Performance Work Statement (PWS) Standard Procurement System (SPS) Contractor Support Services

1.0 Introduction:The Naval Supply Systems Command (NAVSUP) provides supplies, services, and quality-of-life support to the Navy and Joint Warfighter. NAVSUP, headquartered in Mechanicsburg, PA, is a world-wide organization, comprised of two echelon III commands and eight echelon IV Fleet Logistics Centers (FLCs). NAVSUP provides material management, contracting, fuels, transportation, personal property support, mail services, and technical/customer support to the fleet.

The Standard Procurement System (SPS) application is a standardized Contract Writing System employed by the FLCs, and some non-NAVSUP activities receiving contracting authority via NAVSUP. All FLCs process orders through a single database. A second database supports other contracting entities, such as Combined Joint Task Force-Horn of Africa, Defense Logistics Agency Maritime, Department of the Navy (DON) Assistant for Administration, Forces Surveillance Support Center, Naval Criminal Investigative Service, Naval Oceanographic Office, Naval Postgraduate School, Naval War College, NAVSUP Weapons System Support, Navy Information Operations Command, Office of Naval Intelligence, Operational Test & Evaluation Force, Regional Maintenance Facility Yokosuka, and Trident Refit Facility Kings Bay. The databases are hosted by the Defense Information Systems Agency (DISA)at Mechanicsburg Pa.

The primary function of the SPS application is to facilitate the issuance of solicitations, awards and contract modifications. SPS interfaces to other systems and relies on data within those systems, including but not limited to1, Navy Enterprise Resource Planning (ERP), Navy Electronic Commerce OnLine (NECO), Federal Procurement Data System – Next Generation (FPDS-NG), System for Award Management (SAM), Standard Accounting and Reporting System (STARS), Standard Accounting, Budgeting and Reporting System (SABRS), One Touch Supply (OTS), Army Contracting Business Intelligence System (ACBIS), Procurement Data Standard (PDS), Electronic Document Access(EDA), Navy Shipyard Management Information System/Material Access Technology (SYMIS/MAT), PR Builder, and Apade OnLine (AOL, aka 511R).

Functional and Technical administration and maintenance for both databases are accomplished by NAVSUP Business Systems Center (BSC) personnel located in Bremerton, Washington.

2.0 Background:

Contractor support services and technical expertise are required to develop documentation related to the SPS proprietary software. Work may include interacting and coordinating with personnel inside and outside the Government. No travel is required.

3.0 Scope:

The scope of this requirement is to provide support to NAVSUP Audit Manager (AM) and SPS Program Manager (PM) to document the SPS system, correct assessment findings, answer SPS audit related data calls, etc. Work includes coordinating with management, operations team members, assessment personnel, data collection / analysis, drafting documentation, etc. The tasks listed are representative of the work required, but not all inclusive. Any work / tasks required to support SPS audit response / readiness support are deemed within the scope of this requirement.

1 The list of systems, tasks, references, etc. herein are examples and not meant to be all-inclusive.

Requirement Type:

• This requirement is anticipated as Firm Fixed Price.• 2 Full Time Equivalent (FTE) for SPS technical support as follows:• A FTE for the purpose of this order equates to 1,880 direct productive labor hours.• Remote support is permissible in accordance with section 14

4.0 Directives: Contractor shall comply with the following directives2:

The contractor shall comply with the following directives and any updated/future versions as they are released:

• DFAS 7900.4-M, Financial Management Systems Requirements Manual – Refer to https://www.dfas.mil/dfasffmia/bluebook.html for the applicable publications abd most current dates

• DoD Instruction 4161.02, Accountability and Management of Government Contract Property, 27 April 2012 (incorporating Change 1, September 29, 2017)

• DOD Instruction 8500.01 Cybersecurity, 14 March 2014• DoD Instruction 8582.01 Security of Unclassified DoD Information on Non-DoD Information

Systems 6 June 2012 (incorporating Change 1, 27 October 2017)• DoD Manual 8570.01-M, Information Assurance Workforce Improvement Program, 19

December 2005 (incorporating Change 4, 10 November 2015)• Federal Information Processing Standards (FIPS) - Refer to

http://csrc.nist.gov/publications/PubsFIPS.html for the applicable publications and most current dates

• Federal Information Security Modernization Act (FISMA) of 2014 • GAO-09-232G Federal Information System Controls Audit Manual (FISCAM) February 2009• NAVSUPINST 3070.2 - Operations Security, 1 July 2016• NIST Special Publications Series 800 - Refer to http://csrc.nist.gov/publications/PubsSPs.html

for the applicable publications and most current dates• SECNAV Manual 5239.2, DON Cyberspace Information Technology and Cybersecurity

Workforce Management and Qualification Manual, 27 June 2016• SECNAV Instruction 5239.3C, DON Cybersecurity Policy, 2 May 2016• SECNAV Instruction 5510.30B, DON Personnel Security Program Instruction, 6 October 2006• SECNAV M-5510.30 DON Personnel Security Program, June 2006

5.0 Requirements/Tasks:5.1 Coordinate / collaborate with various personnel in the acquisition / financial community,

including Office of Financial Operations (FMO), Resource Sponsors, Program Managers (PM), Audit Manager (AM), Program Support Team members within N7, N6, N8, BSC, Functional / Technical team leads, system interface partners, customers / end user representatives, workshops / events, working groups, ad-hoc teams, etc. Document all conversations, action

2 Unless otherwise stated, refer to the cited URL for the applicable publications and most current dates.

items, responsible party, due date, etc. and send an email to the applicable team members, including AM; include the PM if applicable. At a minimum, copy the PM and AM on all email exchanges with stakeholders.

5.2 Coordinate / attend meetings related to planning / strategy sessions / audit / RMF, etc. as required, via phone, video conference, local or offsite. Take meeting minutes, attendees, action items, responsible party, due date, etc. and provide to the applicable team members, including the AM; include the PM if applicable.

5.3 Assist in answering data calls by gathering / analyzing program data; all submissions will be done by management

5.4 Advise management on meeting Audit, Federal Financial Management Improvement Act (FFMIA) - DFAS Blue Book, Business Process Application Control, Manager’s Internal Control (MIC), Risk Management Framework (RMF) compliance

5.5 Support research / strategic planning / analysis and provide advice to management in the decision making process; provided written documentation of such to management; format commensurate to the requirement, e.g. MS Project for a project schedule, MS Visio for a Business Process Flowchart, etc.

5.6 Assist in documentation of high level and day-to-day level execution documentation, including Program / Project Schedules and Plan of Action and Milestones (POA&M), Concept of Operations (CONOPS), Department of the Navy IT control standards, Standard Operating Procedures (SOP), System Administration / End User Guides, Work Process Checklists, Interface Memorandum of Agreements, Interface Connection Agreements (ICA), Interface Reconciliation Memorandums, responses to audit Notice of Findings and Recommendations (NFR), audit Corrective Action Plans (CAP), etc. Ensure NFRs and CAPs are included in a POA&M and are tracked until the Government has implemented adequate mitigation measures.

5.7 Create / Update hardware and software baselines, diagrams, and documentation as a result of system changes, patches and upgrades.

5.8 Assist with SPS infrastructure, application hardware and software security requirements and documentation

5.9 Assist with program monitoring and control efforts, including critical path management, planning and preparing for critical events. Provide advice in the establishment and implementation of other control methods tailored to SPS program requirements; provided written documentation of such to management, if applicable; format commensurate to the requirement.

5.10 Coordinate / collaborate / assist in the receipt, review, dissemination, advise on the response to, Provided By client (PBC) audit requests, providing data / reports, tracking,

redaction of sensitive information and submission of responses; provided written documentation, if applicable, to management; format commensurate to the requirement.

5.11 Assist in the preparation / review of Engineering Change Proposals (ECP)

5.12 Prepare briefing materials, issue papers, point papers, ad hoc reports

6.0 Deliverables:

Deliverable Section FrequencyAs

Applicable, Provide To

Format / Quantities Due Date

Documentation of Coordination / Collaboration

5.1 Variable PM / AM EmailOne business

day after occurrence

Meeting Minutes 5.2 Variable PM / AMWord document, submitted via email

One business day after

occurrence

Data Gathering / Analysis, Research, Strategic Planning, Analysis, Advice, Documentation, Drawings

5.3 – 5.12

Variable PM / AM

Format commensurate to the documentation requirement / One

As assigned

Monthly Status Report (MSR)

N / A Monthly CORWord document, submitted via email / One

5th Business Day of the Following

Month

• Not every performance requirement has a related standard expressed in this document. In such cases the performance standard is either inherent in the requirement or performance is to be in accordance with standard commercial practice.

• Deliverables shall be provided via email using Microsoft Office or Adobe format, unless otherwise agreed to by the Government. Electronic documents shall be in an editable form without password protection.

• The government will review and approve or disapprove deliverables within 10 business-days of receipt. The Contractor shall consider the deliverable accepted if a government response has not been provided within the 10 business-day review time. Disapproved deliverables shall be reworked by the contractor and resubmitted within 5 business days of contractor notification, unless the COR and contractor mutually agree upon other terms.

• Monthly status reports shall include:o Documentation of participation in meetings attended and items for action.o A description of tasks performed and completed during the month, indicating status (in

progress or completed) for significant program and project milestones and summary of contacts with stakeholders.

o Summary of supporting documentation, including documents worked on and status (in progress or submitted).

o Summary of events planned for the next month.

7.0 Quality Assurance and Performance Requirements:• The Government will monitor the Contractor's performance. The Government reserves the

right to review services to be provided, including those created or performed at the Contractor's facilities, to determine conformance with performance and technical requirements.

• The COR will coordinate overall quality assurance of contractor’s compliance with the contract and inspection of products and services provided by the contractor.

Performance ObjectivePerformance

StandardMethod of

MeasurementAcceptable Quality

LevelsSurveillance

Method

Documentation of Coordination / Collaboration

Timeliness, Completeness & Quality

100% Document Review

100% on time. 98% correct grammar and spelling.

Review of performance error rates.

Meeting MinutesTimeliness, Completeness & Quality

100% Document Review

100% on time. 98% correct grammar and spelling.

Review of performance error rates.

Data Gathering / Analysis, Research, Strategic Planning, Analysis, Advice, Documentation, Drawings

Timeliness & Quality

Spot Check of Data at Source and Complete Data Analysis

100% Document Review

Correct source data is used and analysis conducted correctly.

100% on time. 98% correct grammar and spelling.

Review of performance error rates.

Monthly Status Report (MSR)

Timeliness & Quality

100% Document Review

100% of supporting documentation submitted ontime. 98% correct grammar and spelling.

Review of performance error rates.

8.0 Quality Control:• The Contractor is solely responsible for the quality of services provided. The Contractor is also

liable for Contractor employee negligence, and any fraud, waste or abuse.• The Contractor shall utilize a Quality Control System to ensure that services are completed in

accordance with acceptable principles of internal control, and meet specified, acceptable levels of quality. The operation of the Quality Control Program must be described in a written plan maintained and made available to the COR and Contracting Officer (KO) upon award. The plan must be maintained and revised as necessary throughout the life of the award. Revisions to the QC plan shall be approved by the Contracting Officer prior to implementation.

• At a minimum, the Contractor's Quality Control Plan shall include:o An internal quality control and inspection system for required services. The job titles and

organizational positions of the individuals who will conduct the inspections must be specified.

o A method to identify deficiencies in services that may occur. Procedures to correct any deficiency in services that may occur.

o A file of information regarding inspections and other quality and internal control actions that document the purpose of the inspection, the results of the inspection and any corrective action taken as the result of the inspection. Upon request, this file shall be made available to the Government during the period of performance.

9.0 Qualifications/Experience: The Contractor Information Assurance / Security Specialist resources shall have at least 10 years of knowledge and experience with security controls for the following:

• Windows server environments• Unix server environments• Sybase ASE• SPS• SPS standard interfaces

o Electronic Document Access (EDA)o System for Award Management (SAM)o Federal Procurement Data System – Next Generation (FPDS-NG)o Automated Procurement and Data Entry (APADE) legacy system interfaces

• SPS Adapter tools (Software AG WebMethods Trading Networks and Developer, Integration Server and myWebMethods)

• File Transfer Protocol (FTP), Secure FTP scripting, .idx (index) and .ps (postscript) file processes• Microsoft.NET Framework• Experience with Citrix, MS Word, Excel, PowerPoint, Visio and Outlook applications

10.0 Key Personnel Qualification Requirements:• All personnel under this require are considered Key Personnel; SUPTXT237-9400(1-92)

SUBSTITUTION OR ADDITION OF PERSONNEL applies. The vendor must commit core personnel to this contract for six months from award. The Contractor shall notify the Contracting Officer and COR prior to making any change in personnel identified as key for the duration of this PWS. Notification will occur no less than 30 days prior to such change.

Replacement for Key Personnel must possess qualifications equal to or exceeding the qualifications of the personnel being replaced.

• In the event of a planned or unplanned resource absence of more than one week, the vendor is to discuss with the COR options for providing a replacement or potential other coverage options.

• Coordinate with COR on scheduled / unscheduled leave of absences and requirements for appropriate external resources.

• At the two-week point of a planned / unplanned absence, a replacement must be provided by the vendor.

• The Government reserves the right to request substitute contractor support personnel due to unsatisfactory performance, insufficient knowledge, or inadequate skill levels necessary to complete assigned task.

11.0 Training:• Personnel may be required to complete the following or similar training:

o Training and Readiness - The Active Shootero Anti-Terrorism Level 1 Awarenesso Combating Trafficking in Persons (CTIP) / Combating Human Traffickingo Counterintelligence Awareness (annual on base training required)o Cyber Awareness Challenge / Information Assuranceo Insider Threato Operations Security - Uncle Sam's OPSECo Records Management in the DON: Everyone's Responsibilityo Additional training as required

• Provide a copy of completion certificates to the COR and / or record in the NAVSUP Training Portal

• Training is provided by the Government at no cost• Training may be online or onsite during the course of the normal workday

12.0 Contractor Identification:Per DFARS 211.106, contractor employees shall identify themselves as contractor personnel by introducing themselves or being introduced as contractor personnel and displaying distinguishing badges or other visible identification for meetings with Government personnel. In addition, contractor personnel shall appropriately identify themselves as contractor employees in telephone conversations and in formal and informal written correspondence.

13.0 Period of Performance / Hours of Operation:• Work shall be performed from the Date of Award (DOA) for 12 months with four (4)

additional one-year options. The contractor shall provide services during normal working hours excluding federal holidays. Normal working hours are 0800-1700, Monday through Friday, with a normal work week being 40 hours unless requirements dictate otherwise. Exceptions can be permitted by the COR upon request, at the COR’s discretion.

• The contractor is not authorized to begin work until the Visit Authorization Request (VAR) form has been successfully processed and system access has been granted.

• START-UP PERIOD: It is intended to make award of the resultant contractual vehicle in time to allow an approximate 30-day start-up period in advance of the actual commencement of the performance period. All contractor resource(s) onboarding documents must be submitted Via the Prime contractor. The Prime Contractor shall make all necessary preparations during this start-up period and assume full responsibility of the Performance Productive start date. Definition of "PRODUCTIVE": o Visit Authorization Request (VAR)o All contractor resource(s) must have an active JPAS profile within 20 days after contract

awardo Common Access Card (CAC)o Contractor Information Sheet (CIS)

• Note: Invoicing by the contractor will begin as of the commencement of services and no reimbursement will be paid by the Government for efforts expended during the start-up period.

14.0 Place of Performance:• Telework / telecommuting is permissible. The contractor may be required to be on base to

attend meetings. If teleworking, system access will be accomplished remotely via VPN and / or use of Citrix ICA Client in a web browser interface. A DoD approved PKI certificate will be required at contractor’s expense in order to accomplish remote access. Details are available at: http://iase.disa.mil/pki/eca/. The Government will not pay cost related to internet access.

• If working on base, the Government will provide required office space and network access (Wi-Fi) necessary to accomplish prescribed tasks. Office space will be provided at the Naval Supply Systems Command in Mechanicsburg, PA, Bldg. 214, a general office / reception area environment. When on base, individual tasks may require work anywhere within the compound.

• Inclement Weather:o The contract provides for 40-hour work weeks, excluding federal holidays. If the base is

closed, work should be done from home. If the base is open but personnel are not able to make it to the base, or don't feel safe driving, working from home is permissible; personnel shall inform the COR if working from home when the base is open. If there is a delayed start, employees work their normal day, minus the delay time. If working from home on a delay day, there is no subtraction for the delay; report to the COR if working from home.

o The base provides closure and delay information via the following: TV:

ABC 27 CBS 21 NBC 8

Recorded Phone message: 717-605-2000 or (TTY 1-877-831-1524)

15.0 Security:• This requirement is unclassified• All personnel must be U. S. citizens• All personnel shall take the training noted in section 11.

A204-9400(1-17) Contractor Unclassified Access to Federally Controlled Facilities, Sensitive Information, Information Technology (IT) Systems or Protected Health Information (Jan 2017)

Homeland Security Presidential Directive (HSPD)-12, requires government agencies to develop and implement Federal security standards for Federal employees and contractors. The Deputy Secretary of Defense Directive-Type Memorandum (DTM) 08-006 – “DoD Implementation of Homeland Security Presidential Directive – 12 (HSPD-12)” dated November 26, 2008 (or its subsequent DoD instruction) directs implementation of HSPD-12. This clause is in accordance with HSPD-12 and its implementing directives.

APPLICABILITYThis clause applies to contractor employees requiring physical access to any area of a federally controlled base, facility or activity and/or requiring access to a DoN or DoD computer/network/system to perform certain unclassified sensitive duties. This clause also applies to contractor employees who access Privacy Act and Protected Health Information, provide support associated with fiduciary duties, or perform duties that have been identified as National Security Position, as advised by the command security manager. It is the responsibility of the responsible security officer of the command/facility where the work is performed to ensure compliance.

Each contractor employee providing services at a Navy Command under this contract is required to obtain a Department of Defense Common Access Card (DoD CAC). Additionally, depending on the level of computer/network access, the contract employee will require a successful investigation as detailed below.

ACCESS TO FEDERAL FACILITIESPer HSPD-12 and implementing guidance, all contractor employees working at a federally controlled base, facility or activity under this clause will require a DoD CAC. When access to a base, facility or activity is required contractor employees shall in-process with the Command’s Security Manager upon arrival to the Command and shall out-process prior to their departure at the completion of the individual’s performance under the contract.

ACCESS TO DOD IT SYSTEMSIn accordance with SECNAV M-5510.30, contractor employees who require access to DoN or DoD networks are categorized as IT-I, IT-II, or IT-III. The IT-II level, defined in detail in SECNAV M-5510.30, includes positions which require access to information protected under the Privacy Act, to include Protected Health Information (PHI). All contractor employees under this contract who require access to Privacy Act protected information are therefore categorized no lower than IT-II. IT Levels are determined by the requiring activity’s Command Information Assurance Manager.

Contractor employees requiring privileged or IT-I level access, (when specified by the terms of the contract) require a Single Scope Background Investigation (SSBI) or T5 or T5R equivalent investigation, which is a higher level investigation than the National Agency Check with Law and Credit (NACLC)/T3/T3R described below. Due to the privileged system access, an investigation suitable for High Risk national security positions is required. Individuals who have access to system control, monitoring, or administration functions (e.g. system administrator, database administrator) require training and certification to Information Assurance Technical Level 1, and must be trained and certified on the Operating System or Computing Environment they are required to maintain.

Access to sensitive IT systems is contingent upon a favorably adjudicated background investigation. When access to IT systems is required for performance of the contractor employee’s duties, such employees shall in-process with the Navy Command’s Security Manager and Information Assurance Manager upon arrival to the Navy command and shall out-process prior to their departure at the completion of the individual’s performance under the contract. Completion and approval of a System Authorization Access Request Navy (SAAR-N) form is required for all individuals accessing Navy Information Technology resources. The decision to authorize access to a government IT system/network is inherently governmental. The contractor supervisor is not authorized to sign the SAAR-N; therefore, the government employee with knowledge of the system/network access required or the COR shall sign the SAAR-N as the “supervisor”.

The SAAR-N shall be forwarded to the Command’s Security Manager at least 30 days prior to the individual’s start date. Failure to provide the required documentation at least 30 days prior to the individual’s start date may result in delaying the individual’s start date.

When required to maintain access to required IT systems or networks, the contractor shall ensure that all employees requiring access complete annual Information Assurance (IA) training, and maintain a current requisite background investigation. The Contractor’s Security Representative shall contact the Command Security Manager for guidance when reinvestigations are required.

INTERIM ACCESSThe Command's Security Manager may authorize issuance of a DoD CAC and interim access to a DoN or DoD unclassified computer/network upon a favorable review of the investigative questionnaire and advance favorable fingerprint results. When the results of the investigation are received and a favorable determination is not made, the contractor employee working on the contract under interim access will be denied access to the computer network and this denial will not relieve the contractor of his/her responsibility to perform.

DENIAL OR TERMINATION OF ACCESSThe potential consequences of any requirement under this clause including denial or termination of physical or system access in no way relieves the contractor from the requirement to execute performance under the contract within the timeframes specified in the contract. Contractors shall plan ahead in processing their employees and subcontractor employees. The contractor shall insert this clause in all subcontracts when the subcontractor is permitted to have unclassified access to a federally controlled facility, federally-controlled information system/network and/or to government information, meaning information not authorized for public release.

CONTRACTOR’S SECURITY REPRESENTATIVE

The contractor shall designate an employee to serve as the Contractor’s Security Representative. Within three work days after contract award, the contractor shall provide to the requiring activity’s Security Manager and the Contracting Officer, in writing, the name, title, address and phone number for the Contractor’s Security Representative. The Contractor’s Security Representative shall be the primary point of contact on any security matter. The Contractor’s Security Representative shall not be replaced or removed without prior notice to the Contracting Officer and Command Security Manager.

BACKGROUND INVESTIGATION REQUIREMENTS AND SECURITY APPROVAL PROCESS FOR CONTRACTORS ASSIGNED TO NATIONAL SECURITY POSITIONS OR PERFORMING SENSITIVE DUTIESNavy security policy requires that all positions be given a sensitivity value based on level of risk factors to ensure appropriate protective measures are applied. Contractor employees under this contract are recognized as Non-Critical Sensitive [ADP/IT-II] positions when the contract scope of work require physical access to a federally controlled base, facility or activity and/or requiring access to a DoD computer/network, to perform unclassified sensitive duties. This designation is also applied to contractor employees who access Privacy Act and Protected Health Information (PHI), provide support associated with fiduciary duties, or perform duties that have been identified as National Security Positions. At a minimum, each contractor employee must be a US citizen and have a favorably completed NACLC or T3 or T3R equivalent investigation to obtain a favorable determination for assignment to a non-critical sensitive or IT-II position. The investigation consists of a standard NAC and a FBI fingerprint check plus law enforcement checks and credit check. Each contractor employee filling a non-critical sensitive or IT-II position is required to complete:

SF-86 Questionnaire for National Security Positions (or equivalent OPM investigative product) Two FD-258 Applicant Fingerprint Cards (or an electronic fingerprint submission) Original Signed Release Statements

Failure to provide the required documentation at least 30 days prior to the individual’s start date shall result in delaying the individual’s start date. Background investigations shall be reinitiated as required to ensure investigations remain current (not older than 10 years) throughout the contract performance period. The Contractor’s Security Representative shall contact the Command Security Manager for guidance when reinvestigations are required.

Regardless of their duties or IT access requirements ALL contractor employees shall in-process with the Command’s Security Manager upon arrival to the command and shall out-process prior to their departure at the completion of the individual’s performance under the contract. Employees requiring IT access shall also check-in and check-out with the Navy Command’s Information Assurance Manager. Completion and approval of a System Authorization Access Request Navy (SAAR-N) form is required for all individuals accessing Navy Information Technology resources. The SAAR-N shall be forwarded to the Navy Command’s Security Manager at least 30 days prior to the individual’s start date. Failure to provide the required documentation at least 30 days prior to the individual’s start date shall result in delaying the individual’s start date.

The contractor shall ensure that each contract employee requiring access to IT systems or networks complete annual Information Assurance (IA) training, and maintain a current requisite background investigation. Contractor employees shall accurately complete the required investigative forms prior to submission to the Command Security Manager. The Command’s Security Manager will review the submitted documentation for completeness prior to submitting it to the Office of Personnel Management (OPM); Potential suitability or security issues identified may render the contractor

employee ineligible for the assignment. An unfavorable determination is final (subject to SF-86 appeal procedures) and such a determination does not relieve the contractor from meeting any contractual obligation under the contract. The Command’s Security Manager will forward the required forms to OPM for processing. Once the investigation is complete, the results will be forwarded by OPM to the DoD Central Adjudication Facility (CAF) for a determination.

If the contractor employee already possesses a current favorably adjudicated investigation, the contractor shall submit a Visit Authorization Request (VAR) via the Joint Personnel Adjudication System (JPAS) or a hard copy VAR directly from the contractor’s Security Representative. Although the contractor will take JPAS “Owning” role over the contractor employee, the Navy Command will take JPAS "Servicing" role over the contractor employee during the hiring process and for the duration of assignment under that contract. The contractor shall include the IT Position Category per SECNAV M-5510.30 for each employee designated on a VAR. The VAR requires annual renewal for the duration of the employee’s performance under the contract.

BACKGROUND INVESTIGATION REQUIREMENTS AND SECURITY APPROVAL PROCESS FOR CONTRACTORS ASSIGNED TO OR PERFORMING NON-SENSITIVE DUTIES Contractor employee whose work is unclassified and non-sensitive (e.g., performing certain duties such as lawn maintenance, vendor services, etc. ...) and who require physical access to publicly accessible areas to perform those duties shall meet the following minimum requirements:

Must be either a US citizen or a US permanent resident with a minimum of 3 years legal residency in the United States (as required by The Deputy Secretary of Defense DTM 08-006 or its subsequent DoD instruction) and

Must have a favorably completed National Agency Check with Written Inquiries (NACI) or T1 investigation equivalent including a FBI fingerprint check prior to installation access.

To be considered for a favorable trustworthiness determination, the Contractor’s Security Representative must submit for all employees each of the following:

SF-85 Questionnaire for Non-Sensitive Positions Two FD-258 Applicant Fingerprint Cards (or an electronic fingerprint submission) Original Signed Release Statements

The contractor shall ensure each individual employee has a current favorably completed National Agency Check with Written Inquiries (NACI) or T1 equivalent investigation, or ensure successful FBI fingerprint results have been gained and investigation has been processed with OPM.

Failure to provide the required documentation at least 30 days prior to the individual’s start date may result in delaying the individual’s start date.

* Consult with your Command Security Manager and Information Assurance Manager for local policy when IT-III (non-sensitive) access is required for non-US citizens outside the United States.

The Contractor is responsible to ensure all its personnel complete the DoD Information Assurance Awareness Training (IAAT) for the current fiscal year (FY), and annually thereafter, by the due date. Failure to comply with IAAT requirements will result in suspension or termination of system access. Other mandatory training must also be accomplished by the due dates announced.

16.0 Data Rights:It is the government’s intent to retain unlimited rights to all documentation, and data first produced in performance of this requirement. The Government has the right to inspect the work and will have access to, and the right to make copies of the above mentioned items. All digital files, data and other items generated in performance of this effort shall become the property of the Government. The following clauses apply:

Clause Number

Title

252.227-7015 Rights in Technical Data – Commercial Items252.227-7028 Technical Data or Computer Software Previously Delivered to the Government252.227-7030 Technical Data–Withholding of Payment252.227-7037 Validation of Restrictive Markings on Technical Data

17.0 Government Furnished Resources & Property:• The Government will provide computer hardware, software, printing supplies, office space,

supplies, network access (Wi-Fi) and documentation necessary to accomplish prescribed tasks. The government will grant remote access to identified computing systems via the internet and through government provided computer hardware and software for off-site contractor resources. All access will be granted pending approval by the NAVSUP HQ Information Assurance Manager (IAM). The government will provide necessary and reasonable access to NAVSUP program resources. All such access shall be coordinated through the COR.

• Government will provide security access cards to allow contractor accesses to all spaces required to carry out assigned tasks.

• The contractor will be furnished with design documents, specifications, interface requirements and design/applications requirements, Configuration Management Plans, task working papers, project descriptions, program briefing material and other pertinent information, and other documentation or material required to support performance of this requirement. Information will be provided to the contractor within a reasonable time commensurate with schedules and target completion dates for assigned tasks and activities.

• The contractor and any employee or consultant of the contractor is prohibited from using U.S. Government facilities; equipment and / or information for any purpose except as specifically described herein and related to this requirement. Contractor personnel shall not divulge or release data or information developed or obtained in performance of this contract until made public by the Government, except to authorized Government personnel. The contractor shall not use, disclose, or reproduce proprietary data other than as required in the performance of this contract.

• In performance of services under this requirement, the contractor may have access to, or handle data / information this is that contains sensitive, proprietary, or privacy data / information. The contractor shall be responsible for safeguarding the information and data

while under the control of or available to the contractor and preventing it from being compromised, damaged, lost, or improperly disseminated. Computer hard drives shall be encrypted. Encrypted emails shall be used to send sensitive information / data. Personal devices shall not be used to transmit Government data / documents. Use of personal cell phones is permissible for phone calls. Texting to set up meetings and other non-sensitive purposes is permissible. A signed non-disclosure agreement is required. The following clauses apply:

Clause Number Title52.224-1 Privacy Act Notification52.224-2 Privacy Act252.204-7000 Disclosure of Information252.204-7003 Control of Government Personnel Work Product

18.0 Points of Contact:

19.0 NAVSUP Procedures for Contractor Access / Visit Authorization Request (VAR):• A company letter to the Technical Point of Contact (TPOC) containing the following

information: a. Contract Information

(1) Contract Number (2) Date Issued (3) Date of Expiration (4) Name and phone number of the TPOC (5) Purpose (6) Systems to be accessed (7) Files/Data required (8) Type of access required (i.e., inquiry/update/delete) (9) Equipment to be used with location and mode of access identified (10) Security point of contact including address and phone number

b. Information for all contractor employees requesting access, to include:

Position Audit Manager / COR / Invoice AcceptorName Chris SeierOrganization / Code NAVSUP HQ, N71D7

Address 5450 Carlisle Pike, Bldg. 309Mechanicsburg, Pa 17055

Phone 717-605-5645Email Chris.seier@navy.mil

(1) Full Name (2) Job Title (3) Date of Birth (4) Place of Birth (5) Citizenship (6) Social Security Number (7) Naturalization Number (if applicable) (8) Type and date of Security Investigation. (9) Government Clearance Level (if applicable) (10) Valid email address for the Contractor’s employee

c. Appropriate Company Official's signature

• A System Authorization Access Request Navy (SAAR-N) form (OPNAV 5239/14) with original signatures and a copy of the DOD Annual IA Awareness Training Completion Certificate for each contractor employee sent to the COR.

20.0 Clauses and additional information:

• 52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998) This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this/these address(es):

FAR Clauses: http://acquisition.gov/far/

DFARS Clauses: http://www.acq.osd.mil/dpap/dars/dfarspgi/current/

• 5237.102-90 Enterprise-wide Contractor Manpower Reporting Application (ECMRA)

The contractor shall report contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract for the N71 Program Management Support Services via a secure data collection site. Contracted services excluded from reporting are based on Product Service Codes (PSCs). The excluded PSCs are:

(1) W, Lease/Rental of Equipment;

(2) X, Lease/Rental of Facilities;

(3) Y, Construction of Structures and Facilities;

(4) D, Automatic Data Processing and Telecommunications, IT and Telecom- Telecommunications Transmission (D304) and Internet (D322) ONLY;

(5) S, Utilities ONLY;

(6) V, Freight and Shipping ONLY.

The applicable PSC code for this requirement is R408.

The contractor is required to completely fill in all required data fields using the following web address https://doncmra.nmci.navy.mil.

Reporting inputs will be for the labor executed during the period of performance during each Government fiscal year (FY), which runs October 1 through September 30. While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year. Contractors may direct questions to the help desk, linked at https://doncmra.nmci.navy.mil.

• SUPTXT237-9400(1-92) SUBSTITUTION OR ADDITION OF PERSONNEL SUBSTITUTION OR ADDITION OF PERSONNEL

(a) The Contractor agrees to assign to the contract those persons whose resumes, personnel data forms or personnel qualification statements were submitted as required by Section L to fill the requirements of the contract. No substitution or addition of personnel shall be made except in accordance with this clause.

(b) The Contractor agrees that during the contract performance period no personnel substitutions will be permitted unless such substitutions are necessitated by an individual's sudden illness, death or termination of employment. In any of these events, the Contractor shall promptly notify the Contracting Officer and provide the information required by paragraph (d) below.

(c) If personnel for whatever reason become unavailable for work under the contract for a continuous period exceeding 30 working days, or are expected to devote substantially less effort to the work than indicated in the proposal, the Contractor shall propose a substitution of such personnel, in accordance with paragraph (d) below. (d) All proposed substitutions shall be submitted, in writing, to the Contracting Officer at least 15 days (30 days if a security clearance must be obtained) prior to the proposed substitution. Each request shall provide a detailed explanation of the circumstances necessitating the proposed substitution, a complete resume for the proposed substitute and any other information required by the Contracting Officer to approve or disapprove the proposed substitution. All proposed substitutes (no matter when they are proposed during the performance period) shall have qualifications that are equal to or higher than the qualifications of the person being replaced.

(e) In the event a requirement to increase the specified level of effort for a designated labor category, but not the overall level of effort of the contract occurs, the Contractor shall submit to the Contracting Officer a written request for approval to add personnel to the designated labor category. The information required is the same as that required in paragraph (d) above. The additional personnel shall

have qualifications greater than or equal to at least one (1) of the individuals proposed for the designated labor category.

(f) The Contracting Officer shall evaluate requests for substitution and addition of personnel and promptly notify the Contractor, in writing, whether the request is approved or disapproved.

(g) If the Contracting Officer determines that suitable and timely replacement of personnel who have been reassigned, terminated or have otherwise become unavailable to perform under the contract is not reasonably forthcoming or that the resultant reduction of productive effort would impair the successful completion of the contract or the delivery order, the contract may be terminated by the Contracting Officer for default or for the convenience of the Government, as appropriate. Alternatively, at the Contracting Officer's discretion, if the Contracting Officer finds the Contractor to be at fault for the condition, he may equitably adjust (downward) the contract price or fixed fee to compensate the Government for any delay, loss or damage as a result of the Contractor's action.

• SUPTXT237-9401(2-17) PERSONNEL QUALIFICATIONS (MINIMUM)

PERSONNEL QUALIFICATIONS (MINIMUM)

(a) Personnel assigned to or utilized by the Contractor in the performance of this contract shall, as a minimum, meet the experience, educational, or other background requirements set forth below and shall be fully capable of performing in an efficient, reliable, and professional manner. If the offeror does not identify the labor categories listed below by the same specific title, then a cross-reference list should be provided in the offeror's proposal identifying the difference.

(b) The Government will review resumes of Contractor personnel proposed to be assigned, and if personnel not currently in the employ of Contractor, a written agreement from the potential employee to work will be part of the technical proposal.

(c) If the Contracting Officer/Ordering Officer questions the qualifications or competence of any person performing under the contract, the burden of proof to sustain that the person is qualified as prescribed herein shall be upon the Contractor.

(d) The Contractor must have the personnel, organization, and administrative control necessary to ensure that the services performed meet all requirements specified in contracts/delivery orders. The work history of each Contractor employee shall contain experience directly related to the tasks and functions to be assigned. The Contracting Officer/Ordering Officer reserves the right to determine if a given work history contains necessary and sufficiently detailed, related experience to reasonably ensure the ability for effective and efficient performance.

Labor Categories Minimum Requirements Information Assurance / Security Specialist See section 9