Attach 1 - CRN SOW 28BW 16 Apr 26.pdf

STATEMENT OF WORK (SOW)

FOR THE

Ellsworth AFB Integrated Base Defense

Establishment of a Closed Restricted Network to Support the Electronic

Security System

April 16, 2026

Table of Contents

1. Introduction

1.1 Existing Conditions

1.2 Description of Need

2 Technical Requirements

2.1 Closed Restricted Network

2.2 IBDSS CRN Design

2.3 CRN Design Documents

2.4 Network Architecture Design

2.5 Network Services

2.6 Security and Compliance

2.7 Enclosures

2.8 Network Power

2.9 Installation Expectations

2.10 Industry Standards

3 Implementation and Testing Procedures

3.1 Meeting Expectations

3.2 Site Surveys, Analysis, and Reports

3.3 Installation Design Package

3.4 Project Support Agreement

3.5 Government Approval

3.6 Cutover and Transition Plan

3.7 Testing and Evaluation

3.8 Equipment and Components

3.9 Training

4 Security Requirements

4.1 Cybersecurity Requirements

4.2 System Security

5 Installation Requirements

5.1 Regulatory Compliance

5.2 CAC Requirements

5.3 Physical Access Control

5.4 Installation Access

5.5 Entry Access Letter

5.6 Restricted Area/Access Coordination

5.7 Vehicle and Licensing Requirements

5.8 Reporting Requirements

5.9 OPSEC Compliance

6. Regulatory Compliance and Property Management

6.1 Regulatory Compliance

7. Contract Management and Support

7.1 Program Management

7.2 System Engineering

7.3 Hazardous Conditions

7.4 Contractor Employees

7.5 Contract Manager

7.6 Removal of Contractor Employees

8. Government Furnished Properties and Services

8.1 Utilities and workspace

8.2 Telephones

9. Inspection/Acceptance

10. Work Schedule & Location

10.1 Work Location

10.2 Temporary Work Stoppage

10.3 Hours of Service

10.4 U.S. Recognized Holidays

10.5 Down Days

11. Warranty

12. Contract Deliverables

12.1 Written Approval

12.2 Post installation closeout

12.3 Electronic Formats

13. Glossary of Terms

1. Introduction

1.1. Existing Condition

1.1.1 The base-wide Integrated Base Defense Security Systems (IBDSS) is currently operating on the base NIPR network. The current connections are in secure communications rooms and have AC power and back-up power available through Uninterruptable Power Supplies (UPS) and emergency generators. The current IBDSS network resides on approximately fifty-five network switches with an additional thirty-five scheduled to be replaced in FY 2026. The IBDSS field panels connected those switches route to four Nodes which then connect to the Core Switch in the Base Defense Operations Center facility and are duplicated with a redundant connection to the Alternate Base Defense Operations Center.

1.2. Description of Need

1.2.1 The objective of this Statement of Work is to provide a new Closed Restricted Network (CRN) to support base wide IBDSS operations. The contractor shall collaborate with the 28 BW/CS and 28 BW/SFS to transition from the current IBDSS, which uses NIPRNET as its transport, to the new Ethernet-based CRN and new IBDSS head-end services. The contractor shall maintain the existing NIPRNET supported IBDSS concurrently while the new network and IBDSS head-end services are implemented. This includes several legacy buildings as well as new buildings under construction, which are subject to change based on their beneficial occupancy date (BOD). The contractor shall ensure the network is expandable under future contract actions to support facilities that are not yet constructed. Throughout the contract period, the contractor shall be responsible for the complete operations and maintenance (O&M) of the CRN as it’s being implemented. These responsibilities include troubleshooting and resolving all CRN issues, including but not limited to routing problems, physical connectivity faults, and failures of switch or router hardware and software. Upon conclusion of the contract, the contractor is required to prepare a comprehensive turnover package and provide it to 28 BW. This package will contain all network credentials, documentation, licenses, keys, users, groups, passwords and other materials necessary for seamless network management. The contractor shall facilitate a 2-week training period with the incoming network managers to ensure a smooth handover of O&M responsibilities.

1.2.2 Building Priority Listing and Facility Status. The contractor shall cut over are the 54+ legacy locations and 9 new facilities in construction, with IBDSS connections, to the new CRN. A list of impacted facilities shall be provided to the contractor prior to contract performance. All new buildings shall enter a Beneficial Occupancy Date (BOD) to be accepted by the government. There may be slips in the construction BOD date that could delay cutover to the network. The Government shall coordinate impacted facilities with the contractor as they occur.

1.2.3 The list of facilities is based on government data at the issuance of solicitation;

additional buildings may be added depending on government Beneficial Occupancy Dates (BODs). Additional work associated with these changes shall be completed by contract modification.

1.2.4 The contractor shall plan, procure, and install a CRN to support IBDSS as described in this SOW. All equipment listed in the SOW must be compliant with SRD-

3.7.2.1 Network Equipment: IAW DODI 8100.04, DoD Unified Capabilities, the network communications equipment shall be approved by Defense Information Systems Agency (DISA) and listed on the DISA Approved Product List Integrated Tracking System (APLITS). All network components shall comply with applicable DoD cybersecurity policies including RMF, DISA STIGs, and Airforce Network security guidance. This is in addition to TAA compliance requirements. The contractor shall procure and install CISCO network equipment and products as necessary in support of this network. Product substitutions shall not be permitted, unless authorized by the 28 BW/CS and 28 BW/SFS. During the cutover process, if the contractor must replace current equipment to comply with this requirement, the contractor shall notify the 28 BW/CS and 28 BW/SFS and provide a list of current/proposed switches, equipment, etc. before the contractor replaces the equipment.

1.2.5 The contractor shall follow AFI 17-101 Risk Management Framework (RMF) for Air Force Information Technology, and AF SIS (v2.0 / 19 Jan 2022)- Air Force Standalone Information Systems (SIS) / Closed Restricted Network (CRN) assessment & authorization Tactics, Techniques and Procedural Assessment Guides to gain authorization for use. Per DoDI 8510.01, DoD systems (e.g., weapons systems, stand-alone systems, control systems, or any other type of systems with digital capabilities) must receive and maintain a valid authorization before beginning operations. Refer to the RMF KS for additional guidance on authorizations.

2. Technical Requirements

2.1 The contractor shall deliver a CRN that adheres to, but is not limited to, the guidance listed below in Paragraph 2.2. All technical requirements must follow these regulations starting in the design phase through to the final CRN.

2.2 IBDSS CRN Design: The IBDSS CRN shall be designed IAW SRD para's, 3.7.2 -

3.7.2.19 (with the exception of 3.7.2.3). to the following standards and criteria:

2.2.1 UFGS 25 05 11 Cybersecurity for Facility-Related Control Systems

2.2.2 UFGS 26 20 00 Interior Distribution Systems

2.2.3 UFGS 27 10 00 Building Telecommunications Cabling System

2.2.4 UFGS 28 08 10 Electronic Security System Acceptance Testing

2.2.5 UFGS 28 10 05 Electronic Security Systems (IBDSS)

2.2.6 AFI 17-101 Risk Management Framework (RMF) for Air Force Information Technology

2.2.7 DAFMAN 17-1304 Identity, Credential, and Access Management

2.2.8 AFBAN-FS-2021 Air Force Area Network Functional Specification

2.2.9 DAFMAN 17-1305 DAF Cyberspace Workforce Management Program

2.2.10 ESE-SIT-0001, Standardized Electronic Security Equipment, Siting and Design Guidance for Permanent Installations, Air Force Life Cycle Management Center (LCMC)

2.2.11 UFC 4-010-06 Cybersecurity of Facility Related Control Systems

2.2.12 DoDI 8530 Cybersecurity Activities Support to DoD Information Network Operations

2.2.13 System Requirements Document (SRD) For the IBDSS Next Security System Installation & Sustainment Project

2.2.14 AF SIS (v2.0 / 19 Jan 2022)- Air Force Standalone Information Systems (SIS) / Closed Restricted Network (CRN) assessment & authorization Tactics, Techniques and Procedural Assessment Guides

2.2.15 DOD INSTRUCTION 8510.01 RISK MANAGEMENT FRAMEWORK

FOR DOD SYSTEMS

2.3 The contractors’ IBDSS CRN work shall include the design, list of materials, installation, configuration, testing, troubleshooting, network topology, network interconnection spreadsheet and documentation of the new IBDSS CRN.

2.4 The contractor shall design, install and configure a three-tier layered network (Access layer, Distribution or Aggregate layer, and Core layer) IAW Systems Requirement Document (SRD) IBDSS NEXT I&S (USAFE, EAST, WEST and CENTRAL region) S0RD-001 (22SEP22) and manufactures best practice campus design guide. The contractor shall design and configure the IBDSS CRN to keep the Management Plane, Control Plane, and Data Plane separate from each other. The Contractor shall utilize, but not be limited to, VRFs, ACLs, Encryption, 802.1x, and VLANs to achieve this separation. The CRN shall be set up and configured in FIPS mode and adhere to all applicable DISA STIGs. The contractor shall procure, install, and configure bidirectional SFPs to transmit and receive, on a single strand of single mode fiber cable per network device to network device connection (to reduce the amount of fiber needed for the ESS CRN). Furthermore, the contractor shall procure, install, and configure two pair bidirectional 1 Gbps SFPs using Link Aggregate Control Protocol (LACP) EtherChannel link between every access switch and the nearest distribution switch; two pair bidirectional 10 Gbps SFPs using Link Aggregate Control Protocol (LACP) ether-channel link between every distribution switch and each core switch.

2.4.1 Access Layer Requirements: The Contractor shall use standard rack-mounted Cisco switches or environmentally hardened Cisco Industrial Ethernet (IE) switches for NEMA 4x enclosures as required by the installation location. Switches hosting devices like cameras or card readers shall be dually connected to the nearest distribution switch with 1 Gbps bi-directional SFPs, configured as a LACP EtherChannel.

Switches hosting servers or workstations shall be dually connected to the distribution or core layer with 20 Gbps bi-directional SFPs, configured as a LACP MEC interface. All access-to-distribution/core uplinks must be encrypted using MACsec (gcm-aes-256 hmac-sha-256 minimum).

2.4.2 Distribution Layer: Switches can be deployed as stacked switches in a single location or as StackWise Virtual switches across two locations, as determined by the 28 BW. Each distribution switch/stack shall have dual connections to the core layer using single-mode bi-directional SFPs with a minimum throughput of 10 Gbps per link.

Connections will be configured as LACP MEC Layer 2 trunk ports. All distribution-to-core uplinks must be encrypted using MACsec (gcm-aes-256 hmac-sha-256 minimum).

2.4.3 Core Layer: The Contractor shall utilize Cisco StackWise Virtual capable switches for the core, deployed in two geographically separate locations to ensure site redundancy. Core-to-core connections shall be Layer 3 routed ports using bi-directional SFPs. The number of connections and their speeds shall be based on Cisco's best practices for high availability. OSPF shall be used as the Interior Gateway Protocol (IGP), configured for sub-second failover. BGP shall be used for intra-VRF routing and multicast routing. Layer 3 MPLS and LDP shall be used between core nodes. All Layer 3 protocols must support Non-Stop Routing (NSR). If NSR is not feasible on a proposed platform, the Contractor must provide a cost-benefit analysis for a Non-Stop Forwarding (NSF)/Graceful Restart (GR) solution versus a platform that natively supports NSR.

2.5 Network Services: The Contractor shall propose, procure, and configure all necessary network servers for a fully managed solution, including but not limited to: AAA (e.g., Cisco ISE), Active Directory, Certificate Authority, NTP, SNMPv3, Secure SYSLOG, and Secure File Transfer.

2.6 Security and Compliance: FIPS 140-2/3: All cryptographic functions must use NIST CMVP-validated modules. The Contractor must provide CMVP certificate numbers for all deployed hardware/software as a deliverable. DISA STIGs: All devices must be configured to the latest applicable DISA STIGs. Compliance shall be verified using an SCAP-compliant scanner. Access Control: ACLs shall be applied to all Layer 3 interfaces (inbound and outbound) with a "deny by default" posture. ACLs will specifically deny fragmented packets and only permit necessary traffic.

2.7 Enclosures: Each new IBDSS CRN switch shall be installed in a contractor procured separate secure lockable and tampered data rack or NIMA 4X rated enclosure designed IAW IBDSS design requirements with its own UPS or battery backup solution providing at a minimum 4 hours of backup time for the rack or encloser. (as per UFC 4-021-02 2019) assuming adequate physical space is available. If the communication closet lacks sufficient space, the contractor is responsible for coordinating with 28 BW/CS to determine an acceptable alternate installation plan. The contractor shall provide and install a secure, lockable, and tampered data rack enclosure to protect the IBDSS network equipment in the government identified location for the new equipment. Cabinet tampers shall be installed on all newly installed network enclosures, and a red label with white bold lettering shall be placed on each enclosure that says, “This enclosure is protected by an ALARM SYSTEM. Please call (insert the appropriate phone number here for the security squadron) before opening. The associated phone number will be provided by 28 SFS prior to installation. The contractor shall collaborate with the 28 BW/CS prior to installing any equipment in currently existing rack enclosures. Additionally, the contractor shall collaborate with 28 BW Communications Fit Out before installation of equipment in any newly constructed facility.

2.8 Network Power: If the new network switch is installed in an existing data rack, use the existing Uninterruptable Power Supply (UPS) to protect the CRN network from power loss and electrical surges.

2.8.1 The contractor shall use SRD-3.8 Power Requirements: IDS and ACS equipment shall not share branch power circuits or pathways from power panels with non-IDS/ACS equipment. The contractor shall verify through load calculations that the newly installed switch shall not drain the UPS batteries in less than 4 hours. In situations where the UPSs shall be drained in less than 4 hours, the contractor shall procure, install and test the necessary UPS components needed to achieve at a minimum 4 Hours of battery backup for the Rack and all the installed equipment.

2.8.2 In locations where a new data rack is installed; the contractor shall provide a UPS to power and protect the new network switch and all installed equipment for a minimum of 4 Hours of back-up power.

2.8.2.1 If the building does not have local UPS or generator power, provide UPS power for four (4) hours of battery back-up to maintain the IBDSS network during a power failure. The UPS must be fitted with relays to indicate the status of the UPS and power for the IBDSS on the IDS network.

2.9 All equipment shall be neatly installed per the SOW. All installed equipment shall be labeled as shown in the IBDSS CRN Design Documents.

2.10 All work shall be IAW industry standards and manufacturer recommendations.

3. Implementation and Testing Procedures.

3.1 The contractor shall adhere to the following procedures for implementation and testing of the IBDSS CRN.

3.1.1 Before the installation of equipment, the following meetings and reviews shall be scheduled and completed by the contractor’s Project Manager. The project manager shall take notes at each meeting and provide notes to the government within 2 days of the meeting taking place:

3.1.1.1 Project Kickoff Meeting at the customer location and/or teleconference for introductions and scope review.

3.1.1.2 Contractor shall perform site evaluation of the system installation locations.

3.1.1.3 Design Review is conducted by teleconference to present the proposed system design, project schedule, and implementation plan.

3.1.1.4 Revise design, schedule, and implementation plan based on agreements made during the Design Review meeting.

3.1.1.5 Finalize installation and cutover of current systems requirements and document cutover activities into an executable plan.

3.1.1.6 Final Project Plan is approved by the Government before the installation phase begins.

3.1.1.7 28 BW/SFS shall be the OPR, and 28 BW/CS shall be the OCR for the above.

3.2 Site Surveys, Analysis, and Reports

3.2.1 Site Surveys

OBI, CHARLES O CTR USAF AFMC AFLCMC/ESSS

SRD-3.8 Power Requirements: IDS and ACS equipment shall not share branch power circuits or pathways from power panel with non-IDS/ACS equipment.

KOEHLER, BRANDON J MSgt USAF AFGSC 28 BW/FO Updated verbiage

3.2.1.1 The contractor shall conduct a site survey to gather data to fulfill this SOW and provide improvement recommendations where necessary, to determine the optimum location and configuration for equipment/system installation, including any site preparation requirements. The contractor shall provide an itemized breakdown of equipment and services. The contractor is responsible for providing a comprehensive installation plan and schematics to the government.

3.2.1.2 The contractor shall conduct a site survey in collaboration with the 28 BW Communications Fit Out, 28 BW/CS, and 28 BW/SFS to gather data to fulfill this SOW where necessary to determine the optimum location and configuration for network creation and installation including any site preparation and potential equipment requirements. The contractor shall provide an itemized breakdown of potential equipment and identified services for the network requirement and creation. The contractor is responsible for providing a comprehensive installation plan and schematics to the government.

3.2.1.3 The site survey shall gather all pertinent environmental, engineering, configuration, and design information relevant to site conditions. This shall also include a manpower analysis to support sustainment operations once the network has been created, and current/future facilities are switched (cut over) to the new IBDSS CRN. Sustainment shall be provided via a separate contract action.

3.2.3 Analysis and Reporting.

3.2.3.1 The contractor shall analyze the collected data, perform necessary calculations to make technical recommendations, and prepare a Site Survey Report. This report shall be submitted to the Government TPOC for approval prior to proceeding with installation design.

3.2.3.2 The contractor shall analyze the collected data, perform necessary calculations and prepare a Site Survey Report. This report shall be submitted to the Government TPOC for approval prior to proceeding with installation design.

3.2.3.3 Content of Site Survey Report: At a minimum, the Site Survey Report shall include

3.2.3.3.1 Detailed site diagrams and layouts

3.2.3.3.2 Assessment of existing infrastructure (power, network, space, fiber optic strand availability, one strand per connection.)

3.2.3.3.3 Identification of potential challenges and risks

3.2.3.3.4 Recommended equipment placement and configuration

3.2.3.3.5 Site preparation requirements (if applicable)

3.2.3.4 The contractor shall prepare all documentation using Government-provided information, as necessary, and format it into prescribed Government structure corresponding to the requiring agency, DoD, and U.S. Air Force instructions, standards, and specifications. The Contractor shall provide shop High-Level Design (HLD) Low-Level Design (LLD) in PDF and/or Visio format.

3.3. Installation Design Package

3.3.1 The contractor shall develop various technical requirements, specifications, and drawing documents to support the installation design. The contractor shall consider cost-effectiveness, reduction of risks, constraints, and schedules. The design package shall be submitted to the Government as a 30% and final 100% submittal.

3.3.1.1 Closed Restricted Network Installation Design Package. The contractor shall prepare and maintain an Installation Design Package detailing the proposed installation. The IDP shall include, but not be limited to:

3.3.1.1.1 Pre-installation

3.3.1.1.1.1 Installation Schedule within 15 days of the award

3.3.1.1.1.2 Bill of Materials: A complete and detailed Bill of Materials (BOM) listing all equipment, components, and materials required for the project, including part numbers, quantities, and vendor information.

3.3.1.1.1.3 Drawings

3.3.1.1.1.3.1 Floor plans

3.3.1.1.1.3.2 Single Line drawings with device names

3.3.1.1.1.3.3 Network Port Schedule

3.3.1.1.1.3.4 IP scheme

3.3.1.1.1.3.5 Rack enclosure elevations

3.3.1.1.1.4 Design Data Sheets

3.3.1.1.1.5 Site Preparation and Installation Plan

3.3.1.1.1.6 Information Systems Accreditation

3.3.1.1.2 Post installation closeout

3.3.1.1.2.1 As-Built Drawings

3.3.1.1.2.1.1 Finalized Network Topology Map

3.3.1.1.2.1.2 Equipment serial numbers

3.3.1.1.2.2 Technical Report – Study Services – Warranties

3.3.1.1.2.3 Information Systems Accreditation

3.3.1.1.2.4 Cybersecurity Assessment and Authentication

3.3.1.1.2.5 Documentation of Systems Acceptance Test (SAT)

3.3.1.1.2.6 Documentation of approved Authority to Operate (ATO)

3.3.1.1.2.7 Security Authorization Documentation Package

3.3.1.2 Closed Restriction Network Installation Design Schedule

3.3.1.2.1 30% design submittal. The contractor shall have 30 calendar days from issuance of the Notice to Proceed IAW 52.211-10 to provide the Government with the 30% design submittal. The Government shall have 21 calendar days to review the design submittal and recommend acceptance or rejection to the Contracting Officer.

3.3.1.2.2 100% design submittal. The contractor shall have 14 calendar days from issuance of the Notice to Proceed IAW 52.211-10 to provide the Government with the 100% design submittal. The Government shall have

14 calendar days to review the design submittal and recommend acceptance or rejection to the Contracting Officer.

3.4 Project Support Agreement (PSA). The contractor shall prepare and/or maintain a Project Support Agreement (PSA) which is a formal document that details all host-based project support requirements if any are necessary. Examples of these would include changes to real property, or fiber optic cable installations between facilities.

3.5 Government Approval. The Installation Design Package (IDP) and Project Support Agreement (PSA) shall be submitted to the Government TPOC for review and approval prior to commencement of any installation activities.

3.6. IBDSS CRN Cutover and Transition Plan. The contractor shall develop a Cutover and Transition Plan planning for an arbitrary, estimated non-binding Notice to Proceed (NTP) of 1 July 2026, 78 switches are ready to transition upon contract award, 6 switches in quarter 3, and 4 switches in quarter 4 for a total of 88 switches transitioned. Finalized timelines and facility listings shall be provided to contractor upon award. Finalize installation and cutover of current systems requirements and document cutover activities into an executable plan.

3.6.1 The Cutover and Transition Plan shall include:

3.6.1.1 A detailed schedule of cutover activities to support Government Acceptance Testing (GAT) for the existing network and facilities.

3.6.1.2 Identification of systems and operations that shall be impacted.

3.6.1.3 Plan to inform users of scheduled down time and what services shall be impacted. Contractors shall coordinate downtime with both 28 BW/CS and

28 BW/SFS.

3.6.1.4 Down Time: Acceptable down time during the transition (cut over) process timelines shall be provided to the contractor via the 28 BW/CS and 28

BW/SFS.

3.6.1.5 A recovery and fallback contingency plan.

3.6.2 The Cutover and Transition Plan shall be submitted to the Government TPOC and the Contracting Officer for review and approval prior to implementation. The contractor shall work with 28 BW/CS, 28 BW/SFS, and PIO to identify high priority facilities and priorities for the transition plan.

3.7. Testing and Evaluation: The contractor shall conduct tests to ensure that all equipment and systems comply with the performance specifications outlined in the applicable technical manuals, test specifications, PSA, etc. Testing applies to all equipment, whether new, previously installed, or relocated.

3.7.1 IBDSS CRN Testing: The contractor shall perform preliminary visual and continuity tests (cold checks) on all signal and power cables and all cross-connects to ensure proper termination has been made and no short circuits or interconnecting wiring defects exist prior to energizing each system. Network Testing by the contractor must be completed without error. Any discovered errors and issues shall be remedied by the contractor prior to GAT testing.

3.7.2 GAT Testing: Requirements shall include a three-phased approach with Government OPR and OCR oversight.

3.7.2.1 Initial: Preliminary test of all systems and equipment once facilities have been connected to the new IBDSS CRN.

3.7.2.2 Secondary: 72-hour burn in

3.7.2.3 Tertiary: 30-day burn in

3.7.2.4 Documentation: The contractor shall record, date, sign, and provide installation and system test data to the Government TPOC upon completion of the tests.

3.7.2.5 Government Witnessing: Full operational verification must be completed by both the 28 BW/CS and 28 BW/SFS; final system testing shall be witnessed by the Government TPOC.

3.7.2.6 The contractor shall ensure there is sufficient technical support at the installation until GAT testing has been successfully completed.

3.8 Equipment and Components

3.8.1 Pre-Installation Test and Checkout (PITCO).

3.8.1.1 The contractor shall conduct Pre-Installation Test and Checkout (PITCO) for all network requirements deliverable products. This shall include, but is not limited to, installation tests and systems tests for system validation for all deliverable product performance requirements.

3.8.1.2 The PITCO is designed to be accomplished prior to actual integration of a new capability into an existing live system to provide a level of confidence that the equipment/system that shall be delivered for installation is fully operational.

3.9 Project Closeout

3.9.1 Upon conclusion of the contract, the contractor is required to prepare a comprehensive turnover package and provide it to 28 BW. This package shall contain all network credentials, documentation, and other materials necessary for seamless network management.

3.9.2 The contractor is required to conduct a comprehensive training program for the incoming network administrators 1-month prior to contract completion. This shall be completed during a 2-week training period. The training methodology must include both 'over the shoulder' observation of operational and maintenance activities and direct ‘hands-on' experience with the CRN environment to ensure the new team is fully prepared to assume all responsibilities.

4. Security Requirements

4.1 Cybersecurity Requirements

4.1.1 RMF Compliance. The contractor shall support cybersecurity activities necessary to meet DoD cybersecurity requirements equivalent to the current existing system ATO baseline, The IBDSS CRN must comply with all applicable DoD cybersecurity requirements, including the Risk Management Framework (RMF) as outlined in DoD Instruction 8510.01. The contractor shall support the Risk Management Framework accreditation per the DoDIN requirements and provide all required DISA STIG compliance documents and/or verification. The contractor shall develop and implement a System Security Plan (SSP) and Plan of Action and Milestones (POA&M) to address security vulnerabilities. The SSP and POA&M must be submitted to the Government TPOC for approval.

4.1.2 STIG Implementation: The contractor shall implement all applicable Security Technical Implementation Guides (STIGs) to harden the IBDSS CRN and ensure compliance with DoD security standards. The contractor shall provide documentation demonstrating STIG compliance.

4.1.3 Data Handling: All data processed, stored, or transmitted on the IBDSS CRN must be handled as Controlled Unclassified Information (CUI) at a minimum. The contractor shall implement appropriate data handling procedures to protect the confidentiality, integrity, and availability of data, in accordance with DoD policy.

4.1.4 Vulnerability Scanning: The contractor shall perform the initial vulnerability scanning, reporting and analysis for 100% of IP-connected devices and provide documentation or verification to the government. The contractor shall conduct regular vulnerability scans of the IBDSS CRN using DoD-approved scanning tools (e.g., ACAS, SCAP) and remediate any identified vulnerabilities in a timely manner.

Scanning results and remediation plans must be submitted to the Government TPOC.

4.1.5 Incident Response: The contractor shall develop and implement an incident response plan to address any cybersecurity incidents that may occur. The plan must be consistent with DoD incident response policies and procedures.

4.1.6 Accreditation: The contractor shall be responsible for obtaining and maintaining all necessary accreditations documentation for the IBDSS CRN, including but is not limited to Video Image Control and Display System (VICADS) and Vindicator systems, and existing Integrated Base Defense Security System (IBDSS) in accordance with DoD requirements. The contractor shall provide documentation demonstrating accreditation status of the Systems Acceptance Test and Authority to Connect/Operate approval to the Government TPOC. Provide PDF or Visio high-level accreditation diagrams, update the hardware/software list, and update the ports, protocols, and services (PPS) for the initial installation shall be provided to the government at completion of the project.

4.2 System Security

4.2.1 The contractor shall install two tamper switches on the data rack to indicate that the door has been opened. The UPS status relays: AC power fail, UPS system trouble and UPS low battery and the tamper switch shall be cabled in conduct to the existing Intrusion Detection System (IDS) in the building to monitor the IBDSS network security and power per the Integrated Base Defense Security Systems Modernization (IBDSS) and DAFI 31-101 standards.

4.2.3 The contractor shall program the new tamper switches into the existing system.

The contractor shall be Certified by the IBDSS system Manufacturer. The Certification must be current.

4.2.4 Required Certifications:

4.2.4.1 VICADS

4.2.4.1.1 V100 Factory/Manufacturer trained with a minimum of 2 yrs experience

4.2.4.2 Vindicator

4.2.4.2.1 Vindicator Command and Control (VCC) Certified

4.2.4.2.2 Intrusion Detection System (IDS) Certification

4.2.4.2.3 Access Control System (ACS) Certified

4.2.4.2.4 Minimum 5 years field experience on a large DOD/AF

installation upgrade

5. Installation Requirements

5.1 Base Security and Clearance Requirements

5.1.1. Background checks and security investigations shall be conducted in accordance with DoD regulations. The contractor shall provide documentation verifying personnel security clearances to the Government TPOC.

5.2 CAC Requirements. Contractor personnel requiring logical access to government IT systems must obtain and use Common Access Cards (CACs) with Public Key Infrastructure (PKI) certificates. Contractors must comply with all CAC issuance and usage policies, including completing required cybersecurity awareness training annually.

5.3. Physical Access Control. The contractor shall comply with all physical access control procedures at the installation site, including displaying proper identification (e.g., CAC) and adhering to escort requirements. The contractor is responsible for obtaining and returning all base access badges for their personnel.

5.4. Installation Access. Ellsworth AFB is considered a closed base. All personnel entering must have the specific permission of the installation commander for entry. This permission is granted when a contractor employee is sponsored onto Ellsworth AFB by Active-Duty military or civilian government personnel. The Government Representative shall obtain the contractor information necessary to submit and Entry Access Letter to the Visitor Control Center (VCC). The contractor shall be responsible for ensuring that all its employees always obtain and keep on their person while working on the base, the pass issued to them by the VCC. Upon completion of the work or termination of an employee, the contractor shall be responsible for turning in all passes to the Government representative or to the VCC of the 28 BW/SFS.

*NOTE: Failure to turn in passes shall result in WITHHOLDING OF FINAL PAYMENT and revocation of any future badges issued by Installation Pass and Registration Office to the employee and the contractor.

5.5. Entry Access Letter. A completed signed original EAL must be delivered to VCC no later than 5 working days prior to the desired day of entry onto Ellsworth AFB. The Visitor Control Center shall issue a temporary pass to the contractor personnel listed on the EAL. Personal information provided on the EAL shall be cross-referenced against state and federal criminal databases to identify those individuals possessing outstanding warrants. Those individuals with outstanding warrants shall be detained at the Visitor Control Center on the desired day of entry and turned over to Box Elder Police Department.

5.6 Restricted Area/Access Coordination. Contractor performance within restricted/controlled areas shall be required. If contractor work is required in a restricted/controlled area the contractor shall be escorted by a 28BW/CS member as well as a government individual authorized to escort within said areas. Work schedule requests or changes to existing schedules for work to be performed in a “USAF RESTRICTED AREA” shall be submitted at least 7 calendar days in advance for approval and coordination of Ellsworth AFB Security Forces.

5.7 Vehicle and Licensing Requirements.

5.7.1 All contractor employees who shall be driving a vehicle on Ellsworth AFB shall always have a current driver’s license with them while on Ellsworth AFB.

5.7.2 All contractor vehicles to be operated on Ellsworth AFB shall have valid state registration, vehicle inspection, and insurance. Proof of registration and vehicle insurance must always be physically available while the vehicle is on Ellsworth AFB.

5.7.3 Any contractor employee who shall be operating heavy equipment or specialized equipment that requires a license, or certification shall be so licensed and/or certified with proof presented to the contracting officer prior to work start.

5.8 Reporting Requirements. The contractor shall immediately report any security violations, incidents, or suspected compromises (including loss of CACs or security badges) to the Government TPOC and the base Security Management Office.

5.9 OPSEC Compliance. The contractor shall adhere to all applicable Operations Security (OPSEC) requirements. The contractor shall develop and implement an OPSEC plan to protect sensitive information related to the IBDSS CRN project. All contractor personnel assigned to this project must receive OPSEC awareness training.

6. Regulatory Compliance and Property Management

6.1 Regulatory Compliance. The contractor shall comply with all applicable federal, state, and local laws, regulations, and standards in the performance of this contract. This includes, but is not limited to, regulations related to security, cybersecurity, safety, environmental protection, and labor.

6.2 The contractor shall adhere to the following specific regulatory requirements:

6.2.1 DoD and Air Force Instructions: Compliance with all relevant DoD and Air Force Instructions (AFIs) pertaining to electronic security systems, cybersecurity, information assurance, and risk management.

6.2.2 NIST Standards: Adherence to National Institute of Standards and Technology (NIST) Special Publications, including the 800 series, for computer security policies, procedures, and guidelines.

6.2.3 UFGS Standards: Compliance with applicable Unified Facilities Guide Specifications (UFGS) for electronic security systems and related infrastructure.

6.2.4 UFC Standards: Compliance with applicable Unified Facilities Criteria (UFC) for electronic security systems and related infrastructure.

6.2.5 Trade Agreements Act (TAA): All equipment and materials procured for this project must be compliant with the Trade Agreements Act (TAA), if applicable.

6.2.6 Cybersecurity Framework: Adherence to the National Institute of Standards and Technology (NIST) Framework for Improving Critical Infrastructure Cybersecurity.

6.2.7 DoD 8570.01-M: Compliance with DoD 8570.01-M for cybersecurity workforce training, certification, and management.

6.2.8 Safety Regulations: Compliance with all applicable Occupational Safety and Health Administration (OSHA) regulations and other safety standards.

6.3 In addition to the above, the contractor shall adhere to the following product validation requirements:

6.3.1 Product Authenticity: The contractor shall certify that it purchases supplies from authorized resellers and/or distributors. Unless otherwise specified, the contractor shall warrant that the products are new and in their original packaging.

6.3.2 Software Licensing: The contractor shall obtain all manufacturer products submitted at the DO level from authentic manufacturers or through legal distribution channels only, in accordance with all applicable laws and policies at the time of purchase. The contractor shall provide the Government with a copy of the end-user license agreement and shall warrant that all manufacturer software is licensed originally to the Government as the original licensee authorized to use the manufacturer software. The contractor shall track the licensing information and have it available for Government review as needed.

6.3.3 Cybersecurity Validation: The contractor shall ensure that all products recommended and/or procured that impact cybersecurity or IA shall be selected from the National Information Assurance Program (NIAP) Validated Products List, if applicable.

6.4 The contractor shall provide documentation demonstrating compliance with all applicable regulations and standards, including certifications, test reports, and other relevant evidence.

6.5 The contractor is responsible for staying informed of any changes to applicable regulations and standards and ensuring that the IBDSS CRN project remains in compliance.

6.6 Property Management

6.6.1 The contractor shall provide all materials, cables, and connectors as required for the accomplishment of the tasks within the Proposal unless otherwise specified. All material shall be new and unused unless otherwise authorized by the contracting officer. The contractor, at its discretion, may provide initial quantities or supplemental materials as it deems required. All surplus/residual material is the property of the contractor.

6.6.2 The contractor shall establish and maintain a system for managing all Contractor Acquired Property (CAP) used in the performance of this contract, in accordance with FAR Part 45 and other applicable regulations. This includes, but is not limited to, the following:

6.6.2.1 Inventory Tracking. The contractor shall create and maintain internal records of all CAP. The contractor shall record each item delivered and/or ordered in a Material Inspection and Receiving Report/Inventory Tracking Report. At a minimum, the report shall track the following information: item description, order date, serial number, model number, lot number, delivery location, and the manufacturer warranty period and expiration date, if applicable. The contractor shall have inventory report information available for Government review as needed, and the contractor shall ensure the report information can be sorted and manipulated by any of the input fields.

6.6.2.2 Reporting. The contractor shall provide regular inventory reports to the Government TPOC, as directed.

6.6.2.2.1 Marking: IAW DFARS clause 252.211-7003, the contractor shall ensure all items delivered are properly marked with a Unique Item Identifier (UII) unless otherwise specified.

6.6.2.2. Disposition: Upon completion of the project, the contractor shall properly dispose of or transfer all CAP as directed by the Government TPOC.

6.7 Staging and Delivery. The contractor supplied materials shall be shipped from the contractor designated supply points, or drop-ship vendors, sub-contractors and/or other facilities to the installation. The contractor shall provide their own securable storage container. The government shall provide space on the installation to keep the storage container. Location to be provided post-award.

6.8 Disposal of Materials. All debris and unserviceable materials generated under this contract such as scrap, salvage material, industrial waste, non-recyclable materials, and equipment/material not listed shall be disposed of off base by the contractor in accordance with all applicable federal, state, and local regulations.

6.9 Responsibility for Damages. Any damages caused to U.S. Government property while performing this contract shall be restored, replaced and/or repaired to its original condition at no additional cost to the U.S. Government.

7. Contract Management and Support

7.1 Program Management. Program Management shall be provided throughout the design and implementation of the system. The contractor shall describe their established Program Management service offerings in support of the program. At a minimum, the services shall include:

7.1.1 Design planning

7.1.2 Implementation planning

7.1.3 Management of all system integration and site preparation/development activities

7.1.4 Acceptance testing

7.1.5 Migration

7.1.6 Optimization

7.2 System Engineering. Systems engineering services shall be provided from the preliminary system design through the completion of system implementation, security evaluation, and functional testing. At a minimum, system engineering services shall include the following:

7.2.1 System design

7.2.2 System Architecture development

7.2.3 Implementation support (design synthesis)

7.2.4 Acceptance testing

7.3 Hazardous Conditions: During performing work under this contract, should the contractor find existing hazardous conditions that create an unsafe working environment preventing him or her from completing the outlined work, the TPOC shall be immediately notified.

7.4 Contractor Employees: All contract personnel working in situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. They must also ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed. Contractor personnel shall be easily recognizable as contractor employees. This may be accomplished by wearing distinctive clothing bearing the name of the company or by wearing appropriate badges which contain the contractor’s company name and the employee’s name.

7.5 Contract Manager: The contractor shall provide a contract manager who shall be responsible for all requirements in this SOW. The name of this person and an alternate(s) who shall act for the contractor when the manager is absent, shall be designated in writing to the Contracting Officer (CO). The contract manager or alternate shall have full authority to act for the contractor on all matters relating to this contract. The contractor shall provide the contract manager’s names, addresses, and telephone numbers. The contractor shall maintain a current listing of employees, providing updates as changes occur. The contract manager or alternate shall be available during duty days from 0730 to 1600. The contract manager or alternate shall have a good understanding of the requirements pertaining to this contract for interpretation and implementation of directives (written and oral) issued in English by the CO or GR. The Government requires all correspondence to be in either Microsoft Excel or Microsoft Word

7.6 Removal of Contractor Employees: The contractor shall utilize only experienced, responsible and capable employees in the performance of this contract. The CO may require that the contractor remove any of his/her employees who endanger persons or property, or whose continued employment under this contract is inconsistent with the interests of the U.S. Government.

8. Government Furnished Properties and Services

8.1 Utilities and workspace: The Government shall provide reasonable utilities and workspace for the contractor to perform the requested duties. The government shall provide all support equipment (desks, maintenance laptops. patch cords etc.) and storage space for the equipment necessary for the contractor to perform all work. No covered or secure storage areas shall be required or made available to the contractor.

8.2 Telephones: The Government shall not provide telephone services. If available, the contractor may use government phones in case of emergencies or during field and site work. No long-distance telephone calls shall be authorized.

9. Inspection/Acceptance. Upon completion of the above work, acceptance inspections shall be conducted by the contractor and the TPOC. If any deficiencies are found during the inspection, the contractor must correct all deficiencies to meet the needs of a functional system to be provided to the government. All details of workmanship shall be in accordance with the highest industry standards and best practices for Call Manager installation in accordance with the manufacturer’s specifications.

10. Work Schedule & Location.

10.1 Work Location: All work is to be conducted on Ellsworth AFB; remote work is not authorized. The required completion date is 7 months from the contract award. The contractor shall coordinate with the TPOC for the establishment of performance schedule and submit a work schedule no later than (NLT) 15 calendar days prior to commencement of work. The contractor shall not deviate from the approved schedule without obtaining prior approval from the TPOC. The contractor shall notify the Contracting Officer (CO) of any delays or problems impacting task completion including nature of the delay and expected completion date.

10.2 Temporary Work Stoppage: There may be instances where the Government shall require the contractor to temporarily stop work. In the event the U.S. Government requests a temporary shutdown of the facility, the contractor shall be notified in writing by the CO.

10.3 Hours of Service: The contractor shall routinely work during normal duty hours 0700-1600 of the site. However, mission requirements may necessitate work outside normal hours (nights and/or weekends). Any site work requested by the contractor to be performed outside of normal duty hours shall be coordinated with the 28 BW/SFS and 28 BW/CS at least five calendar days in advance and in writing; electronic messaging is acceptable.

10.4 U.S. Recognized Holidays: The contractor shall not perform under this contract on federal holidays on site-unique down-days unless expressly authorized by the 28 CONS.

25 May Memorial Day 03 July Independence Day 07 September Labor Day 11 November Veterans Day 26 November Thanksgiving Day 25 December Christmas Day 01 January 2027 New Year’s Day

Note: American holidays falling on a Saturday shall be observed on the preceding Friday, and holidays falling on a Sunday shall be observed on the following Monday.

10.5 Down Days: Site unique down days are:

22 May (AFGSC Family Day) 06 July (AFGSC Family Day) 04 September (AFGSC Family Day) 10 November (AFGSC Family Day) 27 November (AFGSC Family Day) 24 December (AFGSC Family Day) 04 January 2027 (AFGSC Family Day)

NOTE: Remaining Family Days are yet to be determined at the generation of this SOW.

11. Warranty.

11.1 The contractor shall provide the Government with their standard commercial 1-year warranty. The contractor shall provide the proper contact information and documentation for warranty requests.

11.2 Throughout the contract period, the contractor shall be responsible for the complete operations and maintenance (O&M) of the CRN as it’s being implemented. These responsibilities include troubleshooting and resolving all CRN issues, including but not limited to routing problems, physical connectivity faults, and failures of switch or router hardware and software.

12. Contract Deliverables

12.1 Written Approval: The following deliverables require written approval from the Government TPOC before the contractor can proceed with subsequent phases of work.

Failure to obtain approval may result in delays and/or rework at the contractor's expense.

12.1.1 Pre-installation

12.1.1. Installation Schedule (within 15 days of the award) Reference Paragraph 3.3.1.1

12.1.1.2 Detailed Project Schedule (Plan of Objectives and Milestones - POA&M): A comprehensive schedule outlining all project tasks, milestones, and deadlines. This plan must include adequate response/cycle timelines for Government responses and actions. Government approval required. Reference Paragraph 3.2.1.1

12.1.1.4 Design Data Sheets Reference Paragraph 3.3.1.1

12.1.1.5 Site Preparation and Installation Plan. This shall be submitted to the government for review and approval. Reference Paragraph 3.3.1.1

12.1.1.6 System Design Documents (Installation Design Package - IDP):

Including preliminary (30%, 60%, 90%) and final drawings, schematics, and specifications for the IBDSS CRN.