1-SOW - Replace Substion Relays - Revised 8 May 20.pdf

STATEMENT OF

WORK FOR

Replace Substation Relays (Facility 4739) 355th CES

DAVIS-MONTHAN AFB, AZ 85707

1.1. Description of Services. Upgrade existing protective relaying and install Supervisory Control and Data Acquisition (SCADA) for the Davis Monthan AFB substation in Facility 4739.

Replace existing feeder relays with new Feeder Protection relays in the upper door of the switchgear, install blank plates over the older relay installation cutouts, install a main relay on the incoming line, install arc-flash protection with point sensors in the breaker compartments, and install SCADA system with Real Time Automation Controller (RTAC) and HMI on site.

Implement bus fault protection scheme and establishing a connection between the new main relay and the upstream breaker relays for bus tripping. Enhancing arc-flash protection by installing a loop sensor on the bus.

1.2. Worksite Preparation. Prior to commencing any work the contractor shall coordinate the date and time for delivery and set-up with the contracting officer.

1.3. Place of Performance. Facility 4739.

1.4. Start Date. The contractor shall schedule the start of period of performance with the contracting officer. Period of Performance is negotiable but is anticipated to be no longer than 90 calendar days from project award, or upon approval of AFCEC design review (per Item 4), IAW AFGM 2019-32-02, para 3.1.

1.5. Contractor Hours of Operation. The contractor shall perform services during the hours of 7:00 a.m. and 3:30 p.m., Monday through Friday. The contractor must receive approval from the Project Manager: Mr. Dennis Robinson, at 228-5206 in order to work outside of these hours.

1.6. Manuals/Warrantee Documents & Technical Data. Upon completion the contractor shall provide the Government with two copies of all necessary manuals, warrantee documents, and/or technical data, including copies of system operator, administrator, and/or maintenance manuals, copies of the system’s topology, hardware/ software inventory, and configuration, as well as training and associated materials.

2.1. Project Specifics

Item 1 – Replace Substation Relays (Facility 4739).

Item 2 - All work will be accomplished in accordance with the National Electrical Code and the Davis-Monthan Design Guide. Copies of all licenses and permits shall be included in the final report. Work shall include providing and placing warning signs and barriers/barricades as necessary to prevent unauthorized access to work sites and materials.

Item 3 - All work must be completed IAW AFGM 2019-32-02, AFI 17-101 Risk Management Framework, AFMAN 17-1303 Cybersecurity Workforce Improvement Program, Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting, UFC 4-010-06, NIST SP 800-82r2, NIST SP 800-53r5 (draft), as well as all applicable DoD cybersecurity requirements.

General Notes:

Item 4 - Description of Material and/or Services to be accomplished

1. Provide a submittal of all materials to be used, prior to ordering, to be reviewed and approved by the Project Manager, and DM 355 CES Cybersecurity ISO and Program Manager. Align design specifications and proposal with requirements within UFC 4-010-06, NIST SP 800-82r2. Proposal will require technical and cybersecurity design and review acceptance by AF Civil Engineer Community (AFCEC) COO prior to installation start date.

2. Replace protective relays.

3. Replace the existing feeder relays with new Feeder Protection relays in the upper door of the switchgear.

4. Install blank plates over the older relay installation cutouts.

5. Install a main relay on the incoming line.

6. Install arc-flash protection with point sensors in the breaker compartments.

7. Install a SCADA system with a Real Time Automation Controller (RTAC) and HMI on site IAW cybersecurity requirements.

8. Implement a bus fault protection scheme and establish a connection between the main relay and the upstream breaker relays for bus tripping.

9. Install a loop sensor on the bus to enhance arc-flash protection.

10. Provide and install two rugged Toughbook laptops with Windows 10 IAW Win 10 Migration Memorandum, attached, and SEL AcSELerator software (for Relay Programming). Applicable hardware and software acquisitions must be done IAW AFGM 2019-32-02 via AFWAY/Netcents contracts and meet all cybersecurity requirements.

11. All replacements and installation is included in the Site Work.

12. Provide cybersecurity applicability and documentation in all phases and on all devices IAW UFC 04-10-06, AFGM 2019-32-02, NIST 800-82r2.

13. Return work site to original condition and to the satisfaction of the Project Manager.

3.1. General Information

3.2. English Language. Contractor employees must speak, read, write, and understand English fluently.

3.3. Work Area. The contractor shall, at all times, keep work areas free from accumulations of waste material, rubbish, tools, scaffolding, equipment, and materials. Upon completion of the job or when away from the work site, the contractor shall leave the work area and premises in clean, neat, safe and workmanlike condition. The contractor shall remove and properly dispose of all job related waste material.

3.4. Safety. The contractor shall comply with all local, state and federal laws and safety regulations. Compliance with OSHA and other applicable laws and regulations for the protection of contractor employees is exclusively the obligation of the contractor, and the Government will assume no liability or responsibility for the contractor’s compliance or noncompliance with such responsibilities. The contractor is responsible for furnishing contractor employees with all necessary personal protective equipment to perform services.

3.4.1. Fire Prevention and Safety Standards. Contractor employees shall comply with the Occupational Safety and Health Act (OSHA), Davis-Monthan AFB Fire Protection Program, Air Force Occupational Safety, and the Fire Prevention and Health Program.

3.4. Smoking in AF Facilities. Contractors are advised that the AF has placed restrictions on the smoking of tobacco products in AF facilities. AFI 40-102, Tobacco Use in the Air Force, outlines the procedures used by the commander to control smoking in our facilities. Contractor employees and visitors are subject to the same restrictions as Government personnel. Smoking is permitted only in designated smoking areas.

3.5. Illegal Substances. Illegal substance possession and/or use will not be tolerated on any military installation, including DMAFB. The contractor shall ensure that contractor employees who have base access do not possess and/or use illegal substances. All contractors and subcontractors are required to adhere to all local, state and federal laws concerning possession and/or use of illegal substances. Contractors found to be in possession of illegal substances will be barred from the installation and subject to arrest and prosecution by local authorities.

3.6. Illegal Aliens. IAW Air Combat Command (ACC) supplement to AFI 31-101, The Air Force Installation Security Program (FOUO), illegal aliens are unauthorized on DMAFB. The contractor shall not hire illegal aliens to perform contract services on DMAFB, nor attempt to bring illegal aliens on the installation. Corrective/punitive action will be taken against the contractor and the illegal alien if the contractor hires illegal aliens to perform contract services on DMAFB.

3.7. Contractor Travel on DMAFB. Contractor employees shall not loiter in any working area before or after performing services. All contractor employees shall limit their travel on DMAFB only to the specific areas required for performance of services or in travel directly to and from these locations. Upon completion of contract work, contractor employees shall promptly depart

DMAFB.

3.8. Contractor Employee Conduct. The Government reserves the right to require removal from the installation any contractor employee who endangers persons or property, whose actions are inconsistent with professional conduct, whose continued employment is inconsistent with the interest of military security or who is found to be incapacitated or under the influence of alcohol, drugs, or other substances. Removal of employees for any reason does not relieve the contractor of the requirement to perform services specified herein.

3.9. Cyber Security Requirements.

3.9.1 Vendor must incorporate cybersecurity into all phases of product/service delivery: design, development, test and evaluation, integration, execution, construction, operation, maintenance, sustainment, upgrade, or replacement.

3.9.2 Vendor is required to perform an initial security assessment, a scan of vulnerabilities, to provide a copy of the scan results, and to mitigate the identified vulnerabilities prior to final acceptance by the Air Force.

3.9.3. Vendor must comply with cybersecurity guidance from ISO/PM to add newly-installed or acquired CS to the installation’s inventory.

3.9.4. Vendor must use government-owned assets (e.g., computer, tablet) for CS maintenance and all maintenance is to be conducted on site.

3.9.5 Vendor must provide sufficient documentation to enable the Air Force to finalize the authorization, and obtain approved Risk Management Framework (RMF) authorization package.

3.9.6 When the CS operating system cannot be upgraded or comply, a detailed Plan of Actions and Milestones must be documented and approved through the RMF process to appropriately manage the resulting security risk or to provide remediation that eliminates the risk.

3.9.7 Contractor is required to maintain compliance in accordance with USCYBERCOM TASK ORD 17-0019, as applicable. Contractor will download all monthly patches from DISA site for all applicable operating systems and applications.

3.9.8 Technician Certifications IAW DoD 8570.01M, DoD 8570.01-M, Information Assurance Workforce Improvement Program. The contractor shall ensure that personnel accessing information systems have the proper and current information assurance certification to perform information assurance functions in accordance with DoD 8570.01-M, Information Assurance Workforce Improvement Program. The Contractor shall meet the applicable information assurance certification requirements, including— (1) DoD-approved information assurance workforce certifications appropriate for each category and level as listed in the current version of DoD 8570.01-M; and (2) Appropriate operating system certification for information assurance technical positions as required by DoD 8570.01-M. Upon request by the Government, the contractor shall provide documentation supporting the information assurance certification status of personnel performing information assurance functions. Contractor personnel who do not have proper and current certifications shall be denied access to DoD information systems for the purpose of performing information assurance functions.

3.9.9 Contractor must document any and all necessary privileged use and security access controls necessary to run vendor system. Contractors with privileged access to government systems must meet DoD 8570.01 and 5200.02_AFMAN 15-1405 security clearance levels. All Contractors shall also comply with Operations Security (OPSEC) requirements as set forth in DoD Directive 5205.02E, DoD Operations Security (OPSEC) Program Manual and AFI 10-701, Operations Security. Application and cost for the appropriate Personnel Security Investigation (PSI) shall be the responsibility of the Contractor. If the contractor is notified by any Government official having security cognizance over the contract that an employee’s security clearance has been revoked or suspended, the contractor must notify the Contracting Officer the same day the contractor receives the notice and all access revoked.

Controlled/Restricted Areas. The Contractor shall adhere to/implement local base procedures for entry to AF controlled/restricted areas where Contractor personnel work. An AF Form 2586, Unescorted Entry Authorization Certificate, must be completed and signed by the sponsoring agency’s Security Manager before a Restricted Area Badge will be issued. Contractor employees must have a favorably completed National Agency Check plus written Inquires (NACI) investigation before receiving a Restricted Area Badge. Interim access can be granted in accordance with AFI 31-501, Personnel Security Program Management.

Key Control. The contractor shall establish and implement methods of making sure all keys/combinations issued to the contractor by the government are not lost or misplaced and are not used by unauthorized persons. The contractor shall not duplicate any keys issued by the Government. The contractor shall immediately report to the COR or Contracting Officer any occurrences of lost or duplicated keys. In the event keys, other than master keys, are lost or duplicated, the contractor may be required, upon written direction of the Contracting Officer, to re- key or replace the affected lock or locks without cost to the Government. The Government may, however, at its option, replace the affected lock or locks or perform re-keying and deduct the cost of such from the monthly payment due the contractor. In the event a master key is lost or duplicated, the Government shall replace all locks and keys for that system, and the total cost will be deducted from the monthly payment due the contractor.

The contractor shall prohibit the use of keys and/or cipher lock combinations, issued by DMAFB, by any persons other than the contractor’s employees and the opening of locked areas by contractor employees to permit entrance of persons other than contractor employees engaged in performance of contract work requirements in those areas.

The contractor shall control access to all Government provided lock combinations to preclude unauthorized entry. The contractor is not authorized to record lock combinations without written approval by the COR. Records with written combinations to authorized secure storage containers, secure storage rooms, or certified vaults, shall be marked and safeguarded at the highest classification level as the classified material maintained inside the approved containers.

Privacy Act. The Contractor shall ensure that its employees fully understand and comply with Title 5 of US Code, Section 552.a and DoD 5400.7-R, DoD Freedom of Information Act Program. These procedures must be followed to identify and safeguard reports and data accordingly. The contractor will ensure that Contractor employees are briefed annually on properly identifying and handling Privacy Act data/information.

Protection of Personally Identifiable Information. Personally Identifiable Information (PII) refers to information that can be used to distinguish or trace an individual’s identity either alone or when combined with other information that is linked or linkable to a specific individual. PII may range from common data elements such as names, addresses, dates of birth, and places of employment, to identity documents, Social Security numbers (SSN) or other government-issued identity, precise location information, medical history, and biometrics. The contractor shall protect all PII encountered in the performance of services in accordance with Department of Defense Directive 5400.11, Department of Defense Privacy Program, and DoD 5400.11-R, Department of Defense Privacy Program. If a PII breach results from the contractor's violation of the aforementioned policies, the contractor shall bear all notification costs, call-center support costs, and credit monitoring service costs for all individuals who's PII has been compromised.

3.10. List of Employees. Upon contract award, and prior to beginning work, the contractor shall submit to the Contracting Officer a list of contractor employee names, social security numbers, and driver’s license numbers, or other means of positive identification of all employees performing services on DMAFB. Foremen, supervisors, and superintendents must be identified on the list of employees. The contractor shall submit an updated list when an employee's status or information changes. The name of any contractor employee that is terminated during the period of the contract must be reported to the Contracting Officer, in writing, within one workday of the employee’s termination.

3.10.1 Pass and Identification Items. The contractor shall ensure the pass and identification items required for contract performance on DMAFB are obtained for employees and non- Government owned vehicles.

3.10.2 Retrieving Identification Media. The contractor shall retrieve all identification media, including vehicle passes from employees who depart for any reason before the contract expires;

e.g. terminated for cause, retirement, etc, or upon contract completion. The contractor shall notify the Contracting Officer in writing when an employee departs, and return the employee’s identification to the office that issued it.

3.10.3 Traffic Laws. Contractor employees shall comply with all Davis-Monthan AFB traffic regulations and state traffic laws. Contractor employees are subject to random vehicle speed control checks. Failure to adhere to base traffic regulations may result in the loss of base driving privileges, debarment from the base, or other administrative action. The use of cell phones is strictly prohibited while driving on Davis-Monthan AFB, unless the phone is hands free. Seat belt use is mandatory for all drivers and vehicle passengers.

3.10.4 Random Personnel and Vehicle Searches. Contractor personnel are subject to random personnel and vehicle searches. If contractor personnel refuse to be searched, they will be denied entry to the base. Denial of entry to contractor personnel who refuse to be searched, or detention of personnel found to be in possession of contraband, may result in loss of base driving privileges, debarment from the base, or other administrative action. Detention of contractor employees for any reason does not relieve the contractor of the requirement to perform contract services.

3.10.5. Weapons, Firearms, and Ammunition. Contractor employees are prohibited from possessing weapons, firearms, or ammunition on themselves or within their contractor owned vehicle or privately owned vehicle while on Davis-Monthan AFB.

3.11. Reporting Requirements. Contractor employees shall immediately report to an appropriate DMAFB authority any information or circumstances of which they are aware that may pose a threat to the security of Department of Defense personnel, contractor personnel, resources, and classified or unclassified defense information.

3.12. Physical Security. Contractor employees are responsible for safeguarding all Government property and controlled forms provided for the contractor’s use. At the end of each work period, the contractor shall secure all DMAFB facilities, equipment, and materials.

4.1. Government Provided Services

4.2. Emergency Services. The Government will provide security forces services (call 228-4444 for emergencies only), and fire protection services (call 228-3333). There are no emergency medical services available on DMAFB; therefore the contractor must dial 911 for emergency medical services.

4.3. Utilities. The Government will furnish a source of electricity at the worksite as available.