Atch 3-FSS PWS.docx

PERFORMANCE WORK STATEMENT (PWS)

8 SEPTEMBER 2020

FORWARD SUPPLY SYSTEM (FSS) SPARES LEVELING

At Scott Air Force Base (AFB), Illinois

1.0. DESCRIPTION OF SERVICES

1.1. SCOPE OF WORK

The United States Air Force’s (USAF) Air Mobility Command (AMC) requires ongoing information technology (IT), engineering, advisory, and assistance services (A&AS) for specific analytic support for the unique issues associated with the strategic airlift supply chain. The scope of this tasking and the resulting contract encompasses all activities necessary for the Contractor to provide specific analytic support required to identify and resolve supply chain issues impacting AMC strategic airlift. Any necessary business rule and system changes must be implemented in the Air Force standard leveling tools prior to the next quarterly leveling cycle, following identification of the required change.

1.2. SYSTEM USAGE

In order to validate and compare operational effectiveness of support, and ensure computations are in line with the future vision of AMC Logistics, the Contractor shall be utilizing, modifying, and enhancing the following Air Force standard leveling tools, with no option to use other tools:

Customer Oriented Level Technique (COLT) Readiness Based Leveling (RBL) Aircraft Sustainability Model (ASM)

1.3. SPECIFIC TASKS

The Contractor will be required to perform the following tasks:

1.3.1. TASK 1 - OPERATE THE FORWARD SUPPLY SYSTEM (FSS) CANDIDATE DETERMINATION SYSTEM The Contractor shall operate the program for Forward Supply Location (FSL) candidate determination (Demand and Candidate Program, (DaCP)) on a quarterly basis. The purpose of the FSL candidate determination is twofold. First, it is to provide a list of stock numbers to the leveling tools—COLT and RBL—that are determined to be “FSL candidates”. Those are the National Stock Numbers (NSNs) that will receive the special FSL leveling logic. The second purpose is to provide demand information to the leveling tools so that they can determine what percentages of demands are for the FSS and what are for the host base.

1.3.1.1. The Contractor shall extract data directly from the AF Supply Central Database (AFSCDB), or its US Air Force-approved successor, based upon AMC-approved logic. Both the number of customer demands and quantity demanded will be collected by C-5, C-17, and any other user. The extracted FSL demand history data file will be provided in the established file format.

1.3.1.2. The Contractor shall use the FSL demand history file to create a Candidate Review File in Microsoft (MS) Excel using the DaCP. That review file contains a list of NSNs and demands for AMC review.

1.3.1.3. The Contractor shall coordinate the review file with users (HQ AMC, Air Force Sustainment Center’s 435th Supply Chain Operations Squadron, and Contractor Inventory Control Points (ICPs) (including Boeing and Lockheed Martin), and assist those users in understanding and using the review file.

1.3.1.4. The Contractor shall process the reviewed & coordinated results in the DaCP software and update the DaCP, making manual changes for errors, problems, and last-minute changes. ASM, or ASM-based techniques, will be used to evaluate the impact of DaCP logic changes.

1.3.1.5. The Contractor shall provide demand information to the leveling models (COLT and RBL) in the Air Force Materiel Command (AFMC)-approved format so that they can determine what percentages of demands are for the FSS and what are for the host base.

1.3.2. TASK 2 – OPERATE COLT FSS PRE-PROCESSOR

Contractor shall operate the COLT FSS Pre-Processing computation to compute FSS levels using dedicated FSS-logic and feed these levels into the Primary COLT tool as starting values. The COLT FSS Pre-Processor must be run according to the official Air Force-approved COLT run schedule, using the COLT input files provided by the Air Force COLT Team, and in conjunction with the quarterly COLT run for the en route locations.

1.3.3. TASK 3 – REVIEW COLT AND RBL OUTPUT

The Contractor shall review both COLT and RBL output to ensure accuracy and mission feasibility of the FSS. The Contractor shall provide thorough quarterly reviews/investigations of the computed FSL levels during the RBL/COLT analyst review of results period and prior to the official Major Command (MAJCOM) RBL/COLT review of global spares levels (not just the FSS). This will provide sufficient time to resolve any issues/problems prior to the official push of levels. The Contractor will verify that the FSL logic within both models is working as intended and run model excursions to verify the cause of item level changes. The Contractor will work with the USAF-level RBL/COLT teams to assist AMC in resolving any issues/problems impacting maintenance and operational capability. The Contractor shall provide a written summary of both the COLT and RBL quarterly reviews.

1.3.4. TASK 4 – MAINTAIN THE FSS PROGRAMS

When required changes to the RBL and/or COLT FSS pre-processing logic are identified 4 weeks, or more, prior to the next quarterly run date of either the RBL or the COLT tool, the Contractor shall work with the RBL and/or COLT programmers to ensure all required changes are completed, tested, and implemented prior to the next run date of both Air Force leveling systems. When required changes to the RBL and/or COLT FSS pre-processing logic are identified within 4 weeks of the next quarterly run date of either Air Force leveling system, the Contractor will work with the RBL and/or COLT programmers to ensure all required changes are completed, tested, and implemented prior to the following quarterly run date of the respective Air Force leveling system. The Contractor shall also maintain the programs for FSL candidate determination. These include the data extraction programs and the DaCP. The Contractor shall ensure that all changes to selection criteria, including Stock Record Account Number (SRAN) changes and organizational changes, from the AFSCDB are accommodated. These types of changes are common. The Contractor shall also ensure that programs are kept up-to-date and operational for regular runs and out-of-cycle runs. Changes to the logic in the data extraction and DaCP will be required on a quarterly basis in response to mission and operational changes required by HQ AMC/A4 or HQ USAF/A4. The Contractor shall complete, test, and implement any updates to the programs four weeks prior to the run date of the Air Force leveling systems for all changes requested and approved by AMC AND the Air-Force. ASM, or ASM-based techniques, will be used to evaluate the effectiveness of FSS program maintenance. The Contractor shall include a summary of all changes in the monthly status report (MSR).

1.3.5. TASK 5 – ADDITIONAL STUDIES TO ENHANCE THE FSL LEVELING CONCEPT

The Contractor shall perform studies in support of the FSLs, including monthly mission capable (MICAP) analyses and yearly FSL category reviews in the form of written reports in MS Word format. ASM, or ASM-based techniques, will be used to evaluate the mission impact of FSS program and logic changes.

1.3.6. TASK 6 – ADDITIONAL SHORT-TERM ANALYSIS TASKS

The Contractor shall assist with analysis tasks in support of AMC peacetime and wartime requirements/levels and operations. Analysis results must provide actionable recommendations on new stock levels formed in official USAF logistics systems and spares computation models; for example, inventory cost changes computed in COLT or RBL. Analysis reports must be provided within 48 hours when required by the COR. The anticipated occurrence of these tasks is between three and nine times per year, however the government, at its own discretion, may require more or less of these tasks but will not exceed 12 times per year. ASM, or ASM-based techniques, will be used to assess mission impacts from changes in Readiness Spares Package availability and in the formation of recommendation of new stock levels.

1.3.7. TASK 7 – MONTHLY STATUS REPORTS (MSR)

The Contractor shall provide a MSR of all activities performed in the previous month. The MSR shall include the summary of changes (see para 1.3.4). The report is due within fifteen (15) working days after the end of each month.

1.3.8. Contractor Quality Control Plan (QCP)

The Contractor shall submit a QCP within ten (10) business days of contract award to the Contracting Officer Representative (COR). This plan shall describe the Contractor’s methodology of compliance with the Deliverables and Performance Requirements Summary outlined above. If the COR does not concur with the submitted QCP the Contractor shall provide a revised QCP within five (5) business days.

1.4. SERVICES SUMMARY (SS)

The SS table below summarizes the most important performance objectives and performance thresholds (specific standards) as identified within the body of the PWS. The absence of any performance objective and threshold from this SS shall not detract from its enforceability nor limit the rights or remedies of the government under any provision of the contract.

Table 1: Services Summary

Table 2: Data Deliverables

2.0. ITEMS INCIDENTAL TO THE PLACE OF PERFORMANCEThe government shall make available to the Contractor employee working in a government facility, a workspace, desk and telephone for local calls.

3.0. GENERAL INFORMATION

3.1. PLACES OF PERFORMANCE

The Contractor shall perform the work at Scott AFB, IL or any designated location required by the COR. Permission to work at an alternate site, including telework, must be approved in writing by the COR prior to working off-site. As needed, consultants may be allowed or requested to work from home or Contractor provided facilities using a government furnished laptop or a Contractor provided laptop as appropriate with approval of the COR.

3.2. PERIOD OF PERFORMANCE

The period or performance will include a base year and two option years.

3.3. Personnel Requirements: The Contractor is responsible for determining the resources required to accomplish the tasks and deliverables that will meet the performance requirements.

3.4. Restrictions on Employee Activity. The distinct and separate nature of the government-Contractor relationship must be maintained during the performance of this contract. The Contractor shall restrict its activities as follows:

3.4.1. Contractor employees shall conduct only business covered by this contract while on government premises.

3.4.2. Contractor employees, while performing contract tasks, shall not solicit new business from the government.

3.4.3. Contractor business cards, letterhead, stationary, email signatures and any other identifying products shall not in any way imply employment or legal affiliation with the U.S. Government, Department of Defense, US Air Force or any other government component.

3.4.4. Neither the Contractor nor any Contractor employees shall use government stationary or any form of representation of government affiliation.

3.4.5. Neither the Contractor nor any Contractor employees shall in any way represent, either orally or in writing, that they are employees or agents of the government or have any authority to act on the government’s behalf, either orally or in writing.

3.4.6. Antiterrorism Force Protection Level I Training.

Within 30 calendar days after contract start, all Contractor personnel shall complete Antiterrorism Level I Training, as required by DODI 2000.16. Newly hired personnel shall complete the Antiterrorism Level I Training within the first 30 calendar days of their employment. Refresher Antiterrorism Level I Training shall be completed and documented annually thereafter. The training is provided at https://atlevel1.dtic.mil/at/ and also available through Advanced Distributed Learning Services (ADLS), Force Protection Course (ZZ133079) at https://golearn.csd.disa.mil/kc/main/kc_frame.asp for AF Portal access or https://golearn.csd.disa.mil/kc/login/login.asp for non-portal login.

3.4.7. Information Assurance.

Contractor shall comply with all AMC security requirements pursuant to DoDD 5200.2, Personnel Security Program, DoDI 8500.2 Information Assurance Implementation, and DoD 8570.01-M; Information Assurance Workforce Improvement Program. Contractor shall ensure that all personnel assigned to work on the contract shall complete Annual Information Assurance training by on-line Computer Based Training (CBT). The Contractor shall provide individual employee annual completion certificates in electronic format to the COR.

3.4.8. Contractor Consent to Background Checks.

The Contractor and, as applicable, subContractor will not employ persons for work on this contract if such employee is identified as a potential threat to the health, safety, security, general well-being or operational mission of the installation and its population, nor will the Contractor or subContractor employ persons under this contract who have an outstanding criminal warrant as identified by Law Enforcement Agency Data System (LEADS) through the National Crime Information Center. LEADS checks will verify if a person is wanted by local, state, and federal agencies. All Contractor and subContractor personnel will consent to LEADS background checks. Contractor and subContractor personnel who do not consent to an LEADS check will be denied access to the installation. Information required to conduct an LEADS check includes: full name, driver’s license number, and/or social security number, date of birth of the person entering the installation, and completion of a background check questionnaire. The Contractor will provide this information using the Scott AFB Form 21, Contractors Consent for Background Check, and will submit it in conjunction with the Contractor’s request for either base or vehicle passes. The COR will coordinate vendor access at the backup SEP site location. Completion of a successful LEADS check does not invalidate the requirement for an escort when Contractor or Subcontractor personnel are working within controlled or restricted areas.

3.7.1. Requirements for Contractor Provision of Security Plan, Information Assurance Controls.

The Contractor shall establish an Information Assurance Program to implement and sustain appropriate Information Assurance management, operational, and technical controls and processes required to safeguard Department of Defense (DOD) non-public information resident on or transiting the Contractor's unclassified information systems from unauthorized access and disclosure. Protection measures applied must be commensurate with the risks (i.e. consequences and their probability) of loss, misuse, unauthorized access, or modification of information. The Contractor shall submit for government approval an overarching security plan that describes their strategy for implementation of Information Assurance and Industrial Security requirements throughout the life of the contract. The security plan shall address the security controls described in National Institute of Standards & Technology (NIST) Special Publication 800-53 (current version), Recommended Security Controls for Federal Information Systems and Organizations (http://csrc.mist.gov/publications/PubsSPs.html), and should be tailored in scope and depth appropriate to the effort and the specific unclassified DOD information.

3.7.2. Periodic Government Inspections.

The Contractor shall authorize government inspections and reviews to assure compliance with DOD Information Assurance requirements throughout the contract performance period. The Contractor shall be responsible for taking corrective action based upon the impact and severity of identified weaknesses.

3.7.3. Remote Access.

Contractor Furnished Equipment (CFE) employed for remote access to a government network must meet equivalent Government Furnished Equipment (GFE) Information Assurance computing requirements. The Contractor shall ensure that all CFE (hardware and software) employed to access these environments meet the following minimum Government Information Assurance requirements and provide periodic certification of compliance as a pre-requisite to being granted network access.

(a) Use of personal systems is prohibited;

(b) Operating systems and applications must be configured for compliance with the DISA Gold Disk and applicable Security Technical Implementation Guides (STIGs);

(c) DOD approved anti-virus and anti-spyware software must be installed and signatures must be configured to automatically update on a daily basis;

(d) DOD approved personal firewall must be utilized and configured to permit traffic by exception only, dropping all other traffic. If the personal firewall provides intrusion detection or prevention, the signatures or rules must be updated at the same intervals as the anti-virus software.

(e) Computers must be Information Assurance Vulnerability Management (IAVM) compliant;

(f) Computers must be scanned with the DOD version of E-eye Retina vulnerability scanner (or current approved DOD scanner solution) at a minimum of every 30 days. All vulnerabilities must be remediated and reported to the cognizant Information Assurance Manager;

(g) Contractor employees must possess a current government issued Common Access Card (CAC) and install government certified CAC readers; and

(h) Verification of compliance with these requirements must be provided to an appointed government representative on a monthly basis.

3.7.4. Detect, Analyze, Respond.

3.7.4.1. Reporting Requirements.

The Contractor shall report to the United States Transportation Command (USTRANSCOM) Technical Information Analysis Center (TIAC) and USTRANSCOM designated government personnel within 4 hours of discovery of any suspected cyber intrusion events that affect DOD information resident on or transiting the Contractor's unclassified information systems. Initial report shall be provided even if some details are not yet available, with follow-on detailed reporting within 24 hours. Reportable cyber intrusion events include the following:

(a) A cyber intrusion event appearing to be an advanced persistent threat;

(b) A cyber intrusion event involving data exfiltration or manipulation or other loss of any DOD information resident on or transiting the Contractor's, or its subContractors', unclassified information systems;

(c) Intrusion activities that allow unauthorized access to an unclassified information system on which DOD information is resident or transiting.

Definition of advanced persistent threat: An extremely proficient, patient, determined, and capable adversary, including two or more of such adversaries working together.

3.7.4.2. Incident Report Content.

The incident report shall include, at a minimum, the following information:

(a) Applicable dates (date of suspected compromise and date of discovery);

(b) Threat methodology (all known resources used such as Internet Protocol (IP) addresses, domain names, copies malware, etc.);

(c) An account of what actions the threat(s) may have taken on the victim system/network and what information may have been accessed;

(d) A description of the roles and functions of the threat-accessed system;

(e) An initial list of potentially impacted government programs and each program’s classification;

(f) What information may have been exfiltrated that may impact government programs.

(g) A list of all employees and subcontracted employees who work or have worked with the victim system/network; (h) A point of contact to coordinate damage assessment activities.

3.7.4.3. Incident Report Submission.

The Contractor will submit unclassified network cyber incident reports to the USTRANSCOM TIAC and USTRANSCOM designated government personnel via encrypted email or another mutually agreed upon secure communications method. Copies of malware require special handling and pre-coordination must be accomplished prior to submission.

3.7.4.4. Incident Response Coordination.

In the event of a known or potential intrusion, the Contractor agrees to allow follow-on actions by the government to further characterize and evaluate the suspect activity. The Contractor acknowledges that damage assessments may be necessary to ascertain intruder methodology and identify systems compromised as a result of the intrusion. Company acknowledges that in certain cases a complete forensic analysis may be necessary to ascertain intruder methodology and identify systems compromised as a result of the intrusion. Once an intrusion is identified, the company agrees to take all reasonable and appropriate steps to preserve any and all evidence, information, data, logs, electronic files and similar type information reference NIST Special Publication 800-61: Computer Security Incident Handling Guide, (current version) related to the intrusion for subsequent forensic analysis so that an accurate and complete damage assessment can be accomplished by the government. The Contractor is not required to maintain an organic forensic capability, but must ensure data is preserved until forensic analysis can be performed by the government (e.g. removing an affected system, while still powered on, from the network meets the intent of this requirement). Any follow-on actions shall be coordinated with the Contractor via the COR.

3.7.5. Law Enforcement/Counterintelligence.

In the event of a known or potential intrusion, the Contractor shall consent to responding counterintelligence or law enforcement investigative agency requests to apply forensic analysis tools to Contractor information systems affected by the intrusion, including monitoring tools, imaging tools, and any other techniques that the agency seeks to apply to effectively analyze the intrusion. The Contractor shall allow the responding counterintelligence and/or law enforcement investigative agency to image affected systems, including systems containing proprietary information. Nothing in this contract shall limit the ability to conduct law enforcement or counterintelligence activities, or other activities in the interest of the government.

3.7.6. Information Sharing.

The government may use and disclose reported information (e.g., information regarding threats, vulnerabilities, incidents, or best practices) that does not include attribution information at its discretion to assist entities in protecting information or information systems (e.g. threat information products, threat assessment reports); provided that such use or disclosure is otherwise authorized in accordance with applicable statutes, regulations, and policies.

3.7.7. Confidentiality and Non-Attribution Statement.

The government shall take reasonable steps, by controlled access and need-to-know procedures, to protect against public release of attribution information of the Contractor. The government may use and disclose reported information that includes attribution information only on a need-to-know basis to authorized persons for cyber security and related purposes (e.g., in support of forensic analysis, incident response, compromise or damage assessments, law enforcement, counter intelligence, threat reporting, and trend analysis). The government may disclose attribution information to support Contractors that are supporting the government's cyber security and related activities if the support Contractor is subject to legal confidentiality requirements that prevent any further use or disclosure of the attribution information. The government agrees to consider available exemptions of the Freedom of Information Act to protect against disclosure of attribution information of the Contractor to unauthorized persons. Within a reasonable period necessary to perform an analysis after completion of the assessment, all Contractor proprietary information or third party proprietary information in the possession of the government as a result of the assessment will be destroyed unless other disposition is agreed upon in writing by the Parties or is required by law, Executive Order or regulation.

3.7.8. Information Assurance Training.

Contract employees physically assigned to USTRANSCOM at Scott AFB (SAFB) shall attend/complete security training as prescribed by DOD and USTRANSCOM instructions. At a minimum this includes: Employee Initial Security Training, Annual Security Awareness Training, Operations Security (OPSEC), DOD Antiterrorism Level 1 Training, Personally Identifiable Information (PII) Training and any Security Stand Down Day Training scheduled by the Commander. Contract employees assigned elsewhere shall attend security training established by their respective government security offices and/or installations.

3.7.9. Information Assurance Workforce Improvement Program (IAWIP).

Information Assurance Contractor Training and Certification (JAN 2008)

(a) The Contractor shall ensure that personnel accessing information systems have the proper and current information assurance certification to perform information assurance functions in accordance with DOD 8570.01-M, IAWIP. The Contractor shall meet the applicable information assurance certification requirements, including –

(1) DOD-approved information assurance workforce certifications appropriate for each category and level as listed in the current version of DOD 8570.01-M; and

(2) Appropriate operating system certification for information assurance technical positions as required by DOD 8570.01-M.

(b) Upon request by the government, the Contractor shall provide documentation supporting the information assurance certification status of personnel performing information assurance functions.

(c) Contractor personnel who do not have proper and current certifications shall be denied access to DOD information systems for the purpose of performing information assurance functions.

3.18. Other days of Installation Closure. When the Installation Commander closes the installation for any reason, including but not limited to days of inclement weather, the Contractor will not be granted access to the installation on those days.

3.19. Personnel Replacement. Key personnel are defined as the skilled, experienced, professional and/or technical personnel that are essential for successful accomplishment of the work to be performed and of whose resumes were to be submitted as part of the technical proposal for evaluation purposes. The Contractor shall provide a list of “key personnel” to the COR and shall not remove, replace, or supplement with additional personnel the “key personnel” without prior written approval of the COR. All Contractor requests for key personnel substitution shall be in writing and shall provide for a detailed explanation of the circumstances necessitating the proposed substitution(s). Requests shall contain a complete resume for the proposed substitute and any other information as requested by the COR. Proposed substitutions shall have qualifications that are equal to or greater than the key personnel being replaced. This provision shall be fully applicable to any subcontract, at any tier, which the prime Contractor may enter into.

3.20. Personal Services/Inherently Governmental Functions Prohibited.

The government will neither supervise Contractor employees nor control the method by which the Contractor performs the required tasks. Under no circumstances shall the government assign tasks to, or prepare work schedules for, individual Contractor employees. It shall be the responsibility of the Contractor to manage its employees and to guard against any actions that are of the nature of personal services, or give the perception of personal services. If the Contractor feels that any actions constitute, or are perceived to constitute personal services, it shall be the Contractor’s responsibility to notify the [COR, CO] immediately. These services shall not be used to perform work of a policy/decision making or management nature, (e.g., inherently governmental functions). All executive decisions relative to programs supported by the Contractor shall be the sole responsibility of the government.

4.4. Electronic Contractor Manpower Reporting (eCMRA)

The contractor shall report ALL contractor labor hours (including subcontractor labor hours) as required and when directed by the Contracting Officer in writing, the contractor shall report all contractor labor hours (including subcontractor labor hours) required for performance of services provided under each task order (for example) via a secure data collection site.

5.0. APPENDICES

APPENDIX 5.1.

PWS ABBREVIATIONS

ADLS – Advanced Distributed Learning Services AFB – Air Force Base AFMC - Air Force Materiel Command AFSCDB – Air-Force Supply Central Database AMC – Air Mobility Command CAC – Common Access Card CBT – Computer Based Training CDRL – Contract Data Requirement List CFE – Contractor Furnished Equipment COLT – Customer Oriented Level Technique CO – Contract Officer COR – Contracting Officers Representative DaCP – Demand and Candidate Program DID – Data Item Description DOD – Department of Defense eCMRA – Electronic Contractor Manpower Reporting (eCMRA) FSL – Forward Supply Location FSS – Forward Supply System GFE – Government Furnished Equipment IAVM – Information Assurance Vulnerabilty Management IAW – In accordance with IAWIP – Information Assurance Workforce Improvement Program ICPs – Inventory Control Points IP – Internet Protocol LEADS – Law Enforcement Agency Data System MAJCOM – Major Command MICAP – Mission Capable MS – Microsoft MSR – Monthly Status Report NIST – National Institute of Standards & Technology NSNs – National Stock Numbers OPSEC – Operations Security PII – Personally Identifiable Information PM – Program Manager PWS – Performance Work Statement QCP – Quality Control Plan RBL – Readiness Based Leveling SRAN – Stock Record Account Numbers STIGS – Security Technical Implementation TIAC – Technical Information Analysis Center USAF – United States Air Force USTRANSCOM – United States Transportation Command

APPENDIX 5.2.

HISTORICAL DATA

The following depicts a snap shot of the number of hours expended for annual performance of this effort. This is not intended to dictate the number of hours that an offeror should quote and is only offered for representational purposes. The government assumes no liability for the accuracy of this data as it relates to future efforts. The Contractor is solely responsible for determining its own costs to successfully perform under this Fixed Price effort.

HQ AMC/A4 Supply Chain Analysis Historical Data