RFQ_W912NW-19-T-0062.pdf

SEE ADDENDUM

(No Collect Calls)

W912NW19T0062 02-Jul-2019

b. TELEPHONE NUMBER

361-961-7831

8. OFFER DUE DATE/LOCAL TIME

03:00 PM 09 Jul 2019

5. SOLICITATION NUMBER 6. SOLICITATION ISSUE DATE

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

STANDARD FORM 1449 (REV. 2/2012)

Prescribed by GSA – FAR (48 CFR) 53.212

(TYPE OR PRINT)

(SIGNATURE OF CONTRACTING OFFICER)

ADDENDA X ARE

26. TOTAL AWARD AMOUNT (For Gov t. Use Only )

23.

CODE 10. THIS ACQUISITION IS

SUCH ADDRESS IN OFFER

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT

BELOW IS CHECKED

TELEPHONE NO.

W912NW9. ISSUED BY

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a. UNLESS BLOCK

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME

ARTHUR L. GUNTER

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NUMBER

(TYPE OR PRINT)

30b. NAME AND TITLE OF SIGNER 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a.UNITED STATES OF AMERICA

1 27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1. 52.212-4. FAR 52.212-3. 52.212-5 ARE ATTACHED.X

25. ACCOUNTING AND APPROPRIATION DATA

1. REQUISITION NUMBER

20.

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED.

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, AND 30

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

W45N7V910200KX

ARE NOT ATTACHED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

SET FORTH HEREIN, IS ACCEPTED AS TO ITEMS:

. YOUR OFFER ON SOLICITATION

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

% FOR:SET ASIDE:UNRESTRICTED ORX

SMALL BUSINESS

17a.CONTRACTOR/ CODE FACILITY

OFFEROR CODE

ARMY CONTRACTING COMMAND - REDSTONE

CONTRACTING OFFICE

CORPUS CHRISTI ARMY DEPOT

9035 OCEAN DR. BLDG 10, MAIL STOP 18

CORPUS CHRISTI TX 78419-5260

18a. PAYMENT WILL BE MADE BY CODE

RATED ORDER UNDER

DPAS (15 CFR 700)

13a. THIS CONTRACT IS AX 13b. RATING

DO-S1

CODE15. DELIVER TO CODE 16. ADMINISTERED BY

SEE SCHEDULE

12. DISCOUNT TERMS11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

14. METHOD OF SOLICITATION

RFQ IFB RFPX

FAX:

TEL: SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

8(A)

HUBZONE SMALL

BUSINESS

SIZE STANDARD:

$38,500,000

NAICS:

511210

X

OFFER DATED

29. AWARD OF CONTRACT: REF.

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

EMAIL:

TEL:

31c. DATE SIGNED

SEE SCHEDULE

SCHEDULE OF SUPPLIES/ SERVICESITEM NO. QUANTITY UNIT UNIT PRICE AMOUNT

24.22.21.19.

WOMEN-OWNED SMALL BUSINESS (WOSB)

ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

(CONTINUED)

ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED: ______________________________________________________

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED

32b. SIGNATURE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32c. DATE 32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f . TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

37. CHECK NUMBER

FINALPARTIALCOMPLETE

36. PAYMENT35. AMOUNT VERIFIED

CORRECT FOR

34. VOUCHER NUMBER

FINAL

33. SHIP NUMBER

PARTIAL

38. S/R ACCOUNT NUMBER 39. S/R VOUCHER NUMBER 40. PAID BY

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT 41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42a. RECEIVED BY (Print)

42b. RECEIVED AT (Location)

42c. DATE REC'D (YY/MM/DD) 42d. TOTAL CONTAINERS

STANDARD FORM 1449 (REV. 2/2012) BACK

Prescribed by GSA – FAR (48 CFR) 53.212

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

SEE SCHEDULE

20.

SCHEDULE OF SUPPLIES/ SERVICES

21.

QUANTITY UNIT

22. 23.

UNIT PRICE

24.

AMOUNT

19.

ITEM NO.

W912NW19T0062

Section SF 1449 - CONTINUATION SHEET

PERFORMANCE WORK STATEMENT

PERFORMANCE WORK STATEMENT (PWS)

FOR

COMMVAULT INFORMATION TECHNOLOGY (IT) BACKUP SYSTEM SOFTWARE SUPPORT

PART 1

GENERAL INFORMATION

1.0 GENERAL: This is a non-personal services contract to provide Corpus Christi Army Depot (CCAD) Commvault

IT Backup system premium level support. The Government will exercise no supervision or control over the Contractor during the contract performance period.

1.1 Scope: The Contractor shall provide all personnel, equipment, supplies, transportation, tools, materials, supervision, quality control, and other items and non-personal services necessary to perform software support as defined in this PWS, except for those items specified as government furnished. The Contractor shall perform to the standards of this contract.

1.2 Background: This procurement is for renewal of CCAD’s Commvault IT backup system premium level and support. The level of support is Commvault Premium Level with coverage available 24 hours per day, 7 days per week. CCAD’s Installation process node utilizes Commvault’s storage unit to store critical information such as aircraft\component flight safety and time life information that are crucial to the repair and overhaul processes at CCAD. Commvault provides an off-site disaster recovery repository that receives all CCAD business critical data and host operating systems. In the event of an unforeseen site disaster, this repository will provide the ability to fully recover business data and perform bare metal system recovery. Commvault is a fast, efficient backup and recovery system that reduces the size of backup data at the client level before it is transferred across the network and stored. Commvault uses variable-length deduplication to dramatically reduce network traffic by only sending unique blocks over Local Area Network/Wide Area Network (LAN/WAN). Commvault premium level software includes the following:

5 Each-Commvault Data Protection Advanced – Per Teryabyte (TB), Capacity License 32 Each-Commvault Data Protection Foundation – Per TB, Capacity License 125 Each-Commvault Foundation Endpoint Backup, Recovery and Data Loss 12 Each-Commvault Virtual Machine (VM) Backup & Recovery Advanced – Per VM (10 Pack)

1.3 Description of Services: The Contractor shall furnish all labor, tools, material, equipment, and supervision necessary to provide Commvault IT backup system premium level software support. The contractor shall provide software support in accordance with the performance work statement.

1.4 Period of Performance (POP): The POP shall be one Base Year of 12 Months. The POP will be defined in the contract document. .

1.5 General Information:

1.5.1 Quality Control (QC): The contractor shall develop and maintain an effective QC Program (QCP) to ensure services are performed in accordance with this PWS. The Contractor shall develop and implement procedures to identify, prevent and ensure non-recurrence of defective services. The Contractor’s QCP is the means by which it assures itself that its work complies with the requirements of the contract. As a minimum, the Contractor shall develop QC procedures that address the areas identified in the Performance Requirements Summary.

1.5.2 Quality Assurance (QA): The Government will evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan is primarily focused on what the Government must do to ensure that the Contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

1.5.3 Recognized Holidays: The following are recognized Federal Holidays. The Contractor shall perform services on these days if required:

New Year’s Day Labor Day Martin Luther King Jr.’s Birthday Columbus Day President’s Day Veteran’s Day Memorial Day Thanksgiving Day Independence Day Christmas Day

1.5.4 Hours of Operation: The contractor shall provide Commvault premium level software support services 24 hours per day, 7 days per week. The contractor shall not be required to perform when the Government facility/installation is closed due to local or national emergencies, administrative closings, or similar Government-directed facility/installation closings. For other than firm fixed price contracts, the Contractor shall not be reimbursed when the Government facility is closed for the above reasons. The Contractor shall at all times maintain an adequate work force for the uninterrupted performance of all tasks defined within this performance work statement when the Government facility/installation is not closed.

CCAD may schedule a “compressed work schedule” during various times of the year. The Contracting Officer may authorize a “compressed work schedule” for Contractor operations during a planned CCAD “compressed work schedule”. The Contracting Officer will inform the Contractor of any planned CCAD “compressed work schedule” at least 7 calendar days prior to the change via email or memorandum.

1.5.5 Place of Performance: Performance for work under this contract shall be at the Contractor’s location when responding to customer initiated email or phone requests for remote service requests initiated by customer via email and/or phone call.

1.5.6 Physical Security: The Contractor shall be responsible for safeguarding all Government equipment, information, and property for Contractor use. At the close of each work period, Government facilities, equipment, and materials shall be secured.

1.5.7 Conservation of Utilities: The Contractor shall instruct employees in utilities conservation practices. The Contractor shall operate under conditions that preclude the waste of utilities which include turning off the water faucets or valves after using the required amount.

1.5.8 Post Award Conference/Periodic Progress Meetings: The Contractor agrees to attend any post award conference convened by the KO in accordance with the Federal Acquisition Regulations Subpart 42.5. The KO, COR, and other Government Personnel, as appropriate, may meet periodically with the Contractor to review the Contractor’s performance. At these meetings, the KO will apprise the Contractor of how the Government views the Contractor’s performance and the Contractor shall apprise the Government of problems, if any, being experienced.

The Contractor shall resolve outstanding issues raised by the Government. Contractor attendance at these meetings shall be at no additional cost to the Government.

1.5.9 Contracting Officer Representative (COR): The COR will be identified by a separate letter. The COR monitors all technical aspects of the contract and assists in contract administration. A letter of designation issued to the COR, a copy of which is sent to the Contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting order.

1.5.10 Key Personnel: The following personnel are considered key personnel by the Government: A Technical Account Manager (TAM). The Contractor shall provide a TAM who shall be responsible for the performance of the work. The name of this person and an alternate who shall act for the Contractor when the manager is absent shall be designated in writing to the KO. The TAM or alternate shall have full authority to act for the Contractor on all contract matters relating to daily operation of this contract. The TAM or alternate shall be available between 8:00am and 5pm Monday thru Friday, except for Federal Holidays or when the Government facility is closed for administrative reasons.

PART 2

DEFINITIONS & ACRONYMS

2.0 DEFINITIONS AND ACRONYMS:

2.1 Definitions:

2.1.1 CONTRACTOR. A supplier or vendor awarded a contract to provide specific supplies or services to the

Government. The term used in this contract refers to the prime.

2.1.2 CONTRACTING OFFICER (KO). A person with authority to enter into, administer, and/or terminate contracts, and make related determinations and findings on behalf of the Government. Note: The only individual who can legally bind the Government.

2.1.3 CONTRACTING OFFICER’S REPRESENTATIVE (COR). An employee of the U.S. Government designated by the KO to monitor Contractor performance. Such appointment shall be in writing and shall state the scope of authority and limitations. This individual has authority to provide technical direction to the Contractor as long as that direction is within the scope of the contract, does not constitute a change, and has no funding implications.

This individual does NOT have authority to change the terms and conditions of the contract.

2.1.4 DEFECTIVE SERVICE. A service output that does not meet the standard of performance associated with the

PWS.

2.1.5 DELIVERABLE. Anything that can be physically delivered and includes non-manufactured items such as meeting minutes or reports.

2.1.6 KEY PERSONNEL. Contractor personnel that are evaluated in a source selection process that may be required to be used in the performance of a contract by the Key Personnel listed in the PWS. When key personnel are used as an evaluation factor in best value procurement, an offer can be rejected if it does not have a firm commitment from the persons that are listed in the proposal.

2.1.7 PHYSICAL SECURITY. Actions that prevent the loss or damage of Government property.

2.1.8 QUALITY ASSURANCE. The Government procedures to verify that services being performed by the Contractor are performed according to the acceptable standards.

2.1.9 QUALITY ASSURANCE SURVEILLANCE PLAN (QASP). An organized written document specifying the surveillance methodology to be used for surveillance of Contractor performance.

2.1.10 QUALITY CONTROL. All necessary measures taken by the Contractor to assure that the quality of an end product or service shall meet contract requirements.

2.1.11 SUBCONTRACTOR. One that enters into a contract with a prime contractor. The Government does not have privity of contract with the subcontractor.

2.2 Acronyms:

ACOR Alternate Contracting Officer’s Representative AR Army Regulation CCAD Corpus Christi Army Depot COR Contracting Officer’s Representative COTS Commercial-Off-the-Shelf DA Department of the Army DOD Department of Defense IT Information Technology KO Contracting Officer

LAN Local Area Network POC Point of Contact PRS Performance Requirements Summary PWS Performance Work Statement QA Quality Assurance QAP Quality Assurance Program QASP Quality Assurance Surveillance Plan QC Quality Control QCP Quality Control Program TAM Technical Account Manager TB Terabyte TE Technical Exhibit VM Virtual Machine WAN Wide Area Network WAWF Wide Area Workflow

PART 3

GOVERNMENT FURNISHED PROPERTY, EQUIPMENT AND SERVICES

3.0 GOVERNMENT FURNISHED ITEMS AND SERVICES: Not Applicable

PART 4

CONTRACTOR FURNISHED ITEMS AND SERVICES

4.0 CONTRACTOR FURNISHED ITEMS AND RESPONSBILITIES:

4.1 General: Except for those items specifically stated to be Government-Furnished in paragraph 3.0, the Contractor shall furnish everything required to perform these services as indicated in paragraph 1.1.

PART 5

SPECIFIC TASKS

5.0 REQUIREMENTS:

5.1 Software Support: The Contractor shall provide Commvault IT backup system software support 24 hours per day, 7 days per week with the exception of Government holidays. Commmvault Premium level support shall be provided for the following Commvault items: 5 EA-Commvault Data Protection Advanced – Per TB, Capacity License; 32 EA-Commvault Data Protection Foundation – Per TB, Capacity License; 125 EA-Commvault Foundation Endpoint Backup, Recovery and Data Loss; 12 EA-Commvault VM Backup & Recovery Advanced – Per VM (10 Pack).

5.2 End of Life: The Contractor shall support the Commvault IT backup system for a minimum of one year from the date of a major version release. Contractor shall provide one year notice if it intends to discontinue a specific operating system platform.

5.3 End User Support: The Contractor shall provide the services to its end users accessing or using the IT backup system via a single point of contact with its end users regarding the services.

5.4 Customer Portal: The Contractor shall provide support needs online and/or by telephone 24 hours per day, 7 days per week as identified by the Premium level support agreement.

5.5 Knowledge Center: The Contractor shall provide access to the most recent and comprehensive technical information, updates and troubleshooting guides concerning the Commvault IT backup system within 5 days of release.

5.6 Software Updates: The Contractor shall provide all available software updates for the Commvault IT backup system within 5 days of release.

5.7 Software Upgrades: The Contractor shall provide the download of any available software upgrades for the Commvault IT backup system, including new major releases within 5 days of release.

5.8 Enterprise Contractor Manpower Reporting Application (ECMRA): The Office of the Assistant Secretary of the

Army (Manpower & Reserve Affairs) operates and maintains a secure Army data collection site where the Contractor shall report ALL Contractor manpower (including subcontractor manpower) required for performance of this contract. The contractor shall completely fill in all the information in the format using the following web address www.ecmra.mil. The required information includes: (1) Contracting Office, KO, Contracting Officer’s Technical Representative (COTR) or also known as the Contracting Officer’s Representative (COR); (2) Contract number, including task and delivery order number; (3) Beginning and ending dates covered by reporting period;

(4) Contractor's name, address, phone number, e-mail address, identity of Contractor employee entering data; (5) Estimated direct labor hours (including sub-Contractors); (6) Estimated direct labor dollars paid this reporting period (including sub-Contractors); (7) Total payments (including sub-Contractors); (8) Predominant Federal Service Code (FSC) reflecting services provided by Contractor (and separate predominant FSC for each sub- Contractor if different); (9) Estimated data collection cost; (10) Organizational title associated with the Unit Identification Code (UIC) for the Army Requiring Activity (the Army Requiring Activity is responsible for providing the Contractor with its UIC for the purposes of reporting this information); (11) Locations where Contractor and sub-Contractors perform the work (specified by zip code in the United States and nearest city, country, when in an overseas location, using standardized nomenclature provided on website); (12) Presence of deployment or contingency contract language; and (13) Number of Contractor and sub-Contractor employees deployed in theater this reporting period (by country). As part of its submission, the Contractor shall provide the estimated total cost (if any) incurred to comply with this reporting requirement. Reporting period shall be the period of performance not to exceed 12 months ending September 30 of each government fiscal year and must be reported by 31 October of each calendar year. Contractors may use a direct XML data transfer to the database server or fill in the fields on the website. The XML direct transfer is a format for transferring files from a Contractor’s system to the secure website without the need for separate data entries for each required data element at the website. The specific formats for the XML direct transfer may be downloaded from the website.

PART 6

APPLICABLE PUBLICATIONS

6.0 APPLICABLE PUBLICATIONS: Not Applicable

PART 7

ATTACHMENTS

7.0 ATTACHMENT LIST:

7.1 Attachment 1: Performance Requirements Summary

7.2 Attachment 2: Deliverables Schedule

7.2 Attachment 3: Security Requirements

ATTACHMENT 1 / TECHNICAL EXHIBIT 1

Performance Requirements Summary

This Performance Requirements Summary includes performance standards. The Government will use these standards to determine Contractor performance and shall compare contractor performance to the Acceptable Quality Level (AQL).

PWS

Paragraph

Task Performance Standard Acceptable Quality Levels

(AQL)

Surveillance Method / By Whom

5.2 The Contractor shall

support the Commvault IT backup system for a minimum of one year from the date of a major version release.

Contractor shall provide one year notice if it intends to discontinue a specific operating system platform.

The Contractor shall support the Commvault IT backup system for a minimum of one year from the date of a major version release.

Contractor shall provide one year notice if it intends to discontinue a specific operating system platform.

0% failure to support the Commvault IT backup system for a minimum of one year from the date of a major version release.

Contractor shall provide one year notice if it intends to discontinue a specific operating system platform.

100% Inspection by the COR

5.3 The Contractor shall

provide the services to its end users accessing or using the IT backup system via a single point of contact with its end users regarding the services.

The Contractor shall provide the services to its end users accessing or using the IT backup system via a single point of contact with its end users regarding the services 97% of the time.

3% failure to provide the services to its end users accessing or using the IT backup system via a single point of contact with its end users regarding the services.

Periodic Surveillance by the

COR

5.4 The Contractor shall

provide support needs online and/or by telephone 24 hours per day, 7 days per week as identified by the Premium level support agreement.

The Contractor shall make available support needs online and/or by telephone 24 hours per day, 7 days per week as identified by the Premium level support agreement 98% of the time.

2% failure to make available support needs online and/or by telephone 24 hours per day, 7 days per week as identified by the Premium level support agreement.

Periodic Surveillance by the

COR

5.5 The Contractor shall

provide access to the most recent and comprehensive technical information, updates, and troubleshooting guides concerning the Commvault IT backup within 5 days of release.

The Contractor shall provide access to the most recent and comprehensive technical information, updates, and troubleshooting guides concerning the Commvault IT backup system within 5 days of release 98% of the time.

2% failure to provide access to the most recent and comprehensive technical information, updates, and troubleshooting guides concerning the Commvault IT backup system within 5 days of release.

Periodic Surveillance by the

COR

5.6 The Contractor shall

provide all available software updates for the Commvault IT backup system within 5 days of release.

The Contractor shall provide all available software updates for the Commvault IT backup system within 5 days of release 98% of the time.

2% failure to provide all available software updates for the Commvault IT backup system within 5 days of release.

100% Inspection by the COR

5.7 The Contractor shall

provide the download of any available software upgrades for the Commvault IT backup system, including new major releases within 5 days of release.

The Contractor shall provide the download of any available software upgrades for the Commvault IT backup system, including new major releases within 5 days of release 98% of the time as required.

2% failure to provide the download of any available software upgrades for the Commvault IT backup system, including new major releases within 5 days of release

100% Inspection by the COR

ATTACHMENT 2 / TECHNICAL EXHIBIT 2

Deliverables Schedule

Deliverable Frequency Number of Copies Medium/Format Submit To

Recent and comprehensive technical information, updates and troubleshooting guides concerning the Commvault IT backup system IAW PWS 5.5

Within 5 days of release

1 for each license Download, Email or any available media

COR

Software updates IAW

PWS 5.6

Within 5 days of release r each software component

Download, Email or any available media

COR

Software upgrades

IAW PWS 5.7

Within 5 days of release r each software component

Download, Email or any available media

COR

ATTACHMENT 3 / TECHNICAL EXHIBIT 3

Security Requirements

CAO: April 2017

SECURITY REQUIREMENTS FOR ALL CONTRACTS PERFORMED AT CORPUS CHRISTI ARMY DEPOT

This document is a brief overview of rules and regulations of Naval Air Station Corpus Christi (NASCC) and Corpus Christi Army Depot (CCAD). It is not intended to be all-inclusive or cover all contingencies.

Direct specific security requirements questions to the following numbers:

CCAD: (361) 961-3313

NASCC: (361) 961-2480

Regulations:

Army Directive 2014–05 (or its successor) Policy and Implementation Procedures for Common Access Card Credentialing and Installation Access for Uncleared Contractors

AR 25-1, Army Knowledge Management and Information Technology AR 25-2, Information Assurance

AR 25-55, The Department of the Army Freedom of Information Act AR 70-31, Standards for Technical Reporting

AR 190-13, Department of the Army Physical Security Program AR 360-1, The Army Public Affairs Program

AR 380-5, Department of the Army Information Security Program

AR 380-10, Foreign Disclosure and Contact with Foreign Representatives AR 380-49, Industrial Security Program

AR 380-67, Personnel Security (PERSEC) AR 530-1, Operations Security (OPSEC)

AR 530-1, AMC Supp Operations Security (OPSEC) AR 530-1, CCAD Plan Operations Security (OPSEC) AMC-R 525-13, AMC Force Protection Program

DoD 5220.22-M National Industrial Security Program Operating Manual DoD Directives 5230.24, Distribution Statements on Technical Documents

DoD Directives 5230.25, Withholding of Unclassified Technical Data from Public Disclosure DoD Regulation 5200.2-R Personnel Security Program

DoD 5400.11-R, Department of Defense Privacy Program UFC 4-010-01 9 February 2012 Change 1, 1 October

DoD MINIMUM ANTITERRORISM STANDARDS FOR BUILDINGS UNIFIED FACILITIES CRITERIA

(UFC)

DoDI 1000.13, Identification (ID) Cards for Members of the Uniformed Services, Their Dependents, and other Eligible Individuals

DoDM 1000.13, Volume 1, DoD Identification (ID) Cards: ID Card Life-Cycle DoDI 5200.02 DoD Personnel Security Program

DoDM 5200.02 Procedures for the DoD Personnel Security Program

U.S. Office of Personnel Management Memorandum, "Final Credentialing Standards for Issuing Personal Identity Verification Cards under HSPD-12," July 31, 2008Federal Acquisition Regulation (FAR), March 2005

1. Conduct and Behavior: IAW DoD Directive 5200.8, “Security of DoD Installations and Resources”, the NAS commander has broad authority to remove or exclude any person or persons from the military installation to protect personnel and property, to maintain good order and discipline, and to ensure the uninterrupted and successful performance of the installations mission. In the exercise of this authority, the commander may refuse to grant entry or may bar Contractor employees. Refusal of entry or barment of any employee does not relieve the Contractor of the responsibility to continue performance under this contract.

1.1. All personnel entering and working at CCAD are subject to all rules, regulations and applicable laws. All personnel and their effects are subject to search, to include vehicles and company belongings.

1.2. No person shall willfully fail or refuse to comply with lawful orders or direction of any civilian or military security police officer.

1.3. The Contractor shall not employ persons for work on this contract if such employees are identified to the Contractor by the Government as a potential threat to the health, safety, security, general well-being or operational mission of the installation and its population. Disrespectful behavior, failure to obey orders or regulations, fighting, horseplay, stealing, illegal use of drugs (using/transporting/selling), consuming or being under the influence of alcohol, or being in the possession of illegal weapons are prohibited and subject to appropriate penalties. This may include being detained, banned from entering the Government facility, or remanded to civilian authorities.

1.4. All Contractor personnel will limit their travel on the installation only to specific areas required for performance of the contract, specified break and meal areas, or in travel directly to and from these locations. Employees found on the installation away from officially identified areas may be detained and/or debarred from the installation.

1.5. Subcontracts; if the Contractor enters into a Subcontractor arrangement with another Contractor, the prime Contractor is responsible for Subcontractor performance and compliance. The prime Contractor must provide a copy of the security requirements to the subcontractor. The contracting officer must ensure any questions of adequacy of the Subcontractor are resolved to the mutual satisfaction of the prime Contractor, Subcontractor, security, and CCAD commander.

1.6. All prospective government and contractor employees are subject to a check of their criminal history prior to being granted access to CCAD. Adverse or derogatory information revealed by these checks, or failure to provide full disclosure, may result in denial of access.

2. Support:

2.1 Security support provided by CCAD to the Contractor includes (if applicable) storage containers for classified information/material, use of base destruction facilities, classified reproduction facilities, use of base classified mail services, security badging, investigation of security incidents, base traffic regulations, use of security forms, and conducting inspections required by DoD 5220.22-R “Industrial Security Regulation”, Army Instruction 380-49 “Industrial Security Program”, AR 380-5 “Department of Army Information Security Program”, and AR 25-2 “Information Assurance” and others as required or deemed necessary by the Government.

2.2 Security support requiring joint Army and Contractor coordination includes packaging classified information, mailing and receiving classified materials, implementing emergency procedures for protection of classified information, security checks, and internal security controls for protection of classified material, sensitive material, and high value pilfer able property.

3. Security Investigation Requirements:

3.1. Investigation requirements including IT level and CAC requirements should be clearly indicated in the contract and Performance Work Statement (PWS) as prescribed in paragraph 4.1303, of the FAR:

Personal Identity Verification of Contractor Personnel

(a) The Contractor shall comply with agency personal identity verification procedures identified in the contract that implement Homeland Security Presidential Directive-12 (HSPD-12), Office of Management and Budget (OMB) guidance M-05-24 and Federal Information Processing Standards Publication (FIPS PUB) Number 201.

(b) The Contractor shall account for all forms of Government-provided identification issued to the Contractor employees in connection with performance under this contract. The Contractor shall return such identification to the issuing agency at the earliest of any of the following, unless otherwise determined by the Government:

(1) When no longer needed for contract performance.

(2) Upon completion of the Contractor employee’s employment.

(3) Upon contract completion or termination.

(c) The Contracting Officer may delay final payment under a contract if the Contractor fails to comply with these requirements.

(d) The Contractor shall insert the substance of this clause, including this paragraph (d), in all subcontracts when the subcontractor’s employees are required to have routine physical access to a Federally-controlled facility and/or routine access to a Federally-controlled information system. It shall be the responsibility of the prime Contractor to return such identification to the issuing agency in accordance with the terms set forth in paragraph (b) of this section, unless otherwise approved in writing by the Contracting Officer.

3.2. Subcontracts; if the Contractor enters into a Subcontractor arrangement with another Contractor, subcontractors must be clearly identified in the contract agreement.

3.3. Contractors must maintain the same level investigation or higher as their civilian counterparts. In the absence of a civilian counterpart, CCAD Security will determine the level of investigation based on a position sensitivity review. Close coordination with the COR and company are required. All documentation required for access to CCAD for classified contracts or IT Level I & II shall be processed through the CCAD Security Personnel Security Office prior to entering CCAD facilities.

3.4. Classified Contracts: An interim clearance must be in place prior to entering CCAD facilities. All documentation (i.e. SF 86, etc.) required for security clearance shall be processed through the Contractor Facility Security Office (FSO).

3.4.1. For all contracts involving employees who require a security clearance for performance of their duties or access to classified material, the Contractor must possess or obtain a facility security clearance prior to performing contract work. If the Contractor does not possess a facility clearance, the Government (Contracting Office) may request one from the Defense Security Service (DSS).

3.4.2. Contractor employees without a clearance level or background check properly indicated in the Joint Personnel Adjudication System (JPAS) or its successor, will not be assigned to this task directly or indirectly. Contractor employee(s) will not be authorized access, regardless of personal clearance, without the facility first being cleared to the appropriate level by Defense Security Service (DSS).

3.4. The Contractor shall request security clearances for personnel requiring access to classified information or IT Level I or II within 15 days after receiving a facility clearance. If the Contractor is already cleared, they shall request security clearances for the personnel within 15 days after contract award. Due to costs involved with security investigations, requests for Contractor employee security clearances shall be kept to an absolute minimum necessary to perform contract requirements.

3.4.1. IT Level I positions; Contractor employees shall have one of the following prior to commencing work: A current, valid Tier 5 investigation or equivalent or “Interim” Top Secret eligibility by Defense Industrial Security Clearance Office (DISCO) indicated in JPAS.

3.4.2. IT Level II positions; Contractor employees shall have one of the following prior to commencing work: A favorably completed Tier 3 investigation or equivalent or “Interim” Secret eligibility by DISCO indicated in JPAS.

3.4.3. IT Level III positions: Contractor employees shall have one of the following prior to commencing work: A favorably completed Tier 3 investigation or equivalent or “Interim” Secret eligibility by DISCO indicated in JPAS.

3.5. Unclassified Contracts requiring IT access: All documentation (i.e. SF 85*, etc.) required for their initial security appointment for unclassified contracts to IT Level III shall be processed through the CCAD Security Personnel Security Office prior to entering CCAD facilities.

3.6. IT Level III positions; Contractor employees requiring access to CCAD Local Area Network (LAN) shall have background investigation processed through CCAD Personnel Security Office. If the Contractor employee does not possess the proper investigation, the Government (Contracting Officer Representative) will request one. The Government assumes costs and initiates non-clearance investigation by submitting the appropriate Personnel Security Investigation request to the Army Center of Excellence. Minimum requirements for CAC issuance and access to the LAN is an initiated investigation with favorable FBI fingerprint check. Due to costs and the inherent delays involved with security investigations, requests for Contractor LAN access shall be kept to an absolute minimum necessary to perform contract requirements.

3.6.1. Fitness Issues: CCAD Security will be notify the Contracting Officer Representative (COR) when discovery of adverse information indicates potentially actionable issues that may disqualify the Contractor employee from access.

3.6.2. OPM Memorandum, Final Credentialing Standards for Issuing Personal Identity Verification Cards under HSPD-12 provides government-wide credentialing standards to be used by all Federal departments and agencies in determining whether to issue or revoke personal identity verification (PIV) cards to employees and contractor personnel.

3.6.3. Whether or not to grant access is the sole discretion of the Government. The decision not to grant access will not be grounds for contract modification and shall not constitute an excuse for Contractor performance failure.

3.7. System Authorization Access Request (SAAR): Prior to system access, a SAAR, DD Form 2875, shall be completed by the Contractor employee. The Contractor employee shall complete Part I, the COR shall complete Part II, and CCAD Personnel Security shall complete Part III.

3.8. Unclassified Contracts NOT requiring IT access: Contracts not requiring access to CCAD LAN shall be subject to installation access requirements that include the Defense Biometric Identification System (DBIDS) and/or guest sponsorship. The COR shall provide the appropriate details and contact information.

4. IT/IA Requirements:

4.1. All contract employees with access to the CCAD network must be registered in the Army Training Certification Tracking System (ATCTS) at commencement of services. Contractors and associated subcontractor employees must also complete DoD IA Awareness Training before they can be granted access to the CCAD network and complete the training annually thereafter.

4.2. All contractors working IA/IT functions must comply with DoD and Army training requirements in DoDD 8570.01, DoD 8570.01-M, and AR 25-2 within 6 months of employment.

4.3. Per DoD 8570.01-M, DFARS 252.239.7001, and AR 25-2, the contractor employees’ supporting IA/IT functions shall be appropriately certified upon contract award. The baseline certification, as stipulated in DoD 8570.01-M, must be completed upon contract award.

5. Foreign Nationals:

5.1. Official Visits: All official foreign visits (visits sponsored by a foreign government) must be based on a legitimate need, be sanctioned by the appropriate foreign attaché or embassy, and approved through Department of Army channels. Access will be coordinated through the CCAD Foreign Disclosure Officer (FDO), COR, and respective NASCC/CCAD security offices.

5.2. Unofficial Visits: These are visits by foreign nationals that are not endorsed by a foreign government. The Contractor will submit a request for employee access, based on a legitimate need, to the appropriate COR. The COR will in turn notify the FDO of the request. Due to security considerations, requests for these types of visits should be kept to a minimum. Foreign nationals will require a government escort at all times while on CCAD property. The COR will ensure the foreign contractor employee provides a copy of their passport to NASCC and CCAD security offices, to ensure the appropriate background checks are completed. NOTE: Properly validated permanent resident alien registration card holders are exempt from this requirement.

6. Notifications: The following information will be submitted to the COR and the CCAD Security Manager on company letterhead, signed by the Contractor Facility Security Officer (FSO) within 15 days of awarding the contract. An updated listing shall be provided quarterly or when the company or an employee’s status or information changes. Electronic equivalents are acceptable. The notification shall include:

a. Name, address, and telephone number of company representatives.

b. Employee's name, last four of social security number, shift.

c. The contract number and contracting agency.

d. The highest level of classified information to which Contractor employees require access.

e. The location(s) of contract performance.

f. The date contract performance begins and terminates.

7. Security Point of Contact: At no cost to the Government, the Contractor shall appoint a senior Contractor employee to serve as an on-site point of contact for any security concerns at the CCAD location. This may be a full time position or an additional duty position.

8. Security Training:

8.1. All contractor employees, including subcontractor employees, requiring access to Army installations, facilities, or controlled access areas shall complete AT Level I awareness training within 30 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever applies. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee to the COR (or to the contracting officer, if a COR is not assigned) within 30 calendar days after completion of training by all employees and subcontractor personnel. AT Level I awareness training is available at https://atlevel1.dtic.mil/at.

8.2. US-based contractor and subcontractor employees who are required to travel overseas in performance of their duties must receive government provided AT awareness training that is specific to the area of responsibility (AOR), as directed by AR 525-13. Specific AOR training content will be directed by the combatant commander and the unit ATO will ensure an applicable AT foreign travel briefing is provided to the contractor.

8.3. The contractor and all associated subcontractors shall brief all employees on the local iWATCH program. This is a locally developed training is provided by CCAD security and will be used to inform employees of the types of suspicious behavior to watch for and instruct employees to report suspicious activity to the COR. This training shall be completed within 30 calendar days of contract award and within 30 calendar days of new employees’ commencing performance, with the results reported to the COR no later than 30 days after training completion.

8.3.1 Contracts with a scope of work that call for the use of CCAD specific information or equipment at off base locations and facilities must develop an OPSEC Standard Operating Procedure (SOP)/Plan within 90 days of contract award which will be reviewed by the CCAD OPSEC Officer for approval IAW AR 530-1, Operations Security. The SOP/Plan must identify CCAD's critical information, why it needs to be protected, where it is located, who is responsible, and how the contractor intends to protect it. This plan is “For Official Use Only” and must contain appropriate document controls in accordance with AR 25-55, Chapter 4. The plan must be stored in a secure location such as a lockable container and must be properly destroyed when no longer needed in accordance with local CCAD policy CCADR 25-92, Chapter 1, Section 1-6(j).

8.4. IAW AR 530-1, new contractors and associated subcontractors who require a CAC Card and access to the CCAD network must complete Level I OPSEC training within 30 calendar days of reporting for duty and annual OPSEC contractor refresher training, thereafter.

8.5. Threat Awareness Reporting Program Training: Per AR 381-12 Threat Awareness and Reporting Program (TARP), contractor employees must receive annual TARP training presented by a Counterintelligence Special Agent.

9. Pass and Identification Items: The Contractor shall obtain the pass and identification items for employees and Contractor owned vehicles required for contract performance.

10. Retrieving Identification Media: The Contractor shall retrieve all identification media, including vehicle passes from employees who depart for any reason before the contract expires; e.g. terminated for cause, retirement, etc. and surrender to CCAD security through the COR.

11. Weapons, Firearms, and Ammunition: Contractor employees are prohibited from possessing weapons, firearms, or ammunition, on themselves or within their Contractor-owned vehicle or privately- owned vehicle while on

CCAD.

12. Safeguarding Classified or Sensitive Information: Any material marked as Top Secret, Secret, Confidential, For Official Use Only (FOUO) Freedom of Information Act (FOIA), Privacy Act Information, or any other restrictively marked material discovered by the Contractor or Contractor employees will be surrendered at the earliest opportunity to any military or DoD employee of the installation. Under no circumstances will the Contractor retain such material. The Contractor and all Contractor employees will execute a SF 312, Classified Information Non- Disclosure Agreement or equivalent CCAD Non-Disclosure Agreement as directed or required.

12.1. Classified: Visitor Groups will safeguard classified information IAW DoD 5200.1-R, DoD Information Security Program, AR 380-5, Department of the Army Information Security Program, AR 380- 49, Industrial Security Program, and other directives deemed necessary by the Servicing Security Activity (SSA). The contractor shall comply with FAR 52.204-2, Security Requirements. This clause involves access to information classified “Confidential,” “Secret,” or “Top Secret” and requires contractors to comply with—(1) The Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (DoD 5220.22-M); any revisions to DOD 5220.22-M, notice of which has been furnished to the contractor.

12.2. Information Systems (IS): All Contractor personnel will protect and restrict access to all documentation (i.e.

maps, test and evaluation results, vulnerability assessments, audits, results, or findings) describing operational IS architectures, designs, configurations, vulnerabilities, address listings, or user information.

12.3. FOR OFFICIAL USE ONLY (FOUO): The Contractor shall comply with DoD 5400.7-R, Chapter 4, DoD Freedom of Information Act (FOIA) Program requirements and AR 25-55, Chapter III and Chapter IV, The Department of the Army Freedom of Information Act Program. These regulations set forth policy and procedures for the disclosure of records to the public and for marking, handling, transmitting, and safeguarding FOUO material.

12.4. Privacy Act: All data associated with this task is covered by the Privacy Act of 1974, Title 5 of the U.S. Code, Section 552a and applicable CCAD rules and regulations. Violation of the Act may involve the imposition of criminal penalties. Therefore, all Contractor personnel assigned shall take appropriate actions to prevent unauthorized disclosure of Privacy Act information.

12.5. Operations Security (OPSEC): Contractor personnel must protect information that has been designated as critical to the CCAD mission from disclosure. Critical information will only be disseminated on a “need-to-know” basis and not be discussed in public areas such as hallways, bathrooms, eateries, smoke shacks, or any off-base gathering locations. Contractor employees will not pass critical information over unsecured telephones, facsimiles, and/or e-mail outside of the CCAD firewall. All critical/sensitive information being electronically transmitted will be encrypted. Contractor employees will not post critical information on the web, personal “blogs,” or where it is visible to visitors or the public. All information, to include photos, web posts, and captions, must be reviewed by the CCAD Public Affairs Officer (PAO) and the CCAD Operations Security Officer prior to public dissemination.

12.6. Proprietary Information: Information and materials developed at CCAD are considered business sensitive and must be protected from unauthorized disclosure. This information is the sole property of CCAD and must not be revealed or used except in contract performance. Distribution is limited to authorized US Government agencies and identified Contractors. Contractor personnel must receive prior authorization from the CCAD Public Affairs Officer (PAO) and the CCAD Operations Security Officer to disseminate CCAD information.

13. Reporting Requirements: Contractor personnel shall report to an appropriate authority any information or circumstances of which they are aware may pose a threat to the security of personnel, resources, and classified or unclassified defense information. Contractor employees shall be briefed by their immediate supervisor upon initial on-base assignment.

14. Physical Security: The Contractor shall be responsible for safeguarding all Government property and controlled forms provided for Contractor use. At the end of each work period, all Government facilities, equipment, and materials shall be secured.

15. Key Control: The Contractor shall establish and implement methods of making sure all keys issued to the Contractor by the Government are not lost or misplaced and are not used by unauthorized persons. The Contractor shall not duplicate any keys issued by the Government.

15.1. The Contractor shall coordinate with security for the receiving of keys needed to access necessary work spaces.

15.2. The Contractor shall immediately report to security, the Quality Assurance Evaluator (QAE), and Program Manager any occurrences of lost or duplicated keys.

15.3. In the event keys, other than master keys, are lost or duplicated, the Contractor may be required, upon written direction of the contracting officer, to re-key or replace the affected lock or locks at no cost to the Government. The Government may, however, at its option, replace the affected lock or locks or perform re-keying and deduct the cost of such assistance from payment due the Contractor. In the event a master key is lost or duplicated, all locks and keys for that system shall be replaced by the Government and the total cost deducted from payment due the Contractor.

15.4. The contractor shall prohibit the use of any door obstruction and/or the removal of hardware that would prevent a door from securing properly.

15.5. The Contractor shall prohibit the use of keys, issued by the Government, by any persons other than the Contractor’s employees and the opening of locked areas by Contractor employees to permit entrance of persons other than Contractor employees…