SF_30_Amendment_2_Q&A_Responses_W91ZLK-18-R-0014.pdf

W91ZLK18R0014

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print)

30-105-04EXCEPTION TO SF 30

APPROVED BY OIRM 11-84

STANDARD FORM 30 (Rev. 10-83) Prescribed by GSA

FAR (48 CFR) 53.243

The purpose of this amendment is to:

1. Provide consolidated Question and Answ er as Attachment.

2. Revised attachments J.2 (Past Performance Cover letter and Past Performance Risk Assessment Questionnaire) revising the deadline for submission from 19 October 2018 TO 6 November 2018.

3. Administrative changes to Solicitation SF 1449 attachment.

4. Revision to base PWS enclosed (see highlighted/bold changes)

The point of contact for this action is Mr. David Humfleet, Contract Specialist, david.a.humfleet.civ@mail.mil.

1. CONTRACT ID CODE PAGE OF PAGES

1 56

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

16C. DATE SIGNED

BY 25-Oct-2018

16B. UNITED STATES OF AMERICA15C. DATE SIGNED15B. CONTRACTOR/OFFEROR

(Signature of Contracting Officer)(Signature of person authorized to sign)

8. NAME AND ADDRESS OF CONTRACTOR (No., Street, County, State and Zip Code) X W91ZLK18R0014

X 9B. DATED (SEE ITEM 11)

05-Oct-2018

10B. DATED (SEE ITEM 13)

9A. AMENDMENT OF SOLICITATION NO.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

X The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offer is extended, X is not extended.

Offer must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended by one of the following methods:

(a) By completing Items 8 and 15, and returning 1 copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN

REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE

CONTRACT ORDER NO. IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(B).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

10A. MOD. OF CONTRACT/ORDER NO.

2. AMENDMENT/MODIFICATION NO. 5. PROJECT NO.(If applicable)

6. ISSUED BY

3. EFFECTIVE DATE

25-Oct-2018

CODE

ACC-APG - TENANT DIVISION (W91ZLK)

ACC-APG TENANT DIVISION

BLDG 6001, 2ND FLOOR, ROOM C2-101

6565 SURVEILLANCE LOOP

ABERDEEN PROVING GROUND MD 21005-3013

W91ZLK 7. ADMINISTERED BY (If other than item 6)

4. REQUISITION/PURCHASE REQ. NO.

CODE

See Item 6

FACILITY CODECODE

EMAIL:TEL:

SECTION SF 30 BLOCK 14 CONTINUATION PAGE

SUMMARY OF CHANGES

SECTION C - DESCRIPTIONS AND SPECIFICATIONS

The following have been modified:

PERFORMANCE WORK STATEMENT

PERFORMANCE WORK STATEMENT (PWS)

For

W91ZLK-18-R-0014

MANPOWER for INFORMATION TECHNOLOGY (IT) SERVICES

Table of Contents

SECTION 1: GENERAL INFORMATION

1.0 Purpose

1.1 Background

1.2 Description of Services/Introduction

1.3 Type of Contract and Period of Performance

1.4 Place of Performance

1.5 Observance of Federal Government Holidays and Facility Closures

1.6 Hours of Operation

1.6.1 Early Release

1.7 Contracting Officer Representative (COR)

1.8 Quality Control

1.9 Customer Feedback

1.9.1 Interactive Customer Evaluation (ICE)

1.10 Quality Assurance Surveillance Plan (QASP)0

1.11 Contract Staff0

1.11.1 Key/Essential Personnel

1.12 Personal Appearance Standards

1.13 Performance Location

1.14 Security Requirements

1.14.1 Personal Identity Verification of Contractor Personnel

1.14.2 Restrictions

1.14.3 Contract Security Classification Specification

1.14.4 Contractor Security Clearance Reinvestigation

1.15 Physical Security

1.16 Key Control

1.17 Access Control and Identification

1.17.1 In-processing/Out-processing

1.17.2 Department of Defense (DoD) Common Access Card (CAC)

1.17.3 Security Badges

1.17.4 C4ISR Campus Badges

1.17.5 Access and General Protection/Security Policy and Procedures

1.18 Safeguarding Controlled Unclassified Information

1.18.1 Privacy Act

1.18.2 Disclosure of Information

1.18.3 Nondisclosure

1.19 Government Data and Data Rights

1.20 Organizational Conflict of Interest

1.21 Government Business Communications and Content

1.21.1 Contractor Correspondence

1.22 Intoxicants

1.23 Criminal Actions

1.24 Anti-Terrorism (AT) Level 1 Training

1.25 iWATCH Training

1.25.1 iWATCH program resources

1.26 Threat Awareness and Reporting Program (TARP) Training

1.27 Handling/Access to Classified Information

1.27.1 Derivative Classification Training

1.28 OPSEC Standing Operating Procedure/Plan

1.29 OPSEC Training

1.30 Access to Government Information Systems (IS)

1.31 Army Training Certification Tracking System (ATCTS) registration for contractor employees who require access to government information system

1.31.1 DMDC Authorization

1.32 Mandatory Cyber Reporting

1.33 Safety Compliance

1.34 Travel and Training

1.35 Transportation of Equipment/Material

1.36 Process Improvement

1.37 Document List

1.38 Government Furnished Equipment (GFE)/Worksite

1.39 Joint Ethics Regulation

1.40 Sexual Harassment/Assault Response and Prevention (SHARP)

1.41 Post Award Meeting / Monthly Progress Meetings

1.42 Monthly Performance Reports

1.42.1 Contractor Manpower Reporting Application

1.43 Project Management Services

1.43.1 Project Reporting

1.43.2 Plan of Action and Milestones (POA&M)

1.43.3 Task Execution Organizational Chart

1.43.4 Monthly Task Order Status Update Meeting

1.43.5 In Process Review Meetings

1.43.6 Other Project Management Services

1.44 Organizational Quality Qualifications

1.45 Transition-In Plan

1.46 Transition-Out Plan

SECTION 2: ONE (1) FUNCTIONAL AREA

2.0 FUNCTIONAL AREA 1 – ENHANCED AUTOMATED DATA PROCESSING (ADP)

SUPPORT SERVICES

2.1 Requirements

2.1.1 Operating Conditions

2.1.2 Supported Command Integration Program (SCIP)

2.2 Desktop Technical Support and System Administration

2.3 Local Area Network (LAN) Support

2.4 Mobile Device Support and Administration

2.5 Audio/Visual Support

2.6 Data Center Operations

2.7 Web Site and Database Support

2.8 Backup and Recovery Operations

2.9 Network Monitoring and Server Room Operations

2.10 Cybersecurity Support

2.11 Application Support Operation

2.12 Application Support Testing and Release Management

2.13 Application Support Design, Development, and Implementation

2.14 Application Support SQL Design, Development, and Maintenance

2.15 SharePoint Platform Design, Administration and Support

2.16 Application Support: Design, Development, and Implementation of SharePoint Solutions

2.17 Design, Development, Implementation and Maintenance of Web Applications

2.18 Oracle Design, Development, Maintenance and Reporting

2.19 Cloud Computing Systems Administration

2.20 Technical Writing

2.21 IT Training

2.22 Information Management Officer Support

2.23 Telephone Control Officer Support

2.24 Hours of Operation

2.25 Innovations

2.26 Government Data and Data rights

SECTION 3 APPENDIXES

APPENDIX A: KEY/ESSENTIAL PERSONNEL

APPENDIX B: ACRONYMS

APPENDIX C: DEFINITIONS

APPENDIX D: DOCUMENT LIST

APPENDIX E: CECOM CONUS LOCATIONS

APPENDIX F: C4ISR TENANTS

APPENDIX G: ABERDEEN PROVING GROUNDS TENANTS

SECTION 1: GENERAL INFORMATION

1.0 Purpose: The Army Materiel Command (AMC), U.S. Army Communication Electronics Command (CECOM) objective is to establish a contract that provides on-site professional support service for one (1) distinct functional area documented in Section two (2), in an efficient and cost effective manner. The Functional Area is as follows, Functional Area 1- Enhanced Automated Data Processing Equipment (ADP) Support Services. The contract shall provide the necessary manpower to support Information Technology (IT) services, CECOM CONUS Locations (Reference Appendix E), APG C4ISR (Reference Appendix F) campus, and Aberdeen Proving Grounds (APG) tenant (Reference Appendix G) mission and operations in support of the U.S. Army and APG Senior Mission Commander.

1.1 Background: The U.S. Army Communication Electronics Command (CECOM) and Command, Control, Communication, Computer, Intelligence, Surveillance & Reconnaissance (C4ISR) of Aberdeen Proving Ground (APG), MD are comprised of independent and interdependent organizations that are collectively responsible for the life cycle of C4ISR systems.

C4ISR and APG include organizations listed in Appendix F and G. CECOM is comprised of two

(2) functional support centers: the Integrated Logistics Support Center (ILSC), and the Software Engineering Center (SEC), as well as three (3) separate brigade elements: Tobyhanna Army Depot, Tobyhanna, PA; the U.S. Army Information Systems Engineering Command (USAISEC), Fort Huachuca, AZ.; the Central Technical Support Facility (CTSF), Fort Hood, Texas; and locations specified in Appendix E. As CECOM resides as the APG Senior Mission Commander, CECOM Headquarters has the responsibility to assist and support Organizations (Reference Appendix F and G) on APG.

1.2 Description of Services/Introduction: The Contractor shall provide and maintain; all management, supervision, labor, training, equipment, materials, tools, supplies, facilities, transportation, travel, licenses, permits, certificates, certifications, insurance, pre-employment screenings, reports, files and non-personal services necessary to perform the functions as defined in this Performance Work Statement (PWS) except for those items specified as Government Furnished Equipment (GFE). The Contractor shall perform to the standards in this contract. All solutions and services shall be performed in accordance with all Department of Defense (DoD) and Army policies, regulations, standards and procedures.

It is the inherent responsibility of the installation Network Enterprise Center (NEC) to monitor NIPRnet and SIPRnet network activity and user rights and privileges. The Contractor performing IT Services on this contract shall comply with the NEC network rules and regulations when performing contractual responsibilities as set forth herein.

The Contracting Officer’s Representative (COR) will monitor, document, and evaluate the Contractors performance upon contract award per each task order. The Base IDIQ has a COR, which monitors the over-all IDIQ requirements, and each associated TO will have individual Task Order CORs (TCOR), who will monitor the task orders. The Contractor shall be accountable to provide the required services in accordance with contract. Should the Contractor subcontract any portion of this work, at any time during the effective period of performance of this contract or an associated Task Order (TO), the subcontractor shall adhere to the terms and conditions set forth within this contract. The Contractor shall notify the IDIQ COR and Contracting Officer (KO) no later than thirty (30) business days prior to the subcontractor’s start date. The Contractor shall provide to the IDIQ COR and KO the subcontractor’s legal business name, what services they will be performing, and what percentage of the overall work of this contract that the subcontractor will be performing.

1.3 Type of Contract and Period of Performance: The CECOM Manpower IT non-personal services, will be awarded as an Indefinite-Delivery, Indefinite-Quantity (IDIQ) type contract.

Task orders awarded in accordance with Functional Area 1- Enhanced Automated Data Processing Equipment (ADP) Support Services, shall be awarded as Firm Fixed Price Task Orders.

Period of Performance: The IDIQ contract is being established with a twelve-month base ordering period, as well as three (3) twelve-month option ordering periods. Expected contract award for IDIQ Base is December 2018.

1.4 Place of Performance: Contracted functions will be carried out at the CECOM CONUS locations (Reference Appendix E) and APG, MD (Reference Appendix F and G). Enterprise IT initiatives may require contracted functions be carried out at the U.S. Army Materiel Command (AMC) headquarters, Redstone Arsenal, Alabama.

Appendix E – CECOM CONUS locations Appendix F – Aberdeen Proving Ground Tenants Appendix G – C4ISR Major Tenants

In the event of an emergency situation in which the CECOM and/or APG locations are closed, and the workforce is directed to telework, the Contractor must be able to perform work from an alternate location. Telework-eligible duties are only permitted for systems that are accessible via VPN. The decision to require telework comes solely from the CECOM Commander, or the Commander of the installation where the Contractor performs the duties contained in this PWS.

When the Contractor’s place of performance is reopened, and/or the CECOM Commander/Installation Commander rescinds the instruction to telework, the Contractor must return to their normal place of performance.

Telework is not permitted if Contractor personnel are unable to work due to illness or dependent care responsibilities. If Contractor personnel use Government-furnished equipment (GFE) for telework, the equipment must be used and protected in accordance with DoD, Army, CECOM and APG NEC procedures. Contractor personnel using GFE for telework agree to comply with the terms of computer software license and copyright agreements, and computer virus and protection requirements and procedures. No classified documents (hard copy or electronic) may be taken to, or created at, the alternative work location. For Official Use Only (FOUO) and controlled unclassified information (CUI) data may be taken to alternative worksites if necessary precautions are taken to protect the data, consistent with DoD, Army, and CECOM regulations. Contractor personnel will apply approved safeguards to protect Government records form unauthorized disclosure or damage and will comply with Privacy Act requirements set forth in the Privacy Act of 1974, and codified at section 552a of title 5, United States Code. The use of personal email accounts for transmission of Personally Identifiable Information (PII) is strictly prohibited and must be encrypted and digitally signed. The Government will not be responsible for operating, maintenance, or any other costs associated with the use of an alternate work location. The Government is not liable for damages to the alternate work location.

1.5 Observance of Federal Government Holidays and Facility Closures: Government recognized Federal Holidays apply to all Contractor employees except those performing essential support functions or providing twenty-four (24) hours per day, seven (7) days per week coverage as specified in contract task orders. When a holiday occurs on a Saturday, Federal employees are normally granted the previous Friday as a holiday observance. When a holiday occurs on a Sunday, Federal employees are normally granted the following Monday as the holiday observance. If a Federal Holiday falls on a weekday, it is not recognized as a, “business day.” The Contractor shall not report for work on the below recognized Federal Holidays. Depending on the calendar year, the Contractor should confirm with the TCOR the exact day which the Federal Holiday falls on. The recognized Federal Government Holidays are as follows:

New Year’s Day Labor Day Martin Luther King Jr.’s Birthday Columbus Day President’s Day Veteran’s Day Memorial Day Thanksgiving Day Independence Day Christmas Day

Facility closures may occur due to unplanned events. Other reasons for facility closures include: (a) Closure designated by Federal statute, executive order, or Presidential Proclamation; (b) Adverse weather conditions; (c) national emergencies.

1.6 Hours of Operation: With the exception of emergency operations support or specific support functions requiring twenty-four (24) hours per day, seven (7) days per week coverage, the Contractor is responsible for conducting business, between the core hours of 0700 - 1700 Monday thru Friday, except Federal holidays or Government directed facility closures. However, hours of operation shall correspond to the core hours of the Government customer, or as defined by each task order. The Contractor shall at all times maintain an adequate workforce for the uninterrupted performance of all tasks, when the Government facility is not closed for the above reasons. Stability and continuity of the workforce are essential.

1.6.1 Early Release: On occasion, authorized Government officials may grant its civilian workforce administrative dismissal. The Government may not grant the Contractor an early release such a “59 minute” early release.

1.7 Contracting Officer Representative (COR): Pursuant to DFARS 201.602-2, the KO shall appoint a Contracting Officer Representative (COR) who will oversee contract administration as a whole to the IDIQ. Each individual Task Order shall have its own TCOR assigned. Task Order shall not be approved by the KO until a TCOR has been appointed. The IDIQ COR and TCOR will be identified by separate appointment letter. The KO will provide a copy of the IDIQ COR and TCOR appointment letter (given to and appointing the COR). This appointment letter states the responsibilities and limitations of the COR and TCOR as they pertain to this contract. The IDIQ COR and TCOR monitors all technical aspects of the contract and assists in contract administration. The IDIQ COR and TCOR is authorized to perform the following functions: assure that the Contractor performs the technical requirements of the contract; perform inspections necessary in connection with contract performance; maintain written and oral communications with the Contractor concerning technical aspects of the contract; issue written interpretations of technical requirements, including Government drawings, designs, specifications; monitor Contractor's performance and notify the KO and Contractor of any deficiencies; coordinate availability of Government Furnished Equipment (GFE), and provide site entry of Contractor personnel. The IDIQ COR or TCOR is not authorized to change any of the terms and conditions within the contract award or any TO award against the base contract.

1.8 Quality Control: The Contractor shall develop and maintain a Quality Control Plan (QCP) that contains at a minimum, the items listed below and shall submit it to the TCOR for acceptance no later than thirty (30) calendar days after date of award. The Government will have fifteen (15) calendar days to review, accept and/or comment on the draft deliverable. The final plan is due fifteen (15) calendar days after receipt of comments. The QCP shall include the following minimum requirements:

A description of the inspection process to cover all major services and deliverables. The description shall include specifics as to the areas to be inspected on both a scheduled and unscheduled basis, frequency of inspections, and the title of inspectors.

A description of the records to be kept to document inspections and corrective or preventative actions taken.

All records of inspections performed shall be retained and made available to the Government upon request throughout the task order performance period, and for the period after task order completion, until final settlement of any claims under this contract.

1.9 Customer Feedback: The Contractor shall be responsible for establishing and maintaining professional communication between their employees and the Government throughout the Period of Performance (POP) of this contract and each associated TO. The primary objective of this communication is customer satisfaction. Customer satisfaction is the most significant external indicator of the success and effectiveness of all services provided and can be measured through customer complaints.

Although the Contractor may be able to initially and internally address customer complaints; the customer should communicate complaints to the TCOR as opposed to the Contractor. The TCOR will accept and investigate customer complaints and coordinate with the IDIQ COR. The TCOR may communicate with Contractor Program Management for identification and determine a plan of resolution for the specific problem. The IDIQ COR will consolidate all the task order issues for the KO, to present to the KTR. In the case of an issue being with only one TO, the TCOR still coordinate the issue with the IDIQ COR and KO, who submits the problem to the KTR. Customer feedback may also be obtained either from the results of formal customer satisfaction surveys or from random customer complaints.

1.9.1 Interactive Customer Evaluation (ICE): ICE is a web-based customer feedback system used by the Department of the Defense organizations to solicit performance feedback. APG has implemented the ICE program to facilitate customer feedback on APG programs and services.

The Government will use ICE data in the Contractor performance review process.

1.10 Quality Assurance Surveillance Plan (QASP): The Government will evaluate the Contractor’s overall performance for all task orders awarded under this contract in accordance with the base-contract level QASP. This plan is primarily focused on what the Government must do to ensure that the Contractor has performed in accordance with the terms and conditions within the contract. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s). For those tasks listed in the PWS, the TCOR or other designated evaluator will use simplified surveillance methods to evaluate Contractor performance.

When an observation indicates defective performance, the IDIQ COR or TCOR other designated evaluator will notify the Contractor of non-compliance. The contractor may be required to propose a QASP specific to functional requirements at the task order level. In the situation where a task-order level QASP is not required, performance under that task order will be measured using methods identified in the base-contract level QASP.

1.11 Contract Staff: The Contractor shall maintain an adequate staff of employees meeting all the requirements specified in the IDIQ PWS and each task order PWS. The Contractor shall ensure that all employees are professional, reliable and meet the training, certification and experience requirements of the IDIQ contract and its task orders. Each contracted employee is expected to adhere to standards of conduct that reflect credit on themselves, the Contractor, the U.S. Army, and the Federal Government. The Government reserves the right to direct the Contractor to remove an employee from the work site for failure to comply with the terms and conditions within the contract and task orders. The Contractor shall replace such an employee immediately and maintain continuity of services at no additional cost to the Government. In the event of normal turn-over of employees the Contractor has thirty (30) days to fill any vacancies with the exception of key personnel that may occur throughout the contract and task orders in order to receive payment for the services. Key Personnel will be replaced within five (5) business days. Payment will not be received for work that is not conducted.

1.11.1 Key/Essential Personnel: Key/Essential personnel shall be utilized to fulfill requirements as specified by individual task orders. The following positions are considered key/essential personnel:

Key Personnel

Program Manager Project Manager for FA 1

Essential Personnel IT Desktop Service Support System Administrator Senior Senior Cloud Administrator Video Teleconference (VTC) and Audio/Visual (A/V) Support SharePoint Solution Provider SharePoint Administrator SharePoint Requirements Analyst CECOM Web Support

Key /Essential personnel minimum qualifications are documented in Appendix A: Key /Essential Personnel Responsibilities and Minimum Qualifications.

Contractor proposals shall provide thorough and detailed documentation of the experience, abilities, and background for Key/Essential Personnel in the form of a resume, to include certifications and/or diplomas.

One (1) resume is required for each labor category/position cited as Key personnel and Essential personnel. Reference Appendix A, KEY/ESSENTIAL PERSONNEL.

Substitution for Key/ Essential Personnel shall not be permitted unless such substitution is deemed necessary by the Program Manager and IDIQ COR. In any of these events, the Contractor shall promptly notify the KO, IDIQ COR and TCOR.

All requests for substitutions shall provide a detailed explanation of the circumstances necessitating the proposed substitution(s), a complete resume for the proposed substitute(s), and any other information requested by the KO or IDIQ COR needed to evaluate of the impact relative to the TO, and to approve or disapprove the proposed substitution(s). All proposed substitutes shall have qualifications that are equal to or higher than the qualifications of the person to be replaced. The IDIQ COR/TCOR will verify such requests to ensure the replacement meets the minimum qualification as indicated in the PWS.

1.12 Personal Appearance Standards: While performing services in CECOM, C4ISR, or APG (Reference Appendices E, F, and G) facilities, contract employees shall wear neat, conservative clothing in good repair. Clothing shall be of proper fit, becoming to the individual, appropriate for business wear and the job to which assigned. Abnormally tight or revealing clothing or excessively baggy or oversized clothing is prohibited, as well as tank tops, halter tops, halter dresses, mini-skirts, mini- dresses, leggings or tights as outer wear. Imprinted clothing with embroidered messages of any kind shall not be worn. Baseball caps, non-safety hats, or any type of caps shall not be worn while indoors of a Government facility. Particularly offensive tattoos, or tattoos which are lewd or profanely indecent, racially motivated, offensive in language, or obscene in nature, shall remain covered at all times while performing contract services in CECOM, C4ISR, or APG facilities.

The Contractor shall assess the work environment to determine required Personal Protective Equipment (PPE) in accordance with Occupational Safety and Health Administration (OSHA) standards. The Contractor shall ensure its personnel are outfitted with the proper PPE during task performance of this contract and its task orders.

1.13 Performance Location: The geographic jurisdiction is the continental United States (CONUS) only. Organizations and locations are listed in the attached Appendixes E, F and G.

Specific locations will be identified in each Task Orders.

1.14 Security Requirements: The contractor will be required to have a SECRET facility clearance with no safeguarding. The contractor will require access to Controlled Unclassified Information (CUI) information, SIPRNET, Security Classification Guide (SCG) DISN SIPRNet, and IT sensitive duties.

All Contractor personnel shall, at a minimum, be U.S. Citizens, who shall receive a National Agency Check for functional areas under this PWS. The Contractor shall be responsible for obtaining the appropriate security clearances from Office of Personnel Management (OPM) while ensuring compliance by its employees with the security regulations of the U.S. Government and policy of CECOM, C4ISR, or APG (Reference Appendixes E, F, and G) facility where work is to be performed. Proof of an interim Secret Clearance shall be required prior to work being performed within IDIQ and TO levels.

The contactor will adhere to the CECOM OPSEC Plan, 19 June 2017, unless otherwise annotated within the TO specified by Organization.

Performance of this contract will require the contractor to have access to classified information only at other contractor facilities or government activities. The contractor will adhere to the security classification guide “Defense Information System Network (DISN) Secret Internet Protocol Routing Network) (SIPRNet), dated 01 June 2013.

1.14.1 Personal Identity Verification of Contractor Personnel: All Contractor personnel, inclusive of subcontractors, must be registered in the Joint Personnel Adjudication System (JPAS).

1.14.2 Restrictions: The use of Non-U.S. citizens, including Lawful Permanent Residents (LPRs), is not permitted in the performance of the IDIQ or Task Order contract for any position that involves access to, development of, or sustainment of any U.S. Army IT system or application. Contract performance and information processing under the IDIQ or Task Order contract is restricted to the continental United States (CONUS).

1.14.3 Contract Security Classification Specification: Contractor security requirements will be provided on a TO level in the DD Form 254, Contract Security Classification Specification. All personnel working on classified systems, e.g. Secure Internet Protocol Router Network (SIPRNET) will have a full clearance granted by the Garrison security office. Contractor employees shall be required to access Information Systems (IS) to fulfill the contract requirements and shall possess the required security investigation, security clearance, and formal access approvals. SECRET is the highest clearance required for select network and staff. The Contractor personnel that shall require a SECRET clearance will be identified and determined on a TO level basis.

1.14.4 Contractor Security Clearance Reinvestigation: Contractor shall ensure personnel will file appropriate paperwork for security clearance reinvestigation no later than 90 calendar days prior to the expiration of existing security clearance.

1.15 Physical Security: The Contractor shall be responsible for safeguarding all Government equipment, information, and property provided for Contractor use. The Contractor shall secure Government facilities, equipment, and materials at the close of each business day.

1.16 Key Control: The Contractor shall establish and implement methods of ensuring all keys, key cards, and PIN codes issued by the Government, to Contractor personnel, are accounted for and not in the possession of unauthorized persons. No keys issued to the Contractor, by the Government, shall be duplicated. The Contractor shall develop procedures covering key, key cards, and PIN, controls that shall be included in the QCP. Such procedures shall include turn-in of any issued keys or requests for new PIN Codes in situations where there is a changeover of personnel.

The Contractor shall immediately report any occurrences of lost, duplicated keys, key cards, or compromised PIN codes to the TCOR. PIN Codes shall not be used by anyone other than the person or organization that it is assigned to. In the event keys, other than master keys, are lost or duplicated, the Contractor shall, upon direction of the TCOR, re-key or replace the affected lock(s). When the replacement of locks or re-keying is performed by the Government, the total cost of re-keying or the replacement of the lock or locks shall be deducted from the monthly payment due the Contractor. In the event a master key which the Contractor shall be responsible for, is lost or duplicated, all locks and keys for that system shall be replaced by the Government and the total cost will be deducted from the monthly payment due to the Contractor.

1.17 Access Control and Identification: Contractor employees shall comply with applicable DoD/Army identification and access control policies and procedures.

1.17.1 In-processing/Out-processing: The Contractor employees who are cleared to commence work shall complete an in-processing requirement checklist, submit necessary forms, and shall submit a sponsorship application via automated DoD system, before security/ photo ID badges and access accounts will be issued. Employees shall be escorted, as necessary, prior to completion of all in-processing requirements.

The Contractor shall immediately notify the IDIQ COR and TCOR and Security Officer of contract employee resignations or terminations. The Contractor shall ensure all employee out-processing requirements are completed including: collection and turn-in of employee identification and security badges, turn-in of equipment, disable/delete actions for employee access accounts.

1.17.2 Department of Defense (DoD) Common Access Card (CAC): During contract task order (TO) POP, Contractor personnel shall be required to have a valid DoD CAC if they are to be granted network access in performance of their duties. Contractor personnel assigned to a TO shall return CAC’s that were issued to them to the sponsoring organization’s Security Officer when their employment as a DoD contract employee is terminated or the TO is complete. Contractor personnel who do not require network access for the performance of their duties, may not require a CAC; however they shall be required to obtain a civilian ID for physical access to the Army installation.

For contractors requiring Common Access Card (CAC): Before CAC issuance, the contractor employee requires, at a minimum, a favorably adjudicated National Agency Check with Inquiries (NACI) or an equivalent or higher investigation in accordance with Army Directive 2014-05. The contractor employee will be issued a CAC only if duties involve one of the following: (1) Both physical access to a DoD facility and access, via logon, to DoD networks on-site or remotely; (2) Remote access, via logon, to a DoD network using DoD-approved remote access procedures; or (3) Physical access to multiple DoD facilities or multiple non-DoD federally controlled facilities on behalf of the DoD on a recurring basis for a period of 6 months or more. At the discretion of the sponsoring activity, an initial CAC may be issued based on a favorable review of the FBI fingerprint check and a successfully scheduled NACI at the Office of Personnel Management.

For contractors that do not require CAC, but require access to a DoD facility or installation:

Contractor and all associated sub-contractors employees shall comply with adjudication standards and procedures using the National Crime Information Center Interstate Identification Index (NCIC- III) and Terrorist Screening Database (TSDB) (Army Directive 2014-05/AR 190-13), applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by government representative), or, at OCONUS locations, in accordance with status of forces agreements and other theater regulations.

1.17.3 Security Badges: While performing contractual work, the Contractor shall be required to present and display Government-issued security area identification badges in order to gain and exercise entry into the security areas. The Contractor shall only obtain badges for the minimum number of employees required for the performance of the contract TO. Contractor employees shall be required to wear the badge at all times while in a Government facility and shall be required to remove the badge while outside of the Government facility.

1.17.4 C4ISR Campus Badges: Contractor personnel assigned to the APG, MD C4ISR campus (Reference Appendix F) shall obtain a C4ISR badge for physical access within the campus. The sponsoring organization’s Security Officer will make the determination as to what type of badge is required for Contractor personnel and process the appropriate applications.

1.17.5 Access and General Protection/Security Policy and Procedures: Contractor and all associated sub-contractors employees shall provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services or Security Office. Contractor workforce must comply with all personal identity verification requirements (FAR clause 52.204-9, Personal Identity Verification of Contractor Personnel) as directed by DOD, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

1.18 Safeguarding Controlled Unclassified Information (CUI): CUI Information generated and/or provided under this contract shall be safeguarded and marked as specified in AR 25-55 and DoD 5200.1-M. (Marking is in Volume 2).

1.18.1 Privacy Act: The Contractor shall implement and adhere to appropriate procedural, administrative, technical and physical safeguards to prevent the unauthorized use and/or disclosure of any personally identifiable information (PII). Breaches of PII must be immediately reported to the Government Privacy Officer.

1.18.2 Disclosure of Information: The Contractor shall not release any Government data received, created, or accessed in the performance of this contract, and shall not release any unclassified information, regardless of medium, pertaining to any part of this contract or related program without prior written approval from the KO.

1.18.3 Nondisclosure: During the POP, the Contractor may be required to access nonpublic information, including acquisition sensitive information which shall not be used or disclosed unless authorized by the KO. Contractor employees performing under each TO issued against the base contract shall be required to sign the Certificate of Nondisclosure.

1.19 Government Data and Data Rights: The Government has unlimited rights to any information, document, media, source code, and machine readable material, regardless of physical form or characteristics, that is created or obtained in the course of official Government business under this contract. This is Government data, and all Government data produced under this contract and its task orders shall be Government owned and are the property of the Government with all rights and privileges of ownership/copyright belonging exclusively to the Government. Government data may not be used or sold by the Contractor without written permission from the IDIQ COR. All materials supplied to the Government shall be the sole property of the Government and shall not be used for any other purpose.

1.20 Organizational Conflict of Interest: Contractor and subcontractor personnel performing work under this contract may receive, have access to, or participate in the development of proprietary or source selection information (e.g., cost or pricing information, budget information or analyses, specifications or work statements, etc.) or perform evaluation services which may create a current or subsequent Organizational Conflict of Interests (OCI) as defined in FAR Subpart 9.5.

The Contractor shall immediately notify the KO when it becomes apparent that such access or participation may result in any actual or potential OCI. The Contractor shall promptly submit a plan to the KO of how to mitigate any such OCI. The determination of acceptability of the Contractor’s mitigation plan, will be at the discretion of the KO. In the event that the KO determines that any OCI cannot be resolved, avoided or mitigated, the KO may affect other remedies as he or she deems necessary, including prohibiting the Contractor from participation in subsequent contracted requirements.

1.21 Government Business Communications and Content: For the purpose of performing work under this contract, the Contractor shall use only authorized Government-provided services for email, telecommunications, collaboration, and content management. In particular, the Contractor shall use Government email account for electronic messaging correspondence under this contract.

All work performed under this contract shall be conducted on and through a government-managed device operating on a government-managed network. Commercial internet service provider networks are not authorized for official government business.

1.21.1 Contractor Correspondence: All Contractor correspondence (telephone, oral presentation, written, facsimile, and email display) shall explicitly identify or announce themselves as a contractor and their company name. All email correspondence generated under this contract and TO shall be conducted through a government email account.

1.22 Intoxicants: Contractor personnel performing under this contract/TO are prohibited from being under the influence of alcohol intoxicants, drugs, or substances that produce similar effects, during business hours stated within this PWS. If any Contractor personnel are found to be under the influence of any intoxicants, he/ she shall be immediately removed from their position. This offense may be grounds for removal of that Contractor employee per the discretion of the Contract PM of that TO.

1.23 Criminal Actions: Contractor employees are subject to prosecution for criminal actions due to improper performance of duty as allowed by law. These criminal actions include, but are not limited to the following:

Falsification or unlawful concealment, removal, mutilation or destruction of any official documents or records or concealment of material facts by willful omission from official documents or records.

Unauthorized use of Government property, theft, or vandalism.

Unethical or improper use of official authority or credentials.

Security violations.

1.24 Anti-Terrorism (AT) Level 1 Training: All contractor employees, to include subcontractor employees, requiring access Army installations, facilities and controlled access areas shall complete AT Level I awareness training within 30 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee, to the TCOR or to the contracting officer, if a COR is not assigned, within 45 calendar days after completion of training by all employees and subcontractor personnel. AT level I awareness training is available at the following website: https://Jkodirect.jten.mil/ for CAC holders.

Non-CAC-holders may go to: http://jko.jten.mil/courses/atl1/launch.html.

1.25 iWATCH Training: The contractor and all associated sub-contractors shall brief all employees on the local iWATCH program (training standards provided by the requiring activity ATO). This local developed training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the TCOR. This training shall be completed within 30 calendar days of contract award and within 30 calendar days of new employees commencing performance with the results reported to the TCOR NLT 30 calendar days after contract award.

1.25.1 iWATCH program resources may be found at the following website:

http://www.myarmyonesource.com/familyprogramsandservices/iwatchprogram/default.aspx

1.26 Threat Awareness and Reporting Program (TARP) Training: Threat Awareness

Reporting Program. For all contractors with security clearances. Per AR 381-12 Threat Awareness and Reporting Program (TARP), contractor employees must receive annual TARP training by a Counter Intelligence (CI) agent or other trainer as specified in section 2-4b.

1.27 Handling/Access to Classified Information: Contractor and Subcontractors shall comply with FAR 52.204-2, Security Requirements. This clause involves access to information classified “Confidential,” “Secret,” or “Top Secret” and requires contractors to comply with— (1) The Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (DoD 5220.22-M); (2) any revisions to DOD 5220.22-M, notice of which will be furnished to the contractor.

1.27.1 Derivative Classification Training: At a minimum, all personnel who require Secret Internet Protocol Network (SIPRnet) access, who process or handle classified material, or who prepare reports/orders/summaries that are classified Confidential or higher are derivative classifiers.

Derivative classifiers must complete the prerequisite Derivative Classification Training (Course IF103.16) available through the Defense Security Service (DSS) Center for Development of Security Excellence (CDSE) Security Training, Education and Professionalization Portal (STEPP).

STEPP can be accessed at the following locator: http://www.cdse.edu/stepp/index.html. The training must be completed every two (2) years.

1.28 OPSEC Standing Operating Procedure/Plan: The contractor shall develop an OPSEC Standing Operating Procedure (SOP)/Plan within 90 calendar days of contract award, to be reviewed and approved by the responsible Government OPSEC officer. This plan will include a process to identify critical information, where it is located, who is responsible for it, how to protect it and why it needs to be protected. The contractor shall implement OPSEC measures as ordered by the commander. In addition, the contractor shall have an identified certified Level II OPSEC coordinator per AR 530-1.

If available, the Contractor shall utilize the Government Organization’s existing OPSEC SOP specified in each task order PWS.

1.29 OPSEC Training: Per AR 530-1 Operations Security, the contractor employees must complete Level I OPSEC Awareness training. New employees must be trained within 30 calendar days of their reporting for duty and annually thereafter. Level I OPSEC training is available at the following website: http://cdse.edu/catalog/elearning/GS130.html (Duration: 45 minutes).

1.30 Access to Government Information Systems (IS): Contractor management shall ensure all Contractor employees with access to Government information systems on the non-secure internet protocol router network (NIPR) or secure internet protocol router network (SIPR) shall be registered in the Army Training Certification Tracking System (ATCTS) prior to performing under a TO. Contractor employees shall successfully complete the DoD Cybersecurity Challenge training.

The training shall be completed prior to Contractor employee’s accessing IS. This training shall be taken by Contractor employees on an annual basis. All email correspondence generated under a TO shall be conducted through a government email account.

1.31 Army Training Certification Tracking System (ATCTS) registration for contractor employees who require access to government information systems: All contractor employees with access to a government info system must be registered in the ATCTS (Army Training Certification Tracking System) at commencement of services, and must successfully complete the DOD Cybersecurity Awareness prior to access to the IS and then annually thereafter.

All contractor employees and associated sub-contractor employees must complete the DoD Cybersecurity awareness training before issuance of network access and annually thereafter. All contractor employees working Cybersecurity/IT functions must comply with DoD and Army training requirements in DoDD 8140.01, DoD 8570.01-M (Ch4) and AR 25-2 within six months of appointment to Cybersecurity/IT functions.

IA Workforce Contractors shall authorize the release of certification information from DoD approved certification providers via the Defense Manpower Data Center (DMDC) Information Assurance Workforce Certification Application.

All contractor employees with access to a government info system must be registered in the ATCTS (Army Training Certification Tracking System) at commencement of services, and must successfully complete the DOD Cybersecurity Awareness prior to access to the IS and then annually thereafter.

Per DoD 8570.01-M (Ch4) , DFARS 252.239.7001 and AR 25-2, the contractor employees supporting Cybersecurity/IT functions shall be appropriately certified upon contract award. The baseline certification as stipulated in DoD 8570.01-M (Ch4) must be completed upon contract award.

1.31.1 DMDC Authorization: IA Workforce Contractors shall authorize the release of certification information from DoD approved certification providers via the Defense Manpower Data Center (DMDC) Information Assurance Workforce Certification Application.

1.32 Mandatory Cyber Reporting: In addition to regulatory reporting requirements, the detection or discovery of any unauthorized access, denial of service, or compromise of a Contractor's classified or unclassified network, information system or data contained thereon shall be reported within twenty-four (24) hours to the Organization Security Officer.

1.33 Safety Compliance: The Contractor shall comply with all applicable DOD, Army, Federal, state, and local safety, health and environmental regulations and requirements. Any non-compliance shall be immediately reported to the TCOR. The Contractor shall prevent Contractor activities from presenting hazards to Contractor personnel, the public, and Army personnel and property. Any hazardous conditions related to the performance of work, outside of the Contractor’s control, shall be reported to the TCOR. The work is typically performed in adequately lighted and climate-controlled areas. Government Furnished facilities may be equipped with building alarms to include security, fire, water and uninterruptable power sources.