47QFWA26K00XX-Tankers SPO_RFI_PWS Draft Excerpt.pdf

United States Air Force (USAF)

KC135 Tanker Support Division System Program Office (SPO)

Information Assurance (IA), Mission Assurance (MA)

Lifecycle Management Program - Integrated Data Environment

(AF Tanker SPO - IA/MA - LCMP-IDE) in support of:

United States Air Force (USAF)

Air Force Materiel Command

Air Force Lifecycle Management Center (AFLCMC)

KC-135 Tankers Support Program Office

(KC-135 Tankers SPO)

(AFLCMC-WLT)

PERFORMANCE WORK STATEMENT (PWS) EXCERPT

1. Scope

The Legacy Tanker Division, KC-46, and Next Generation Air-Refueling System (NGAS)

Program Offices (PO) have mission requirements to provide Information Assurance

(IA)/Mission Assurance (MA), Aerospace Systems (AS), Aerospace Engineering (AE), and information/mission systems security improvements to Airborne and Ground systems/platforms involving secure systems, mechanical, structural, electrical, aerospace engineering, and technical research/analysis in support of the Legacy Tanker Division, KC-

46, NGAS and other aircraft owned and operated by Department of War (DoW), as well as other ground and airborne systems/platforms with mission requirements supported by Legacy

Tanker.

Under this effort, the contractor will provide personnel continuity of operations to support weapon system maintenance & operation, modifications, and mission assurance activities for the Legacy Tanker Division, KC-46 and NGAS POs, as well as any sub-clients, portfolio of systems. Weapon system modification and maintenance & operation activities span the

Defense Acquisition Life Cycle phases and examples include Materiel Solution Analysis, Technology Maturation and Risk Reduction, Engineering and Manufacturing Development

(EMD), Production and Deployment, and Operations and Support. The contractor will provide operational/systems know-how during Technical Interchange Meetings (TIM) to refine roadmaps for future modifications and to guide requirements for definitions, systems design, modification readiness, and test planning. Contractor personnel will review and provide input on technical documents, provide technical expertise to Requirements Working

Groups (RWG), Requirements Review Boards (RRB), and Stakeholder Working Groups

(SWG). Additionally, contractor personnel will provide operational know-how in reviewing the original equipment manufacturers provided technical and training materials, developing modification training materials, planning, managing and conducting contractor/Government developed test and evaluations, and executing training sessions for other operational crew members, both on the ground and airborne.

2. The Tanker Program Offices require functional area expertise in the following objective areas.

The contractor must support with expertise to fulfill mission requirements:

1. Task Order Program Management Services

2. Requirements Definition

3. Acquisition Programs, maintenance & operation Programs, and Logistics Programs

4. Test And Evaluation Planning and Execution

5. Lifecycle Management Process - Integrated Data Environment (LCMP-IDE)

6. Digital Material Management

7. Systems Engineering Analysis

8. Risk Management

9. Spectrum Management

10. Cybersecurity and Information Assurance

11. Logistics Data Analysis

3.1 Provide Task Order Program Management Services

The contractor shall provide program management services under this Task Order (TO) and prepare associated documentation, including but not limited to the Project Management Plan

(PMP), as outlined in Section Error! Reference source not found., the Monthly Status Report

(MSR) and the Technical Status Meeting Minutes Report, described in Section Error!

Reference source not found.. Tasks include coordination of technical status meetings, preparation of required documentation, and submission of actionable deliverables to drive project oversight and accountability. The contractor shall manage subcontractor performance to ensure adherence to task timelines and deliverables described in Sections Error! Reference source not found. and Error! Reference source not found..

3.1.1 Coordinate A Project Kick-Off Meeting

The contractor shall schedule, coordinate, and host a Project Kick-Off Meeting at a location approved by the Government. The meeting will provide an introduction between the contractor personnel and Government personnel and provide an opportunity to discuss technical management, security issues, and travel authorization and reporting procedures. At a minimum, the attendees shall include the contractor’s key personnel, Legacy Tanker

Division, Technical Points of Contact (POC), other relevant Government personnel, the GSA

Contracting Officer (CO) and Program Manager (PM). At least three days prior to the Project

Kick-Off Meeting, the contractor shall provide Kick-Off Meeting Agenda for review and approval by the General Services Administration (GSA) Contracting Officer (CO), GSA

Program Manager (PM), and the Legacy Tanker Division Contractor Officer’s Representative

(COR).

The agenda shall include, at a minimum, the following topics/deliverables:

• POC for all parties

• Personnel discussion (i.e., roles and responsibilities and lines of communication between contractor and Government)

• Staffing Plan and status

• Security discussion and requirements (i.e., building access, badges, Common Access

Cards (CACs))

• Invoicing requirements

3.1.2 Kick-Off Meeting Materials

The contractor shall host a kick-off meeting within 30 days of contract award or option year start date. The Government will provide the contractor with the number of Government participants for the Kick-Off meeting. The contractor shall provide sufficient (preferably electronic) copies of the presentation materials for all present.

3.1.3 Convene Technical Status Meetings

The contractor TO PM shall convene a monthly Technical Status Meeting with Legacy

Tanker Division, GSA PM, and other Government stakeholders. The purpose of this meeting is to ensure all stakeholders are informed of the monthly activities and MSR, provide opportunities to identify other activities and establish priorities and coordinate resolution of identified problems or opportunities. The contractor TO Project Manager (PM) shall provide minutes of these meetings, including attendance, issues discussed, decisions made, and action items assigned, via a Technical Status Meeting Minutes Report to the GSA PM.

3.1.4 Project Management Plan (PMP)

The contractor shall document all support requirements in a Project Management Plan (PMP) and provide it to the Government. The PMP shall:

• Describe the proposed management approach and contractor organizational structure including the contractor’s approach for quality management to ensure TO deliverables are of the highest quality in accordance with the Quality Assurance Surveillance Plan

(QASP).

• Provide for an overall Work Breakdown Structure (WBS) with a minimum of three levels and associated responsibilities and partnerships between or among Government organizations.

• Contain detailed Standard Operating Procedures (SOP) for all tasks and processes that require Government involvement and/or approval.

• Include milestones, tasks, and subtasks required in this TO.

• Describe in detail the contractor’s approach to risk management under this TO.

• Describe in detail the contractor’s approach to communications, including processes, procedures, communication approach, and other rules of engagement between the contractor and the Government.

• Update changes as required by the PMP. This is an evolutionary document, and updated changes shall be made as they occur in the program. The contractor shall work from the latest Government-approved version of the PMP.

3.1.5 Prepare Trip Reports

The Government will identify the need for a Trip Report when a Consent to Purchase is submitted (Appendix #). The contractor shall keep a summary of all Long-Distance Travel including, but not limited to, the name of the employee, location of travel, duration of trip, and POC at travel location. Trip Reports shall also contain Government approval authority, total cost of the trip, a detailed description of the purpose of the trip, and any knowledge gained.

3.1.6 Conduct Transition-In

The contractor shall conduct transition-in activities, if any, as needed, to ensure that there will be minimum service disruption to vital Government business and no service degradation during and after transition. The contractor shall implement any necessary transition-in activities, if any, immediately after TO Award (TOA), and all transition-in activities shall be completed no later than 45 calendar days after TOA.

3.1.7 Conduct Transition-Out

The contractor shall provide transition-out support when required by the Government. The

Transition-Out Plan shall facilitate the accomplishment of a seamless transition from the incumbent to incoming contractor/Government personnel at the expiration of the TO. The contractor shall provide the Transition-Out Plan within three months of Project Start (PS).

The contractor shall review and update the Transition-Out Plan. In the Transition-Out Plan, the contractor shall identify how it will coordinate with the incoming contractor and/or

Government personnel to transfer knowledge regarding the following:

• Project management processes

• Points of contact.

• Location of technical and project management documentation.

• Status of ongoing technical initiatives.

• Appropriate contractor–to-contractor coordination to ensure a seamless transition.

• Transition of Key Personnel

• Schedules and milestones.

• Actions required by the Government.

The contractor shall also establish and maintain effective communication with the incoming contractor/Government personnel for the period of the transition via weekly status meetings or as often as necessary to ensure a seamless transition-out.

Note: If required, the contractor shall implement its Transition-Out Plan no later than six months prior to expiration of the TO.

3.2 Requirements

Contractor personnel will work in coordination with the client to integrate with existing

Government workforce, adhering to the parameters of Section 9.13, Non-Personal Services, and utilize their previous operational experience while interfacing with existing total force partners to assist them in identifying capability gaps and requirements, system shortfalls, and mission requirements; and, aid in requirements definition, organization and prioritization for funding analysis, decision and development of a fielding strategy for potential solutions. The contractor shall assist the Government to refine, enhance and improve the process in the area of requirements support when required.

3.3 Data Analyst / Maintenance & Operations

Contractor personnel shall perform detailed logistics and system analysis tied to deliverables outlined in Section 4.6 (e.g., Logistics Data Analysis Reports). Such deliverables will include the integration of AI tools, including Network Internet Protocol Router Generative Pre-

Trained Transformer (NIPRGPT) and Retrieval Augmented Generation (RAG) pipelines, to support the analysis of report data and enhance the accuracy of maintenance scheduling and reliability improvements in alignment with Legacy Tanker Division, KC-46 and NGAS PO objectives.

3.4 Test and Evaluation / Training Planning and Execution

Contractor personnel shall assist in developmental and operational test planning and execution, test training development and implementation, test event scheduling and tracking.

The contractor shall refine, enhance and improve test and evaluation planning and execution support processes when required.

Contractor personnel will utilize unit processes, tools and mechanisms, and/or work to integrate test processes, tools, and mechanisms for test discrepancy documentation, reporting, and tracking to ensure discrepancies are documented, tracked and resolved by the appropriate agency. Contractor will implement a model-based test approach in alignment with Legacy

Tanker Division, KC-46 or NGAS objectives.

Contractor personnel shall conduct analysis of various modification design documentation;

identify changes in operational techniques and procedures; and subsequently develop training concepts or strategies related to modifications for eventual assimilation into long-term weapon system training curriculums.

3.5 Lifecycle Management Process–Integrated Data Environment (LCMP-IDE)

3.5.1 Compliance

The contractor shall provide updates to compliance status and documentation, infrastructure support, software maintenance and support, user support, incident response, and hosting environment support. The contractor shall maintain compliance with the DoW Risk

Management Framework (RMF) to retain the system’s Authority to Operate (ATO): efforts include recurring system vulnerability and maintenance patching, maintenance of Security

Technical Implementation Guide (STIG) / Security Requirements Guide (SRG) compliance, and continuous monitoring of the system for security threats and newly discovered vulnerabilities. To document these efforts, the contractor shall submit the LCMP-IDE

Analysis Report on a monthly basis and the LCMP-IDE Usage Summary Report on a semi-annual basis, as outlined in Section 3.5.6 and listed in Table 4.1. The contractor shall support security roles to include compliance with applicable policies, procedures, and directives;

assist in meeting security requirements for the system and its components; assist in the day-to-day operations of the system and its operational availability to support the mission.

Information about the system and its operational status shall be maintained and reported to

DoW/Air Force authoritative sources, to include National Defense Authorization Act

(NDAA) compliance and maintenance of system records in Information Technology

Investment Portfolio Suite (ITIPS) and Enterprise Mission Assurance Support Service

(eMASS) systems.

3.5.2 Infrastructure Support

The contractor shall provide ongoing infrastructure support to ensure the system is stable, reliable, and up to date. The contractor shall perform tasks such as patching, backups, technical refresh and regular monitoring to ensure uptime and usability (Note: Large-scale reengineering of the infrastructure would be reserved for separate modernization activities to be separately priced, under a different task order and approved if deemed necessary). The contractor shall support the testing and staging of production-ready LCMP-IDE updates prior to Configuration Control Board (CCB) approval and subsequent deployment to the Legacy

Tanker and KC-46 LCMP-IDE production Automated Information System.

3.5.3 Software Maintenance and Support

The contractor shall support a CCB for reviewing and approving changes, regular code reviews/scans, and software testing. The contractor shall maintain separate testing, staging, and production environments to facilitate updates and software configuration management for the LCMP-IDE. The contractor shall support production deployments of major/minor releases required to provide updates, enhancements, and issue resolution.

3.5.4 User Support

The contractor shall provide a DoW-trusted, smart card enabled account for any user of the

LCMP-IDE system. The contractor shall provide a helpdesk ticketing service to support activities such as initial account request, account provisioning, account decommissioning, change permission requests, and smart card issues/renewals. Accounts will be reviewed and audited for DoW policy compliance. On-call helpdesk support provides Tier 1, 2, and 3 assistance for issue resolution by system administrators. In addition, the contractor shall support the ongoing operations of the system by strategic communications to coordinate planned maintenance efforts and/or incident status to the user community. The contractor shall provide user account management procedures to be regularly reviewed and documented and user usage data reporting as required. The contractor shall provide evaluations including system performance analysis, auditing log records, reporting, and monitoring anomalous user activity.

3.5.5 Incident Response

The contractor shall provide ongoing preventative maintenance efforts, and address incident scenarios ranging from minor system issues to major infrastructure failure by providing responses from various supporting staff to restore system functionality or otherwise address the incident condition as quickly as possible. The contractor shall assist the Government in assessment of capabilities in real-world environments.

3.5.6 LCMP–IDE Business Intelligence Analysis

The contractor shall provide improved efficiency, effectiveness, and productivity of the program office while using LCMP-IDE. The contractor shall provide analysis and recommendations for using the LCMP-IDE system to manage information associated with

Legacy Tanker, KC-46, and any future weapons system lifecycle management systems established under this TO. The contractor shall conduct research and analysis to assist the users in improving the LCMP-IDE system’s alignment with lifecycle management processes.

The contractor shall conduct research and analysis to assess LCMP-IDE system usage levels in managing fleet lifecycle information in the divisions, and across the tanker enterprise. The contractor shall implement usage metrics depicting monthly statistics and time-based trends.

The contractor shall prepare two LCMP-IDE Usage Summary Reports showing the number of LCMP-IDE users, their organizations and locations, and the usage metrics.

Deliverable: LCMP-IDE Analysis Report and Deliverable, LCMP-IDE Usage Summary

Report

3.5.7 LCMP–IDE Enhancements & Support

If the PO office desires/funds upgrades or enhancements to the LCMP-IDE environment the contractor shall provide oversight and development to its LCMP-IDE site and support associated with existing capabilities. The contractor shall provide updates to the specific modules listed below to enhance the user experience and provide new functionality where requested. Targeted efforts will include but not be limited to: (specific enhancements will be identified during Option Years).

Deliverable: Software deployment based on software delivery scheduled provided to the government

4.0 DELIVERABLES/REPORTS

The contractor shall prepare and deliver assigned deliverables in accordance with this PWS and the Table 4.1. All deliverables shall be reviewed by the COR for adherence to the schedule and requirements. All physical deliverables will become the property of the

Government and may contain a legend or similar marking identifying the contractor staff who prepared the deliverable including the first initial, last name and employer.

The contractor shall ensure that each deliverable is accurate and complete, technically sound, and free of clerical errors. The reviewer shall notify the COR via e-mail that a review has been completed. If such a review may not be performed on any deliverable, the contractor shall contact the COR prior to submitting the deliverable. The contractor shall immediately notify the COR if schedules for task completion may not be met and upon learning of anything that might affect performance under this PWS.

4.1 Digital Material Management

The contractor shall develop the contractor model(s) by modifying and extending the government reference architecture (GRA), following the government style guide.

The Contractor shall provide regular synchronization between specified models resident on

Contractor and Government integrated digital environments [as contractor models are updated].

The contractor shall implement an authoritative source of truth (ASOT) methodology within a digital ecosystem [including Digital System Model] to the extent required by the modeling objectives included in the contract.

The contractor shall identify model configuration items and manage them according to the

CM plan.

The contractor shall perform configuration management of both government and contractor identified model configuration items per the contractor’s specified CM standard (EIA-649-1).

4.2 Systems Engineering Analysis

The contractor shall provide systems engineering, airworthiness assessments, operational safety, suitability, and effectiveness (OSS&E), maintenance & operation support, modification and engineering data analyst processes, and platform and system technical expertise essential for ensuring the reliability, safety, and functionality of aerospace systems.

4.3 Risk Management

The contractor shall provide risk, issues, and opportunity (RIO) guidance and management for all Legacy Tanker Division, KC-46 and NGAS programs via the LCMP-IDE Risk

Management Module. The contractor shall maintain the risk, issues, and opportunity management process (RIOMP) guide. The contractor shall maintain a digital dashboard

(consistent with section 4.6) for top level review of the program RIO across the POs. The contractor shall plan and execute a quarterly RIO program review chaired by PO leadership to approve opening and closing of division RIOs.

4.5 Spectrum Management

The contractor shall provide spectrum guidance and management for all spectrum-dependent

PO programs. The contractor shall maintain the spectrum management process in alignment with the Acquisition Spectrum Management Office (AQCSMO) standard operating procedures. The contractor shall maintain a digital dashboard (consistent with section 4.6) for top level review of the program spectrum across the PO portfolio.

4.5 Cybersecurity and Information Assurance

The contractor shall analyze IA/MA requirements, constraints, and guidelines described in requirements documents and shall apply the results of the analysis to develop recommendations for the optimal method of incorporating IA/MA into systems that merge voice, data, and video traffic over networks. The contractor shall conduct IA/MA technical research, analysis, and recommendations for existing and emerging Assessment &

Authorization (A&A) activities for the Legacy Tanker Division and KC-46 PO to certify and accredit secure airborne/ground communications systems, information systems, special-purpose airborne/ground systems.

The contractor shall conduct technical analysis of certification and security test and evaluation activities, Verification and Validation (V&V) analysis, and assessment of IA/MA issues connected with the development of systems and architectures to ensure that this development complies with existing and evolving A&A activities and policy for new IA/MA systems and modifications to existing systems.

As new technologies and capabilities are developed, the contractor shall draft reports analyzing survivability and threats to platform systems information networks and databases that will enable the Air Force Tanker Support Division/Approved Sub-Clients to develop assessments, evaluations, and residual risk documents for inclusion in the associated DoW

A&A packages.

Deliverable: Test and Evaluation Report

The contractor shall conduct research and analysis to assist the Legacy Tanker Division and

KC-46 PO platform systems in its assessment of cybersecurity priorities and strategies for achieving strategic planning, interoperability, and secure architectures in its fielding of information technology (IT)/IA/MA capabilities that satisfy specified mission requirements for command, control, communications, computers and intelligence (C4I).

Deliverable: Technical Analysis for Integrating IA/MA into Command, Control, Communications, Computers, Intelligence, Surveillance, and reconnaissance (C4ISR)

To assess aircraft system compliance with policies and interoperability, the Contractor shall conduct technical research and analysis to support recommendations for the application of leading-edge technology, existing networks, reduce vulnerabilities, and increase efficiency to mitigate aircraft operational capability gaps. The Contractor shall provide recommendations for the development of a DoW IT/IA/MA-compliant architecture framework that incorporates Network Centric Enterprise Services and complies with the component of the

Department of Defense Information Network (DODIN)) architecture.

Deliverable: Technical Assessment & Authorization Reports

The contractor shall conduct technical research, analysis, and recommendations for existing and emerging A&A activities to certify and accredit secure airborne and ground communications systems, information systems, and special-purpose airborne and ground systems. The Contractor shall provide cybersecurity risk analysis for system-level components of weapons systems. The contractor shall determine the scope of information necessary to complete analysis, determine system attributes and data requirements, review architectural documentation, block wiring diagrams, system interface documentation, hardware and software information and configurations, technical documentation, mission information, mission essential subsystem, and develop A&A packages in accordance with

Department of Defense Instructions (DoDI) 8510.01 Risk Management Framework (RMF) for DoW Systems. The Contractor shall determine maturity and extent of data available and able to be collected, locate information sources, and support system information package development. Cybersecurity risk prioritization may be accomplished with Government participation to develop and deliver the system information package.

The contractor shall design, document, and evaluate test plans for systems to include aircraft or Internet Protocol based network systems. The Contractor shall utilize a proven assessment methodology for evaluating weapons systems to evaluate complex system-of-systems components, published academic articles relating to aviation cybersecurity, prepare reports, establish access to systems integration laboratories (SIL) and incorporate rigor associated with formal test and evaluation for assessing Air Force Tanker Support Division/Approved

Sub-Clients platform systems that will be reflected in pre and post-test reports. Test planning will require Government approval of proposed method of test within test plans prior to execution.

The contractor shall provide assessments onsite. Assessments shall analyze avionics systems and weapons systems components’ firmware and software, identify vulnerabilities in avionics systems and weapons systems components’ firmware, software and protocols, determine access vectors for potential targeting of avionics systems and weapons systems components, develop proof-of-concept demonstrations for identified vulnerabilities, and identify means to non-cooperatively introduced malware and counterfeit firmware and software into avionics systems and weapons systems components. The results shall be compiled into a

Cybersecurity Vulnerability Performance Assessment.

The contractor shall evaluate risks and impacts to identified vulnerabilities, classify vulnerabilities, perform risk analysis for prioritization, provide risk ratings considering mission impact, and deliver formal mitigation recommendations in a risk analysis report for

Air Force Tanker Support Division/Approved Sub-Clients platform systems.

As new technologies and capabilities are developed, the Contractor shall draft reports analyzing survivability and threats to Air Force Tanker Support Division/Approved Sub-

Clients platform systems information networks and databases that will enable the Air Force

Tanker Support Division/Approved Sub-Clients platform systems to develop assessments, evaluations, and residual risk documents for inclusion in the associated DoW A&A packages.

Deliverable: Technical Analysis for Integrating IA/MA into Command, Control, Communications, Computers, Intelligence, Surveillance, and reconnaissance (C4ISR)

The contractor shall conduct assessments related to the technical, operational, and scheduling aspects of strategic planning efforts. The Contractor shall conduct technical analyses of tools, techniques, and procedures to capture the state of commercial and military technology, aerospace operations, and infrastructure. Based on this technical analysis, the Contractor shall develop recommendations for Transformation Plans and Plans of Action and Milestones

(POA&M) associated with cybersecurity measures on the aircraft.

The contractor shall provide cybersecurity technical analyses for capability-based planning processes and other strategic planning efforts through architecture development, requirements analysis, capability analysis, technical and resource evaluation of alternatives, and examination of key enabling technologies consistent with other agencies and commands.

Deliverable: IA/MA Input to JCIDS Documentation

4.6 Logistics Data Analysis

The contractor shall provide Data Analysis (DA) to the organization for Product Support

Reliability Improvement and Logistics Data Program Management. The contractor shall use digital tools (not limited to) PowerBI, Qlik, Basing and Logistics Analytics Data

Environment (BLADE), and GO81 to provide a wide range of analyses to include process improvement and stakeholder engagement; to isolate and analyze potential deficiencies related to the weapon system. The contractor shall utilize artificial intelligence (AI) tools and processes such as NIPRGPT, RAG pipelines for the analysis of textual report data pertaining to aircraft status and maintenance activities to enhance the reliability of the weapons system.

The contractor shall create, review, and provide input on data visualization and provide expertise to include client requested working groups. Data Analysis can be used to transform complex data sets into meaningful insights to support decision-making processes.

Anticipated Labor Categories

• Business Intelligence Analyst (Junior, Journeyman, Senior, and SME)

• Computer and Information Research Scientist (Junior, Journeyman, Senior, and SME)

• Computer and Information Systems Manager (Junior, Journeyman, Senior, and SME)

• Computer Hardware Engineer (Senior and SME)

• Computer Systems Analyst (Journeyman and Senior)

• Computer User Support Specialist (Junior, Journeyman, and Senior)

• Data Warehousing Specialist (Junior)

• Database Administrator (Junior, Journeyman, Senior, and SME)

• Database Architect (Junior, Journeyman, Senior, and SME)

• Document Management Specialist (Junior, Journeyman, and Senior)

• Engineer (Junior, Journeyman, Senior, and SME)

• Information Security Analyst (Junior, Journeyman, Senior, and SME)

• Information Technology Project Manager (Junior, Journeyman, Senior, and SME)

• Management Analyst (Junior, Journeyman, Senior, and SME)

• Network and Computer Systems Administrator (Junior, Journeyman, Senior, and SME)

• Software Developer, Applications (Junior, Journeyman, Senior, and SME)

• Software Developer, Systems Software (Journeyman, Senior, and SME)

• Software Quality Assurance Engineer and Tester (Journeyman, Senior, and SME)

• Technical Writer (Senior and SME)

• Training and Development Specialist (Junior and SME)