Frequently Asked Questions

Frequently Asked Questions (Policy) [top]

1. If I have a contract that meets all the requirements for preparing a CPAR form, but the contract has recently closed, do I still have to do CPAR?

A: ASN (RD&A) memorandum dated 2 October 1997 directed the PEOs and SYSCOMs to "...initiate the collection of past performance information by January 1998." Therefore, if the contract closed after December of 1997, and meets all the other reporting requirements contained in the January 1998 DoN CPARS Guide, you should prepare a CPAR form.

2. Do I have to do a CPAR form for contracts funded with RDT&E 6.1, 6.2, or 6.3 funds?

A: No. If the RDT&E contracts are funded with 6.1 (Basic Research), 6.2 (Exploratory Development), or 6.3 (Advanced Technology Development) funds a CPAR form is not required because they fall under the Science and Technology Sector which is not applicable to CPARS. Refer to the January 2000 DoN CPARS Guide, page A1-4, for guidance regarding RDT&E.

3. How do  overseas users and their contractors get access to the browser supported 128 bit encryption, with the SSL (Secure Socket Layers), so that all account information will be encrypted when transmitted across the Internet?

A: All  users, including those overseas on a military installation, currently have access to 128 bit encryption via the security procedures located on the website. Information on updating or configuring your browser is contained on the same site.. Under current U.S. law, overseas contractors may not have access to 128 bit encryption technology; therefore, the technology cannot be exported to overseas contractors. Overseas CPARS focal points must have the contractors manually fill out the contractor blocks on the CPAR form, and the contractor must provide the filled out form to the DoN Focal Point who will then enter the CPAR into the automated system. The CPARS Focal Point should manually provide the completed (after completion by the Reviewing Official) form to the contractor.

Update: On January 12, 2000, the U.S. Department of Commerce Bureau of Export Administration (BXA) issued new encryption export regulations which now allow the export of "retail" encryption products (of any key length) around the world. The only restrictions that remain are on terrorist supporting states (Cuba, Iran, Iraq, Libya, North Korea, Sudan and Syria), their nationals, and other sanctioned entities. For full details, see http://www.bxa.doc.gov/Encryption/Default.htm. Now overseas contractors and government personnel may obtain and use browsers with 128-bit encryption.

4.  Should PPI be collected for joint ventures? [top]

A: Yes, PPI should be collected for `joint venture` contractors when the applicable business sector and dollar thresholds indicate that the contract is PPI eligible. There is no indication from current guidance that joint ventures should be excluded. Also, remember that the intent of the data collection is not only for future DoN source selections, but also to share with other agencies. Your PPI input may be very valuable to other agencies, even if you think that DoN might not procure an item involving this particular joint venture in the future.

5. Are CPARs required for delivery orders (DO)?

A:  Yes. The information contained in a performance assessment of work performed under a DO is equally as important as that performed under a stand-alone contract, or any other type of procurement instrument.

6. Who should prepare the CPARS for DOs?

A:  TheCPARS Guide, paragraph 2.7, states: "For delivery order or task order contracts, the contracting officer should specify in the contract the frequency of, and the individual(s) responsible for, past performance assessments associated with orders to be placed against that contract." In general, it makes the most sense for the person or persons with the most knowledge (i.e., closest to the process) to prepare the CPARS.

7. Can a single CPARS be prepared for multiple work efforts?

A:  "When a single contract instrument requires segregation of costs for combining efforts, or contains multiple production lots (or increments of work), an individual CPAR may be completed for each segment of work. When the type of effort and the contractor`s performance on each order are so similar as to reflect identical results, the program manager in consultation with the CPAR focal point may elect to prepare a single CPAR for each contract."

8. Who prepares a CPARS on a DO under a GSA contract?

A: Good question. GSA is currently reviewing their policy on this item. We believe that the people receiving the goods or services are the best qualified to prepare a CPARS and should do so for DOs awarded under GSA contracts--GSA won`t know how well the contractor performed. However, they should have a record of performance for future use--which they will get from our activities preparing a CPARS.

When registering a GSA contract in CPARS, the GSA schedule number should be entered in the contract number field and the local "F" order number is placed in the order number field. An order number is required when registering GSA contracts.


9. Are overseas contracting offices exempt from CPARS requirements? [top]

A:  This question has arisen both on the basis of the 128-bit encryption requirement and because it is perceived that the need for PPI data on overseas contractors is minimal. The DoN CPARS Guide makes no exceptions from the requirement to prepare CPARS based on location. There are overseas sites (Marine Corps in Okinawa, for example)
utilizing the automated system, so we know it can be done. Any contracting office having difficulties processing automated CPARS should contact NLSC.

Failure to enter completed CPARs records into the CPARS AIS prevents sharing data with other DOD activities. There may be occasions when overseas contractors also do work on Army or Air Force work. This may not be true for     shipbuilding contractors but it could apply to machine shops or electrical overhaul facilities, for example. If the completed CPARS are entered into the Navy`s CPARS AIS then they become reports of record that can be shared with other agencies either though the AIS or eventually in the DOD PPAIS, which is currently under development.

10.  Do CPARS have to be done on BOAs (Basic Ordering Agreements)?

A: The Basic Ordering Agreement (BOA) instrument itself is not subject to CPARS since it is not a contract. However, each order executed under a BOA is a contract and, as such, if the order exceeds the applicable dollar threshold, then the order is subject to CPARS. Also, if the total of all orders against the same BOA exceeds the threshold, then a CPAR is required.

11.  How do I make note of a prime contractor’s compliance with the sub-contractor performance plan submitted for the contract?

A.  CPARS assessments are an evaluation of the prime contractor’s ability to perform on the contract. The sub-contractor should not be individually assessed. In the Evaluation Areas of Block 18, the Assessing Official should assess whether the contractor met small/small disadvantaged and women-owned business participation goals in the Subcontract Management area on the Systems CPARS form and in the Business Relations area on the Services and IT CPARS form.

12.  Are there forms available for completing CPARS containing classified information?  Can I enter that information into the CPARS application?

A.  Forms are available from your CPARs Management Board member or call the CPARS help desk at 603-431-9460, ext. 486.  Classified information is not to be entered into the CPARS automated application.  Use the on-line automated application as intended, for unclassified use only.  Completed classified CPARs must be filed on the originator`s classified computer system and would only be available for Source Selection users via a request to the originator with the usual security precautions (i.e. need to know, clearance, etc.)  Talk to your CPARS Management Board member about the point of contact for collection and storage of this information.

13. Are CPARs releasable under the Freedom of Information Act (FOIA)?

A. DoD policy states that past performance evaluation information (e.g. CPARs) is privileged source selection information and is not releasable under the Freedom of Information Act. Further, Federal Acquisition Regulation (FAR) Subpart 42.1503 (b) states: " The completed evaluation shall not be released to other than Government personnel and the contractor whose performance is being evaluated during the period the information may be used to provide source selection information." When a FOIA request is received for CPAR records, the unit FOIA office must refer the request to the CPAR focal point for coordination. The CPARS Program Manager at the Naval Sea Logistics Center, Portsmouth, NH, is available for additional guidance/information in this area.

Air Force Frequently Asked Questions [top]

1. What are the hardware restrictions to the contractors? How would this affect corporate restrictions (firewalls) to prevent contractor sensitive data from getting out of the company. This could be a real problem for smaller contractors if their "firewall" solution is to use a dedicated machine not connected to their own network.

A: To gain access to automated CPARS, the user must have a personal computer with at least a 486-class processor, 8 megabytes of RAM, Windows 95, 98 or Windows NT, and a browser with 128-bit encryption. Today, most browsers have 128-bit encryption or it can be downloaded off the Internet. In addition, the user will need to download Adobe Acrobat Reader, which is available on the web for free. User firewalls would not be affected by this system. It remains the responsibility of the corporation to protect their networks and data by whatever means they have established. If the small business does not have access to a computer, or chooses not to participate on-line for his CPARS because of his security restrictions, he can receive his CPARS either in person or by mail. Our Air Force guide outlines procedures for this. (Note: The Navy has not had any major problems reported by small or large businesses during the last three years.)

2. How can we guarantee that even the small contractors have EQUAL ACCESS into the system?

A: CPARS has approved access controls including software programs and password protections at the database level. To gain access, the command or center focal point will grant contractors access to the system using user id and password. In the event a contractor does not have computer access, the AF guide specifies hand delivery or mail as the method of transmittal for the completed CPARS.

3. Suggest giving each new contractor a handout on CPARS at the time he is awarded a contract.

A: We will ask the Navy to see if anything has been developed. If not, we will develop a handout for the vendor community.

4. How will the large and small contractors be trained?

A: Center focal points will be responsible for training contractors. To assist them, the website has a Computer Based Training (CBT) module as well as practice sessions for contractors to become familiar with the system. Help desk support is also available to all users. Additionally, AQC is working with the Electronic Commerce Resource Centers to provide training to the vendor community. Finally, AQC recommends CPARS be discussed during post award conferences.

5. Is it clear on the website and form that classified data is not to be entered into the system?

A: The Air Force Guide to the CPARS system that is posted on the automated CPARS website states that classified and Special Access Program (SAP) CPARS are not to be entered into the CPARS automated information system. Classified and SAP CPARS are to be processed according to AFPD 31-4, Information Security and AFI 31-401, Information Security Program Management. We’ve asked the Navy to place a marking "Unclassified Use Only" on the CPARS website and automated CPAR forms as an additional reminder to users.

6. What do we do if we find out classified information has been typed into the system? Do we shut it down?

A: There are existing procedures for handling security violations on information systems. The violation would be treated according to the circumstances of the infraction (i.e. system shutdown, etc).

7. Can the classified data be completely erased from the CPARS database and the backup database?

A: Upon notification/identification, the automated CPARS Program Manager would have the CPARS System Administrator completely erase the classified CPAR from the CPARS database and the backup database.

8. Would we know who input the classified data and when?

A: Yes, each CPAR is identified to one focal point. The focal point controls all access to inputting a particular CPAR, and maintains the matrix form with these access rights.According to the CPARS SSAA, "The CPARS System provides a documented history of AIS use. The audit trail is of sufficient detail to reconstruct events in determining the cause or magnitude of compromise should a security violation occur."

9. Would we know who had accessed the classified data, so that we could ensure that the classified material was destroyed at each place that it had been accessed?

A: Yes, the CPARS system has the capability of identifying who accessed the data: According to the automated CPARS System Security Authorization Agreement (SSAA) dated 28 Mar 00: "All access to CPAR data is recorded by the CPARS Administration Object within the Oracle Server.

10. Is there system security documentation for the CPARS AIS? [top]

A: There is an approved System Security Authorization Agreement (SSAA), IAW DoD requirements, dated April ’00. The SSAA contains particulars on system safeguards.

11. Do we have standard templates for the program?

A: Yes, they are on the automated CPARS website.

12. Is there a system in place to guarantee e-mails get to the correct person?

A: At this time, there is no receipt notification capability. However, it is incumbent upon individuals to provide their correct e-mail address when they register with the focal point.

13. Are we going to have 3 years worth of previous contractor performance info loaded into the system so as to avoid having to use two different systems to monitor this info?

A: Today, all of AFMC’s Past Performance Data is loaded into DoD’s Past Performance Automated Information System (PPAIS). Once a past performance report is finalized in the automated CPARS, it will go into the repository, PPAIS, for retrieval by the Services. During the implementation of the automated CPARS, the operational commands will be required to input the last two years past performance data. There are relatively few CPARS from the Operational MAJCOMS.

14. How long will the Pilots last?

A: The pilots were completed in FY-01.

15. Who will be responsible for collecting and reporting metrics? A: Under the new system, the PEO can run a report at any time to check on the status of a CPARS; however, the focal point has the responsibility for ensuring that CPARS are completed in a timely manner. For AFMC, each center focal point provides metrics to his center commander. This process will continue as the new CPARS is implemented. Currently, the operational commands are not reporting metrics to the commanders. We will be working with these commands over the next few months to increase compliance with the requirement to complete CPARS.SAF/AQCI has access to all data for Air Force. As the system is implemented in the AF, AQCI will validate any AF-wide enhancements/improvements and if approved, forward those to the Navy for possible incorporation based upon AQC funding availability.

16. Need to have a Source Selection Cover Sheet for those CPARS downloaded from the system?
A: We can easily add to the CPARS website. AQCI is providing the cover sheet to the Navy for posting.

17. Will an actual source selection be performed during the Pilot session?
A: Yes, SMC will be conducting a source selection during the pilot program. As a side note, all of the centers currently have access to the DoD PPAIS system to obtain CPARS, (including Army and Navy) during their source selections

18. Downloading files (information) into shared database server is contrary to latest computer security training, if we focus on preventing the spread of virus. 

A: The approved System Security Authorization Agreement validates that standard security measures are in place to protect CPARS. We believe computer security training was primarily focused on downloading from personal disks, etc without standard procedures for virus checking. [top]