CCRI Prep_PWS 7JUL23.pdf

Ver. June 2021

PERFORMANCE WORK STATEMENT (PWS)

FOR

Tennessee Army National Guard (TNARNG) Cyber Command Readiness Inspection (CCRI) Evaluation Services

1.0 General:

1.1 Scope: The contractor shall provide all personnel, equipment, tools, materials, supervision, and quality control necessary, except as specified in Paragraph 3.0 as Government Furnished, to perform CCRI Evaluation Services, as defined in this PWS.

1.1.1 Objectives.

1.2 Background: The TNARNG has a responsibility to the Department of Defense Information Networks to secure and fortify all aspects of the network to include (but not limited to) physical/traditional/informational security culminating in communication security. Because of these responsibilities, we require support for these efforts.

1.3 Period of Performance (PoP): The Period of Performance shall begin NLT 20 SEPTEMBER 2022 with a (CCRI) Evaluation Services Launch Meeting via Microsoft TEAMS. The remaining service dates will be conducted consecutively and will be discussed and scheduled with vendor upon award of contract. The evaluation service, not including the Launch Meeting, shall be no more than 2 work weeks but no less than 1 work week in length.

1.4 General Information:

1.4.1 Place and Performance of Services: The contractor shall provide services between the hours of 0700-1630 on Monday through Friday, except on recognized US holidays or when the Government facility/installation is closed due to local or national emergencies, administrative closings, or similar Government-directed facility/installation closings. Our facilities are closed every 1st and 3rd Monday of each month as a recognized day off in the TNNG. Performance shall be at TNNG State Headquarters in Nashville, TN and at our local training base in Smyrna, TN. The contractor shall at all times maintain an adequate work force for the uninterrupted performance of all tasks defined within this PWS when the Government facility/installation is not closed for the above reasons. When hiring personnel, the contractor shall keep in mind that the stability and continuity of the work force are essential.

1.4.1.1 Telework: The Government does not permit the contractor to telework in support of this requirement. In furtherance of Continuity of Operations Planning (COOP), a telework program may be enacted to ensure that the Government's mission-critical operations stay operational during times of national emergency or incidents of national significance. Telework shall be at no additional cost to the Government.

1.4.1.2 Unscheduled gate closures by the Security Police may occur at any time causing all personnel entering or exiting a closed installation to experience a delay. This cannot be predicted or prevented. Contractors are not compensated for unexpected closures or delays. Vehicles operated by contractor personnel are subject to search pursuant to applicable regulations. Any moving violation of any applicable motor vehicle regulation may result in the termination of the contractor employee’s installation driving privileges.

1.4.1.3 The contractor’s employees shall become familiar with and obey the regulations of the installation, including fire, traffic, safety, and security regulations while on the installation. Contractor employees should only enter restricted areas when required to do so and only upon prior approval. All contractor employees shall carry proper identification with them at all times and shall be subject to such checks as may be deemed necessary. The contractor shall ensure compliance with all regulations and orders of the installation, which may affect performance. The Government reserves the right to direct the removal of an employee from Government property or revoke access to Government systems for misconduct, security reasons, or any overt evidence of communicable disease. Removal of contractor employees for reasons stated above does not relieve the Contractor from responsibility for total performance of this contract.

1.4.2 Recognized Holidays: The following are recognized United States (US) holidays.

The contractor shall not perform services on these days:

1.4.2.1 New Year’s Day: January 1st

1.4.2.2 Martin Luther King, Jr.’s Birthday

1.4.2.3 President’s Day

1.4.2.4 Memorial Day

1.4.2.5 Juneteenth National Independence Day: June 19th

1.4.2.6 Independence Day: July 4th

1.4.2.7 Labor Day

1.4.2.8 Columbus Day

1.4.2.9 Veteran’s Day: November 11th

1.4.2.10 Thanksgiving Day

1.4.2.11 Christmas Day: December 25th

1.4.3 Quality Control (QC): The contractor shall develop and maintain an effective QC Plan (QCP) to ensure services are performed in accordance with this PWS. The contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The contractor’s QCP is the means by which it assures itself that its work complies with the requirements of the contract. As a minimum, the contractor shall develop QC procedures that address the areas identified in Technical Exhibit 1, Performance Requirements Summary (PRS).

1.4.4 Quality Assurance (QA): The Government will evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance

Plan (QASP). This plan is primarily focused on what the Government will do to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and acceptable quality level(s) or defect rate(s).

1.4.5 Installation Access and Security Requirements. The contractor shall comply with all applicable installation/facility access and local security policies and procedures, which may be obtained from the COR. The contractor and all associated subcontractor employees shall provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services, or Security Office. The contractor shall ensure compliance with all personal identity verification requirements as directed by Department of Defense (DoD), Headquarters Department of Army (HQDA) and/or local policy (see PWS 6.0). Should the Force Protection Condition (FPCON) change, the Government may require changes in contractor security matters or processes.

1.4.5.1 RESERVED.

1.4.5.2 For contractors that do not require a CAC, but require access to a DoD facility or installation: Contractor and all associated sub-contractors employees shall comply with adjudication standards and procedures using the National Crime Information Center Interstate Identification (NCIC-III) and Terrorist Screening Database (TSDB) (Army Directive 2014-05), and applicable installation, facility and area commander installation/facility access, and local security policies and procedures (provided by a Government representative).

1.4.5.3 Awareness Training (AT) Level 1: All contractor employees, including subcontractor employees, requiring access to Army installations, facilities, and controlled access areas shall complete AT Level 1 training within 30 calendar days after contract start date and within 30 calendar days of new employees commencing performance. The contractor shall submit certificates of completion for each affected contractor and subcontractor employee to the COR within 15 calendar days after completion of training by each employee or subcontractor personnel. AT Level 1 awareness training is available at the following website: https://www.jcs.mil/JKO/

1.4.5.4 RESERVED.

1.4.5.5 Communications Security/Information Technology (COMSEC/IT) Security. All communications with DoD organizations are subject to COMSEC review. All telephone communications networks are continually subject to intercept by unfriendly intelligence organizations. DoD has authorized the military departments to conduct COMSEC monitoring and recording of telephone calls originating from, or terminating at, DoD organizations. Therefore, the contractor is advised that any time contractor personnel place or receive a call they are subject to COMSEC procedures. The contractor shall ensure wide and frequent dissemination of the above information to all employees dealing with DoD information. The contractor shall abide by all Government regulations concerning the authorized use of the Government's computer network, including the https://www.jcs.mil/JKO/ restriction against using the network to recruit Government personnel or advertise job openings.

1.4.5.6 Use of Government Information Systems (IS) and access to Government networks is a revocable privilege, not a right. Users are the foundation of the DoD strategy, and their actions affect the most vulnerable portion of the Army Enterprise Infostructure (AEI). Contractor employees shall have a favorable background investigation or hold a security clearance and access approvals commensurate with the level of information processed or available on the system. Contractor employees shall:

1.4.5.6.1 Comply with the command's Acceptable Use Policy (AUP) for Government owned IS and sign an AUP prior to or upon account activation.

1.4.5.6.2 Complete initial and/or annual Information Assurance (IA) training as defined in the IA Best Business Practices (BBP) training (https://atc.us.army.mil/iastar/docs/Training_BBP.pdf).

1.4.5.6.3 Mark and safeguard files, output products, and storage media per classification level and disseminate them only to individuals authorized to receive them with a valid need to know.

1.4.5.6.4 Protect IS and IS peripherals located in their respective areas in accordance with physical security and data protection requirements.

1.4.5.6.5 Practice safe network and Internet operating principles and take no actions that threaten the integrity of the system or network.

1.4.5.7 Army Training Certification Tracking System (ATCTS): All contractor employees with access to a Government information system shall be registered in ATCTS (https://atc.us.army.mil/iastar/index.php) at commencement of services, and shall successfully complete the DoD Information Assurance awareness training prior to access to the IS and then annually thereafter. (https://iatraining.us.army.mil/).

1.4.5.8 Information Assurance (IA) Training. All contractor employees and associated subcontractor employees shall complete the DoD IA Awareness Training before issuance of network access and annually thereafter.

1.4.5.9 Information Assurance (IA)/Information Technology (IT) certification. All contractor employees performing services involving IA/IT functions shall comply with DoD and Army workforce training requirements in DoDD 8140.01, DoD 8570.01-M and AR 25-2 within six months of the start of contract performance or appointment to IA/IT functions. In accordance with DoD 8570.01-M, DFARS 252.239.7001, and AR 25-2, contractor employees supporting or performing IA/IT functions shall be appropriately certified upon contract award. The baseline certification as stipulated in DoD 8570.01-M shall be completed upon contract award.

https://atc.us.army.mil/iastar/docs/Training_BBP.pdf https://atc.us.army.mil/iastar/index.php

1.4.5.10 Protection of Personally Identifiable Information (PII). The contractor shall protect all PII encountered in the performance of services in accordance with Defense Federal Acquisition Regulation Supplement (DFARS) 224.103 Personally Identifiable Information and Department of Defense Directive (DoDD) 5400.11, Department of Defense Privacy Program, and DoD 5400.11-R. If a PII breach results from the contractor’s violation of the aforementioned policies, the contractor shall bear all notification costs, call-center support costs, and credit monitoring service costs for all individuals whose PII has been compromised.

1.4.5.11 OPSEC Training: In accordance with AR 530-1, Operations Security, new contractor employees shall complete Level I OPSEC training within 30 calendar days of their reporting for duty and annually thereafter. The contractor shall submit certificates of completion for each contractor employee to the COR within 15 calendar days after completion of training. Level 1 OPSEC training is available at https://securityawareness.usalearning.gov/opsec/index.htm.

1.4.5.12 OPSEC SOP/Plan. The contractor shall develop an OPSEC Standard Operating Procedure (SOP)/Plan and provide it to the COR within 90 calendar days of contract award to be reviewed and approved by the responsible Government OPSEC officer, per AR 530-1, Operations Security. This SOP/Plan shall include a process to identify the Government's critical information, why it needs to be protected, where it is located, who is responsible for it, and how to protect it. The contractor shall implement OPSEC measures as required by the Government. In addition, the contractor shall identify an individual who will be an OPSEC Coordinator. The contractor shall ensure this individual becomes OPSEC Level II certified within 90 days of appointment as OPSEC coordinator in accordance with AR 530-1. Contractor shall provide a copy of the certification to the COR NLT 15 days after completion.

1.4.5.13 Access to Classified Information. The contractor shall comply with FAR52.204- 2, Security Requirements. This clause applies to contracts that involve access to information classified “Confidential,” “Secret,” or “Top Secret,” and requires contractors to comply with the Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (DoD 5220.22-M) and applicable updates/changes.

1.4.5.14 Threat Awareness and Reporting Program (TARP). Per AR 381-12, Threat Awareness and Reporting Program (TARP), contractor employees with security clearances must receive annual TARP training by a counterintelligence (CI) agent or other trainer as specified in Chapter 2 Threat Awareness and Education, Section II, paragraph 2-4b. The contractor shall identify annual TARP training, personnel trained, and date of training within 15 days of training completion.

1.4.6 Physical Security. The contractor shall safeguard all Government property provided for contractor use. At the close of each work period, Government facilities, equipment and materials shall be secured.

1.4.9 Contract Manager (CM): The contactor shall designate a CM who shall ensure performance under this contract. The name of this person, and an alternate who shall act for the contractor when the CM is absent, shall be designated in writing to the KO.

The CM or alternate shall have full authority to act for the contractor on all contract matters relating to daily operation of this contract. The CM shall work through the COR, to resolve issues, receive technical instructions, and ensure adequate performance of services. The CM shall ensure that contractor employees do not perform any services outside the scope of the contract without an official modification issued by the KO. The CM shall ensure contractor employees understand that services performed outside the scope of the contract are performed wholly at the expense of the contractor.

1.4.10 Identification of Contractor Employees: All contractor personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression that they are Government employees. The contractor shall ensure that all documents or reports produced by contractor personnel are suitably marked as contractor products or that contractor participation is appropriately disclosed. The contractor’s status as a “contractor” shall be predominantly displayed in all correspondence types (to include signature blocks on e-mail) and dealings with Government or non-Government entities. Contractor personnel shall wear identification badges distinguishing themselves as such. The badges shall have the company name, employee name and the word “contractor” displayed.

1.4.11. Combating Trafficking in Persons: The United States Government has adopted a zero-tolerance policy regarding trafficking in persons. Contractors and contractor employees shall not engage in severe forms of trafficking in persons during the period of performance of the contract; procure commercial sex acts during the period of performance of the contract; or use forced labor in the performance of the contract. The Contractor shall notify its employees of the United States Government’s zero tolerance policy, the actions that will be taken against employees for violations of this policy. The contractor shall take appropriate action, up to and including termination, against employees or subcontractors that violate the US Government policy as described at

FAR 22.17.

1.4.12 Contractor Travel: The contractor shall travel to 3041 Sidco Drive, Nashville TN 37204 during the performance of this contract to conduct CCRI Prep with the TNARNG J6 Cyber Security team.

The contractor will be authorized travel expenses consistent with the substantive provisions of the Joint Travel Regulation (JTR) and the limitation of funds specified in this contract. All travel requires COR recommendation for approval and/or authorization by the KO prior to travel arrangements being made.

1.4.13-1.4.15 RESERVED.

2.0 Definitions and Acronyms:

2.1 Definitions:

2.1.1 Contractor: A supplier or vendor awarded a contract to provide specific supplies or service to the Government. The term used in this contract refers to the prime.

2.1.2 Defective Service: A service output that does not meet the standard of performance associated with the PWS.

2.1.3 Deliverable: Anything that can be physically delivered and includes non-manufactured things such as meeting minutes or reports.

2.1.4 Key Personnel: Contractor personnel that are evaluated in a source selection process and that may be required to be used in the performance of a contract by the PWS. When key personnel are used as an evaluation factor in best value procurement, an offer can be rejected if it does not have a firm commitment from the persons that are listed in the proposal.

2.1.5 Physical Security: Actions that prevent the loss or damage of Government property.

2.1.6 Quality Assurance: The Government procedures to verify that services being performed by the Contractor are performed according to acceptable standards.

2.1.7 Quality Assurance Surveillance Plan (QASP): An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance.

2.1.8 Quality Control: All necessary measures taken by the Contractor to ensure that the quality of an end product or service shall meet contract requirements.

2.1.9 Subcontractor: One that enters into a contract with a prime contractor. The Government does not have privity of contract with the subcontractor.

2.2 Acronyms:

AEI Army Enterprise Infostructure AR Army Regulation AT/OPSEC Antiterrorism/Operational Security BI Background Investigation CM Contract Manager COR Contracting Officer Representative DA Department of the Army DD254 Department of Defense Contract Security Classification Specification DFARS Defense Federal Acquisition Regulation Supplement DoD Department of Defense DSCA Defense Counterintelligence and Security Agency

FAR Federal Acquisition Regulation GFP/M/E/S Government Furnished Property/Material/Equipment/Services HQDA Headquarters, Department of the Army HSPD Homeland Security Presidential Directive IA Information Assurance IS Information System(s) KO Contracting Officer NGB National Guard Bureau OCI Organizational Conflict of Interest PII Personally Identifiable Information PIPO Phase In/Phase Out POC Point of Contact PRS Performance Requirements Summary PWS Performance Work Statement QA Quality Assurance QASP Quality Assurance Surveillance Plan QC Quality Control QCP Quality Control Program SCR Service Contract Reporting SSN Social Security Number TE Technical Exhibit USD(I) Under Secretary of Defense for Intelligence

3.0 Government Furnished Property, Material, Equipment and Services (GFP/M/E/S):

The Government will provide the property, material, equipment, and/or services listed below solely for the purpose of performance under this contract:

3.1 Property: The Government will furnish the necessary workspace for the contractor to perform services outlined in this PWS to include desk space, telephones, computers and other items necessary to maintain an office environment.

3.2 Materials: N/A.

3.3 Equipment: N/A.

3.4 Services: N/A.

3.5 Utilities: N/A.

4.0 Contractor Furnished Property, Materials, and Equipment (CFP/M/E):

4.1 General: Except for those items specifically stated to be Government-Furnished in Paragraph 3.0, the contractor shall furnish everything required to perform these services as indicated in Paragraph 1.1.

4.2 The contractor shall possess or be eligible to receive and maintain a SECRET facility clearance from the Defense Counterintelligence and Security Agency (DSCA).

4.3 Contractor Security Clearance: The contractor’s employees performing work in support of this contract shall have been granted a SECRET security clearance from the Defense Industry Security Clearance Office.

5.0 Requirements: The contractor shall:

5.1 Provide a CCRI Team Lead with the following qualifications: minimum of 5 years of experience in a CCRI Team lead position (ARNG experience preferred); Certified Ethical Hacker (CEH) and Certified Information Systems Security Professional (CISSP) certified, with active Top Secret (TS) preferred. Team lead must have the ability to assess compliance with CCRI Certified Network Defender (CND) Directives, Cyberspace Tasking Orders (CTO), contributing factors, and Task Orders (TASKORD) and Operation Orders (OPORDs) to include Host Base Security System (HBSS) compliance, Public Key Infrastructure (PKI) enforcement, Insider Threat, and Assured Compliance Assessment Solution (ACAS) scanning and remediation. Team lead must provide daily in and out briefs and a compiled full CCRI out brief at conclusion of contracted service.

5.1.1 Provide an ACAS Security Assessor that can assess Network Diagrams and ACAS vulnerability scans to validate full IP Address coverage and proper configuration in accordance with TASKORD requirements and DISA Tactics, Techniques and Procedures (TTP) guidance.

5.1.2 Provide a traditional/physical security assessor that can assess Physical/Traditional Security policies and processes with United States Army Corps of Engineers (USACE) Information System Security Manager (ISSM) and conduct a walkthrough of facilities using DoD Traditional Security Technical Implementation Guides (STIG). Must have ability to assist ISSM with Traditional Security STIG checks and interpretation.

5.1.3 Provide a Network Security Assessor that can assess network architecture border devices (Premise Router, Firewall) and infrastructure Policy. Must have ability to assess Internal Switches, routers, and Intrusion Detection System IDS) devices. If required, must have the ability to also assess Voiceover Internet Protocol (VoIP) Controllers, IP, Phones, and VTC equipment.

5.1.4 Provide a Senior Web, Database, Windows Active Directory (AD), and Domain Name System (DNS) Server Assessor that can assess Windows Active Directory and DNS Servers on NIPR and SIPR enclaves. Must have the ability to assess Web and Database Servers on NIPR/SIPR enclaves and assess AD/DNS, Web, and Database policies.

5.1.5 Provide a CCRI HBSS/Windows Workstation Security Assessor that can assess HBSS OPORDs by DoD standards. Must have the ability to individually assess a sample Windows Workstation Operating System (OS), Office Products, and Antivirus.

5.1.6 All assessors will have eight (8) years of relevant cybersecurity experience including at least 2 years of experience providing CCRI Staff Assisted Visit (SAV) support within DoD environments (ARNG preferred). Must have a minimum of a Security+ (CISSP Preferred), Secret clearance, TS preferred. Additional requirements:

• Traditional/Physical Security Requirements – DISA Traditional Security trained.

• Network infrastructure – DISA CCRI trained Network Reviewer, CCNP, Security+, five years of Network security assessment experience on DoD networks.

• Web/Database – DISA CCRI trained on WEB, Database, Windows AD and DNS Server Reviewer. CISSP. Must have 8 years of DISA CCRI experience performing WEB, Database, Windows AD and DNS assessments on DoD Networks and performed a minimum of five (5) CCRI SAVs on ARNG networks.

• HBSS requirements – DISA CCRI trained HBSS/Windows Workstation Security Reviewer, CISSP, 8 years of CCRI experience performing HBSS assessments on DoD Networks and have performed a minimum of five (5) CCRI SAVs on ARNG networks.

• ACAS requirements – CCRI trained ACAS Reviewer, CISSP, 5 years of CCRI experience performing ACAS assessments on DoD Networks.

5.1.7 Provide documentation that demonstrates at least 20 completed CCRI SAVs with a subset of seven (7) for the Army National Guard in the past five (5) years. Please include contract information (title and period of performance) and agency supported.

5.1.8 Provide at least four (4) examples of assisting ARNG state(s) who achieved excellent or outstanding rated scores for their Official CCRI.

5.1.9 Experience and working knowledge of the ARNG networking environment required.

5.1.10 Utilize a Windows based auditing system that has the following capabilities:

• Enable local user account information.

• Account management events.

• Account name change events.

• Account logon & logoff dates and times.

• Failed logon events.

• Administrator, Backup Operator, Auditor, and Power User group membership.

• Event log capacity and actions.

• Audit policy configuration and modification events.

• Privileged use events.

• System service configuration.

• System port information.

• Data transfer and print job events.

5.2 Service Contract Reporting: Not Applicable

6.0 Applicable Publications: Publications applicable to this PWS are listed below:

Publication (Chapter/Page)

Date of Publication

Mandatory or Advisory

Website

Federal Acquisition Regulation https://www.acquisition.gov/?q=browsefar Defense Federal Acquisition

Regulation Supplement http://www.acq.osd.mil/dpap/dars/dfarspgi/current/in dex.html or https://www.acquisition.gov/dfars Joint Travel Regulation (JTR) https://www.defensetravel.dod.mil/site/travelreg.cfm

DoDM 1000.13-M-V1 DoD Identification (ID) Cards (Enclosure 2, paragraph 3.b)

01/23/2014 (Change 1:

07/28/2020) http://www.esd.whs.mil/Directives/issuances/dodm

Federal Information Processing Standards (FIPS) Publication 201-2

Personal Identity Verification (PIV) of Federal Employees and Contractors

(paragraph 9)

August 2013 http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.201 -2.pdf

DoDM 5200.2 Procedures for the DoD Personnel Security Program

(PSP)

04/03/2017 https://www.esd.whs.mil/Directives/issuances/dodm/

DoDI 5200.46 DoD Investigative and Adjudicative Guidance for Issuing the Common

Access Card (CAC)

09/09/14 (Change 1:

05/04/2018) https://www.esd.whs.mil/Directives/issuances/dodi/

Homeland Security Presidential Directive (HSPD)-12

Policy for a Common Identification Standard for Federal Employees and

Contractors

08/27/2004 https://www.dhs.gov/homeland-security-presidential-directive-12

DoDI 5400.11 Department of Defense Privacy and

Civil Liberties Programs

01/29/2019 https://www.esd.whs.mil/Directives/issuances/dodi/

DoD 5400.11-R Department of Defense Privacy

Program

05/14/2007 https://www.esd.whs.mil/Directives/issuances/dodm/

DoDD 8140.01 Cyberspace Workforce Management

10/05/2020 https://www.esd.whs.mil/Directives/issuances/dodd/

DoD 8570.01-M Information Assurance Workforce

Improvement Program

12/19/2005 (Change 4:

11/10/2015) https://www.esd.whs.mil/Directives/issuances/dodm/

DoD 5220.22-M National Industrial Security Program

Operating Manual (NISPOM)

02/28/2006 (Change 2:

05/18/2016) https://www.esd.whs.mil/Directives/issuances/dodm/

Army Directive 2014-05 Policy and Implementation

Procedures for Common Access Card Credentialing and Installation Access for Uncleared Contractors

03/07/2014 https://armypubs.army.mil/ProductMaps/PubForm/A rmyDir.aspx

AR 25-2

Information Assurance

04/04/2019 http://armypubs.army.mil/ProductMaps/PubForm/AR .aspx

AR 530-1

Operations Security

09/26/2014 http://armypubs.army.mil/ProductMaps/PubForm/AR .aspx

AR 525-13

Antiterrorism

12/09/2019 http://armypubs.army.mil/ProductMaps/PubForm/AR .aspx

AR 381-12 06/01/2016 http://armypubs.army.mil/ProductMaps/PubForm/AR .aspx https://www.acquisition.gov/?q=browsefar http://www.acq.osd.mil/dpap/dars/dfarspgi/current/index.html http://www.acq.osd.mil/dpap/dars/dfarspgi/current/index.html https://www.acquisition.gov/dfars http://www.esd.whs.mil/Directives/issuances/dodm http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.201-2.pdf http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.201-2.pdf https://www.esd.whs.mil/Directives/issuances/dodm/ https://www.esd.whs.mil/Directives/issuances/dodi/ https://www.dhs.gov/homeland-security-presidential-directive-12 https://www.dhs.gov/homeland-security-presidential-directive-12 https://www.esd.whs.mil/Directives/issuances/dodi/ https://www.esd.whs.mil/Directives/issuances/dodd/ https://www.esd.whs.mil/Directives/issuances/dodm/ https://www.esd.whs.mil/Directives/issuances/dodm/ http://armypubs.army.mil/ProductMaps/PubForm/AR.aspx http://armypubs.army.mil/ProductMaps/PubForm/AR.aspx http://armypubs.army.mil/ProductMaps/PubForm/AR.aspx http://armypubs.army.mil/ProductMaps/PubForm/AR.aspx http://armypubs.army.mil/ProductMaps/PubForm/AR.aspx http://armypubs.army.mil/ProductMaps/PubForm/AR.aspx http://armypubs.army.mil/ProductMaps/PubForm/AR.aspx http://armypubs.army.mil/ProductMaps/PubForm/AR.aspx

Threat Awareness and Reporting Program (TARP)

(Section II, ¶ 2-4.b)

6.1 Applicable Forms: Forms applicable to the PWS are listed below:

Form Date Website

DD 1172-2

Application for Identification Card/DEERS Enrollment

Mar 2017 http://www.dtic.mil/whs/directives/forms/index.htm

I-9 Employment Eligibility Verification

10/21/2019 https://www.uscis.gov/sites/default/files/files/form/i-9.pdf

DD 441

Department of Defense Security

Agreement

Feb 2020 http://www.dtic.mil/whs/directives/forms/dd/ddforms0001- 0499.htm

DD 250

Material Inspection and Receiving

Report

Aug 2000 https://www.esd.whs.mil/Directives/forms/dd0001_0499/

TECHNICAL EXHIBIT 1

Performance Requirements Summary (PRS)

This PRS includes performance objectives the Government will use to determine contractor performance and will compare contractor performance to the Acceptable Quality Level (AQL).

Performance

Objective Performance Standard Acceptable Quality

Levels (AQL) Surveillance Method / By

Whom 5.1

Daily briefs Team lead must provide daily in and out briefs and a compiled full CCRI out brief at conclusion of contracted service.

100% completed the daily in and out briefs and full out brief at the conclusion of the contract.

Periodic Inspection / COR http://www.dtic.mil/whs/directives/forms/forminfo/forminfopage2479.html http://www.dtic.mil/whs/directives/forms/forminfo/forminfopage2479.html http://www.dtic.mil/whs/directives/forms/index.htm https://www.uscis.gov/sites/default/files/files/form/i-9.pdf http://www.dtic.mil/whs/directives/forms/dd/ddforms0001-0499.htm http://www.dtic.mil/whs/directives/forms/dd/ddforms0001-0499.htm https://www.esd.whs.mil/Directives/forms/dd0001_0499/

TECHNICAL EXHIBIT 2

Deliverables Schedule

PWS Reference / Deliverable Title

Frequency Number of Copies

Medium/Format Submit To

1.4.5.3 AT Level 1

Awareness Training Certificates

Provide within 15 calendar days after employee completes training.

1 Electronic Submission

COR

1.4.5.7 ATCTS & IA

Training

Register in ATCTS and conduct IA training by commencement of services.

Provide IA training certificate upon completion.

1 Electronic Submission

COR

1.4.5.11 OPSEC

Training Certificates

Provide within 15 calendar days after employee completes training.

1 Electronic Submission

COR

1.4.5.12 OPSEC

Level II Certification for OPSEC Coordinator

Develop an OPSEC Standard Operating Procedure (SOP)/Plan and provide it to the COR within 90 calendar days of contract award to be reviewed and approved by the responsible Government OPSEC officer.

In addition, the contractor shall identify an individual who will be an OPSEC Coordinator. The contractor shall ensure this individual becomes OPSEC Level II certified within 90 days of appointment as OPSEC coordinator in accordance with AR 530-1. Contractor shall provide a copy of the certification to the COR NLT 15 days after completion.

1 Electronic Submission

COR

1.4.5.14 TARP

Training Certification.

Provide within 15 calendar days after training completion.

1 Electronic Submission

COR

1.4.10 Identification

Media

Return upon employee’s departure from contract performance.

Original(s) Hard Copy KO