Attachment W912PA22R00010002_Questions-Answers 020422.pdf

Question Answer

1. Do you have a document to propose to contractualize the data processing (GDPR law) or would you like us to send you our contract proposal?

US Forces operate in Belgium pursuant to the U.S.

NATO Status of Forces Agreement and other host nation agreements. When contracting with host nation vendors, the U.S. Government understands vendors must comply with applicable provisions of the European Union (EU) General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679). As the U.S. Government will operate consistent with its NATO and host nation agreements, and host nation vendors must comply with all applicable EU and host nation regulations, we see no need to execute a specific agreement concerning the EU

GDPR.

2. Would you like to have resumes or competency profiles in our offer, the reading of the documents "scope of work" and "released" leaves us with a doubt.

Please follow the proposal preparation instructions provided under 52.212-1 “Instructions to Offerors – Commercial Items (Sep 2021)’, paragraph III.

Proposal Contents, 2. Part II – Technical Proposal.

3. Concerning the body cam :

- The agents will work exclusively within the site; therefore the body cam will only be able to "film" people inside the site

- If the people on site are / will be informed that they are likely to be filmed

- What about the data processing?

-The guards will be working exclusively inside the installation’s perimeter.

-Before entering the installations all appropriate markings are installed at the entrance and on the perimeter fence to notify the public is being monitored.

-The images recorded by the guards each day will be automatically deleted at night while the unit recharges, unless an incident has occurred. In this case the body-worn camera would be isolated and brought to Chievres to retrieve the data of that incident. The body-worn data will only be retrieved if an incident report is opened by the Military Police. The only person authorized and able to retrieve the recorded video footage would be the COR, the Provost Marshal, the Deputy Provost Marshal and any Military Police Investigator. The Belgian Law authorizes up to 30 days of recording, only 24 hours are being recorded and automatically deleted upon recharge.

The procedure in case of an incident is as follows:

After the incident, the guard will bring to body-worn camera to the site supervisor, the site supervisor will assign another body-worn camera to the guard and an incident report will be initiated.

3. - What about the data processing (Continued).

Then the COR will go to the site and bring back the body-worn camera to Chievres to retrieve the data from that specific body-worn camera for investigation. Contractors do not have access to the data. This is intentional, nor do they have the access to turn on or turn off the body-worn camera.

4. Trainings : Concerning the specific trainings mentioned below, can you refer us which is the referenced training organization and/or the duration and price.

1.23.4 Information Assurance (IA) Training:

1.23.4.1 All Contractor employees, including subcontractors, requiring access to Government information systems shall complete the Department of Defense (DoD) IA Cyber Awareness

Training within thirty (30) days (Deliverable # 25) after contract start date or effective date of incorporation of this requirement into the contract, whichever applies, or thirty (30) days after employment of new personnel. Verification of the training shall be provided to the COR within seven (7) days after completion of the training (Deliverable # 26).

1.23.4.2 All Contractor employees, including subcontractors, working information technology (IT)/IA functions shall comply with DoD and Army training requirements per Information

Assurance Training Certification and Workforce Management

DoD Directive (DoDD) 8570.01, Information Assurance

Workforce Improvement Program DoD 8570.01-M, and

Information Assurance AR 25-2 within thirty (30) calendar days of employment. Training is available atCaution-Caution-https://ia.signal.army.mil/DoDIAA/default.asp < Caution-Caution-https://ia.signal.army.mil/DoDIAA/default.asp > .

1.23.4.3 All Contractor employees, including subcontractors, performing services under this contract with access to a

Government information system must be registered in the Army

Training Certification Tracking System (ATCTS), the web address is Caution-Caution-https://atc.us.army.mil/iastar/index.php < Caution-Caution-https://atc.us.army.mil/iastar/index.php > . Verification of registration shall be provided to the COR within seven (7) days after registration. (Deliverable # 27). Contractor personnel must complete refresher training every twelve (12) months (Deliverable

# 28). Verification of the training shall be provided to the COR within seven (7) days after completion of the training (Deliverable

# 29).

1.23.5 Personally Identifiable Information (PII):Contractor

employees, including subcontractors, performing services under the contract with access to PII and Government information shall complete “Identifying and Safeguarding PII” within 30 calendar days of employment (Deliverable # 30). Contractor personnel shall complete refresher training every twelve (12) months from

The trainings are free of charge and the method of training is online. The average duration of the trainings is between 1 to 2 hours per training, depending on the skill of the student. All these trainings are annual.

4. Trainings (Continued) initial completion (Deliverable # 31). The Contractor shall provide the COR a copy of the training certificates for its employees no later than seven (7) days after completion (Deliverable # 32).

Training is available atCaution-Caution-http://iatraining.disa.mil/eta/piiv2/launchPage.htm < Caution- Caution-http://iatraining.disa.mil/eta/piiv2/launchPage.htm > .

5. On page 27 of the W912PA22R0001_Released you ask in point 3.(a) "Relevant performance is defined as performance of efforts involving requirements that are similar or greater in scope, magnitude (of at least € 10,000,000.00)," shall we understand "at least € 10,000,000.00 per year”. can you clarify?

The magnitude of effort is at least € 10,000,000.-per listed prior relevant experience. There is no requirement on the contract length.

6. Could you elaborate more on the reason why issuing a new RFQ only 02 years after the previous one while the contract was originally concluded for a 5-year period? Do we have to understand that you are facing issues with the quality of the services, the current manning, the scope of the contract,… ?

The U.S. Government concluded that re-competing the requirements contained in the current contract are in its best interests but will not provide its reasons.