2. Cheyenne Mountain SFS 21 CS Communications Contract - 31 Jul 25.docx

PERFORMANCE WORK STATEMENT (PWS)

For 21st Communications Squadron (21 CS) Services Bridge Contract

Space Systems Command

Battlespace Awareness Acquisition Delta (SSC/SZB) 21st CS Services - Bridge contract FA8723-25-R-0007

Note, all CUI information has been removed from this document for the purposes of posting to SAM.gov

Page Intentionally Blank

REVISION HISTORY

Table of Contents

FINANCIAL IMPROVEMENT AND AUDIT REMEDIATION REQUIREMENTS (FIAR)

Appendices APPENDIX A: Acronym List 1

APPENDIX D: Surveillance Matrix 1

Figures Figure 1: Mission Assurance Center and O-Level Maintenance Approach 18

Tables

Page Intentionally Blank

1 INTRODUCTION

The 21st Communications Squadron (21 CS) Services Bridge Contract documents requirements for operations and maintenance support for the CMSFS Information Systems Infrastructure.

The United States Space Force (USSF), Peterson Space Force Base (PSFB), CO, in coordination with North American Aerospace Defense Command (NORAD), United States Northern Command (USNORTHCOM), United State Space Command (USSPACECOM), and United States Strategic Command (USSTRATCOM), determine and approve requirements for the systems the 21 CS supports.

Life cycle management of 21 CS covered systems is the responsibility of the Battlespace Awareness Acquisition Delta (SSC/SZB). More specifically, the Government program management of the O&M TO will be performed by NCMC-ITW/AA & LCS2 Division (SZBN) - Systems Program Office (SPO), PSFB, CO.

1.1 21 CS Services Covered Systems The 21 CS ministration and specialized security, communications, computing, and network systems that make up the CMSFS base information systems. 21 CS covered systems are identified in Appendix B, (CUI) 21 CS CMSFS Equipment Support Performance Requirements. The systems consist of commercial-off-the-shelf (COTS), Government-Off- The-Shelf (GOTS), Free and Open Source Software (FOSS), and specialized hardware and software. Major components to 21 CS covered systems are application servers, database servers, workstations, communication equipment, switches and virtual machines.

1.2 Terms and Definitions

The following terms and definitions are applicable to the PWS:

a. Government Program Manager (GPM). The GPM provides primary program oversight and management of the bridge contract. The GPM will also review the Contractor’s performance at periodic points in time.

b. Systems Program Office (SPO). The SPO staff supports the GPM in execution of the bridge contract.

c. Contracting Officer (CO). The individual designated by the AF to direct and/or redirect the efforts of the Contractor or modify any of the items of the contract. The CO for this bridge contract is located at Peterson SFB, CO.

d. Contracting Officer Representative (COR). The COR is the Government representative appointed by the CO responsible for monitoring, evaluating, and reporting Contractor performance on the bridge contract. The COR will interface with the Customer, the Contractor, and the SPO. The COR for this bridge contract is located in CMSFS.

e. Contractor’s On-Site Bridge contract Lead. The contractor’s bridge contract lead, at each support location, will serve as the focal point to work with the assigned COR. The individual typically has a detailed knowledge of daily activities associated with the PWS and bridge contract and is responsible for day-to-day communication with the COR.

21st Communications Squadron Services PWS

f. Contractor’s Program Manager. The contractor’s PM serves as the focal point between the GPM and the company’s management regarding all issues and discrepancies. The contractor’s PM ensures full compliance with the terms and conditions of the contract and has the primary responsibility for bridge contract performance.

2 APPLICABLE DOCUMENTS

2.1 PWS Referenced Documents

The following documents are applicable to this PWS. All services provided under the bridge contract shall comply with applicable statues, regulations, policies, and other requirements, required by Department of Defense Instruction (DoDI) 5000.02 and Air Force Instruction (AFI) 63-101/20- 101.

The latest release versions shall be followed.

a. Documents rescinded during the execution of the contract shall be applicable until the date rescinded.

b. The contractor shall notify the CO within 30 calendar days of notification of revisions, changes, supplements, or rescissions if there is a cost impact resulting from such revisions, changes, supplements, or rescissions. If the CO is not notified within the 30 days, the contractor will not be compensated for any cost increase incurred for work performed in accordance with (IAW) such revisions, changes, supplements and rescissions.

c. Any task set forth in a reference that calls for exercise of discretionary Government authority, shall be subject to the final approval of the Government official having such authority.

d. If there is a conflict between two or more publications, those issued by a higher authority shall control over those issued by a lower authority.

e. If there is a conflict between two or more publications issued at the same level of authority, those with a later date of issue shall control over those with earlier dates of issue.

2.1.1 Department of Defense Publications

DoDI 5200.44 Protection of Mission Critical Functions to Achieve Trusted Systems and Networks (TSN), Incorporating Change 3

15 Oct 2018

MIL-PRF-32216A

Notice 1

2.1.2 Department of the Air Force Publications

NIST 800-37

Risk Management Framework for Information Systems and Organizations; A System Life Cycle Approach for Security and Privacy

20 Dec 2018

AFSPC/CC

Memorandum

None (SBD1/Cybersecurity

2.1.3 SPO Publications

2.1.4 Other Publications

3 PERFORMANCE REQUIREMENTS

NOTE: Engineering and technical services provided under these requirements are subject to the General Rules regarding Organizational and Consultant Conflicts of Interest as defined in the Federal Acquisition Regulation (FAR) Part 9.505.

3.1 21 CS Support The objective of 21 CS Support is to maintain effective system user (operator) capability and ensure availability of the supported CMSFS Information Systems Infrastructure. 21 CS Support task requests are submitted, assigned, and tracked using ServiceNow System work orders for all work centers.

Tier levels for 21 CS support are defined as follows:

· Tier 0 - Help Desk

· Tier 1 – Server, application and network infrastructure level support

· Tier 2 - Engineering and vendor (assist) level support

3.1.1 21 CS - Management and Reporting The objective of 21 CS – Management and Reporting Work Center activities is to establish clear and effective communication and coordination of 21 CS Support activities between the contractor and Government stakeholders.

The 21 CS Work Centers provide support and services to missions or rooms which require TS/SCI clearance for access. Security requirements defined below for each Work Center are expected to meet the requirements specified on DD Form 254, DoD Contract Security Classification Specifications.

There are no Government defined shift schedules. Contractor personnel shift durations and transition times for Work Centers staffed 24x7x365 may be determined by the contractor and must be coordinated prior to implementation with the Government.

3.1.1.1 General and Administrative

3.1.1.1.1 Tasks

The individual ‘shall’ statements that combine to achieve the task objectives.

a. The contractor shall staff the 21 CS - Management and Reporting tasks 8x5 weekdays minus US Federal holidays.

b. 21 CS - Management and Reporting personnel shall have a minimum-security clearance of SECRET with at least one (1) of the personnel with a security clearance of TS/SCI.

c. The contractor shall obtain approval from the supervising COR of planned personnel shift durations and transition times for Work Centers staffed 24x7x365.

d. For Work Centers where minimum-security clearance requirements are less than 100% TS/SCI, the contractor shall manage individual work schedules so that TS/SCI cleared employees are available when needed to meet Work Center requirements.

e. The contractor shall provide technical training and specialized equipment training unique to the contractor’s approach to satisfy 21 CS Support requirements.

f. The contractor shall maintain continuity binders for each on-site Work Center / role that provides an overview of the role; identification of applicable service assets supported, Local Procedures, Operating Instructions, checklists, TMs and TOs; and description of “day-in-the-life” for the role.

g. Work Centers shall perform applicable equipment support tasks listed in Appendix B and meet or exceed the stated performance standards.

h. Work Centers shall perform applicable services listed in Appendix C and meet or exceed the stated performance standards.

i. Unless more stringent Work Center timelines are defined, each Work Center shall meet or exceed and collect metrics relative to the following ticket resolution timelines.

· Low: Resolved within 30 calendar days of being assigned to the work center.

· Med: Resolved within 14 calendar days of being assigned to the work center.

· High: Responded to in 10 min and resolved within 24 hours of being assigned to the work center.

j. The contractor shall collect, analyze, and report metrics of 21 CS Support task performance relative to outcomes / standards defined in this PWS.

k. The contractor shall brief system and program capabilities and status during VIP Visits/Tours, Events and Meetings (typically 4 per month) with no less than 4 hours’ notice.

l. The contractor shall review Government assigned documents (e.g., Service Level Agreement (SLA), Operational Level Agreement (OLA), Memorandum of Understanding (MOU), Implementation Plan (IPlan), Memorandum Of Agreement (MOA), Concept of Operations (CONOPS), etc.) and provide comments identifying issues and concerns to the Government POC by assigned suspense date or 14 days whichever is longer. Training can be useful, it is not acceptable as a substitute for organized, managed, documented, and tracked training.

m. All workshops or teams specified in the PWS must remain independent and separate as specified by the PWS and managed by a single shop lead/manager with appropriate expertise. Teams may not be combined with any other teams, and personnel may not be shared between different teams. The contractor may organize the teams into two “Flights”: Operations and Maintenance, each with its own Flight Lead.

n. All Cheyenne Mountain contractor leaders will ensure that all workshops operate within the standards and requirements specified in T.O. 33A-1001 and other applicable T.O.’s.

o. The contractor shall plan, host, and conduct a quarterly 21 CS Program Management Reviews (PMR) for communications of metrics on system and services performed and other program objective believed to warrant commander attention.

p. Each 21 CS Program Management Leadership Review shall include the following, as a minimum:

· Status and metrics for DRSN at both CMSFS and PSFB, VSS, VTCs conducted, GCCS, SMART.neXt

· NCC tickets across all networks

· Network uptimes

· Other program objectives believed to warrant commander/director attention

· Action items

· The contractor shall develop meeting notes for the 21 CS Program Management Leadership Reviews.

3.1.1.1.2 Deliverables

The artifacts prepared by the tasks and provided to the Government. Includes CDRLs and non- CDRLs

a. Role continuity binders [DAL Item]

b. Government assigned document review comments [DAL Item]

c. 21 CS Support task performance metrics [DAL Item]

d. 21 CS Program Management Leadership Review Meeting Notes [DAL Item]

3.1.1.1.3 Outcomes / Standards

The expected results from performing the tasks and the measurements that define the acceptable level of performance.

a. VIP Visits/Tours, Events and Meetings meet planned objectives.

b. The 21st leadership is informed of 21 CS Support activities and issues.

c. The contractor provides Government assigned document review comments by assigned suspense date or 14 days from request, whichever is longer.

d. The contractor meets the performance standards listed in Appendix D: Surveillance Matrix based on High, Medium, and Low category as identified on each trouble ticket (categories are based on a combination of factors including breadth of the incident, priority of the system, and VIP users affected).

e. The contractor will respond within a 48-hour window to all government-generated Data Calls, and ad-hoc metrics.

f. The contractor will abide by and perform in accordance with all regulations set down by OSHA, DISA, USAF, USSF, USSC, Hosting Installation, 21 CS, and 21 CS SCB.

3.1.1.2 Commander’s Inspection Program (CCIP)

The actual work for CCIP consists of establishing and maintaining inspection programs. Once established and updated, the CCIP program can go into maintenance mode and the program becomes less time-consuming. There are seven programs (e.g. Tools, TMDE, ESD, etc.) that affect all work centers. The workload varies from center to center depending on how large their programs are.

Note: In a self-requested Staff Assistance Visit (SAV), the results will not be held against the contractor unless the SAV is directed by the SCB Flight Chief, Operations Director, Special Mission Director, the 21 CS Deputy Director or Director. Findings in these cases will be evaluated by the COR and assessed for inclusion as a PAR on a case-by-case basis.

3.1.1.2.1 Tasks

The individual ‘shall’ statements that combine to achieve the task objectives.

a. Each Production Work Center (PWC) shall appoint a primary and an alternate Quality Assurance Representative (QAR). IAW TO 00-33A-1001, the PWC refers to the work center responsible for maintaining the equipment/system. In some cases, a work center can be both the owning and production work center. The QAR Serves as shop SME for QA matters and assists 21 CS QA in performing equipment evaluations (EE) once notified by the QA office based on the EE schedule.

b. The contractor shall participate in and support all facets of the Space Base Delta 1’s Commander’s Self-Assessment Program (SAP), performing all specified tasks that fall under 21 CS and meeting all specified requirements.

c. If assigned as a assessor by the 21 CS Director, Deputy Director or Flight Director, the contractor will use Self-Assessment Checklists (SACs), typically 26 applicable checklists completed on a triannual basis (every 4 months), or as directed by the 21 CS Unit Self-Assessment Program (USAP) managers from DAFI 90-302, “The Inspection System of the Department of the Air Force” and input compliance and/or observations into the Management Internal Control Toolset (MICT). In addition, and if appointed as a QAR, equipment evaluations are conducted using AFCQCCs/LCQCCs IAW TO 00- 33A-1001.

d. The contractor shall track any/all deficiencies/observations related to their duties/responsibilities in the appropriate reporting system through compliance, reporting compliance to the 21 CS USAP managers by the published suspense dates. The contractor shall support all additional self-inspection requirements as specified by the 21 CS QA office.

e. The contractor shall comply with all DoD/DAF/USSF/USAF regulations and local guidelines from hosting installation and 21 CS with reference to MICT. All MICT checklists will be completed, reviewed and updated in a timely manner and IAW all published guidelines. The standard for the contractor’s compliance with all published DoD/DAF/USSF/USAF regulations and guidelines published by the local unit commanders shall be “Continuous Compliance”, i.e. the contractor shall be in compliance at all times.

f. The contractor may request assistance from 21 CS in the form of Self-Assistance Visits (SAV’s) from COR’s and 21 CS QA on an as-needed basis. SAV’s from SBD-1 and other external program managers must be coordinated through 21 CS chain of command.

g. If the contractor is unable to maintain compliance in any area for any reason – especially for reasons beyond their control - the contractor shall:

· Notify 21 CS chain of command as soon as possible

· Append a “No” response to the SAC.

· Open an Observation in MICT (if applicable); if an answer to a question is marked “No / Non-comply”, an Observation must be opened.

· For an Observation, create a Corrective Action Plan (CAP), select the appropriate Major Graded Area (MGA), assign an Estimated Completion Date (ECD) and Suspense Date, and Close-Out Criteria IAW MICT, Hosting Installation, and 21 CS business rules/self-assessment plans and track to resolution. Accomplish the CAP, track through resolution and document results.

· Assist in developing a solution

· Track the issue to resolution

3.1.1.2.2 Deliverables

The artifacts prepared by the tasks and provided to the Government. Includes CDRLs and non- CDRLs None specified

3.1.1.2.3 Outcomes / Standards

The expected results from performing the tasks and the measurements that define the acceptable level of performance.

a. All requirements and business rules/self-assessment plans specified in authorized documents pertaining to the Commander’s Inspection Program (CCIP) are accomplished in a timely manner.

b. Zero significant findings in the results of the Commander’s Inspection Program from external inspections (e.g., IG, QA, other authorized outside agencies)

c. All MICT checklists are completed in accordance with 21 CS USAP deadlines.

3.1.1.3 Management Internal Control Toolset (MICT)

MICT is a self-evaluation tool used in the Commander’s Inspection Program (CCIP). The MICT program consists of Self-Assessment Checklists (SACs) that are assigned to each work center. MICT findings are considered “self-identified”. Deficiencies identified during this process will not normally be negatively documented against the contractor provided all of the following conditions are met.

· The deficiency is identified by the contractor themselves and not by a COR, QA, IG or any other external agency.

· The deficiency is then followed with a “No” response in MICT for the appropriate question and a well-documented Observation shall be established.

· The Corrective Action Plan (CAP) documented in the Observation is executed satisfactorily: on time, completely corrects the original deficiency and satisfies all Close-Out Criteria.

· The Observation is tracked by the contractor through completion and the MICT documentation is complete and timely.

References:

· DAFI 90-302, The Inspection System of the Department of the Air Force Attachment 4, table A4.1.

· SBD-1 Commander’s Inspection Program Business Rules

· TO 00-33A-1001, Methods and Procedures General Cyber Defense Operations Activities Management Procedures and Practice Requirements

3.1.1.3.1 Tasks

The individual ‘shall’ statements that combine to achieve the task objectives.

a. Each work center shall assign a primary and an alternate MICT POC (assessor) for each SAC assigned to their shop. The POC serves as shop SME for MICT matters and assists the 21 CS USAP managers in assessing all applicable MICT checklists assigned to the assessor.

b. All MICT checklists (typically 1-3 per Work Center) shall be re-assessed by the assigned assessors and re-validated by a Government representative every 90 days, or as specified by 21 CS USAP managers.

3.1.1.3.2 Deliverables

The artifacts prepared by the tasks and provided to the Government. Includes CDRLs and non- CDRLs Completed MICT checklists [DAL Item]

3.1.1.3.3 Outcomes / Standards

The expected results from performing the tasks and the measurements that define the acceptable level of performance.

a. The MICT program is accomplished IAW all requirements and timelines specified by the CCIP Business Rules at Hosting Installation, and 21 Leadership levels.

b. The deficiency is identified by the contractor themselves and not by a COR, QA, IG or any other external agency.

c. The deficiency is then followed with a “No” response in MICT for the appropriate question and a well-documented Observation shall be established.

d. The Corrective Action Plan (CAP) documented in the Observation is executed satisfactorily: on time, completely corrects the original deficiency and satisfies all Close- Out Criteria.

e. The Observation is tracked by the contractor through completion and the MICT documentation is complete and timely.

3.1.1.4 External Inspection

External Evaluations are those performed by COR, 21 CS QA, any IG team or any external agency authorized to conduct official USAF/USSF compliance inspections. Inspections can be performed in conjunction with unit exercises, SBD-1/Delta Horizontal inspections, SBD-1/Delta Vertical inspections or inspections individually directed by the 21 CS Director or Deputy Director representatives.

Any deficiencies or findings identified in external inspections are actionable in assessing compliance with the PWS. Findings in external inspections are actionable by the COR for use in a PAR. In cases of an external inspection finding, the COR will examine the findings, confer with the inspecting agency if applicable, confer with the contractor and render a PWS compliance judgment accordingly.

Severity of the finding will be documented IAW Deficiency Definitions in USAF AFI 90-302 and the PAR assessments based on the impact on the mission.

Deficiency Definitions (DAFI 90-302)

· CRITICAL Deficiency — Any deficiency which results in, or could result in, widespread negative mission impact or failure.

· SIGNIFICANT Deficiency— A validated deficiency which has or could have negative mission impact.

· MINOR Deficiency— A deviation from guidance or standards; left uncorrected, the deficiency may limit mission effectiveness.

· IN COMPLIANCE—A rating which indicates a program complies with governing directives and supports mission accomplishment despite any deficiencies.

· IN COMPLIANCE WITH COMMENTS— A rating which indicates a program complies with most governing directives but does not meet some mission requirements due to deficiencies.

· NOT IN COMPLIANCE— Rating which indicates a program does not comply with key elements of governing directives; deficiencies exist which may result in significant mission impact.

3.1.1.4.1 Tasks

The individual ‘shall’ statements that combine to achieve the task objectives.

The contractor shall comply with all USAF/USSF regulations and local guidelines from hosting installation and 21 CS with reference to External Inspections.

3.1.1.4.2 Deliverables

The artifacts prepared by the tasks and provided to the Government. Includes CDRLs and non- CDRLs Completed external inspections checklists [DAL Item]

3.1.1.4.3 Outcomes / Standards

The expected results from performing the tasks and the measurements that define the acceptable level of performance.

For external inspections, the contractor’s performance standard shall be:

· Zero “Critical” deficiency findings

· Zero “Significant” deficiency findings

· No more than two “Minor” deficiency findings

3.1.1.5 Records Management

References:

· AFI 33-322

· AF ERM Solution

· DoD 5200.1-R, Appendix 3

3.1.1.5.1 Tasks

The individual ‘shall’ statements that combine to achieve the task objectives.

The contractor shall perform Records Management (typically 17 accounts) requirements and manage Privacy Act (PA) and Controlled Unclassified Information (CUI) records.

The contractor shall perform SAVs on each Records management account every other year.

The contractor shall maintain records provided to the Contractor at contract start and generated by the Contractor in performance of PWS requirements.

The Contractor shall comply with user responsibilities IAW AFI 33-322, para 5 and support directions provided by government Base Records Manager and the Commanders IAW AFI 33-322, para 4.

The contractor shall create, maintain and dispose of records IAW AFI 33-322.

The contractor shall track annual mandatory annual training and the status of appointment letters.

The contractor shall create and maintain electronic records IAW HQ Air Force Electronic Records Management (ERM) Solution.

The contractor shall forward Freedom of Information Act (FOIA) and Privacy Act (PA) request received to SBD-1 FOIA/PA Manager.

The contractor shall protect PA records IAW AFI 33-332, The Air Force Privacy and

Civil Liberties Program and IAW DoDM 5200.01-V1, Appendix 3.

3.1.1.5.2 Deliverables

The artifacts prepared by the tasks and provided to the Government. Includes CDRLs and non- CDRLs

a. Records [DAL Item]

3.1.1.5.3 Outcomes / Standards

The expected results from performing the tasks and the measurements that define the acceptable level of performance.

a. Zero Critical Records Management deficiencies.

b. No more than one Records Management Significant deficiency per External inspection.

c. No more than two Records Management Minor deficiencies per External inspection.

3.1.1.6 Freedom of Information Act Program (FOIA)

3.1.1.6.1 Tasks

The individual ‘shall’ statements that combine to achieve the task objectives.

a. The contractor shall comply with DoDD 5400.7-R, DoD Freedom of Information Act Program, and any applicable Air Force supplements and requirements. This directive sets policy and procedures for the disclosure of records to the public and for marking, handling, transmitting, and safeguarding for Controlled Unclassified Information (CUI) and information previously designated as For Official Use Only (FOUO) material.

b. The contractor shall comply with AFI 33-332, Air Force Privacy Act and Civil Liberties Program, when collecting and maintaining information protected by the Privacy Act of 1974 authorized by Title 10, United States Code, Section 8013.

c. The contractor shall maintain and dispose of records IAW Air Force Records Information Management System (AFRIMS) Records Disposition Schedule (RDS) located at https://afrims.cce.af.mil/

3.1.1.6.2 Deliverables

None Specified.

3.1.1.6.3 Outcomes / Standards

a. Contractor compliance with DoDD 5400.7-R, DoD Freedom of Information Act Program, and any applicable Air Force supplements and requirements.

b. Contractor compliance with all applicable Privacy Act requirements IAW AFI 33- 332, Air Force Privacy Act and Civil Liberties Program.

c. The contractor shall maintain and dispose of records IAW Air Force Records Information Management System (AFRIMS) Records Disposition Schedule (RDS)

3.1.1.7 Security Manager

3.1.1.7.1 Tasks

The individual ‘shall’ statements that combine to achieve the task objectives.

3.1.1.7.1.1 CMSFS Employees Processing

a. The contractor shall complete DD Form 2586 (RAB/AFECC) IAW CMSFS Policies

b. The contractor will ensure NISSC employees residing at CMSFS attend 21 CS newcomers brief to receive Security, to include escort, OPSEC, and EM training.

c. The contractor will provide escort exams annually to the 21 CS Security Manager on a yearly basis.

d. The contractor shall maintain the original copy of DD Form 2586 for all NISSC Employees

e. The contractor shall complete DD Form 2875 for NIPRNet /SIPRNet/REL Account

f. The contractor shall process all contractor and sub-contractor CAC requests with the Government Program Office for all newly hired employees or employees that need updates to CAC status.

g. The contractor shall draft SCI nomination letters for all new hire employees and current employees who need the SCI access to perform contractual duties

h. The contractor shall process and submit all NC2 packets for teams working in an TS/SCI/NC2 environment, contractor will resubmit NC2 packets as needed or requested by USSTRATCOM in support of mission

i. The contractor shall create and maintain all Entry Access Letters for contractor SCIF occupied rooms

j. The contractor shall draft and verify all team member COMSEC letters for areas which require COMSEC

k. The contractor shall draft and submit Vehicle Access Letters for signature to 21 CS Unit Security Assistant .

l. If needed, the contractor security manager shall serve as the “Incident” OPR for any/all contractor personnel only that are involved in SBD1/21st CS initiated investigations.

m. The contractor shall take custody of an employee in the event of a security incident

n. The contractor shall ensure proper investigation documents are in order

o. The contractor shall comply with all government officials during an investigation.

p. Contractor shall notify the SSO should an adverse report have to be submitted in DISS/NBNS or GOV approved AIS for all SCI briefed personnel.

q. The contractor shall serve as Lead Room Custodian. The contractor shall ensure proper security documentation is present and properly completed (SF 700, SF 701, and SF 702).

r. The contractors will track all controlled area visitors with and/or without EAL’s on an AF form 1109

s. The contractor shall ensure any/all personnel (to include outside contractors) requiring access to controlled areas/spaces are on an Facility Access List.

t. The contractor will ensure any/all personnel requiring access to classified areas have an approved VAR for the specific room/area posted by the 21 CS Security Assistant (3 days to process)

u. The contractor shall ensure escorts are trained via the 21 CS Newcomers brief and be available as needed.

v. The contractor will follow processes and procedures outlined in the 21 CS Security SOP

w. The contractor shall “Out-Process” all contractor Employees at CMSFS; to include the following duties:

· Contractor shall return CACs to PSFB (Building 1840) Security Manager within 7 calendar days of employee termination.

· Contractor shall ensure all special access debriefs have been done prior to employees’ separation from the contract.

3.1.1.7.1.2 Special Security Representative (SSR)

a. The contractor shall support the SSO for all SCIF rooms that fall under the contractor’s responsibility and ensure timely re- accreditation.

b. The contractor shall serve as the Special Security Representative (SSR) for all SCIF rooms occupied by NISSC personnel and Host-Tenant Support Agreement (HTSA) supported facilities.

c. The contractor shall ensure all GSA approved safes have all the proper documentation. The contractor will ensure all Secured Areas (NCC, Communications Closets, etc.) are properly alarmed and documented.

d. The contractor will track the SCIF safe inspections monthly and send a copy of the tracking documents to the CORs.

e. The contractor shall create and maintain SCIF EALs

f. The contractor shall comply with SBD-1 and 21 CS Unit Security Manager and documented Staff Assistant Visits.

g. The contractor will track all regular, mandated security inspections and send copies of the tracking documents to the COR’s.

h. The contractor shall prepare and manage subcontractor DD 254s.

i. The contractor shall attend 21 SFS OL-CM security related meetings e.g. Quarterly, or as directed by the Unit Security Manager Office, the contractor shall inspect all rooms, shredders, degaussers, and printers to verify compliance to the EPL and security regulation.

j. All security inspections shall be documented in MS Excell and reported to the COR’s upon completion.

k. Once yearly, or as directed by the 21 CS Unit Security Manager, the contractor shall request and test response times to all open storage and alarmed areas to include the bellows.

l. Quarterly, or as directed by the 21 CS Unit Security Manager, the contractor shall perform ceiling checks to ensure no changes or proof of tampering of open storage areas.

3.1.1.7.2 Deliverables

The artifacts prepared by the tasks and provided to the Government. Includes CDRLs and non- CDRLs

a. Incident Reports [DAL Item]

b. Security Test and Inspection Reports [DAL Item]

c. EPL Inspection Reports [DAL Item]

d. SAV Reports [DAL Item]

e. The contractor shall ensure all employees based on their position maintain proper security clearances (SECRET (S), TOP SECRET (TS), Sensitive Compartmented Information (SCI), NC2, Communications Security (COMSEC) Information Restricted Data (RD) Critical Nuclear Weapon Design Information (CNWDI) Formerly Restricted Data (FRD), Special Access Program (SAP), North Atlantic Treaty Organization (NATO) Secret, AtomicTS, CosmicTS, Controlled Unclassified Information (CUI), Nuclear Command and Control - Extremely Sensitive Information (NC2-ESI), etc.) in the performance of the contract.

3.1.1.7.3 Outcomes / Standards

The expected results from performing the tasks and the measurements that define the acceptable level of performance.

a. No reported 21 CS support impacts due to CMSFS Employee Security Processing issues.

b. Zero significant findings related to contractor’s Special Security Representative.

c. The contractor shall ensure all employees based on their position maintain proper security clearances (SECRET (S), TOP SECRET (TS), Sensitive Compartmented Information (SCI), NC2, Communications Security (COMSEC) Information Restricted Data (RD) Critical Nuclear Weapon Design Information (CNWDI) Formerly Restricted Data (FRD), Special Access Program (SAP), North Atlantic Treaty Organization (NATO) Secret, AtomicTS, CosmicTS, Controlled Unclassified Information (CUI), Nuclear Command and Control - Extremely Sensitive Information (NC2-ESI), etc.) in the performance of the contract.

3.1.2 Work Order Requirements

a. Examples of work orders (WO) include, but are not limited to, installations, removals, or wiring relocations. Additionally, work orders may include installation or removal of cables/transmission media, as required for new requirements, and follow-on O&M of these equipment items/media. The COR will be notified of any installation found to be incomplete or not installed according to industry standards. The Contractor shall maintain the installed infrastructure.

b. The Contractor shall process Work Orders (WO’s) through the Cyberspace Infrastructure Planning System (CIPS).

c. All work orders issued hereunder are subject to the terms and conditions of the contract. The Contractor shall refer any questions, concerns, or disputes concerning work orders to the COR or SCB Chief in writing within 24 hours (2 hours for emergencies) of receipt of the work order. Should questions, concerns, or disputes occur, the Contractor shall continue work while elevating to the COR in writing for direction/resolution

d. Work orders will be accomplished during normal duty hours; however, occasions may arise that require work to be accomplished outside of these hours. The Contractor shall be responsible for covering such situations with adequate personnel and completing the work within the stipulated time.

e. The Requirements Manager (RM) will classify work orders as routine, priority, or emergency. The RM is authorized to reclassify/reprioritize work orders without cost before work commences. The Contractor shall comply with the time limits listed below from the time of receipt of the work order. However, exceptions to time limits may be allowed, with the written approval of a 21 CS Government Representative with appropriate justification. All cable cut repairs shall be classified as emergency unless determined otherwise by the COR orders as routine, priority, or emergency.

f. The Contractor shall comply with the time limits listed below from the time of receipt of the work order. However, exceptions to time limits may be allowed, as directed by a 21 CS Government representative. All cable cut repairs shall be classified as emergency unless determined otherwise by a 21 CS Government representative.

g. Routine. Complete within 10 duty days following submission of site survey

h. The objectives of the WO activities (typically 240 WO per year) are to facilitate tracking, planning, coordination, and completion of Wor Priority. Complete within three duty days.

i. Emergency. Respond on work site within four hours and complete work as soon as possible upon approval.

j. The COR may provide initial notification to the Contractor verbally, with a written follow- up within two hours. The Contractor will keep the COR apprised of emergency work order status.

k. Work Orders or "Jobs". Are approved and tracked using the CIPS.

l. Work Orders or "Jobs" will be worked in order of Government approved priority levels (Mission Critical, Required, Enhancement) and according to 00-33A-1001 and 00-33D- 3003. The term “jobs” refers to actions being performed by the technician, or is the general term used by technicians referring to work that needs to be performed and is equivalent to the term “work order”. Jobs can be created from trouble tickets when the open ticket transfers from the original data collection point (Communications Focal Point (CFP)) to the production work center. For example, a trouble ticket becomes a job if the CFP cannot resolve the issue, and the trouble ticket is passed to the work center for further assistance, investigation, troubleshooting, and/or repairs. Jobs can be opened directly by the owning/production work center when required.

m. Work orders with an estimate of greater than 30 days to complete and/or coordination of work efforts between multiple work centers and customers will typically be elevated to a Project by the 21 CS OL-CM Requirements Manager (typically 13 projects/year included in the typically 240 Work Orders)). Projects will be entered into Cyberspace Infrastructure Planning System (C I P S ). A SAXI number will be generated, and a government project manager will be assigned. Project activities require a Government adjudicated Technical Solution & Costing (TS&C) prior to performing the work.

n. The WO activities that are more than 30 days but do not require a detailed design solution or multiple work center coordination as is required for a TS&C will be identified by 21 CS OL-CM Requirements Manager.

References:

· TO 00-33A-1001

· TO 00-33D-3003

· UFC 3-580-01, Telecommunications Interior Infrastructure Planning and Design

· AF Base Area Network Functional Specification 2015 CIPS Visualization Component (CVC) is an Air Force enterprise-wide resource that provides a method of managing communications infrastructure assets. CVC provides a single toolset to plan, perform, and sustain a geospatially accurate, complete and secure communications data set.

3.1.2.1 Tasks

The individual ‘shall’ statements that combine to achieve the task objectives.

a. The contractor shall staff the WO/Planning Work Center 8x5 weekdays minus US Federal holidays.

b. WO/Planning Work Center personnel shall have a minimum-security clearance of SECRET with at least two (2) of the personnel with a security clearance of TS/SCI.

c. The contractor shall prioritize and resolve WO’s and Projects activity IAW Government assigned priority levels (Mission Critical, Required, Enhancement) and according to 00-33A-1001 and 00-33D-3003.

· Emergency: respond within 1 hour and complete within 4 hours of initiation

· Exceptions to the time limit may be granted by the government. In such cases the ticket will be revised to meet a new delivery schedule

· Typically, Emergency WO will be less than 10% of total monthly WO.

· Mission Critical: complete within 7 days of initiation

· Required: complete within 14 days of initiation

· Enhancement: complete within…