Attachment 4: Draft Technical Exhibit s

Defense Counterintelligence and Security Agency
Personnel Vetting Fieldwork

DRAFT TECHNICAL EXHIBITS A-M

A
B
C
D
E
F
G
H
J
K
L
M

Personnel Vetting Information Technology Requirements
Personnel Vetting Training Requirements
Personnel Vetting Security Requirements
Personnel Vetting Billing Requirements
Requirements for the Protection of Personally Identifiable Information Reserved
Performance Requirements Summary
Deliverables Schedule
Placeholder for Quality Assurance Surveillance Plan
Firm-Fixed-Unit-Price BI Product List
Required Contractor Training
Wage Determination

DCSA BI Fieldwork

Technical Exhibits

Technical Exhibit A. Personnel Vetting Information Technology Requirements This Technical Exhibit provides additional details related to the technical requirements for the Contractor under this Contract. The Contractor shall adhere to all standards applicable to the execution of this contract, including Cybersecurity Maturity Model Certification (CMMC) Level 2 Third-Party (C3PAO) Assessment requirements, to ensure the security and integrity of systems, data, and services. All Contractor systems, software, and tools used in the performance of the contract that store, or process Controlled Unclassified Information (CUI) or Federal Contract Information (FCI) shall adhere to the CMMC requirements.

1. APPLICABILITY

1.1. The Contractor shall comply with the below requirements as part of the Fieldwork Contract. 1.2. This document applies to the Contractor, its subcontractors and teaming partners, and employees (hereafter referred to collectively as “Contractor”).
1.3. These requirements, including all the references listed are applicable to all information, regardless of medium, maintained by the Contractor for the performance of this contract. 1.4. These requirements are in addition to all applicable requirements established by 5 United States Code (U.S.C.) 552a; and to all other requirements established by various Federal statutes, mandates, and Executive Orders for the management and security of Information and Information Systems. The following additional requirements should not be construed to alter or diminish civil and/or criminal liabilities provided under 5 U.S.C. 552a or any other applicable Federal statutes. 1.5. The Contractor shall furnish and maintain dedicated computing devices for all Contractor personnel. These devices shall be used solely for the execution of duties related to this Contract and no other