W91CRB21R0018 Approved.pdf

SEE ADDENDUM

(No Collect Calls)

W91CRB21R0018 22-Jun-2021

b. TELEPHONE NUMBER 8. OFFER DUE DATE/LOCAL TIME

12:00 PM 23 Jul 2021

5. SOLICITATION NUMBER 6. SOLICITATION ISSUE DATE

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

STANDARD FORM 1449 (REV. 2/2012)

Prescribed by GSA – FAR (48 CFR) 53.212

(TYPE OR PRINT)

(SIGNATURE OF CONTRACTING OFFICER)

ADDENDA ARE

26. TOTAL AWARD AMOUNT (For Gov t. Use Only )

23.

CODE 10. THIS ACQUISITION IS

SUCH ADDRESS IN OFFER

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT

BELOW IS CHECKED

TELEPHONE NO.

W91CRB9. ISSUED BY

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a. UNLESS BLOCK

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME

GERALD A. SIMMONS

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NUMBER

(TYPE OR PRINT)

30b. NAME AND TITLE OF SIGNER 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a.UNITED STATES OF AMERICA

0 27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1. 52.212-4. FAR 52.212-3. 52.212-5 ARE ATTACHED.

25. ACCOUNTING AND APPROPRIATION DATA

1. REQUISITION NUMBER

20.

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED.

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, AND 30

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

ARE NOT ATTACHED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

SET FORTH HEREIN, IS ACCEPTED AS TO ITEMS:

. YOUR OFFER ON SOLICITATION

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

% FOR:SET ASIDE:UNRESTRICTED ORX

SMALL BUSINESS

17a.CONTRACTOR/ CODE FACILITY

OFFEROR CODE

ACC - APG - W91CRB

BLDG 4310

6515 INTEGRITY COURT

ABERDEEN PROVING GROUND MD 21005-3013

18a. PAYMENT WILL BE MADE BY CODE

RATED ORDER UNDER

DPAS (15 CFR 700)

13a. THIS CONTRACT IS A

13b. RATING

CODE15. DELIVER TO CODE W81E2G 16. ADMINISTERED BY

12. DISCOUNT TERMS11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

14. METHOD OF SOLICITATION

RFQ IFB RFPX

HQDA / OTJAG

ELECTRONIC DISCOVERY DIV, US ARMY LEGAL SERVI

9275 GUNSTON ROAD

FORT BELVOIR VA 22060

TEL: 703.693.0574 FAX:

FAX:

TEL: SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

8(A)

HUBZONE SMALL

BUSINESS

SIZE STANDARD:

$12,000,000

NAICS:

541199

X

OFFER DATED

29. AWARD OF CONTRACT: REF.

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

EMAIL:

TEL:

31c. DATE SIGNED

SEE SCHEDULE

SCHEDULE OF SUPPLIES/ SERVICESITEM NO. QUANTITY UNIT UNIT PRICE AMOUNT

24.22.21.19.

WOMEN-OWNED SMALL BUSINESS (WOSB)

ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

(CONTINUED)

PAGE 2 OF188

ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED: ______________________________________________________

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED

32b. SIGNATURE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32c. DATE 32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f . TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

37. CHECK NUMBER

FINALPARTIALCOMPLETE

36. PAYMENT35. AMOUNT VERIFIED

CORRECT FOR

34. VOUCHER NUMBER

FINAL

33. SHIP NUMBER

PARTIAL

38. S/R ACCOUNT NUMBER 39. S/R VOUCHER NUMBER 40. PAID BY

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42a. RECEIVED BY (Print)

42b. RECEIVED AT (Location)

42c. DATE REC'D (YY/MM/DD) 42d. TOTAL CONTAINERS

STANDARD FORM 1449 (REV. 2/2012) BACK

Prescribed by GSA – FAR (48 CFR) 53.212

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

SEE SCHEDULE

20.

SCHEDULE OF SUPPLIES/ SERVICES

21.

QUANTITY UNIT

22. 23.

UNIT PRICE

24.

AMOUNT

19.

ITEM NO.

Section SF 30 - BLOCK 14 CONTINUATION PAGE

SPECIAL INSTRUCTIONS

The information provided below addresses requirements prescribed by FAR 16.504, Indefinite-quantity contracts.

1. The base contract is awarded as a Single-Award Indefinite Delivery, Indefinite Quantity (IDIQ) with a five-year ordering period.

2. The Contracting Office will issue Task Orders (TO) to the contractor via email. Each TO will provide the specific requirements.

3. ACC-APG is the only activity authorized to award orders against this contract.

CONTRACT MIN AND MAX

1. The Governments minimum contract obligation is Task Order (TO) 0001. The Government intends to issue TO 0001 along with the IDIQ Contract award.

2. The Government reserves the right to award only the minimum.

Section B - Supplies or Services and Prices

ITEM NO SUPPLIES/SERVICES MAX

QUANTITY

UNIT UNIT PRICE MAX AMOUNT

0001 UNDEFINED Job Hardcopy Document and Media Acquisition

FFP

The contract shall provide provide products and services in-accordance-with the FLASH Performance Work Statement (PWS) incorporated herein for the five (5) year ordering period.

FOB: Destination

PSC CD: R418

MAX

NET AMT

UNIT UNIT PRICE MAX AMOUNT

0002 UNDEFINED Job Hardcopy Document Preparation and Index

FFP

The contract shall provide provide products and services in-accordance-with the FLASH Performance Work Statement (PWS) incorporated herein for the five (5) year ordering period.

UNIT UNIT PRICE MAX AMOUNT

0003 UNDEFINED Job Scan to Digital Image / OCR

FFP

The contract shall provide provide products and services in-accordance-with the FLASH Performance Work Statement (PWS) incorporated herein for the five (5) year ordering period.

UNIT UNIT PRICE MAX AMOUNT

0004 UNDEFINED Job Blowback

FFP

The contract shall provide provide products and services in-accordance-with the FLASH Performance Work Statement (PWS) incorporated herein for the five (5) year ordering period.

UNIT UNIT PRICE MAX AMOUNT

0005 UNDEFINED Job Photocopying

FFP

The contract shall provide provide products and services in-accordance-with the FLASH Performance Work Statement (PWS) incorporated herein for the five (5) year ordering period.

UNIT UNIT PRICE MAX AMOUNT

0006 UNDEFINED Job Document Coding

FFP

The contract shall provide provide products and services in-accordance-with the FLASH Performance Work Statement (PWS) incorporated herein for the five (5) year ordering period.

UNIT UNIT PRICE MAX AMOUNT

0007 UNDEFINED Job Electronic Files Processing

FFP

The contract shall provide provide products and services in-accordance-with the FLASH Performance Work Statement (PWS) incorporated herein for the five (5) year ordering period.

UNIT UNIT PRICE MAX AMOUNT

0008 UNDEFINED Job Standard Databases

FFP

The contract shall provide provide products and services in-accordance-with the FLASH Performance Work Statement (PWS) incorporated herein for the five (5) year ordering period.

UNIT UNIT PRICE MAX AMOUNT

0009 UNDEFINED Job Web Hosting

FFP

The contract shall provide provide products and services in-accordance-with the FLASH Performance Work Statement (PWS) incorporated herein for the five (5) year ordering period.

UNIT UNIT PRICE MAX AMOUNT

0010 UNDEFINED Job Other Services

FFP

The contract shall provide provide products and services in-accordance-with the FLASH Performance Work Statement (PWS) incorporated herein for the five (5) year ordering period.

UNIT UNIT PRICE MAX AMOUNT

0011 UNDEFINED Job Project Mgt and Technical Support

T&M The contract shall provide provide products and services in-accordance-with the FLASH Performance Work Statement (PWS) incorporated herein for the five (5) year ordering period.

TOT MAX PRICE

CEILING PRICE

UNIT UNIT PRICE MAX AMOUNT

0012 UNDEFINED Job Electronic Data and Documentation Acq

T&M The contract shall provide provide products and services in-accordance-with the FLASH Performance Work Statement (PWS) incorporated herein for the five (5) year ordering period.

UNIT UNIT PRICE MAX AMOUNT

0013 UNDEFINED Job Electronic Data and Documentation Acq

T&M The contract shall provide provide products and services in-accordance-with the FLASH Performance Work Statement (PWS) incorporated herein for the five (5) year ordering period.

UNIT UNIT PRICE MAX AMOUNT

0014 UNDEFINED Job Database Creation

T&M The contract shall provide provide products and services in-accordance-with the FLASH Performance Work Statement (PWS) incorporated herein for the five (5) year ordering period.

UNIT UNIT PRICE MAX AMOUNT

0015 UNDEFINED Job Electronic Data Processing

T&M The contract shall provide provide products and services in-accordance-with the FLASH Performance Work Statement (PWS) incorporated herein for the five (5) year ordering period.

UNIT UNIT PRICE MAX AMOUNT

0016 UNDEFINED Job Pre-Trial and trial Support

T&M The contract shall provide provide products and services in-accordance-with the FLASH Performance Work Statement (PWS) incorporated herein for the five (5) year ordering period.

UNIT UNIT PRICE MAX AMOUNT

0017 UNDEFINED Job Specialized Professional Services

T&M The contract shall provide provide products and services in-accordance-with the FLASH Performance Work Statement (PWS) incorporated herein for the five (5) year ordering period.

UNIT UNIT PRICE MAX AMOUNT

0018 UNDEFINED Job Managed Review Services

T&M The contract shall provide provide products and services in-accordance-with the FLASH Performance Work Statement (PWS) incorporated herein for the five (5) year ordering period.

UNIT UNIT PRICE MAX AMOUNT

0019 UNDEFINED Job Other Direct Cost (ODC) and Travel

T&M The contract shall provide provide products and services in-accordance-with the FLASH Performance Work Statement (PWS) incorporated herein for the five (5) year ordering period.

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

0020 Job Contract Manpower Reporting

FFP

Contractor Manpower Reporting requirement has been added to the Performance Work Statement (PWS). The contractor is required to completely fill in all required data fields using the following web address: http://www.SAM.gov, and then click on “Department of the Army CMRA” or the icon of the DoD organization that is receiving or benefitting from the contracted services.

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

0021 Job Contract Data Requirement List (CDRL)

T&M The contract shall provide provide products and services in-accordance-with the FLASH Performance Work Statement (PWS) incorporated herein for the five (5) year ordering period.

TOT ESTIMATED PRICE

Section C - Descriptions and Specifications

PERFORMANCE WORK STATEMENT

PERFORMANCE WORK STATEMENT (PWS)

For

Flexible Litigation Augmentation Support for HQDA (FLASH)

U.S. Army Judge Advocate General’s Corps (JAGC)

SOLICITATION NUMBER:

W91CRB-21-R-0018

29 June 2021

PART 1

GENERAL INFORMATION

1. GENERAL: This performance work statement (PWS) is for an indefinite-delivery indefinite quantity (IDIQ) non-personal services contract to provide professional legal support services for the U.S. Army Judge Advocate General’s Corps (JAGC). Professional legal support encompasses a wide range of professional services and products that help attorneys collect, organize, develop, and present evidence throughout the course of all types of litigation (civil or criminal) and board proceedings, from pre-filing investigation and early case assessment (ECA), through complaint, discovery, and trial, and through post-trial briefs and the appeals process. The types of professional legal support required under this contract will generally fall into the following worldwide services: (1) Hardcopy Document and Media Acquisition; (2) Hardcopy Document Preparation and Indexing; (3) Scan to Digital Image and optical character recognition (OCR) (including Hardcopy and Microfiche Scanning); (4) Blowback; (5) Photocopying; (6) Document Coding; (7) Electronic Files Processing (EFP) including Scanned Doc / ESI processing and production; (8) Standard Database Creation, Maintenance and Utilization; (9) Hosting; (10) Other Services (Language Translation and Document Storage); (11) Project Management and Technical Support (i.e., resource planning, implementation, and administration); (12) Electronic Data and Document Acquisition (forensic collection); (13) Pre- Trial, Trial, and Post-Trial Support; (14) Specialized Professional services (includes experts, historians, researchers, legal writing, etc.); (15) Managed Review services; and (16) Facility Space setup and maintenance (i.e., document center for legal review, sensitive compartmented information facility (SCIF), etc.). The Government shall not exercise any supervision or control over the contract service provider(s) performing the services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn is responsible to the Government.

1.1 Description of Services/Introduction: The Contractor shall provide all administrative, logistical, professional and technical labor, equipment, supplies, facilities, transportation, tools, materials, supervision, technology, and other items and non-personal services necessary to provide a wide range of professional legal support services and products through the course of litigations, investigations, board proceedings, and responses to third party subpoenas, Congressional inquiries, and Freedom of Information Act (FOIA) requests. Contractor shall also prepare and present executive level briefings for JAGC personnel, Headquarters Department of the Army (HQDA) and Department of Defense (DoD) personnel concerning work performed.

Contractor shall maintain all data in an electronic format available for analysis and reporting.

Data remains the property of the Government. The Contractor shall perform to the standards in this contract.

1.2 Background: The JAGC provides legal services for the Army, its Soldiers, family members, and retirees. The JAGC is comprised of military Judge Advocates, civilian counsel, military para-professionals, and civilian paralegals that all serve in a variety of roles. Judge Advocates may serve as prosecutors and defense attorneys for criminal matters under the Uniform Code of Military Justice, while both Judge Advocates and civilian counsel may serve as litigation attorneys in civil litigation in both Federal and State venues (e.g., Courts and Boards), and practice operational, labor, contract, environmental, tort and administrative law, including investigations, and FOIA or Privacy Act matters. These legal matters require the JAGC, in often short suspense timeframes, to collect, scan, copy, decrypt, process, review, and produce increasingly large volumes of paper documents, emails, computer and network files, other electronically stored information (“ESI”), and utilize other professional legal support services (e.g., legal research and writing, translation and transcription, trial support, and expert testimony).

The U.S. Army Legal Services Agency (USALSA) is an Army field operating agency of the Office of The Judge Advocate General (OTJAG) that supports Army and Joint Force priorities by representing the Army in legal matters before courts and administrative bodies. This representation is accomplished in compliance with electronic discovery (eDiscovery) requirements found in the Federal Rules of Civil Procedure, Army policies and regulations, as well as Board and Court rules of practice. The Army eDiscovery Division (EDD), housed within USALSA on Fort Belvoir, VA, provides in-house litigation support for these legal matters, and is responsible for managing and coordinating legal support services for the JAGC relating to ESI and services utilizing ESI. These legal matters, however, increasingly involve urgent and/or large scale professional legal support needs beyond EDD’s existing capabilities.

This contract shall serve as a flexible and responsive solution to meet such large scale and/or urgent professional legal support needs in support of the JAGC mission. While the primary focus of this contract is to support the civil litigation mission, the Army expects to use these professional legal support services in other areas of the JAGC practice, such as FOIA, military justice, and investigations. Moreover, any future contract may be utilized by the JAGC and other DoD affiliated entities.

1.3 Objectives: Obtain professional legal support services to augment Army’s internal eDiscovery Program for large scale and/or surge cases and/or cases that require resource support.

The types of professional legal support services will generally fall into the following areas:

Hardcopy Document and Media Acquisition Hardcopy Document Preparation and Indexing Scan to Digital Image / OCR (includes hardcopy and microfiche Scanning) Blowback Photocopying Document Coding Electronic Files Processing (includes scanned doc/ESI processing and production;

audio/video digitization) Standard Database Creation, Maintenance and Utilization Hosting Other Services (includes Language Translation and Document Storage) Project Management and Technical Support (resource planning, implementation, and administration Electronic Data and Document Acquisition (forensic collection) Pre-Trial and Trial and Post-Trial Support Specialized Professional Services (includes experts, historians, researchers, legal writing) Managed Review Services Facility Space setup (for legal review, SCIF, etc.)

The services sought will help the JAGC in its large scale cases and/or cases with a short suspense, in the Continental United States (CONUS) and Outside the Continental United States (OCONUS), with the collection, scanning, processing, analysis, review, production, and presentation of evidence, for all types of litigation matters including civil or criminal matters in front of state and federal courts and magistrates, administrative hearings, and board proceedings, as well as responses to Congressional inquiries, third-party subpoenas, and Freedom of Information Act (FOIA) requests, from pre-filing investigation and early case assessment (ECA), through complaint, discovery, trial, and through post-trial briefs and the appeals process. The FLASH program will also provide the JAGC access to resources such as testifying subject matter experts, historians, researchers and legal writers, analysts, etc., to support their cases and investigations, CONUS and OCONUS. Primary services will be utilized to support the civil litigation mission. However, the Army also expects to use these professional legal support services in matters such as Freedom of Information Act (FOIA), military justice, and investigations.

1.4 Scope: This contract will be used to provide worldwide professional legal support products and services to the JAGC on an indefinite delivery, indefinite quantity task order basis.

Individual task orders issued under this contract may support any Department of the Army (DA) agency on a local, nationwide, or worldwide basis. The professional legal support services include: project management; managed review; expert analysis; technology processes, and;

products from early case assessment/pre-processing ingestion through trial presentation and post-trial phases. These services utilize state of the art technology, including analytics and technology assisted review (“TAR”), and employ eDiscovery best practices to collect, decrypt, process, ingest, analyze, review, host, and produce ESI for investigations, inspections, examinations, and/or litigation. Assistance may be required to respond to information requests from many sources, including, for example, Congressional requests for information and third-party subpoenas and audits, as well as to provide assistance to Judge Advocates and other professional staff members to acquire, organize, analyze and present evidence as part of unofficial or official discovery in a lawsuit or investigation. The prime Contractor shall be a FedRAMP certified (moderate level) litigation support provider.

1.5 Reserved

1.6 General Information:

1.6.1 Quality Control: The Contractor shall develop and maintain an effective quality control program to ensure services are performed in accordance with this PWS. Through its Quality Control Plan (QCP), the Contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The Contractor’s quality control program is the means by which it assures itself that its work complies with the requirement of the contract.

Work failing to meet these standards shall be rejected, and the Contractor shall be required to perform the work again at no additional cost to the Government. To ensure all deliverables conform to contract specifications, the Contractor shall implement quality control procedures for all tasks as delineated in its proposal. The Contractor shall stress to its staff the importance of quality control and quality assurance. The Contractor shall maintain quality control of all work performed, review the condition and appearance of output, check output for accuracy and consistency, ensure completion of all steps, and produce the required number of deliverables as specified by the task order. The QCP shall be delivered to the (KO and to the Contracting Officer’s Representative (COR) within 30 calendar days after contract award. Copies of changes made to the QCP shall be forwarded to the Contracting Officer (KO) and COR within 5 working days of when the changes are made. The importance to the Government of quality work cannot be overstated. The Government is committed to the production of deliverables that meet the contract specifications when first presented to the Government; the Government will reject work not meeting contract quality standards and will insist re-work be done at the Contractor's expense. Repeated failure to deliver acceptable work may result in contract termination. Thus, the Government views it as being in the Contractor's best interest to have in place a thorough and robust quality control program. After acceptance of the QCP the Contractor shall receive the KO’s acceptance in writing of any proposed change to his QC system.

REF: CDRL No. A001

1.6.2 Quality Assurance: The government shall evaluate the Contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). The QASP is primarily focused on what the Government must do to ensure that the Contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

1.6.3 Recognized Holidays: The Contractor is not required to perform services on Government holidays.

New Year’s Day Labor Day Martin Luther King Jr.’s Birthday Columbus Day President’s Day Veteran’s Day Memorial Day Thanksgiving Day Juneteenth Day Christmas Day Independence Day

1.6.4 Hours of Operation: When performance is at a Government specific-site / facility, the Contractor is responsible for conducting business customary for that specific-site / facility.

Typically, this will be between the hours of 8:00 AM and 5:00 PM (at the time zone of the Contractor’s specific location, locally, nationwide, or worldwide) Monday thru Friday except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. The Contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons. When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the workforce are essential.

1.6.5 Place of Performance: This contract requires worldwide support. The Contractor should plan to provide accommodations for any personnel used to support this requirement. In select circumstances (i.e., SCIF on Government facilities, or resource support for Army’s internal eDiscovery Division at Fort Belvoir, Virginia), the Government will provide space to accommodate the required contract personnel, locally in the national capital region, nationally, or worldwide. Government locations would be specified by COR during issuance of the Task Order, and would be made available at Government locations, if required.

1.6.6 Period of Performance: A five (5) year ordering period per Section F of the contract.

1.6.7 Security Requirements: All security requirements shall be in accordance with the DD254 referenced in Section J of the contract. The Contractor shall not use, disclose, or reproduce any proprietary data, other than as required in the performance of this PWS. The Contractor shall not divulge or release data or information developed or obtained in the performance of this contract except upon written approval from the Government Representative and the COR.

Contractor personnel are subject to all local installation rules and procedures. Site-specific approval regarding access, issue of security badges, etc., will be coordinated as required.

Contractor personnel should be aware at all times of any unusual persons or packages in their work area and immediately report those to the building security staff. If Contractor personnel become aware of any person seeking unauthorized access to classified materials, they should immediately report this to the COR.

The Contractor shall conform to all applicable federal and industry security standards. In addition, the Contractor shall work closely with Army and DoD Security Teams to ensure the implementation comports with the DoD’s internal security requirements and appropriate FedRAMP certification in order to ensure the overall protection of data due to loss, disaster or malicious attack. Contractors shall meet all existing DoD security requirements. Any Contractor hosting Army data will also be required to submit a System Security Plan (“SSP”) that meets or exceeds the requirements of NIST SP 800-171, and any amendments or replacements to NIST, FIPS, or other security standards.

All work under this effort is proprietary to Army and DoD; the Contractor shall not release any information regarding the work to anyone without written permission by the Government.

1.6.7.1 Applicability: All OTJAG Army organizations residing, traversing or furnishing and receiving Department of Defense information network–Army (DODIN–A) information technology (IT) services, products, and support through the established contract for support to or on the local area network JAGCNet System Identification: 3575 Registration Type: Assess and Authorize System Acronym: Judge Advocate General's Corps Network System Name:

JAGCNET Version / Release Number: 1.0 Information System Owner: HQDA Office of the Judge Advocate General The Department of Defense information network (DODIN) includes DoD IT (e.g., DoD-owned or DoD-controlled information systems (IS), platform IT systems, and IT products and services) that are operated by or on behalf of DoD components as defined in DODI 8500.01 and control systems and industrial control systems (ICS) as defined in National Institute of Standards and Technology (NIST) Special Publication 800–82.

All information management, information technology Task-orders/ Delivery-orders within this contract will integrate security early and throughout the IT development life cycle, capital planning, investment control, portfolio management, and enterprise architecture processes in accordance with the DoD Cybersecurity Architecture and other applicable DoD and Army issuances. Contractor shall ensure the security standards are integrated into the acquisition planning and contract administration in accordance with this PWS, and issued Task-orders/ Delivery-orders within this contract. Agency cyber security representatives will ensure that contracts and other agreements include specific requirements to provide cybersecurity for information and the IT used to process that information in accordance with DODI 8500.01 and DODI 8510.01. Document baseline cybersecurity requirements as a condition of contract award for acquisitions utilizing information technology.

Agencies’ cybersecurity program manager(s) shall ensure that the personnel, processes, and IT for which the contract supports the development, procurement, integration, modification, operation and maintenance, and/or final disposition responsibility in acquiring information technology will include the appropriate information technology security policies and requirements, including use of common security configurations available from the National Institute of Standards and Technology’s (NIST) website at http://checklists.nist.gov. Agency contracting officers should consult with the requiring official, local information assurance officers, and information security system managers to ensure the appropriate standards are incorporated. All Cybersecurity Request for Proposal (RFP), Task-Orders, Delivery-Orders and IM/IT considerations will be submitted to the agency Information Assurance officer and agency portfolio manager to assist in developing the risk management framework that reflects the specific stakeholder cybersecurity requirements and the specifics of the solution under development.

DoD organizations that use external IT services provided by a non-DoD U.S. Government agency must ensure the categorization of the system delivering the service is appropriate to the confidentiality, integrity, and availability needs of the information and mission. DoD organizations must also ensure that the system delivering the service operates under a current authorization from that agency. In accordance with DoDI 8500.01, the external government agency and the DoD organization need to develop an interagency agreement or government statement of work for this application with requirements for service level agreements (SLAs) that include the application of appropriate security controls which will be reviewed by the agency information assurance officer, information system security manager and agency cyber security division.

Agency command senior intelligence official or information security manager shall approve or validate the need-to-know for individuals (contractor) requiring SCI access and validate the need to establish SCIFs, SCI communications, and information systems (classified and unclassified).

Regulations:

Department of Defense INSTRUCTION, NUMBER 8510.01, Risk Management Framework (RMF) for DoD Information Technology (IT) 12/29/2020

AR 25-1, Army Information Technology, 07/15/2019 AR 25-2, Army Cybersecurity (Previously: Information Management Information

Assurance) 04/04/2019 AR 380-5, Army Information Security Program, 10/22/2019 Department of the Army Pamphlet 25–2–14 Information Management: Army

Cybersecurity Risk Management Framework for Army Information Technology 04/08/2019

DOD Instruction 8520.2, Public Key Infrastructure (PKI) and Public Key (PK) Enabling, 24 May 2011

Department of the Army Pamphlet 25–1–1 Information Management: Management of Sub-disciplines Army Information Technology Implementation Instructions 15/07/2019

National Institute of Standards and Technology (NIST) Special Publication 800–82.

Army Regulation 380–28 Security Army Sensitive Compartmented Information Security

Program

1.6.7.2 Clearance: Contractor personnel shall possess a minimum of an Interim SECRET security clearance and must be a United States citizen. The Contractor shall forward security clearances to a person designated by the COR for all personnel assigned to work on this contract/task order(s).

1.6.7.3 Non-Disclosure Statement: All personnel who support this contract shall be required to sign an Army Non-Disclosure Statement prior to obtaining access to the Army Local Area Network (LAN), and/or to classified information.

1.6.7.4 Antiterrorism/Operations Security:

1. AT Level I Training. All Contractor employees, to include subcontractor employees, requiring access to Army installations, facilities and controlled access areas shall complete AT Level I awareness training within 10 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable. The Contractor shall submit certificates of completion for each affected Contractor employee and subcontractor employee, to the TM or to the KO, if a TM is not assigned, within 15 calendar days after completion of training by all employees and subcontractor personnel. AT Level I awareness training is available at the following website: https://jko.jten.mil/courses/atl1/launch.html.

2. Access and General Protection/Security Policy and Procedures. Contractor and all associated subcontractor employees shall provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshall Office, Director of Emergency Services or Security Office. Contractor workforce must comply with all personal identity verification requirements (FAR clause 52.204-9, Personal Identity Verification of Contractor Personnel) as directed by DoD, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

2a. For Contractors requiring Common Access Card (CAC). Before CAC issuance, the contractor employee requires, at a minimum, a favorably adjudicated National Agency Check with Inquiries (NACI) or an equivalent or higher investigation in accordance with Army Directive 2014-05. The Contractor employee will be issued a CAC only if duties involve one of the following: (1) Both physical access to a DoD facility and access, via logon, to DoD networks on-site or remotely; (2) Remote access, via logon, to a DoD network using DoD-approved remote access procedures;

or (3) Physical access to multiple DoD facilities or multiple non-DoD federally controlled facilities on behalf of the DoD on a recurring basis for a period of 6 months or more. At the discretion of the sponsoring activity, an initial CAC may be issued based on a favorable review of the FBI fingerprint check and a successfully scheduled NACI at the Office of Personnel Management.

2b. For Contractor not eligible for CAC, but requires access to DoD facility or installation: Contractor and all associated subcontractors employees shall comply with adjudication standards and procedures using the National Crime Information Center Interstate Identification Index (NCIC-III) and Terrorist Screening Database (TSDB) (Army Directive 2014-05-AR 190-13), applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by government representative), or, at OCONUS locations, in accordance with status of forces agreements and other theater regulations.

3. AT Awareness Training for Contractor Personnel Traveling Overseas. The standard language required US based contractor employees and associated subcontractor employees to make available and to receive government provided area of responsibility (AOR) specific AT awareness training as directed by AR 525-13. Specific AOR training content is directed by the combatant commander with the unit ATO being the local point of contact.

4. iWATCH Training. The Contractor and all associated subcontractors shall brief all employees on the local iWATCH program (training standards provided by the requiring activity ATO). This local developed training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the COR. This training shall be completed within 30 calendar days of contract award and within 10 calendar days of new employees commencing performance with the results reported to the COR NLT 45 calendar days after contract award.

5. Army Training Certification Tracking System (ATCTS) registration for Contractor employees who require access to government information systems. All contractor employees with access to a government info system must be registered in the ATCTS (Army Training Certification Tracking System) at commencement of services, and must successfully complete the DoD Information Assurance Awareness prior to access to the IS and then annually thereafter.

6. For contracts that require a formal OPSEC program. N/A

7. For contracts that require OPSEC Training. Per AR 530-1, Operations Security, new

Contractor employees must complete Level I OPSEC training within 30 calendar days of their reporting for duty. All Contractor employees must complete annual OPSEC awareness training.

8. For Information assurance (IA)/information technology (IT) training. All Contractor employees and associated sub-Contractor employees must complete the DoD IA awareness training before issuance of network access and annually thereafter.

9. For information assurance (IA)/information technology (IT) certification. Per DoD 8570.01-M, DFARS 252.239-7001 and AR 25-2, the Contractor employees supporting IA/IT functions shall be appropriately certified upon contract award. The baseline certification as stipulated in DoD 8570.01-M must be completed upon contract award.

10. Contractor Authorized to Accompany the Force clause. N/A

11. Access to Government information systems (Antiterrorism/Force Protection for Defense Contractors Outside the US). For all Contractors requiring performance or delivery in a foreign country, all non-local national contractor personnel shall comply with theater clearance requirements that allow the combatant commander to exercise oversight to ensure the Contractor’s compliance with combatant commander and subordinate task force commander policies and directives.

12. For contracts that require handling or access to classified information. Contractor shall comply with FAR 52.204-2, Security Requirements. This clause involves access to information classified “Confidential,” “Secret,” or “Top Secret” and requires Contractors to comply with— (1) The Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (DoD 5220.22-M); (2) any revisions to DoD 5220.22-M, notice of which has been furnished to the Contractor.

13. Threat Awareness Reporting Program. For all Contractors with security clearances. Per

AR 381-12 Threat Awareness and Reporting Program (TARP), Contractor employees must receive annual TARP training by a CI agent or other trainer as specified in 2-4b.

1.6.7.5 Off-Site Processing and Storing of Government’s Information / Security and Privacy Compliance: The Contractor shall comply with all the Government’s information security and privacy directives, policies and requirements unless Contractor obtains a written waiver from Army and DoD Security Teams. These include, but shall not be limited to, the following provisions and any amendments or replacements of:

1. The Privacy Act of 1974 (5 U.S.C. § 552a), as amended;

2. Office of Management and Budget (OMB) Circular A-130, Management of Federal

Information Resources (Transmittal Memorandum No. 4), including Appendices;

3. E-Government Act of 2002 (P. L. 107-347), including Title II, Section 208 - Privacy

Provisions and Title III - Federal Information Security Management Act of 2002 (FISMA), and related OMB guidance;

4. National Institute of Standards and Technology (NIST), including NIST SP 800- 171, Federal Information Processing Standards (FIPS) and Special Publications and

5. Army Rules and Regulations, and DFARs clauses including protection of Controlled Unclassified Information (CUI).

1.6.7.6 Control and Protection of Government’s Information. The Contractor shall implement effective, administrative, technical, and physical safeguards to ensure that all of the Government’s information in its possession or under its control is adequately protected from loss, misuse, and unauthorized access or modification. The creation, collection, use, processing, storing, maintenance, dissemination, disclosure, and disposal of Government information shall comply with all applicable federal and state laws, Army Rules and Regulations, and DFARs regarding protection of information. The Contractor shall not use any such information except to the extent necessary to carry out its obligations under the contract. The Contractor shall not disclose such information to any third party unless (i) disclosure is authorized in the Agreement,

(ii) the Contractor obtains the prior written consent of the COR, or (iii) to the extent expressly required by applicable law, in which case the Contractor shall notify the COR at least ten (10) business day before such disclosure, to allow the Government to object or concur. The Contractor, subcontractor, or any entity under the Contractor’s control shall not access, disseminate, maintain, store, use or disclose such information outside the United States, unless specifically directed by the Agreement or otherwise authorized by the COR.

1.6.7.7 Return, Destruction and Retention of Government’s Information. All Government information remains the property of the Government. Upon completion or termination of the contract, or at any time upon request of the COR, the Contractor shall promptly return to the COR all such information in its possession and/or securely dispose of it as required in the contract, PWS, or as directed by the COR. Information shall be returned securely in a format directed by the COR. Retention of such information by the Contractor beyond the conclusion of the contract is only permissible in accordance with the COR’s direction.

1.6.7.8 Inspections / Assessments / Audits / Reviews / Examinations. Contractor shall grant Army and DoD Security Teams, the U.S. Government Accountability Office (GAO), or a selected third party acting on the Army’s behalf, permission to perform inspections, assessments, audits, reviews or examinations of all controls in Contractor’s physical and/or technical environment in relation to all Government information being handled and/or services being provided to the JAGC pursuant to this Agreement. The Contractor shall fully cooperate by providing access to knowledgeable personnel, physical premises, documentation, infrastructure and application software that collects, processes, transmits, or stores such information pursuant to this PWS. These inspections, assessments, audits, reviews, and examinations may be conducted either by phone, electronically or in-person. Nothing in this clause shall be viewed as limiting the federal government’s audit and inspection rights delineated in other clauses of this PWS or by statute.

1.6.7.9 Security and Privacy Incident Handling. The Contractor shall monitor its facility, premises and information systems for security and privacy incidents and provide the capability to respond to and resolve them effectively and in a timely manner, including allowing for inspection, investigation, forensic analysis, and any other action necessary to ensure compliance with OMB M-17-12 (Preparing for and Responding to a Breach of Personnally Identifiable Information) and USALSA’s Breach Response Plan, and to assist in responding to a breach.

USALSA’s Breach Response Plan is available through the organizational Information System Security Management Officer, Information Technology Division, Cyber Security department.

The Contractor and subcontractors (at any tier) shall report a suspected or confirmed breach in any medium or form, as soon as possible and without unreasonable delay, consistent with USALSA’s Breach Response Plan. All security and privacy incidents that involve the Government’s information must be immediately reported to USALSA’s Computer Security Incident Response Team (CSIRT)/Information Security Manager (ISM) at the telephone/email address provided in paragraph 1.6.7.7.1 below. The Contractor and subcontractors (at any tier) shall cooperate and exchange information with agency officials in order to effectively report and manage a suspected or confirmed breach. The Contractor shall maintain capabilities to, at a minimum, determine what Government information was or could have been accessed and by whom, construct a timeline of user activity, determine methods and techniques used to access the information, and identify the initial attack vector.

1.6.7.9.1 Security and Privacy Incident Points of Contact. The Contractor shall appoint and provide points of contact (names, telephone numbers, e-mail addresses) for the officials who have overall accountability for incident response and protection of Government information and with whom the COR, KO, and/or other applicable DA staff may communicate throughout the duration of the contract about information security and privacy issues. These individuals or designees shall, at a minimum:

1. Be available to assist the Government as needed in resolving an incident;

2. Notify the Government of an incident immediately after the Contractor becomes aware of it; and

3. Notify USALSA’s Computer Security Incident Response Team (CSIRT) via email at

Esmeralda.marrero3.civ@mail.mil as well as to the COR of an incident.

The Contractor shall take all necessary steps to effectively contain identified incidents and coordinate and cooperate with the Government in investigating and remediating the incident.

The Contractor shall, at its own costs and at a minimum, provide individuals affected by a breach involving personally identifiable information (PII) under its control with notice of the breach and access to two (2) years of complimentary credit monitoring and identity protection services to protect such affected individuals against risks posed by the breach.

1.6.7.10 NIST SP 800-171 Security Requirement.

1.6.7.10.1 Definitions.

1. “Adequate security” means protective measures that are commensurate with the consequences and probability of loss, misuse, or unauthorized access to, or modification of information.

2. “Covered contractor information system” means an information system that is owned or operated by a contractor that processes, stores, or transmits Federal contract information.

3. “Federal contract information” means information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government, but not including information provided by the Government to the public (such as on public Web sites) or simple transactional information, such as necessary to process payments.

4. “Information” means any communication or representation of knowledge such as facts, data, or opinions, in any medium or form, including textual, numerical, graphic, cartographic, narrative, or audiovisual (Committee on National Security Systems Instruction (CNSSI) 4009).

5. “Information system” means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information (44 U.S.C. 3502).

1.6.7.10.2 Covered Contractor Information System. This contract will or may involve the use of a covered contractor information system and work will or may involve the Government’s controlled unclassified information (CUI) being processed or stored off-site at a covered contractor information system.

1.6.7.10.3 Adequate Security. The Contractor shall provide adequate security on all covered contractor information systems. To provide adequate security, the contractor shall implement all security requirements contained in the latest published version of NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations, (available via the internet at http://dx.doi.org/10.6028/NIST.SP.800-171) in effect at the time the solicitation is issued or as authorized by the Contracting Officer.

1.6.7.10.4 Subcontracts. The Contractor shall include the substance of this clause, including this paragraph 1.6.7.10, in subcontracts under this contract, in which the subcontractor may have Federal contract information residing in or transiting through its information system. Contractor also must require its subcontractors (first tier) to include Section 1.6.7.10 in any of their subcontracts (second tier) to which the conditions and requirements of Section 1.6.7.10 would apply.

1.6.7.11 Physical Security: The Contractor shall be responsible for safeguarding all government supplied equipment, information and property provided for Contractor use. At the close of each work period, government facilities, equipment, and materials shall be secured.

The Contractor shall be responsible for safeguarding and ensuring that storage containers and information processing equipment, which have been used to store or process classified information, and which is transferred to the Contractor’s facility for work performed under this contract, remains in a sensitive compartmented information facility (SCIF) space at the Contractor’s site. Classified information will be protected at all times, either by storage in an approved security container, or having it under the personal observation and physical control of the authorized contractor personnel.

1.6.7.12 Lock Combinations: The Contractor shall establish and implement methods of ensuring that all lock combinations are not revealed to unauthorized persons. The Contractor shall ensure that lock combinations are changed when personnel having access to the combinations no longer have a need to know such combinations. These procedures shall be included in the Contractor’s Quality Control Plan.

1.6.8 Special Qualifications: All personnel quoted for this contract shall be able to demonstrate competence in understanding, reading, speaking, and writing the English language.

1.6.8.1. The Contractor personnel assigned to the project shall be:

Responsible for providing contract and corporate level resources, including a dedicated Army Program Manager and dedicated Army Project Manager(s) for performing all work ordered under the IDIQ contract that will also supervise each task order.