A9 VWC IT Support PWS - DRAFT.pdf

PERFORMANCE WORK STATEMENT (PWS)

Virtual Warfare Center Information Technology (IT) Support

09 Dec 2024

1.0 Description of Services.

1.1 Scope/Background.

Air Mobility Command (AMC)/A9 manages and operates the AMC Virtual Warfare Center (VWC), providing a state-of-the-art venue and modeling and simulation capability for AMC.

The VWC allows AMC to integrate disparate methodologies and tools in support of AMC research efforts. It is critical to advancing AMC’s warfighting capability through the development of novel materiel and operational concepts. As part of the VWC, AMC/A9 uses and develops sophisticated computer modeling and simulation, mathematical techniques, and programs to assess the impact of decision alternatives. To perform its missions, AMC/A9 utilizes multiple global airlift, tanker, and warfighting computer models for evaluating air mobility capability in peacetime and wartime scenarios. These models range from various spreadsheet-based approaches to large-scale models and simulations such as the Analysis of Mobility Platform (AMP), the Air Refueling Model (ARM), Command Professional Edition (CPE), and the Advanced Framework for Simulation, Integration, and Modeling (AFSIM).

Additionally, AMC/A9 maintains a workload on a cloud hosted Special Access Program (SAP) environment, to provide modeling and simulation support to various AMC research activities at higher classification levels. The contractor shall provide system administration and Information System Security Manager (ISSM) capabilities for AMC/A9’s VWC network, tentatively known as the AMC/A9 Warfighting Research Network (WARNET). Additionally, the contractor shall provide system administration support for the AMC/A9 and AMC/A8Z workload hosted on the MORPHEUS SAP cloud environment.

1.2 Requirements.

1.2.1 Task Description. The primary purpose of this contract is to obtain the requisite expertise through contract resources to support the following tasks.

1.2.1.1 System Administration. The Contractor shall:

1.2.1.1.1 Configure and maintain the AMC/A9 Warfighting Research Network (WARNET), a private classified, Microsoft Windows based network, currently comprised of a single high performance desktop server and multiple client laptop workstations.

These workstations may frequently operate in off-site locations and/or disconnected from the server and other clients.

1.2.1.1.2 Create options for, and manage, WARNET expansion and integration efforts.

Projected growth to the VWC mission will require ongoing architecture changes to the WARNET to keep pace with evolving requirements. Options should consider network, hardware and software upgrades, to include estimated cost and submissions of draft Cyberspace Infrastructure Planning System (CIPS) requirements.

1.2.1.1.3 Install and update mission required specialized software to include AMP, AMP Port Analysis Tool (AMP-PAT) ARM, CPE, AFSIM, Synthetic Theater Operations Research Model (STORM), JMP, Joint Mission Planning System (JMPS), Tableau, R, Python, Master Air Attack Plan Toolkit (MAAP-TK), SIMDIS, and any other specialized software as required for AMC/A9’s mission. Distribute hardware and software. Organize and maintain positive control of all software licensing agreements.

1.2.1.1.4 Know and apply computer policies, authorized system configurations, system security procedures, and terminology in both the work environment and support areas.

1.2.1.1.5 Ensure hardware and software complies with Air Force (AF) standards.

1.2.1.1.6 Install and maintain new equipment and software, including patches as required.

1.2.1.1.7 Monitor and maintain system security. Review and correct items identified by security scans, and complete actions required by Time Compliance Network Orders (TCNOs), or Maintenance Tasking Orders (MTO). Ensure all identified Risk Management Framework (RMF) requirements are documented and implemented as necessary.

1.2.1.1.8 Set up user accounts and assist users with troubleshooting computer problems.

Perform Trusted Agent (TA) responsibilities per letter of appointment.

1.2.1.1.9 Notify vendors of software/hardware problems. Work with vendors to correct system/equipment faults.

1.2.1.1.10 Maintain the VWC network installation of Command Professional Edition Real Time Multiplayer (RTMP) software. This highly specialized software is in active development and will require routine/ongoing collaboration with the developer to ensure that development efforts meet AMC/A9 requirements.

1.2.1.1.11 Advise AMC/A9 on future RTMP deployment strategies and options to ensure maximum flexibility, scalability, and performance.

1.2.1.2 Information System Security Manager (ISSM). The Contractor shall:

1.2.1.2.1 Utilizing RMF, begin and support an accreditation process for the WARNET.

Support updates and revisions to the accreditation as required due to WARNET expansion and/or architecture changes.

1.2.1.2.2 Perform all Endpoint Security Solutions (ESS) requirements including all testing, analysis, and documentation in adherence with the Certification and Accreditation (C&A) requirements RMF. In addition, daily information assurance monitoring, analysis and reporting are required.

1.2.1.2.3 Includes both testing and the validation of implemented program RMF Security controls.

1.2.1.2.3 Per Security control vulnerabilities found, ESS will recommend additional security controls for program personnel to implement in preparation for the re-test and correction validation.

1.2.1.2.4 Provide Incident Response Plan based on analysis from Host Based System Security (HBSS)/Splunk or other scans.

1.2.1.2.5 Ensure a major emphasis is placed on the ESS effort to standardize the security documentation and the engineering/security testing/auditing/intrusion detection functions.

1.2.1.2.6 Current security monitoring tools mandated by the Government for use are HBSS and Splunk. The Contractor shall be qualified in the use of current monitoring tools and shall be able to analyze the events from those tools to provide the Government with the true picture of risk or possible attack. Additional security tools may be made available in the future.

1.2.1.2.7 Shall understand Amazon Web Services (AWS) Cloud technologies, Virtual Machines (VM), Microsoft Windows operating systems, along with various flavors of UNIX/LINUX. Networking architecture, devices, technologies, and protocols as well as practical experience in firewalls, Virtual Private Networks (VPNs) and wireless technology, web server Apache, Oracle, SQL and as well as other Commercial Off-The Shelf (COTS) server products is important.

1.2.1.2.8 Provide expertise in the use of testing/auditing tools.

1.2.1.2.9 This expertise currently includes one or more of the following: Security Content

Automation Protocol (SCAP) Scanner; HP Fortify Static Code Analyzer; HP Web Inspect; and ACAS/Nessus Security Scanner.

1.2.1.2.10 Review weekly WARNET vulnerability scan result spreadsheets and send by email to the AMC/A9 Contracting Officer Representative (COR); process normally occurs on Monday’s (Tuesday, if Monday is a Federal Holiday).

1.2.1.2.11 Review enterprise Mission Assurance Support System (eMASS) weekly to ensure accuracy of WARNET vulnerability scan plan of action and milestones (POA&Ms) against the WARNET vulnerability scan result spreadsheets.

1.2.1.2.12 Upload results of WARNET vulnerability scans into eMASS.

1.2.1.2.13 Review/approve CAT I vulnerabilities or USCYBERCOM Information Assurance

Vulnerability Alerts (IAVAs), that will not be resolved within the 21-day suspense, in the AMC Vulnerability POA&M SharePoint site that AISS manages/coordinates for the AMC Programs.

1.2.1.2.14 Submit WARNET Interim Authority to Test (IATT) requests.

1.2.1.2.15 Coordinate with AMC/A9 to ensure a Fortify code scan is accomplished for each

WARNET release/minor modification.

1.2.1.2.16 Coordinate with AMC/A9 to ensure Security Technical Implementation Guide

(STIG) checklists are completed and validated for each release/minor modification.

1.2.1.2.17 Ensure completed STIG checklists are ingested into eMASS and POA&Ms are generated for any opening STIG findings and/or closed for each WARNET release/minor modification.

1.2.1.2.18 Review all WARNET STIG POA&Ms in eMASS to ensure current milestones and ECDs.

1.2.1.2.19 Stay abreast of the content of the DISA STIGs by maintaining a library of all relevant STIGs and the updates to the DISA STIGs.

1.2.1.2.20 STIG updates shall be communicated to the WARNET Program Management Office within three weeks of changes.

1.2.1.2.21 Review/sign minor modification checklist, when Fortify code scan and STIG validation is complete for each WARNET release.

1.2.1.2.22 Upload signed/approved minor modification checklist and supporting artifacts to eMASS for each WARNET release.

1.2.1.2.23 Upload signed/approved minor modification checklist and supporting artifacts to ITS for each WARNET release.

1.2.1.2.24 Upload the updated WARNET PPS spreadsheet to eMASS, as a supporting RMF artifact.

1.2.1.2.25 Review all WARNET RMF artifacts and seek AMC/A9, Government Program Manager approval/signature, before sending to ESS for upload to eMASS.

1.2.1.2.26 Review/approve test results and supporting artifacts for each applicable RMF assessment procedure in eMASS; approves the applicable assessment procedures, by approving the corresponding security control in eMASS.

1.2.1.2.27 When the ATO expiration is within 60 days, shall submit the RMF package in eMASS to the appropriate OPR (step 4) for their review and ATO approval;

ESS/ISSM uses the OPR’s RMF Artifact Rubric Grading document, as the official guidance for RMF submissions.

1.2.1.2.28 After the WARNET RMF package is submitted in eMASS to the appropriate OPR (step 4), the Contractor shall submit an “RMF-ATO submission checklist” in ITS, to officially notify the OPR that the DCBS RMF package has been submitted in eMASS for their review/approval.

1.2.1.2.29 Around the anniversary date, of the WARNET ATO, Coordinate with AMC/A9, to ensure WARNET RMF artifacts have been reviewed/updated and uploaded to eMASS; ISSM signs an annual review memo and updates “Security Review Date” in eMASS (FISMA) tab.

1.2.1.2.30 Coordinate with the AMC/A9 to accomplish the annual Contingency Plan (CP) exercise; ISSM uploads the CP exercise results memo and updates the “Contingency Plan Test Date” in eMASS (FISMA) tab.

1.2.1.2.31 Coordinate with ESS POC to accomplish the AMC systems semi-annual review Incident Response exercise; uploads the AMC systems semi-annual review Incident Response exercise memo to eMASS.

1.2.1.2.32 Investigate/create/submit possible WARNET Security POA&Ms to the appropriate OPR, AMC, and DISA Helpdesk as required.

1.2.1.2.33 Apply eMass inheritance security control packages for WARNET RMF.

1.2.1.2.34 Validate all WARNET controls in eMass to determine what controls are compliant and non-compliant.

1.2.1.2.35 Create/Update/Maintain all required WARNET RMF ATO documentation.

1.2.1.2.36 Assist the Government with RMF/Security documentation requested.

1.2.1.2.37 Validates and renew 3 Year renewal PIA document.

1.2.1.2.38 Provide WARNET Security and Documentation support.

1.2.1.2.39 Maintain and coordinate Ports, Protocols and Services documentation.

1.2.1.2.40 Validate Hardware and Software listings and apply them to STIG applicability matrix documents.

1.2.1.2.41 Attend and support all Configuration Control Board (CCB) related meetings and discussion to provide security feedback to all program development and deployment decisions.

1.2.1.2.42 Provide a monthly status report to the AMC/A9 COR detailing current work accomplished supporting the RMF process and the WARNET accreditation process.

The report shall also detail the current status of WARNET accreditation.

1.2.1.3 System Administration Support for SAP Cloud workload. The Contractor shall:

1.2.1.3.1 Support the configuration and maintenance of a combined AMC/A9 and AMC/A8Z virtual environment (workload) on the centrally managed MORPHEUS SAP cloud host. This environment will include specialized modeling and simulation software, to include AMP, ARM, AFSIM, and Command PE.

1.2.1.3.2 Ensure the environment meets all security and other requirements directed by the cloud hosting organization.

1.2.1.3.3 Ensure the environment supports all AMC/A9 modeling requirements. Provide recommendations for any changes or modifications to the environment.

1.2.2 The contractor shall provide a monthly status report to the AMC/A9 COR detailing current work accomplished supporting tasks specified in paragraphs 1.2.1.1, 1.2.1.2, and 1.2.1.3.

1.3 Deliverables. All deliverables shall meet professional standards and meet the requirements set forth in contractual documentation. Products and documentation delivered under this PWS become the property of the Government, with all intellectual property rights.

Table 1 – Data Deliverables

Data Item Number PWS Para. Deliverable Description

A001 1.2.1.2.10 Weekly WARNET Vulnerability Scan Report A002 1.2.1.2.42 Monthly RMF/WARNET Accreditation Status

Report A003 1.2.2 Monthly Status Report

1.4 General Information.

1.4.1 Personnel Maintenance. Contractor shall make every effort to maintain quality personnel to ensure continuity until contract completion. Contractor shall notify the COR within 24-hours of personnel resignation, reassignment, or termination. If it should become necessary to substitute or replace personnel, contractor shall provide satisfactory evidence (prior to the substitution or replacement of the personnel), such as a resume, to the COR that potential replacement personnel possess the required qualifications.

1.4.2 Place of Performance.

All tasks within this PWS will be executed on Scott AFB at the locations listed below:

HQ AMC Analyses, Assessments, and Lessons Learned Directorate (AMC/A9) Bldg. 1900W 1 Soldier Way, JDPAC Scott AFB, IL 62225

(AMC/A8Z) Bldg. 1906 (Huyser House) 103 W. Martin St.

Scott AFB, IL 62225

Note: Due to ongoing construction and expansion efforts in AMC, primary work locations may change during the contract.

1.4.3 Hours of Work. Typical core operating hours of AMC/A9 are 0730 - 1630 Central Time (which includes a lunch break), Monday through Friday, each week, excluding federal holidays.

All Federal Holidays observed consist of the following: New Year's Day, Martin Luther King Day, Presidents Day, Memorial Day, Juneteenth, Independence Day, Labor Day, Columbus Day, Veterans Day, Thanksgiving Day, and Christmas Day. If the holiday falls on a Saturday, it is observed on Friday. If the holiday falls on Sunday, it is observed on Monday. The Contractor shall ensure availability to perform contracted tasks during core operating hours.

The contractor shall ensure continuity of operations during periods of personnel turnover and long-term absences. Long-term absences are considered those longer than two weeks duration.

1.4.4 Travel. The contractor shall not be required to travel in performance of this PWS. If travel becomes necessary, a contract modification will be negotiated and executed.

1.5 Security. The contractor and all contractor personnel shall abide by all AF and local rules, procedures and standards of conduct. A Department of Defense Contract Security Classification Specification (DD Form 254) is required for access to classified material. The contractor shall also perform in accordance with (IAW) 32 CFR part 117.

1.5.1 Security Clearance. Contractors working on this contract will be required to access classified information up to the Top Secret (TS) level. All contractor personnel working on the contract are required to have a minimum of a Tier 5 Security Investigation and be currently enrolled in Continuous Vetting to perform work on this TO. Contractor personnel may have an

“interim TS” access security clearance and accepted by the Director/Commander within 30 calendar days of task order award. Contractors shall have final Top Secret access eligibility (AMC/SSO will request necessary upgrades to ICD 704 access eligibility as needed).

Contractors are required to have an ICD 704 access eligibility TS/SCI security clearance and the ability to be read into Special Access Programs (SAP) at the TS level to perform work on this contract. Classified work performed under this contract will be conducted in a secure environment. Once contractor’s security eligibility is verified, Government will give contractor access to applicable Government facilities from the commencement of the contract until completion. Some AMC missions are highly sensitive/limited need-to-know and occur with little or no notice. Contractor personnel shall comply with AMC, USTRANSCOM, 618 AOC, and installation commander security requirements. The contractor shall also complete visit requests for each individual that will be performing work on the contract in the Defense Counterintelligence Security Agency (DCSA) Defense Information System for Security (DISS) prior to performance start date. The prime contractor shall ensure that any teaming partners or subcontractors (if approved by the Government Contracting Activity) have the appropriate clearances prior to beginning performance. If the Contractor is notified by any Government official having security cognizance over the contract that an employee’s Security Clearance has been revoked or suspended, the Contractor shall notify the Government the same day as the Contractor receives the notice.

1.5.2 Access to Government Automated Information Systems. All contractor personnel provided government-furnished computer access shall observe DoD, USAF, AMC, and local Automated Information Systems (AIS) security policies and procedures as provided by the Information Assurance Officer (IAO) upon contract award. Violations of local AIS security policy, such as password sharing, performing personal work, file access violations, or browsing files outside the scope of the contract is prohibited.

1.5.3. Contractor Consent to Background Checks. Contractor shall not employ persons to perform under this TO if such employee is deemed or identified by Scott AFB as a potential threat to the health, safety, security, general well-being, or operational mission of the installation and its population, nor shall the contractor or subcontractor employ persons under this TO who have an outstanding criminal warrant as identified by DataMax through the National Crime Information Center. DataMax checks will verify if a person is wanted by local, state, and/or federal agencies. All contractor and subcontractor (if approved by the GCA) personnel shall consent to DataMax background checks. If contractor/subcontractor personnel who do not consent to DataMax check will be denied access to the installation. Information required to conduct DataMax check includes: full name, driver’s license number, and/or social security number, date of birth of the person entering the installation, and completion of a background check questionnaire. Contractor shall have this information ready to provide to the Scott Visitor Control Center, if requested.

1.5.4 Badges. Contractor is required to provide identification badges for their employees. All contractor personnel shall wear these badges while on duty on government site. Badges are required to identify the individual, company name, and be clearly and distinctly marked as contractor. Contractor’s identification badge will not be used as an entry requirement for installation entry or into any government designated controlled or restricted area.

1.5.5 Property Protection. Property protection for the facility where contractor’s primary work center is located will be the responsibility of the local facility manager and local government Security Manager, or their duly authorized representative IAW AFI 31-101, Integrated Defense, and command/local directives. Contractor shall safeguard all government-owned equipment and materials in his/her possession or use.

1.5.6 Safeguarding Unclassified and/or Controlled Unclassified Information (CUI).

Contractor shall meet Air Force standards for storing, processing, and handling controlled, unclassified information and systems, IAW DoDI 5200.48 and DAFI16-1403. In particular, the Contractor will not release any CUI outside of AMC without the written permission of the COR. Additionally, all resources (e.g. maps, publication/instructions, photos) provided by Government to assist contractor personnel in the performance of their contract will be surrendered upon termination of employment or the end of the contract performance period.

The Government will take reasonable steps, by controlled access and need-to-know procedures, to protect against public release of attribution information of the contractor. The Government may use and disclose reported information that includes attribution information only on a need-to-know basis to authorized persons for cyber security and related purposes (e.g., in support of forensic analysis, incident response, compromise or damage assessments, law enforcement, counterintelligence, threat reporting, and trend analysis). The Government may disclose attribution information to support contractors that are supporting the Government's cyber security and related activities if the support contractor is subject to legal confidentiality requirements that prevent any further use or disclosure of the attribution information. The Government agrees to consider available exemptions of the Freedom of Information Act to protect against disclosure of attribution information of the contractor to unauthorized persons.

Within a reasonable period, necessary to perform an analysis after completion of the assessment, all contractor proprietary information or third-party proprietary information in the possession of the Government as a result of the assessment will be destroyed unless other disposition is agreed upon in writing by the Parties or is required by law, Executive Order or regulation.

1.5.7 Privacy Act. Work on this project requires that personnel have access to personally identifiable information covered under the Privacy Act. Personnel shall adhere to the Privacy Act, Title 5 of the U.S. Code, Section 552a and applicable agency rules and regulations.

1.5.8 Contractor Working in Controlled or Restricted Areas. In the unlikely event that a contractor requires access to the controlled or restricted area and does not have the proper security clearance, the Government will ensure an escort(s) is provided for contractor at all times when within a controlled or restricted area. Based on AMC/A9 procedures, contractor may act as escort officials under certain circumstances. Contractor shall be issued an AF Form 1199, Air Force Entry Control Card, also known as line badge, and work on base a minimum of four days a week (shall have an assigned workspace on base). Contractor is only allowed to escort visitors from the same company for which he/she works, and all visits shall be for official business. In addition, contractor shall fulfill, maintain, and comply with all security requirements IAW AFI 31-101, Integrated Defense and command/local directives.

1.5.9 Access to Government Facilities with Controlled or Restricted Areas. Contractor shall comply with security regulations imposed by the installation commander and/or the agency responsible for the project location. Due to specific mission requirements inherent in controlled or restricted areas on Scott AFB, the Government may direct contractor to leave the controlled or restricted areas at any given time.

1.5.10 Access to Government Facilities with Controlled or Restricted Areas for Replacement Contractor. The following scenario (i.e., replacement contractor with an inadequate security clearance) is abnormal. The Government will ensure replacement contractors not initially possessing the proper clearances and requiring entry to controlled or restricted areas are escorted continuously. Replacement contractor shall submit paperwork within seven days of being assigned to obtain an approved security clearance or favorable review. Replacement contractor personnel shall obtain a security clearance prior to working with, or having direct access to, classified material. In addition, replacement contractor personnel shall obtain a “favorable review” prior to having access to a Controlled Area. The above information shall be submitted to 375 SFS/S5 or as directed by the Government.

1.5.11 Safeguarding Classified Information. This TO deals with classified information.

Contractor personnel shall meet Air Force standards for storing, processing, handling, and marking and derivative classification of classified information and systems. Additionally, all classified resources (e.g. maps, publication/instructions, photos) provided by the Government to assist Contractor personnel in the performance of this TO will be surrendered upon termination of employment or the end of the TO performance period. Contractor personnel shall not store any classified information at their company location or laptops.

Security support provided by the Air Force to the contractor to include storage containers for classified information/material, use of base destruction facilities, classified reproduction facilities, use of base classified mail services, security badging, base visitor control, investigation of security incidents, base traffic regulations, the use of security forms, and conducting inspections required by 32 CFR part 117, and AFI 16-1406, Air Force Industrial Security Program.

The Contractor shall coordinate required security support with the COR, including packaging classified information, mailing and receiving classified materials, implementing emergency procedures for protection of classified information, security checks, and internal security controls for protection of classified material and high value pilfer able property.

1.5.12 Non-Disclosure Agreements. In performance of this contract, the contractor may obtain access to sensitive, nonpublic information. The contractor agrees (a) to use and protect such information from unauthorized disclosure in accordance with the FAR; (b) to use and disclose such information only for the purpose of performing this contract and to not use or disclose such information for any personal or commercial purpose; (c) to obtain permission of the Government COR before disclosing/discussing such information with a third party; (d) to return, upon government request, any non-public, sensitive information no longer required for contractor performance; and (e) to advise the Government COR of any unauthorized release of such information. Upon request, the contractor shall have its employees assigned to this contract execute a non-disclosure agreement for delivery to the Government. The Government will require contractor personnel to sign a non-disclosure statement to protect non-public information of the Government (reference Appendix 4.1).

1.5.13 Data Rights. The Government will retain unlimited rights to all data and deliverables developed at government expense for this contract. Performance of this effort may require the contractor to access and use data that is propriety to a government agency or government contractor, which is of such a nature that its dissemination or use other than in performance of this effort would be averse to the interests of the Government and/or others. Thus, contractor personnel shall not divulge, or release data or information developed or obtained in performance of this effort until made public by the Government, except to authorize government personnel or upon written approval of the Contracting Officer (CO). Contractor shall not use, disclose, or reproduce proprietary data that bears a restrictive legend, other than as required in the performance of this effort.

1.5.14 Industrial Security Requirements. Contractor shall comply with DoD 5220.22, Volume 2;_AFMAN 16-1406, Volume 2; DoDM 5200.01, Volume 1; DAFMAN 16-1404, Volume 1; DoDM 5200.01, Volume 2;_AFMAN 16-1404, Volume 2; DoDM 5200.01, Volume 3; DAFMAN 16-1404, Volume 3; DoDM 8140, and the SCI Addendum. Facility and employee security clearances are obtained according to DoDM 5220.22, Volume 2; AFMAN 16-1406, Volume 2; DoDM 5200.02, and_DAFMAN 16-1405. This manual includes specific requirements for the handling of classified information, security clearance, control of areas, visitor control procedures, Sub-Contractors, vendors and suppliers, consultants, parent-subsidiary and multiple facility organizations, sensitive compartmented and Communications Security (COMSEC) information, overseas operations, security requirements for automated information systems, and operations security (OPSEC). This includes clearance procedures, visitors, and inspections.

1.5.15 Training. All personnel shall complete required training as prescribed IAW with the instructions listed in the above paragraphs. All required training can be found within MyLearning, https://lms-jets.cce.af.mil/moodle/ or training develop by the local Wing Information Protection Office. Antiterrorism (AT) Level I training is required by DODI

2000.16. Newly hired personnel shall complete the AT Level I training within the first 30 calendar days of their employment. Refresher AT Level I training shall be completed and documented annually thereafter.

1.5.16 Contractor Registration of Vehicles on Scott AFB. All contractor or contractor employees’ vehicles used for the performance of this contract shall comply with all local, state, and federal regulations. Additionally, any pass shall be surrendered to Security Forces upon demand to positively identify a person’s need to be on Scott AFB.

1.5.17 Safety Requirements. The Contractor shall comply with all safety provisions, e.g., technical specifications, technical publications, Federal Occupational Safety and Health Standards (Title 29 CFR Part 1910). If there is no applicable Occupational Safety and Health Administration (OSHA) standard, the Contractor shall use other applicable nationally or locally recognized sources of safety, health, and fire prevention standards.

1.6 Contractor Furnished Items and Services. Except for those items or services specifically https://lms-jets.cce.af.mil/moodle/ stated in Section 3 as government-furnished, contractor shall furnish everything needed to perform this contract.

1.7 Section 508 Compliance. All services and products provided in response to the requirements identified in this PWS shall comply with Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d), and the Architectural and Transportation Barriers Compliance Board Electronic and Information Technology (EIT) Accessibility Standards (36 CFR part 1194).

1.8 Contractor Manpower Reporting. In order to support the requirements of title 10, U.S.C., section 235 and 2330a, DoD contractors will report ALL contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract for AMC via the Service Contract Reporting (SCR) section of the System for Award Management (SAM) (http://sam.gov). Reporting inputs will be for the labor executed during the period of performance for each Government fiscal year (FY), which runs 1 October through 30 September. While inputs may be reported any time during the FY, all data shall be reported no later than 31 October of each calendar year. A DoD Guidebook for Service Contract Reporting in the SAM is available at https://dodprocurementtoolbox.com/site-pages/service-contract-reporting-scr. GSA has posted guidance at https://sam.gov, search the “HELP” section. Should contractors have issues using SAM, contact the Federal Service Desk at https://www.fsd.gov.

2.0 Services Summary (SS).

The Services Summary (SS) table below summarizes the most important performance objectives and thresholds (specific standards) as identified within the body of the PWS. The absence of any performance objective and threshold from this summary shall not detract from its enforceability or limit the Government’s rights or remedies afforded under this contract Metrics shall be calculated monthly unless otherwise specified.

Table 2 – Services Summary

Performance Objectives PWS Para. Performance Threshold

All VWC network (WARNET) systems (PCs, laptops, clusters, printers, and monitors) are operational.

1.2.1.1 95% of all systems are operational at all times.

Provide Weekly Vulnerability Scan Report.

1.2.1.2.10 Submitted no later than the 2nd

workday of the following week. No more than three late Weekly Vulnerability Scan Reports per 12-month period of performance.

Provide Monthly Status Report. 1.2.2 Submitted no later than the 10th workday of the following month. No more than one late Monthly Status Report per 12-month period of performance.

Provide Risk Management Framework/WARNET Accreditation Monthly Status Report.

1.2.1.2.42 Submitted no later than the 10th

workday of the month. No more than one late Monthly Status Report per 12-month period of performance.

Comply with all security regulations in working with classified data and systems.

1.2.1 No security violations (monthly).

Maintain Virtual Warfare Center RTMP capability.

1.2.1.1.10 RTMP capability is operational 95%

of the time.

Update Virtual Warfare Center environment.

1.2.1.1 All Virtual Warfare Center

workstations are updated to the current AMC/A9 baseline environment within two weeks of a new environment being established.

Maintain MORPHEUS cloud capability.

1.2.1.3 The AMC/A9 workload on the

MORPHEUS cloud is operational 95% of the time (excluding overall MORPHEUS down time).

Update MORPHEUS cloud. 1.2.1.3 The AMC/A9 workload on the MORPHEUS cloud is updated with current versions of all installed models within two weeks of new version release.

3.0 Government-Provided Property and Services.

3.1 Government-Provided Documentation. The Government will make available to the contractor the pertinent procedures, plans, and other documentation.

3.2 Government-Provided Hardware/Software. The Government will make available any computer hardware and/or software, special tools and/or test equipment required to fulfill the assigned requirements of this PWS and any associated work plan/schedule. Computer terminals and access to computer resources provided will be sufficient to enable the contractor to perform assigned tasks and meet all delivery schedules. The contractor shall, in addition to utilization of PCs, have access to computing and storage capabilities that are physically located in devices such as storage area networks, distributed processors, file/terminal services, routers, and hubs.

3.3 Government-Provided Facilities. The Government will provide office space, furniture, telephone service, office supplies, and materials to work on-site at AMC/A9, Building 1900W, Scott AFB, IL.

4.0 Appendices.

4.1 Non-Disclosure Agreement.

4.2 Historical Data.

APPENDIX 4.1

NON-DISCLOSURE AGREEMENT FOR CONTRACTOR EMPLOYEES

SUPPORTING AMC CONTRACTS

NOTE: This Non-Disclosure Agreement is an agreement designed for use by contractor (including subcontractor) employees assigned to work on AMC contracts. Its use is designed to protect non-public government information from disclosure and prevent violations of federal statutes/regulations. The restrictions contained in this agreement also serve contractors by promoting compliant behavior that keeps contractors eligible to compete for government contracts. In addition to the potential impact on future business opportunities, failure to abide by this agreement could result in administrative, civil or criminal penalties specified by statute or regulation.

"Non-public information," as used herein, includes trade secrets, confidential or proprietary business information (as defined for government employees in 18 USC 1905); advance procurement information (future requirements, acquisition strategies, statements of work, budget/program/planning data, etc.); source selection information (proposal rankings, source selection plans, contractor bid or proposal information); information protected by the Privacy Act (social security numbers, home addresses, etc.); sensitive information protected from release under the Freedom of Information Act (pre-decisional deliberations, litigation materials, privileged material, etc.); and information that has not been released to the general public and has not been authorized for such release (as defined for government employees in 5 CFR 2635.703).

1. I, currently an employee of , hereby agree to the terms and conditions set forth below:

2. I understand that I will have access to confidential business information (as defined by 18 USC 1905), contractor bid or proposal information (as defined by FAR 3.104-3), and/or source selection sensitive information (as defined by FAR 3.104-3) either for contract performance or as a result of working in an AMC facility or of working near AMC personnel, contractors, visitors, etc. I fully understand that such information is sensitive and shall be protected in accordance with 41 U.S. Code Section 423 and 18 U.S. Code Section 1905 and FAR Part 3. I also certify that I do not have any real or apparent conflicts of interest with respect to the information disclosed. If any potential conflicts of interest, real or otherwise, do present themselves, then I shall immediately disclose the pertinent information that may be a potential conflict to an agency ethics official who shall review the circumstances.

3. In the course of performing under contract/order # or some other contract or subcontract for the AMC I agree to:

Use only for government purpose any and all confidential business information, contractor bid or proposal information, and/or source selection sensitive information to which I am given access. I agree not to disclose "nonpublic information" by any means (in whole or in part, alone or in combination with other information, directly or indirectly or derivatively) to any person except to a U.S. government official with a need to know or to a non-government person (including, but not limited to, a person in my company, affiliated companies, subcontractors, etc.) who has a need to know related to the immediate contract/order, has executed a valid form of this non-disclosure agreement, and receives prior clearance by the contracting officer. All distribution of the documents will be controlled with the concurrence of the contracting officer.

a) Not use such information for any non-governmental purposes, including, but not limited to, the preparation of bids or proposals, or the development or execution of other business or commercial ventures.

b) Store the information in such a manner as to prevent inadvertent disclosure or releases to individuals who has not been authorized access to it.

4. I understand that I shall never make an unauthorized disclosure or use of confidential business information, contractor bid or proposal information, and/or source selection sensitive information unless:

a) The information has otherwise been made available without restriction to the Government, to a competing contractor, or to the public;

b) The contracting officer determines that such information is not subject to protection from release.

5. I agree that I shall not seek access to "non-public information" beyond what is required for the performance of the services I am contracted to perform. I agree that when I seek access to such information or attend meetings or communicate with other parties about such information, I will identify myself as a contractor. Should I become aware of any improper or unintentional release or disclosure of "non-public information," I will immediately report it to the contracting officer in writing. I agree that I will return all forms (including copies or reproduction of original documents) of any "non-public information" provided to me by the Government for use in performing my duties to the control of the Government when my duties no longer require this information. By signing below, I certify that I have read and understand the terms of this Non- Disclosure Agreement and voluntarily agree to be bound by its terms.

Signature of Employee/ Date

Printed Employee Name

Signature of Company Official/ Date

Printed Company Official Name