I.B.3_PWS.pdf

PERFORMANCE WORK STATEMENT

For

EDUCATION SUPPORT SERVICES CONTRACT

Part 1

GENERAL INFORMATION

1.1 INTRODUCTION

1.1.1 This is a non-personal services contract to providing educational administrative support services required by the Army Continuing Education Division (ACED) in the Office of the Adjutant General Directorate (TAGD) and its subordinate agencies. The contractor shall provide services in accordance with (IAW) the terms, conditions, and specifications of this contract. This work includes but is not limited to any function, which is necessary during the processing of educational benefits and programs.

Beginning upon initial receipt or contact, research and review required regulations, records, and law;

develop a recommendation on the disposition for government approval, prepare responses for signature, release dispositions to required agencies or claimants, and other related services as further defined herein.

The government will not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the contractor who, in turn, is responsible to the government. Significant impact to services provided under this contract may occur during transformation periods. Modifications to the contract for significant increase or decrease in workload will be negotiated between the Contracting Officer (KO), the Government and the contractor. For planning purposes, the government has included historical workload data pertaining to this requirement in technical exhibit 3 (TE 3).

1.1.2 TAGD is a large directorate under the Army Human Resources Command (HRC). The overall TAGD mission is implementing and sustaining various human resource programs, services and systems that enable readiness and sustain the well-being of the Army team. TAGD seeks to provide centrally managed contracting support for the comprehensive range of services covered in the TAGD mission.

1.1.3 Army Continuing Education System (ACES) is the proponent for an integrated system of adult education programs and services, as defined and described in Army Regulation (AR) 621-5, ACES, dated 11 July 2006, Rapid Action Revision issued 6 September 2009. The ACES vision is that every Soldier participates in the voluntary education program and every eligible Soldier uses TA for degree completion.

ACES promotes lifelong learning, readiness and resilience through flexible and relevant education programs, services and systems in support of the Total Army.

1.2 WORK OVERVIEW

1.2.1 Scope of Work. Contractor work and responsibility shall include all contractor planning, programming, administration, management, supervision, and execution necessary to provide specified services. The contractor shall conduct work in accordance with (IAW) this contract and all applicable federal, state, and local laws, standards, codes, regulations, and directives to include applicable publications mentioned throughout the Performance Work Statement (PWS) and found in Section 6 of this contract. The contractor shall ensure that all work meets critical reliability rates or tolerances specified in the PWS, the Performance Requirements Summary (PRS), TE 1, or in applicable referenced documents. The contractor shall perform all contractor-related administrative services, such as material requisitioning, Quality Control (QC), financial control, and correspondence, in order to comply with the PWS. The contractor shall acquire and maintain accurate and complete records, files, and libraries of documents to include federal, state, and local regulations, codes, laws, technical manuals, and manufacturer's instructions and recommendations, which are necessary and related to functions being performed. The contractor shall compile historical data, prepare required reports, and submit information as specified by the Deliverables Scheduled, Technical Exhibit 2.

1.2.2 Place of Performance. All of the work will be performed at Fort Knox, Kentucky.

1.2.3 Customers Supported. The contractor shall provide support and service for agencies under TAGD, ACED, and other organizational elements having support agreements with Fort Knox. Units and activities are subject to change during the contract period.

1.2.4 Functional Areas. Work to be performed by the contractor is categorized under Functional Areas, found in Section 5. Functional areas covered by this contract are numbered as follows:

1.2.4.1 Paragraph 5.1 – Contract Operations Management

1.2.4.2 Paragraph 5.2 – Education Services Career Program (CP31) Support

1.2.4.3 Paragraph 5.3 – ACED Office Operations Support

1.2.2.4 Paragraph 5.4 – Army Personnel Testing Program Support

1.2.2.5 Paragraph 5.5 – GoArmyEd Program Support

1.2.2.6 Paragraph 5.6 – Postsecondary School Management

1.2.2.7 Paragraph 5.7 – Joint Services Transcript

1.2.2.8 Paragraph 5.8 – Tuition Management Team Support to include Tuition Recoupment/Refund

1.2.2.9 Paragraph 5.9 – Government Approved School Invoice Processing Support

1.2.2.10 Paragraph 5.10 – American Council on Education (ACE) Military Evaluations Program

1.2.2.11 Paragraph 5.11 – Processing of Claims, Inquiries and Requests for Information for Post 9/11

1.2.2.12 Paragraph 5.12 – Documentation and Reports

1.3 Administrative

1.3.1 Restricted Areas. The contractor shall comply with mandatory security access requirements to restricted areas such as the communication center; promotion boards areas, and other sensitive item areas.

Contractor personnel working in restricted areas may be required to sign in and out and state the nature of their business at the entrance desk. A list of these facilities will be made available to the contractor during the contract kick-off meeting. Work performed in restricted areas shall be coordinated with the respective restricted area security officer and the Contracting Officer’s Representative (COR).

1.3.2 Security Inspections. Security inspections will be conducted by Defense Security Service. The Installation Security Office may conduct a spot check of the contractor to ensure compliance with AR 380-67, Army Security Program.

1.3.3 Government Personnel. The contractor shall interface with government personnel in performance of this contract.

1.3.4 Other Contractors. Other government contractors will be performing services in areas associated with requirements of this contract. Some contractors will be providing services associated with, and in support of, work identified in this contract. The government will facilitate initial contact between contractors performing other contracts and this contract. The contractor shall provide all further required coordination between contractors for any task specified in this contract that relates to or impacts on any other contracted work.

1.3.5 Disputes with Customers or Other Government Contractors. The contractor shall verbally notify the Contracting Officer (KO) and COR of unresolved disputes in receiving support from or providing support to customers or other contractors no later than (NLT) two work hours from time of dispute. The contractor shall provide written notice of dispute resolution(s) to the KO NLT two workdays after resolution.

1.3.6 The contractor shall copy the COR on all correspondence with the KO so that they can maintain program situational awareness and ensure contract continuity.

1.4 PERFORMANCE

Quality Control. The contractor shall develop and maintain an effective Quality Control Program (QCP) to ensure services are performed in accordance with this PWS. The contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The contractor’s quality control program is the means by which he assures himself that his work complies with the requirement of the contract. The QCP (electronic version) will be delivered by the Contractor to the Government within 30 days after contract award and each option period. Electronic copy of a comprehensive written QCP shall be submitted to the KO and COR within 5 working days when changes are made thereafter. After acceptance of the quality control plan the contractor shall receive the contracting officer’s acceptance in writing of any proposed change to his QC system.

1.4.1.1.1 The procurement objectives, associated standards, metrics, and quantitative values for each metric shall be reported in the monthly status report (MSR) that clearly identifies the monthly performance level against each procurement objective.

1.4.1.1.2 The QCP shall include a customer comments and complaint program, and quantitative processing system. The program shall allow identification and correction of validated customer complaints and provide feedback to the government and customers on corrective action(s) taken. The term customer refers to customers internal and external to the organizations identified by this contract.

1.4.1.2 The QCP shall be incorporated into the Contractor Consolidated Plan referenced in PWS paragraph 5.13.6.

1.4.2 Quality Control Files. The contractor shall maintain a file of all inspections or tests conducted by the contractor, to include any corrective actions taken in accordance with Federal Acquisition Regulation (FAR) part

46.102 and 46.105.

1.4.3 Government Quality Assurance. The government will evaluate the contractor’s performance under this contract IAW the Quality Assurance Surveillance Plan (QASP). This plan is primarily focused on what the government will do to ensure that the contractor has performed IAW the performance standards set forth in the Performance Requirement Summary (PRS). The KO and COR will inspect for compliance with contract terms throughout the contract period. The government will monitor the contractor's performance under this contract by performing checks that may include a combination of random sampling, planned sampling, scheduled inspections, incidental inspections, and validated customer complaints.

1.4.4 Inspection Reports. The government will record surveillance inspections. When the contractor's performance is unsatisfactory, the Government may issue a Non Conformance Report (NCR). The contractor shall reply in writing NLT ten workdays from the date of the NCR, giving reasons for unsatisfactory performance, corrective action taken, and procedures to preclude recurrence.

1.4.5 Participation in Government Quality Assurance. In addition to performing contractor quality control, the contractor shall participate in government quality assurance programs as defined in the functional areas of this contract and as required by the COR.

1.5 STAFFING

1.5.1 The contractor shall provide trained employees who are able to work independently within the specified period of performance. Employees shall have working knowledge of the Department of Defense and other education programs and services, government acronyms, and military unique procedures. They shall have capability to research records and communicate the findings both orally and in writing. Proficiency in MS Office, Internet Explorer, Adobe Acrobat/Pro and other general office related software is required. Knowledge of office computer skills is required for all contractor positions supporting this requirement. No special certifications are required.

1.5.2 Contractor personnel supporting the “Postsecondary School Management” (PWS paragraph 5.6) shall have knowledge of MS Office database management software.

1.5.3 The contractor shall provide trained employees who can work independently. Contractor employees shall be trained, qualified, certified, or licensed as required in this contract prior to starting work.

With the exception of mandatory training identified in PWS paragraph 1.6.19.3, the government will not provide initial skills training to contractor employees. The contractor shall maintain records of training qualifications, certifications, and licenses. The contractor shall maintain the workforce in such a manner as to ensure that employees remain fully qualified to perform work assigned.

1.5.4 The contractor employees shall have the ability to understand military rank structures, personnel classification testing, and military acronyms. They shall be able to analyze, research, and interpret Army regulations and policies. Possess a moderate level of logical reasoning with the ability to articulate their thoughts both verbally and in writing.

1.5.5 Project Manager / Alternate Project Manager.

1.5.5.1 Project Manager (PM). The contractor shall provide a PM who shall be responsible for the performance of the work, task order compliance and quality control. The PM is responsible for the planning and execution of all activities related to the contract. The PM shall ensure that all personnel assigned to a task meet government qualification standards and receive necessary training. The PM shall review subcontractor deliverables, invoices and approvals for payment. The PM shall review all deliverables prior to their submission for acceptance. The PM shall possess experience in managing large-scale government projects, and be familiar with government policies and procedures. The PM shall have knowledge of military personnel automation systems and be able to work in a digital environment. The PM shall possess good analytical skills, time management, and be an independent thinker. Proficiency in MS Office is required. The PM shall be a self-starter and be an analytical thinker. The PM shall be employed by the prime contractor. The PM APM (in the absence of the PM) shall have full authority to act for the contractor on all contractual matters relating to daily operation of this contract. This authority shall extend to any subcontractors employed by the prime in support of this contract.

1.5.5.1.1 Education, training and experience required and a Bachelor’s degree in Education Services or Business Administration/Management, Workforce Development or related field; and six to eight years of experience in the field or in a related area pertinent to education services; or a Master’s degree from an accredited college, and minimum of six years’ experience in training and administration experience, and project management in the “customer related” service field.

1.5.5.1.2 Prior military experience or experience with the Army military education programs (i.e.:

GoArmyEd, Post 9/11 GI Bill, etc.), and familiarity with government logistic procedures is preferred.

1.5.5.1.3 The PM is considered essential to the performance of this contract. The name, qualifications and a copy of the proposed PM’s resume shall be included as part of the contractor’s technical proposal.

Submit notification of PM change/replacement along with name and qualifications of replacement(s) to the KO and COR NLT 15 calendar days before change. Replacements shall meet or exceed qualification standards set in this PWS.

1.5.7.2 Alternate Project Manager (APM). The contractor shall provide an APM who shall be responsible for the performance of the PM’s tasks in their absence. APM shall possess experience in managing large-scale government projects, and be familiar with government policies and procedures. The APM shall have knowledge of military personnel automation systems and be able to work in a digital environment. The APM shall possess good analytical skills, time management, and be an independent thinker. Proficiency in MS Office is required. The APM shall be a self-starter and be an analytical thinker. The government recommends that the APM be an employee of the prime contractor; however, in the event he/she is not, the individual shall still have the same authority as the PM during his/her absence (i.e.: leave, medical, etc.). The APM (in the absence of the PM) shall have all the authority of the PM, and shall be able to act for the contractor when the designated program manager is absent.

1.5.7.2.1 Education, training and experience required and a Bachelor’s degree in Education, Business Administration/Management, Workforce Development or related field; and three to five years of experience in the field or in a related area pertinent to education services.

1.5.7.2.2 Prior military experience or experience with the Army military education program (i.e.:

GoArmyEd, Post 9/11 GI Bill, etc.), and familiarity with government logistic procedures is preferred.

1.5.7.2.3 The name and qualifications of the APM shall be provided to the KO and COR via e-mail NLT five workdays before end of Phase-In period and the beginning of the contract full performance. Submit notification of APM change/replacement along with name and qualifications of replacement(s) to the KO and COR NLT 15 calendar days before change. Replacements shall meet or exceed qualification standards set in this PWS.

1.5.8. Contractor functional lead staffing requirement for Education Services Career Program (CP31) Support (PWS Paragraph 5.2); ACED Office Operations Support (PWS Paragraph 5.3); Army Personnel Testing Program Support ((PWS Paragraph 5.4); GoArmyEd Program Support (PWS Paragraph 5.5);

Postsecondary School Management ((PWS Paragraph 5.6); Joint Services Transcript (PWS Paragraph 5.7); Tuition Management Team Support to include Tuition Recoupment/Refund (PWS Paragraph 5.8);

Government Approved School Invoice Processing Support (PWS Paragraph 5.9); American Council on Education Military Evaluations support (PWS Paragraph 5.10); and Processing of Claims, Inquiries and Requests for Information for Post 9/11 (PWS Paragraph 5.11). The contractor shall provide a functional lead with a minimum of an Associate’s Degree or 60 semester hours, as well as, two years of experience that has equipped the person with the knowledge, skills and abilities to perform the task.

1.5.9. Guidance on Contractor Employees used to support this contract

1.5.9.1. Personnel. The contractor shall not employ any person whose employment will violate the joint ethics requirements of Department of Defense (DoD or DOD) DoD Reg. 5500.7-R. The contractor shall employ only persons that are legal residents of the United States to accomplish work specified in this contract.

1.5.9.2 Language. The contractor shall employ only persons able to speak, read, write, and understand fluently English for those positions interacting with government and other personnel in performance of this contract, or where English is used or essential to provide the product, record, data, information, or service.

1.5.10 Contracting Officer's Representative (COR). The COR will be appointed by the KO by separate letter. The COR will monitor all technical aspects of this contract and assists in contract administration.

A letter of appointment issued to the COR, a copy of which is sent to the contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost/price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting order.

1.5.11 Contracting Officer’s (KO) Authority. The KO is the only person authorized to direct changes in any requirements under this contract and, notwithstanding any provisions contained elsewhere in this contract, said authority remains solely with the KO. In the event that the contractor effects any change at the direction of any person other than the KO, the change will be considered to have been made without authority and solely at the risk of the contractor.

1.6 ADMINISTRATION

1.6.1 Legal Federal Holidays. The contractor shall observe the following as legal public holidays.

Consequently, the contractor is not required to perform services on the following federal holidays:

New Year’s Day Labor Day Martin Luther King (MLK) Jr.’s Birthday Columbus Day President’s Day Veteran’s Day Memorial Day Thanksgiving Day Independence Day Christmas Day

NOTE: The Department of Labor (DoL) Service Contract Act (SCA) wage determinations applicable to this procurement may require other holidays in addition to the above stated observances. The contractor shall be responsible for complying with all wage determination requirements and other appropriate/applicable DoL laws and regulations.

1.6.2 Core Hours. The contractor shall be responsible for conducting business between the hours of 7:30 am and 4:00 pm (Eastern Time), Monday thru Friday, except Federal holidays or when the government facility is closed due to local or national emergencies, administrative closings, or similar government directed facility closings. Any variance in operating hours will be approved by the KO. The contractor shall at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the government facility is not closed for the above reasons. When hiring personnel, the contractor shall account for stability and continuity of the workforce. Specific allowances may be made to accommodate situations to adjust operating hours in the event of adverse weather or other situations that risks personal safety and cause installation closure.

1.6.3 Installation Closures. Announcements of installation closures will be made in the following manner: during normal duty hours, notification will be given through normal chain of command; during non-duty hours, notification will be made through local radio and television channels. The contractor shall follow the same guidelines as the government under delays or closures.

1.6.4 Training Holidays. Installation commands have historically granted military personnel (enlisted and officers) training holidays (i.e. Friday after Thanksgiving) in addition to the ten Federal holidays listed above. Training holidays are not considered a day of excused absence for the contractor.

1.6.5 Contractor Identification.

1.6.5.1 Identification of Contract Employees. All contractor personnel attending meetings, answering government telephones, and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are government officials.

1.6.5.2 Contractor Generated Products. The contractor shall ensure that all documents or reports produced by contractor employees are suitably marked as contractor products or that contractor participation is appropriately disclosed. All documents shall clearly contain the contractor’s company name, date the document was created, full name of the contractor personnel(s) creating the document, and a contractor Point Of Contact (POC) with contact information (phone number and e-mail) in the event there are questions regarding the document. The contractor shall insert the following statement at the header of all contractor-generated documents: “The information contained in this document was generated by “contractor name” for use by the U.S. Government.”

1.6.5.3 Contractor/Subcontractor Identification Badge (ID). The contractor shall furnish a numbered Identification (ID) badge to all employees providing direct service to the government under this contract.

The ID shall at a minimum contain, the employee’s name, their picture, the contractor/subcontractor company information, functional area of assignment (Division/Branch) contract title, office number, and badge expiration date (not to exceed end of final option period). Contractor shall furnish all contractor ID badges NLT first workday of contract employee performance in support of this contract.

1.6.5.4 Display of Contractor/Subcontractor ID Badge. Contractor/subcontractor personnel shall wear this ID badge in a visible area at all times during performance of this contract and shall be clearly visible from at least eight feet distance. Contractor personnel shall wear the company issued badge above the waist of their clothing at all times when performing work under this contract. Preferably, contractor/subcontractor personnel on duty shall wear their ID badge on the upper front quadrant of the outer garment at all times when at work, during performance of this contract. Badge shall not be hidden under clothing or in a pocket and shall be displayed at all times while on the military installation. If wearing of the ID badge in the designated location should constitute a safety hazard, the contractor shall designate an alternate location for display of the ID badge for the employee affected.

1.6.5.5 Answering Telephones. At all times when answering government phones or calling customers, claimants or supporting agencies Contractor personnel shall identify themselves as contractor employees (for example, John or Jane Doe, ABC Corp).

1.6.6 Command Interest. The contractor shall notify the KO and COR immediately on matters within the scope of this contract which impact the installation, government funds, or satisfactory performance of this contract and follow-up in writing via e-mail NLT one workday of the discovery of the matter.

1.6.7 Security Guidance.

1.6.7.1 Security Requirements.

1.6.7.1.1 The contractor shall anticipate working with DoD Information Technology (IT) systems that require strict adherence to the DoD security investigation policies in effect at the time an employee is assigned to work on the contract. Failure to safeguard any sensitive information which may involve the contractor or the contractor’s personnel, or to which they may have access may subject the contractor and/or the contractor’s employees to criminal liability. Provisions of the privacy act apply to all records and reports maintained by the contractor.

1.6.7.1.2 Defense Federal Acquisition Regulation Supplement (DFARS) Compliance. Contractor will comply with DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting. Contractor is required to implement applicable security controls listed in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, "Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations" to safeguard covered defense information that is processed or stored on their internal information system or network. Contractor is required to provide "adequate security" (as defined by DFARS 252.204-7012) for covered defense information that is processed, stored, or transmitted on the contractor's internal information system or network.

1.6.7.1.3 The contractor shall comply with all installation security requirements and requirements specified herein. The contractor shall establish and implement a security plan to include access to controlled areas, control of classified material and equipment, security of vehicles, facilities, and equipment, and handling of sensitive and pilfer able material. The following regulations shall be used as a guide for developing these plans: AR 190-11, AR 190- 13, AR 190-51, AR 25-2, AR 380-5, AR 380-67, FM 3-19.30, DoD 5220.22-M and DoD 5220.22-R. The security plan shall be incorporated into the Contractor Consolidated Plan referenced in PWS paragraph 5.13.6.

1.6.7.1.4 Prior to a new contractor employee in-processing with HRC, Ft Knox, KY the contractor shall either submit a Visit Request thru the Joint Personnel Adjudication System (JPAS) to the HRC Security Office or a Visit Authorization Letter (VAL) to the COR and the HRC Security Office NLT seven workdays prior to their arrival or report date. Requests submitted in JPAS shall include the supported contract number. The VAL shall be used to validate background investigations to ensure compliance with minimum computer access requirements (AR 25-2). Personnel reporting into HRC shall be vetted which includes possessing the minimum investigation, entrance into Contractor Verification System (CVS), and possession of a contractor’s CAC (reference PWS paragraph 1.6.8.4). The VAL shall be on the contractor’s organizational letterhead and include the following information:

1.6.7.1.4.1 Contractor name and cage code

1.6.7.1.4.2 Contract # being supported

1.6.7.1.4.3 Employee Full Name, social security number (SSN), DOB and POB

1.6.8.1.3.4 Type Investigation and date (Submitted/Open/Closed)

1.6.7.1.4.5 Date Central Clearance Facility (CCF) Adjudicated or interim granted

1.6.7.1.4.6 Name of HRC government point of contact (include the Directorate when known)

1.6.7.1.4.7 Name of COR and Contact Information (phone and e-mail)

1.6.7.1.4.8 Start and end date of visit

1.6.7.1.4.9 If subcontracted, identify primary contracted organization and cage code

1.6.7.2 Access to Personally Identifiable Information and Protected Health Information. If the contractor has access to this information, provisions of the privacy act apply to all records and reports maintained by the contractor IAW Health Insurance Portability and Accountability Act (HIPAA) of 1996, PII, PHI, and AR 25-2. The contractor shall safeguard information of a confidential or sensitive nature, also known as PII and PHI. In addition, the contractor, unless otherwise authorized by the government, shall limit access to PII and PHI to those employees and subcontractors who require the information in order to perform their official duties under this contract. The contractor shall comply with the privacy act and all applicable agency regulations on individual privacy, to include:

1.6.7.2.1 Data Breach Response and Notification: The contractor shall adhere to the reporting and response requirements for PII set forth in Memorandum, Office of the Secretary of Defense, Subject:

Safeguarding Against and Responding to the Breach of Personally Identifiable Information (PII), June 5, 2009, ALARCT 050/2009, DoD 5400.11-R, and any amendments. The contractor or its subcontractor(s) shall immediately notify the KO, COR and ACOR upon discovery that a suspected or actual breach of PII has occurred. The notification shall include, to the greatest extent possible, the identification of each individual whose PII has been or possibly has been breached. In addition, the contractor or its subcontractor shall provide the KO, COR and ACOR with any other available information that must be included in required breach reporting and notifications. The contractor shall provide this information at the time of the initial notification to the Government or promptly thereafter as information becomes available. The Government will determine whether a breach of PII has occurred, and whether breach notification to affected individuals is required. If breach notification to affected individuals is required, the Government will determine if the contractor shall make the required notification. If the contractor is to notify the impacted population, it shall submit the notification letters to the KO, COR and ACOR for review and approval.

1.6.7.2.1.1 All Army Activities (ALARACT) 050/2009, DoD Directive 5400.11-R, and any amendments.

1.6.7.2.1.2 AR 25-2 Information Assurance.

1.6.7.2.1.3 DoD Directive 5400.11, DoD privacy program.

1.6.7.2.1.4 DoD Directive 5400.11-R, DoD privacy program.

1.6.7.2.1.5 Health Insurance Portability and Accountability Act.

1.6.7.2.1.6 Furthermore, the contractor shall encrypt all contractor-owned laptops or other portable media storage devices that process or store PII and PHI IAW National Institute of Standards and Technology (NIST) (http://www.nist.gov/) Federal Information Processing Standards Publication (FIPS) publication (PUB) 201 w/ Change 1, dated March 2006. The contractor shall require FIPS 201, Change 1 encryption of any sensitive PII and PHI when transmitted electronically across the internet or other public networks.

Failure to safeguard information - which may involve the contractor or the contractor’s personnel or to which they may have access - may subject the contractor and/or the contractor’s employees to criminal liability. Contractor shall follow provisions set in DoD Directive 5400.11-R when it suspects or encounters an actual data breach.

1.6.7.3 Background Security Checks.

1.6.7.3.1 Contractor personnel supporting this contract shall have a favorable Federal Bureau of Investigations (FBI) finger print card check, and initiate a NACI or equivalent investigation (as determined by the government) before access to government system can be granted, and shall maintain the level of security required for the life of the contract. U.S. citizens may be granted access to RAPIDS if the security investigation has been initiated through OPM IAW DoD Regulation 5200.2-R. Contractors assuming the role of a Site Security Manager (SSM)/Alternate Site Security Manager (ASSM) shall have a NACI completed and adjudicated with favorable results. The contractor is responsible for ensuring their employees maintain a current NACI for the life of this contract.

1.6.7.3.2 The contractor is responsible for scheduling and managing their personnel through the NACI process. In addition, the contractor is responsible for notifying the COR and KO NLT three workdays if it encounters difficulties with the NACI process that will prevent it from completing the process

1.6.7.3.3 National Agency Check Investigation (NACI). All contractors performing unclassified tasks are required to agree and complete a NACI to verify the identity of the individual. Contractors are required to give, and to authorize others to give, full, frank, and truthful answers to relevant and material questions needed to reach a suitability determination. If any of the contractors have already been cleared by DOD or another Federal Government agency, further clearance may not be necessary. The contractor shall provide the COR with the appropriate documentation that supports the individual’s cleared status.

Contractor shall at a minimum be required to access or control unclassified documents that require For Official Use Only (FOUO) document designation. All contractors shall have their background investigation validated prior to being entered into the Trusted Associate Sponsorship System (TASS).

This is critical for all new employees with no previous known investigation. The minimum requirements for being entered into TASS are: 10-point fingerprint check (FD 258); Favorable review and submission of a NACI.

Unfavorable review of investigation is a disqualifying factor (includes declining to grant interim clearance by DISCO) and person should not be entered into CVS or brought on board to support a contract for HRC. The HRC Security Office will submit NACIs on contractors supporting the commands contracts. It is critical that all new contract employees coordinate with the HRC Security Office ten calendar days prior to reporting for duty. This will allow for the processing of the required NACI and entrance into CVS. Contract representatives are encouraged to review the NACI paperwork prior to contacting the HRC Security Office; however, all paperwork will be reviewed by an HRC security specialist prior to submission to the Office of Personnel Management (OPM). NACI's are currently being submitted in ALES and the contractor shall submit all investigations electronically IAW the Personnel Security Investigation Portal (PSIP) 2.0 Register Guide (system is located at https://www.psip.army.mil).

1.6.7.3.4 Garrisons/installations may require additional background reviews/checks. The contractor shall determine these additional requirements during the phase-in process and report results to the COR and KO NLT 30 calendar days after contract award. Report shall contain installation name, review/check required, installation point of contact with contact information (i.e.: full name, e-mail, phone, address), brief summary of requirements, and projected processing time.

1.6.7.3.5 Investigations for Computer Network Access. For contractors wishing access to the Ft Knox installation computer network shall have the following security investigations depending on level of access IAW Fort Knox Policy Memo No. 9-09.

1.6.7.3.5.1 Overall manager of Standard Army Management Information System (IT-I position) - Single Scope Background Investigation (SSBI).

1.6.7.3.5.2 System administrators or network managers (IT-II position) - National Agency Check with Local Agency and Credit Checks (NACLC).

1.6.7.5.3 Users of system (individual having an ID and password) (IT-III position) – NAC, Entrance National Agency Check (ENTNAC), or NACI.

1.6.7.5.4 The contractor will shall coordinate with the other installations in order to obtain specific installation guidance for network access.

1.6.7.4 Government Equipment and Facilities Security. The contractor shall safeguard all government equipment, information and property provided for contractor use. At the close of each work period, government facilities, equipment, and materials under the contractor’s responsibility shall be secured. The contractor shall return all government furnished items (GFI) to the COR upon request, at the end of the contract period of performance or in the event of a contract termination.

1.6.7.5 Key Control.

1.6.7.5.1 All references to keys include key cards.

1.6.7.5.2 When the contractor feels that keys or key controls should be issued to contract employees they shall submit a request through the Division Chief to the KO justifying why the access is necessary.

The contractor shall establish and implement methods to make sure all keys/key cards issued to the contractor by the Government are not lost or misplaced and are not used by unauthorized personnel. The contractors shall develop a key control plan to ensure keys issued to the contractor by the Government are not lost, misplaced, or used by unauthorized persons. Responsibilities and procedures shall be as specified in AR 190-13, AR 190-51, and FM 3-19-30. The contractor shall maintain records as required by AR 190-51 to ensure accountability of keys. The procedure shall cover all subcontractors employed by the contractor to support the contractor. Finally, procedures shall include turn-in of any issued keys by personnel who no longer require access to locked areas, employees leaving the contractor, or as a clearing procedure at the end of the contract. The key control plan shall be incorporated into the Contractor Consolidated Plan referenced in PWS paragraph 5.13.6.

1.6.7.5.3 Key Inventories. The contractor shall conduct key inventories IAW the approved key control plan at the installation site. The contractor shall coordinate with the COR for the key control process. The contractor shall make key inventory records available for review by the KO and/or COR upon request.

1.6.7.5.4 The government will have access to any government-owned property under the control of the contractor.

1.6.7.5.5 Key Duplication. Keys issued to the contractor by the government will not be duplicated.

1.6.7.5.6 Master and File Keys. Building numbers or room numbers shall not be placed on master and file keys. Keys shall be coded to identify buildings or room numbers. Keys to areas where fire alarms, panels, and extinguishing systems are located shall be provided to the fire department. Keys shall not be checked out to anyone other than authorized personnel unless approved by the KO.

1.6.7.5.7 Unauthorized Users. The contractor shall prohibit the use of government issued keys/key cards by any personnel other than the contractor’s employees. The contractor shall prohibit the opening of locked areas by contractor employees to permit entrance of personnel other than contractor employees engaged in the performance of assigned work in those areas, or personnel authorized entrance by the KO.

1.6.7.5.8 Lost Keys. If the access key/key card is not collected and/or the access media is lost, stolen or damaged (needing replacement) the contractor shall notify the COR, KO and affected government installation OPSEC officer NLT 24 hours after detecting the issue and inform them of the circumstances surrounding the issue and their planned corrective action. In the event keys, other than master keys, are lost or duplicated, the contractor shall, upon direction of the KO, re-key or replace the affected lock or locks; however, the government (at its option) may replace the affected lock or locks, or perform re-keying. When the replacement of locks or re-keying is performed by the government, the contractor is responsible for the total expense of re-keying or the replacement of the lock or locks. In the event a master key is lost or duplicated, all locks and keys for that system will be replaced by the government and then the contractor is responsible for the total expense of the replacement.

1.6.7.6 Lock Combinations. The contractor shall establish and implement methods of ensuring that all lock combinations are not revealed to unauthorized personnel. The contractor shall ensure that lock combinations are changed when personnel having access to the combinations no longer have a need to know such combinations. These procedures shall be included in the contractor’s QCP.

1.6.7.7 Installation / Facility Access and General Protection. Access and General Protection/Security Policy and Procedures: Contractor and all associated sub-contractors employees shall comply with applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by government representative). The contractor shall also provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services or Security Office. Contractor workforce shall comply with all personal identity verification requirements as directed by DOD, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the government may require changes in contractor security matters or processes.

1.6.7.8 Unauthorized Users. The contractor shall prohibit the opening of locked areas by contractors to permit entrance of persons other than contractors engaged in the performance of assigned work in those areas or personnel authorized entrance by the Agency. If it is found that contractors have been misusing keys to gain entrance to the work area during non-duty hours, holidays, or weekends and there is no written requirement for access during nonstandard working hours, this will be considered an abuse of government property security. The contractor shall establish and implement methods of ensuring all lock combinations are not revealed to unauthorized persons. The contractor shall ensure lock combinations are changed when personnel having access to the combinations no longer require such access. The contractor shall prohibit the use of government issued keys / key cards by any persons other than the issued employees.

1.6.7.9 Operations Security Standing Operating Procedure. Contractor shall coordinate with the COR to obtain the government installation Operations Security (OPSEC) officer contact information and comply with all applicable requirements specified AR 530-1. Per AR 530-1, OPSEC, new contractor employees shall complete Level I OPSEC training NLT 30 calendar days after reporting for duty. All contractor employees shall complete annual OPSEC awareness training and provide certificates. This training shall be completed NLT 30 calendar days of contract award and NLT 30 calendar days of new employees commencing performance with the results reported to the COR and each affected installation OPSEC Officer NLT 45 calendar days after contract award and in Monthly Status Report (MSR) thereafter. The contractor is responsible for ensuring all applicable employees have completed requisite training, and shall certify that their workforce have completed the training per the MSR instructions listed in this PWS paragraph 1.6.19.3.9.

1.6.7.10 Common Access Card. Contractor employees that require access to government systems and facilities in order to perform services under this contract shall obtain a Common Access Card (CAC).

This requirement is in addition to the contractor provide employee ID badge. Proof of employment and security clearance / favorable background check is required before a CAC will be issued authorizing access to the Installation and government computer systems. CACs may not be issued to contractor employees unless a data record authorizing CAC issuance is resident in the Defense Eligibility Enrollment Reporting System (DEERS). The Trusted Associate Sponsor System (TASS) was developed as a secure and authorized means of entering contractor data into DEERS in addition to automating the CAC application and approval process. In order to enter contractor data into TASS, the contractor's data shall be resident in an authorized source database. The Joint Personnel Adjudication System (JPAS) is that authoritative source. The contractor's Facility Security Office (FSO) shall ensure its employee(s) has a record in JPAS prior to its employee(s) requesting a CAC be issued. Contractors without JPAS accounts may request accounts by following the instructions provided in the Frequently Asked Questions (FAQ) topic "How do I get a JPAS account (Industry Users)?" found on the JPAS website, https://jpas.dsis.dod.mil/faq-gen.html. Personnel eligible for a CAC who are not in JPAS (i.e.: certain contractor employees, foreign nationals, and DoD affiliates) will be required to register at a site where an equivalent background vetting will be accomplished IAW FIPS PUB 201.

Finally, the contractor shall adhere to any additional ID card requirements directed by the Army’s HRC.

CAC for staff at Fort Knox may be issued by the ID Card Section at the HRC’s Welcome Center located in 3-1-030 at 1600 Spearhead Drive, Fort Knox KY or the installation ID Card Section located at building 1384, Fort Knox, KY.

1.6.7.11 CAC Registration Process. NLT five workdays after award of this contract, the contractor shall begin the CAC registration process for all personnel requiring a CAC. Be advised that CAC issuance is restricted, so should be limited to contractor personnel directly assigned to support this contract.

1.6.7.12 Homeland Security Presidential Directive-12. The “smart” card or CAC identification system is necessary for access to DoD facilities, physical assets, and/or systems. Furthermore, the government may require more stringent identification verification media in order to obtain access to sensitive sites and/or assets. In these instances of heightened security requirements, the contractor shall be aware that extensive employee background checks are time consuming; therefore, there will not be adequate time before the start of a task order to process an alternate employee if the primary fails their security screen.

Consequently, it is imperative that the contractor assign qualified personnel (with reputable backgrounds) to these contracts. Delays in the start of a task order due to the rejection of a contractor employee’s security clearance application will be deemed the fault of the contractor, not the government.

1.6.7.13 Government Facility Access Media Accountability. The prime contractor shall be responsible for accounting for and retrieving all government facility access media (i.e.: vehicle passes, CACs, etc.). The prime contractor is responsible for retrieval of all government facility access media in the event a contractor / subcontractor employee is terminated, leaves before the contract period of performance ends and/or at completion of contract. Contractor shall coordinate with the COR for return of the government facility access media. Contractor shall accomplish media turn-in NLT five workdays of employee termination and/or contract expiration. If the media is not collected and/or the access media is lost, stolen or damaged (needing replacement) the contractor shall notify the COR, KO and affected government installation OPSEC officer NLT 24 hours after detecting the oversight as to circumstance for non-collection of the sensitive media. In addition, upon completion of this contract, or termination of employment of any contractor or subcontractor employee, the contractor shall collect and properly dispose of all contractor/subcontractor-furnished identification cards. If any cards are not collected, the contractor shall notify the COR, KO and government installation OPSEC NLT 24 hours of detecting the oversight as to circumstances for non- collection of card(s)/sensitive media.

NOTE: Reference Federal Acquisition Regulation (FAR) Clause 52.204-9 – Personal Identity Verification of Contractor Personnel – for specific guidance regarding this requirement.

1.6.7.14 Systems Access: When requested by the government, the contractor shall provide access to and information regarding the systems that the contractor operates or maintains on behalf of the government under this contract.

1.6.7.15 Policies Governing Workstation Use. Contractor shall adopt and enforce policies and procedures in accordance with Department of Defense (DoD) or Army Command Directives that specify the proper functions to be performed. Inappropriate use of computer workstations can expose a covered entity to risks, such as virus attacks, compromise of information systems, and breaches of confidentiality. Many tasks may have existing policies and procedures that address appropriate business use of workstations.

Upon award, the Contractor shall assess their physical surroundings to ensure that any risks associated with a workstation’s surroundings are known and analyzed for a possible negative impact.

1.6.7.16 Utilizing Electronic Mail (e-mail). When contractor or subcontractor personnel send e-mail messages as part of contract performance, each sender shall include his/her first and last name, e-mail address and name of employer. Accounts established in government e-mail systems for contractor and subcontractor personnel shall identify individuals as contractor personnel in the address book display and on individuals’ e-mail.