP). Utilize the RAPIDS COOP Template posted on the VOIS.

(6) Access the RAPIDS Configuration Tool to install new or replacement hardware devices.

(7) Add, Change, or Delete VOs in Security Online.

(8) Keep up with all RAPIDS/DEERS/ID card policies and procedures and ensure personnel, to include the installation community, is aware of changes pertinent to them. Monitor the VOIS website daily to receive new Messages of the Day (MOTD) and DMDC newsletters.

(9) Read and disseminate the quarterly Army Project Office Digest to site personnel.

(10) Ensure SSMs and VOs sign the DD Form 2841 to fulfill their LRA responsibilities for issuing an identity or network credential, reflecting PKI certificates to the card receipt. The DD Form 2841 is maintained locally by the SSM.

(11) Ensure RAPIDS hardware custody and accountability. DMDC maintains custody and accountability of RAPIDS hardware and supporting software. The SSM keeps the DD Form 1149 Requisition and Invoice/Shipping Document on file for equipment inventory, including taking measures for accountability of equipment during staff turnover. Note: RAPIDS facilities are custodians of DMDC hardware/software assets by controlling, supervising, and managing the property in their care as listed in DoDI 5000.64, Accountability and Management of DoD-Owned Equipment and Other Accountable Property. RAPIDS equipment life cycle requires replacement due to use, new and emerging technologies. When the RAPIDS equipment is no longer in use (life cycle is complete), return the equipment to DMDC.

(12) Ensure physical security and must maintain the RAPIDS platform as provided. DMDC prohibits altering of RAPIDS hardware configurations and software modifications, including, placing alternative boot/reboot media, or connecting non-approved external storage media devices, and unauthorized moving of equipment. Note: RAPIDS facilities who fail to follow published guidance and inventory is lost, stolen, damaged, or misplaced are responsible for replacement costs to DMDC.

(13) Ensure proper security and access control by ensuring users at the site:

(a) Keep their CAC and PIN secure.

(b) Make sure that the user who is logged in to the RAPIDS workstation is the only one completing transactions in RAPIDS.

(c) Make sure the workstation monitors face away from the customer and that a privacy screen is used.

(d) Ensure that there are sound barriers around the workstation to protect audible data exchange with customers.

(e) ALWAYS remove their CAC from the card reader when leaving the RAPIDS workstation. If leaving the RAPIDS workstation for long periods, log off the workstation so that the next person can log on. Always keep your CAC with you.

(f) Store all cardstock (used, unused, failed, and confiscated), and consumables in a locked drawer/cabinet/safe away from customer view or unauthorized access, during and after duty hours. Secure RAPIDS equipment in a locked area after duty hours.

(g) Allow only DMDC authorized software and hardware to be installed on the RAPIDS workstation.

(14) Ensure that during ID card issuance:

(a) Make sure the background behind the customer is solid white and does not display any patterns, symbols, etc.

(b) Site users educate customers about the CAC. Request that the customer read the posted DD Form 2842, Acknowledgement of Responsibilities, as being a CAC holder. Before issuing an ID card, the customer will have to agree to the terms of the DD Form 2842 by digitally signing this document. Be sure the customer is aware they are signing a legally binding document.

(c) The customer and RAPIDS operator remain at the workstation during the entire CAC issuance process.

(d) Site users provide the customer with a DMDC issued CAC protective sleeve and instruct them to keep their CAC in the sleeve or a plastic cardholder to protect it from damage. The customer should not place stickers on, write on, stamp, or punch holes in their CAC.

(e) Site users write the correct error code on CACs that fail during issuance or CACs that are confiscated. A full list of ID Card Error Codes is available on the VOIS.

(15) Ensure proper RAPIDS Workstation Maintenance:

(a) Always keep the Virtual Private Network (VPN) connected on the RAPIDS workstation to allow for software updates. For more information on how to sustain VPN connection on workstation(s), see the VPN Connectivity Tip Sheet on the VOIS.

(b) Maintain the fingerprint scanner by wiping it down after every use with a dry lens cloth. Do NOT use any alcohol-based substances to clean the platen.

(c) Clean the Smart Card printer regularly to reduce the frequency of printer failures and ensure that the printer is operating efficiently to produce high quality cards. Refer to the Printer Cleaning Instructions on the VOIS.

(d) Because Smart Card printer consumables have a shelf life of 12-18 months, sites should practice the first-in, first-out inventory methodology. Mark the outside of the consumable’s package with the date received and use the oldest consumables first.

(e) Destroy the Smart Card printer ribbon and transfer film that contains PII. The Privacy Act protects PII. Dispose of the printer consumables in accordance with local security procedures (i.e., shredding). The APO does not recommend burning the ribbons because the materials will emit hazardous gases. Refer to the Proper CAC Printer Ribbon and Re-transfer Film Disposal/Destruction Policy on the VOIS.

(f) Sites must install any shipped maintenance replacement components within 3 days of receipt and return the component needing repair to the maintenance vendor, using the prepaid shipping label that accompanies the replacement equipment.

d. The verification of the Primary and Secondary fingerprint may be necessary if the VO cannot successfully match an individual’s fingerprint or when the beneficiary is not present. The SSM can perform the skip fingerprint verification when a person’s identity can be verified through another means or is already positively identified.

e. For high-volume Common Access Card Central Issuance Request Station (CACCIRS) sites:

(1) Prior to creating a Central Issuance Facility (CIF) request on a CACCIRS workstation, the SSM must establish a Person in Charge (PIC) who will be responsible for CAC distribution. Once the PIC has been identified, the SSM must add the PIC to the site PIC list in RAPIDS.

(2) Proper security procedures dictate that one SSM receives the CACs and a different SSM receives the PIN mailer shipments. For the most up-to-date information about CACCIRS sites, SSMs should refer to the ILP User Guide located on the VOIS. Failure to receive the CACs or PINs, as well as failure to accept the CACs in the ILP, prevents CAC recipients from accessing a DoD network.

1.13.2.1 SSM Specific Responsibilities.

a. SSM Applications. SSMs will utilize the following applications to fulfill their duties:

(1) Security Online. SSMs perform all user administration functions through Security Online, which include adding a user to a site, assigning roles to a new user, updating user information, deactivating a user, and managing site information.

(a) SSMs are responsible for verifying with their appropriate command security office the appropriate vetting has been initiated on behalf of a VO. Once verified, a VO can be added to the site roster via the Security Online application.

(b) After adding a new user to the site, the SSM is responsible for assigning roles that provide a user with access or privileges. The SSM can only assign the roles of a VO and cannot assign the roles of SSM. A The APO must endorse the request to assign SSM roles. If the SSM assigns a new VO role, they must ensure they meet security requirements to access RAPIDS. The SSM will need to assign the following roles to VOs to issue Common Access Cards (CACs):

1.Issuing Official (IO) – verifies data and issues ID cards but cannot enter data into DEERS

2. Verifying Official (VO) – verifies or authenticates the registered individual against the DEERS database.

3. Local Registration Authority (LRA) – entity authorized by a RA to verify subscribers’ identity and collect information for public key certificates, and to forward requests for certificates to the CA.

(c) The Security Online application also provides the SSM with the capability of reviewing the contact information and roles assigned to all RAPIDS users associated with the site. In addition, the Security Online application will allow the SSM to monitor the training courses of all RAPIDS users.

(d) The SSM administrative responsibilities include updating contact information for their site. Keeping site information current is important to an ID Card facility because DEERS shares this information with other systems that are critical to the installation, maintenance, and support of RAPIDS. SSMs update the site contact information, which includes site mailing address, site location address, and site telephone numbers using Security Online.

(2) RAPIDS Device Configuration Tool. Provides a way for SSMs to install and configure components for the RAPIDS workstation. The SSM accesses this tool by clicking the RAPIDS Configuration icon on the RAPIDS desktop.

(3) Inventory Logistics Portal (ILP). Tool designed to track CAC and USID cardstock and automate the CAC/USID reorder process. The ILP automatically reorders CAC/USID cardstock based on the reorder threshold and reorder quantity specified for each site.

(a) There is 100 percent accountability at RAPIDS sites for CACs. All CACs are accounted for by the DMDC. ILP helps SSMs accomplish this.

(b) The ILP has three main functions:

1. Monitors and orders CAC cardstock based on the site’s inventory levels, card issuance rates, and assigned reorder threshold

2. Continuously updates the individual card status; options include Available, Issued, and Terminated

3. Tracks cardstock and consumables shipments

(4) Statistical Analysis Software (SAS). Using SAS, SSMs can access, run, customize, manage, save, and print RAPIDS reports. SAS helps SSMs manage security, technical and training issues at their site, as well as monitor cardstock and workload management. Using RAPIDS reports generated in SAS, SSMs will be able to track card transactions for CACs and USID cards issued from an ID card facility.

(a) SAS provides capabilities for reporting to include:

1. Ability to choose from three options to view, export and print reports

2. Ability to access RAPIDS reports from a CAC-enabled, non-RAPIDS workstation using a web browser

3. Ability to produce report output in various formats, including output type PDF and Excel. Note: Excel format is only available to view on a CAC-enabled, non-RAPIDS workstation

(b) RAPIDS reports should be run and reviewed by SSMs daily and weekly to help identify security, technical, or training issues at the ID card facility. After viewing daily reports, SSMs should consolidate report data by viewing a weekly report, which should replace the individual daily reports. At the end of each month, a monthly report should be run to replace the individual weekly reports. Quarterly reports should be run to replace the individual monthly reports. Once the daily, weekly, and monthly reports have been consolidated into a quarterly report, they can be deleted.

(5) Verifying Official’s Information System (VOIS). The VOIS provides real-time systems information, updated program information, and many other resources, such as archived MOTDs, points of contact (POC), RAPIDS documentation, and links to other Websites.

(a) RAPIDS users can access the VOIS from either a RAPIDS workstation or a CAC-enabled non- RAPIDS workstation. Please review each link to familiarize yourself with all the resources available to you on the VOIS.

(b) Below is a list of the significant documents in each section:

1. Policy—Separated into two sections:

a) DoD and Service-level Policy— DoDI 1000.13, DoDM 1000.13 v1 and v2

b) Supporting Memorandums—Memorandums from the Defense Human Resource Activity (DHRA)

2. RAPIDS User Guide—RAPIDS User Guides, Features and Enhancements (F&E) documents

3. Training Aids—Broken down into the following sections:

a) Tip Sheets – Procedures on performing various tasks within RAPIDS

b) DMDC Learning Site—DMDC LMS User Guide, Web-Based Training (WBT) Matrix, WBT Memo,

c) Posters & Flyers – How to Return CACs to DMDC flyer

d) Best Practices – Document Scanning Best Practices

4. Newsletters—Did You Know Newsletters

5. Hardware – Information on the Smart Card Printer, Camera, Fingerprint Scanner, Other Peripherals, Laser Printer, Desktop/Deployable/Shipboard System

6. Forms—Gives the user access to all the documentation and instructions regarding CAC issuance and ordering CAC consumables, including DD Form 1172-2, DD Form 2841, DD Form 2842, and the Cardstock and Consumables Order Form.

7. Security— Privacy Act Statement, Security Standard Operating Procedures (SSOP) for RAPIDS, RAPIDS Continuity of Operations (COOP) Planning Checklist

8. RAPIDS Related Applications—RAPIDS Site Locator, Mil Connect, DMDC RAPIDS Reporting Tool

9. Contacts—Help Desk Contact Centers, Service Project Officers (SPO), TASS Service and Agency SPOCs, Medical Project Officer List

10. Links—CAC.mil, Defense Health Agency, Other Resources

11. Messages of the Day (MOTD)

a) Presents the user with the current MOTD

b) Allows the user to view an archive of old MOTDs

12. What’s New—Documents that have been posted within the past 30 days

13. System Status

a) Provides an updated status diagram and table of the DMDC Network

b) Lists projected/scheduled outages

b. Managing Supplies in the ILP. The SSM must register the cardstock before using the media to create ID cards. To register the cardstock, the SSM must “Receive,” “Check,” “Accept,” and “Open” the cardstock. If the SSM does not perform these operations on each new shipment of cardstock, the media will not be able to complete the issuing process. For detailed procedures and guidance on how to Receive, Check, Accept, and Open the cardstock, please reference the ILP User Guide. The ILP User Guide can be located on the VOIS.

(1) If there is a need for an out-of-cycle ordering of cardstock or consumables, fill out the Cardstock and Consumable Order Form located on the VOIS and send the request to the APO explaining why you need an additional shipment.

(2) If you are manually ordering cardstock because of a discrepancy with the count of cardstock on hand versus the count in the ILP, identify the discrepancy in Section II of the Cardstock and Consumables Order Form. The APO reviews cardstock discrepancies against transactions.

(3) The Chip Unique ID (CUID) is the alphanumeric ID located in the upper right-hand corner on the back of the CAC. If the SSM enters an incorrect CUID, it will cause card count discrepancies in the ILP. These discrepancies are due to incorrect card statuses in the ILP. SSMs may need to manually input a CUID when the card reader cannot read the chip on the CAC. Inputting a CUID is a monitored activity. Failure to support this will result in continued on-hand reporting in the ILP.

(4) Reporting missing CAC/USID Cardstock. SSMs at each site are responsible for the proper management of all cardstocks sent to their site. If, despite all precautions, cardstock is missing the following actions must be taken:

(a) The SSM performs all due diligence to locate the missing cardstock (e.g., confirms tracking number, date of delivery, and signature of person who signed; and verifies that the cardstock is not in the mail room or other location on the base).

(b) If the cards cannot be located, the SSM reports the missing shipment to the APO.

(c) The APO contacts DMDC Customer Operations regarding the missing cardstock and initiates a formal investigation.

(d) DMDC marks the shipment as temporarily lost in the ILP. DMDC may provide cardstock support while the investigation is underway.

(e) The SPO provides a final report to DMDC Customer Operations. The report must include the following:

1. Details regarding the steps taken to locate the missing cardstock

2. Actions taken to prevent future cardstock losses

(f) DMDC reviews the report for completeness and notifies the SPO of the next steps to take.

1. If the report is satisfactory, DMDC marks the shipment as permanently lost in the ILP and removes it from the site’s inventory. Normal processing resumes.

2. If the report is unsatisfactory, DMDC requests additional information from the SPO. Additional actions may be required if mishandling of cardstock reoccurs at the site.

c. Returning CAC/USID Cardstock.

(1) Failed, rejected, or returned ID cards contain information regarded as Privacy Act and PII and must be returned to DMDC by FedEx using the DEERS/RAPIDS FedEx account number.

(2) DMDC monitors the FedEx account regularly. Sites should only use it for the return of cardstock. When using this number, your site will not incur shipping costs. DO NOT destroy, shred, or cut ID cards. RAPIDS operators are responsible for safeguarding ID cards by keeping them locked in a secure drawer, cabinet, or safe at your site until returned to DMDC for destruction. DMDC has a 100% accountability requirement for ID cards, so return all ID cards to DMDC for final destruction using the provided information below.

(3) SSMs must ensure that unauthorized persons do not obtain ID cards at sites by becoming familiar with the controls for processing and handling. SSMs should also inventory ID cards monthly or whenever an issuing officer is relieved of custodial duties.

(4) The DEERS database and RAPIDS application maintain security by linking the SSN of the sponsor to the type of card issued. For additional security, the DEERS database maintains a 4-digit alphanumeric security code, which is not visible to the user.

(5) As required by the Privacy Act of 1974, all returned cardstock should be double packaged for return to DMDC to protect the PII displayed on the printed ID card.

(a) The first (inner) package should be a large brown envelope or box marked "For Official U.S. Government Use Only". The inner package should contain the returned CACs, a cover sheet stating the number of ID cards, site ID, and site contact information, and the Privacy Act Data Cover Sheet, which identifies the cardstock as containing PII data.

(b) The second (outer) package should be a box from Federal Express or from your site. Insert the first (inner) package into the second (outer) package for return shipment using the FedEx account provided by DMDC or by an approved traceable means; in the rare instance your location cannot access FedEx shipping support.

(c) Inspect the outer box to ensure that it is in good condition and can be properly sealed. There should be no markings on the outer box. The box must be able to withstand the weight of the cardstock and should not break when in transit. If a box breaks or opens in transit, you risk exposing PII data contained on the returned ID cards.

(d) ID cards contain Privacy Act data, and it is your responsibility to ensure that a Privacy Act Data Cover sheet is included in the package. The Privacy Act Data Cover Sheet is in the Chapter 18: Appendices. Print the Privacy Act Data Cover Sheet in color.

(e) Complete Section 1, including a commercial telephone number.

(f) Complete Section 3:

1. CAC Consumables Team, 2 (800) 372-7437 Defense Manpower Data Center

3. 2102 E. 21st Street N

4. Wichita, KS 67214

(g) Under Section 4a, check the FedEx Express Saver checkbox.

(h) Under Section 7, Payment, check the Third-Party checkbox and enter the following FedEx Account number: 2283-7326-5

(i) Include a cover sheet specifying the number of returned ID cards, your Site ID, and the contact information for your Site.

(j) Place returned ID cards and the Privacy Act Data Cover Sheet into a FedEx envelope or package marked "For Official Government Use Only".

(k) Affix the FedEx US Air bill to the package and arrange for pickup or drop off.

(l) Remove and retain the back copy of the FedEx US Air bill (labeled Recipient’s Copy) for your records.

Note: SSMs should use the FedEx account number above to return cardstock only. DMDC regularly monitors this account. If you have further questions, please contact the DSC User Help Desk.

(6) For more information on returning cardstock and CACs, refer to the ILP User Guide on the VOIS.

d. Handling and Safeguarding of Cardstock and Consumables.

(1) As an SSM, you are responsible for safeguarding your site’s cardstock. Whenever you receive new blank cardstock, keep it in the factory shrink-wrapped package, locked in a secure drawer, cabinet, or safe at your site until it is loaded into the ID card printer. Once loaded into the printer, do not remove the cardstock. Cardstock may remain in the printer when not in use for short periods (e.g., overnight) if the printer is properly safeguarded from unauthorized access. Sites are responsible for safeguarding their cardstock. A locked office door with limited access to authorized personnel is an example of safeguarding cardstock.

(2) Used printer consumables contain information regarded as Privacy Act and PII. The printer ribbon and transfer film contain information that is printed on the cardstock produced in the Smart Card printer. It is important that sites destroy or properly dispose the printer ribbon and transfer ribbon...

(3) Remove cardstock media and printer consumables before shipping the Smart Card printer. It is important to keep all printers in good working order by performing routine maintenance as required by the DMDC.