Attachment 1 - Performance Work Statement for JPED Security System.pdf

CUI

PERFORMANCE WORK STATEMENT

Joint Personal Effects Depot

Security System Windows 11 Upgrade, Technical Refresh, Modernization and Intrusion Detection, Access Control, Video Surveillance and Visitor Management System Maintenance

Part 1

General Information

1. GENERAL: This is a non-personnel services contract to provide a security system upgrade to Microsoft Windows 11 operating system, electronic security system technical refresh, Homeland Security Presidential Directive 12 (HSPD-12) modernization and to provide system maintenance for the intrusion detection, access control, video surveillance and visitor management systems. The Government shall not exercise any supervision or control over the contract service providers performing the services herein.

Such contract service providers shall be accountable solely to the Contractor who, in turn, is responsible to the Government.

1.1 Description of Services/Introduction: The contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform a security system upgrade to meet Department of Defense (DoD) standard for operating systems to strengthen the cyber security posture while concurrently streamlining the information technologies operating environment. Technically refresh and modernize computer hardware, software, and firmware and network infrastructure in accordance with (IAW) HSPD-12 and to perform maintenance on access control, video surveillance and visitor management systems as defined in this Performance Work Statement (PWS).

The contractor shall meet the standards in this contract.

1.2 Background: The Joint Personal Effects Depot (JPED) currently serves as a DoD centralized facility to collect, inventory and process the Personal Effects (PE) and transfer custody of PE from U.S. Government control to individuals identified as the Person Eligible to Receive Effects (PERE). As the only organization of its kind in the DoD, the JPED has pioneered and advanced the care of handling of PE to ensure PE is delivered in a presentable and timely manner. The JPED is comprised of a military, civilian, and contractor workforce that supports a critical, worldwide mission for soldiers and families. In May 2011, the JPED relocated to a newly constructed facility at Dover Air Force Base (AFB), DE. The facility was outfitted with a security system that was installed by ADT who was the current installer of Dover AFB security systems. ADT had installed the Brivo ACS5000-S Access control system and the Nextiva 6.2 Video Monitoring System. The ACS system utilizes the Software House SWH-4100 and HID 5355 proximity badge readers, and the VMS uses Arecont AV8365DN, Axis P1344, Axis P3346, Axis Q6034, Axis Q6044, and Axis Q6054 cameras and 2 SATA Beast storage arrays with 3 Dell Power Edge R530 and 3 Dell Power Edge R410 servers running Windows Server 2008. AFNET requirements and installation and DoD Information Assurance Certification and Accreditation Process (DIACAP) have changed since the system’s installation, and the current systems no longer are authorized for installation use and require an upgrade for the physical security posture of our facility.

1.2.1. The JPED facility, building 122, is a United States Army asset, beneficial occupancy of the facility occurred in 2011 and is located on Dover AFB, Delaware {Exclusive Federal Jurisdiction} which is a closed Installation.

1.3 Objectives: The JPED currently has a need for a security systems upgrade and maintenance contract.

The contractor shall provide a maintenance service plan designed with parts, labor, software, and guarantees a response and repair time to necessitate an effective security system at JPED, on Dover AFB, DE. The contractor shall perform a comprehensive preventative, maintenance, inspection (PMI) and test of the JPED security systems twice annually. The contractor shall provide detailed PMI and service reports within ten (10) days of work performed. The contractor shall keep detailed records, logs, update maps and/or diagrams of each task performed and chronologically organized cumulative records for the security systems. Logs will be maintained on-site in the Site Security Office and will be available for inspection.

1.3.1. The work covers installation, repairs due to damages caused accidentally by persons (e.g., such as cart damage, minor fixes, etc.) or by facility malfunction (e.g., leaks, power spikes, steam, etc.), replacement of parts, proper connections, adjustments, tests, and troubleshooting of all existing and future security system devices and related support equipment, components and materials located at JPED.

The Contractor shall to the greatest extent possible, minimize impacts on facility and security system operations while performing maintenance services. Certain procedures (which cause major disruptions to the Intrusion Detection System (IDS) or other major security systems) may have to be performed after duty hours. All work shall be coordinated with the COR (Contracting Officers Representative) at least one week in advance. The contractor shall provide a preventive maintenance plan and schedule.

1.3.2. The contractor shall provide all staffing, materials, supplies and replacement parts as necessary to maintain a required level of service. The maintenance services will address video surveillance system and the Physical Access Control System (PACS), Visitor Management System (VMS), IDS, Video Surveillance System (VSS), facility access card readers, biometric access readers, Network Video Recorders (NVR), personnel security turnstiles and communications network.

1.3.3. The contractor shall provide JPED access to a telephonic technical support phone number for the duration of the contract as well as a website and/or email address that is available during the normal business hours of JPED. The technical support staff must be familiar with and capable of assisting JPED personnel with the operation of the system and applicable software.

1.3.4. Provide emergency maintenance service for all existing security equipment. The contractor shall respond telephonically or electronically to all telephone or electronic service calls within (1) hour and emergency maintenance shall begin onsite within four (4) hours. If there are more requests than can be responded to within four (4) hours the COR will prioritize the emergency service requests. The contractor shall provide a point of contact and a 24-hour telephone number where the government may initiate service requests. Contractor shall replace defective equipment with loaner equipment from the available service pool if faulty equipment cannot be repaired onsite for continued service.

1.4 Scope: The purpose of this contract is to provide installation of an operating system upgrade, technical refresh, modernization, sustainment and maintenance of the electronic security systems at the JPED. This contract will be broken into three phases: Phase 1 - Access Control, Video Surveillance, and Visitor Management Systems, Phase 2 - Additional 13 Cameras for Video Surveillance System, and Phase 3 - Personnel and Vehicle Gates. The Contractors shall furnish the necessary personnel, materials, equipment, facilities, travel, and other services required to satisfy the security capabilities and solutions required by the Government. Contractor will work with the 436th Communications Squadron to ensure all software and hardware must achieve an Authority to Operate (ATO) on the AFNET authorized IAW DoD Instruction 8510.01, Risk Management Framework (RMF) for DoD Information Technology. All hardware, software, and firmware components provided and installed under this contract must be listed on the most current Department of Defense Information Network (DoDIN) Approved Products List (APL) prior to installation.

The contractor shall provide documentation verifying each component's APL status as part of the RMF package. With the pace of change, it is impossible to anticipate how information technology (IT) requirements and security programs will evolve over the life of the contract. It is intended that this contract will be dynamic in nature to provide the full range of currently available IT capabilities, solutions and emerging security technologies throughout its life. The contractor shall also accomplish the additional security enhancements:

Phase 1 - Access Control, Video Surveillance, and Visitor Management Systems

• Upgrade computers, hardware, and server operating systems to DoD, and Air Force authorized operating system version(s) and all technical refresh/enhancements will include the necessary security controls applied, and configurations made and documentation provided, for a RMF Confidentiality Medium, Integrity Medium Availability Medium (CIA-MMM) compliant system with the privacy overlay applied per Office of Management and Budget Circular A-130 - Appendix III: Federal agencies are required to secure their information systems.

• Provide monthly workstation and server operating system, application, and network device iOS security and/or configurations updates, to include security updates and/or configurations for technologies not specifically mentioned here but provided by the Contractor.

• Install five (5) new entry card readers compatible with reading Common Access Cards and key fobs on all exterior doors, front gate, and vehicle gate.

• Install three (3) new entry card readers on internal doors to processing units, and command staff area front and rear doors compatible with Common Access Cards and key fobs.

• Ensure manual access is capable for magnetic doors in case of extended power loss. Specifically, the entrance door to Operations area in main hallway next to badge reader #8.

• Install network Video Surveillance System (VSS) with 90 days recorded video storage for each camera feed. VSS hardening is required of the VSS in compliance with DISA STIGs (Security Technical Implementation Guides).

• Video storage system will need to have capability to export video clips from recordings to disk or other network storage.

• Install four (4) new exterior cameras as in attached diagram with stationary viewpoint.

• Install ten (10) new cameras as in attached diagram with 360 degree viewing angle in receiving, shipping, and processing unit areas.

• Install ten (10) new cameras as in attached diagram with stationary viewpoint.

• Install one (1) new exterior camera as in attached diagram with PTZ - 360-degree cameras with pan, scan, and zoom capabilities at the receiving dock.

• Incorporate existing intercom system into surveillance camera system if possible and have remote clients able to operate the opening and closing and unlocking of front gate and/or door.

• If installing new cameras in place of existing equipment, contractors shall ensure old or unused equipment and all components not being utilized in the new system be disposed of properly and not left at location.

• Remove and dispose of (13) existing cameras that will not be replaced with new cameras.

• When removing and disposing of existing equipment, the contractor shall ensure all media (e.g., hard drives, solid-state drives, NVRs) is sanitized in accordance with NIST Special Publication 800-88, Guidelines for Media Sanitization. The contractor must provide a certificate of sanitization for each disposed device.

Phase 2 – Additional Cameras for Video Surveillance System

• Install thirteen (13) new cameras as in attached diagram with 360 degree viewing angle in processing unit areas.

• If installing new cameras in place of existing equipment, contractors shall ensure old or unused equipment and all components not being utilized in the new system be disposed of properly and not left at location.

• Remove and dispose of (18) existing cameras that will not be replaced with new cameras.

Phase 3 – Personnel and Vehicle Gate system

• Upgrade the one (1) exterior personnel gate and one (1) vehicle gate hardware with new mechanical system and ensure the system can open/close front gate and vehicle gate controlled by the computer operating system.

o The gates are currently controlled utilizing Brivo software on stand-alone computers.

The personnel gate is powered by a HySecurity Gate, model: SlideSmart DC15. The vehicle gate is powered by a Chamberlain Liftmaster, model: SL585-100-43-G3

1.4.1 Preventative Maintenance and System Updates. The contractor shall perform preventative maintenance twice annually and apply system updates in accordance with industry best practices and manufacturer recommendations. Preventative maintenance shall include inspection, cleaning, and replacement of parts as necessary. System updates shall include security patches, bug fixes, and enhancements. All work shall be documented, and records shall be provided to the user upon request. The contractor shall coordinate with the client to schedule maintenance and updates to minimize operational impact.

1.5 Unforeseen Site Conditions: Contractor represents that it has visited the project site and is familiar with the nature of construction in the general area where the site is located, including site conditions. Contractor shall make no claims for differing site conditions except as authorized in the contract and remedy these conditions at the direction of the Contracting Officer (CO). Additional work or materials may be required, such as conduit that does not exist will be required by the Contractor despite not being identified in the contract ahead of time.

1.6 Warranty: The contractor shall provide its standard commercial warranty for all supplies and services rendered under this contract. This warranty shall be the same as that offered to the general public for the same or similar items. All warranty services shall be provided at no additional cost to the Government. The rights and remedies provided herein are in addition to and do no limit any rights afforded to the Government by any other clause of this contract.

1.7 Supply Chain Risk Management (SCRM): The contractor shall provide evidence of a secure supply chain for all IT components provided. This includes verifying the provenance of all hardware and software to ensure it is sourced from original equipment manufacturers (OEMs) or their authorized resellers. The Government reserves the right to reject any component that cannot be verified as authentic and untampered and non-refurbished.

1.8 General Information

1.8.1 Services Summary: The table below summarizes the most important performance objectives and thresholds (specific standards) as identified within the body of this PWS. The absence of any performance objective and threshold from this summary shall not detract from its enforceability or limit the Government's rights or remedies afforded under this contract.

Performance Objective Performance Threshold Reference Provide telephonic and/or electronic technical support No more than 1 unacceptable support service per month

IAW PWS 1.3.3

Contractor shall provide a response time within four (4) working hours following receipt of service call

No more than 1 failure to arrive within the stated service call window per month

IAW PWS 1.3.4

Contractor shall ensure equipment is operating within technical specifications

No unacceptable installation of equipment IAW PWS 1.4

Contractor shall provide Field Service Report

No more than 1 incomplete or late report provided per month

IAW PWS 1.3

Provide all work plans prior to work being started for approval

No service will be completed without prior approval of a work plan by the COR

IAW PWS 1.3.1

Perform a comprehensive preventive maintenance, inspection and test twice annually

No more than 1 unacceptable service per year

IAW PWS 1.3

and PWS 1.4.1

Perform monthly security patching and configuration updates.

No more than 1 unacceptable service per month

IAW PWS 1.3

and PWS 1.4.1

The Contractor shall provide the necessary documentation for compliance with the Risk Management Framework prior to award of the contract.

No missing documentation during performance of the contract

IAW PWS 1.6.3

1.8.2 Quality Control (QC): The contractor shall develop and maintain an effective quality control program to ensure services are performed in accordance with this PWS. The contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The contractor’s quality control program is how he assures himself that his work complies with the requirement of the contract. The contractor or its subcontractors shall perform critical implementation functions as well as manage the team of professionals in accomplishing work components of the JPED security system upgrade, technical refresh, maintenance and sustainment projects. The contractor shall present an overview of the project plans including a summary of processes to be employed, metrics and percentages of security system that are compliant, project schedule, and planned status and project reviews within 30 days after contract award.

After acceptance of the quality control plan the contractor shall receive the CO’s acceptance in writing of any proposed change to his QC system.

1.8.3 Government Furnished Property (GFP): No GFP will be provided under this contract.

1.8.4 Recognized Holidays:

New Year’s Day Labor Day Martin Luther King Jr.’s Birthday Columbus Day President’s Day Veteran’s Day Memorial Day Thanksgiving Day Juneteenth Christmas Day Independence Day

1.8.5 Hours of Operation: The contractor is responsible for conducting business, between the hours of 8:00 AM to 4:00 PM Monday through Friday, excluding Federal Holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. For other than firm fixed price contracts, the contractor will not be reimbursed when the government facility is closed for the above reasons. The Contractor shall at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons. When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the workforce are essential.

1.8.6 Place of Performance: The work to be performed under this contract will be performed at the JPED, 122 Purple Heart Drive, Dover AFB, DE 19902.

1.8.7 Security Requirements: All personnel employed by the contractor in the performance of this contract, or any representative of the contractor entering the governmental Installation shall abide by all security instructions and directives of Dover AFB. Employees are responsible for safeguarding all government property provided for contractor use.

1.8.7.1. The contractor and, as applicable, subcontractor shall not employ persons for work on this contract if such employee is identified as a potential threat to the health, safety, security, general well-being or operational mission of the Installation and its population, nor shall the contractor or subcontractor employ persons under this contract who have an outstanding criminal warrant as identified during the Criminal Background Check (CBI).

1.8.7.2. Contractors shall ensure their employees and those of their subcontracts have the proper credentials allowing them to work in the United States. Employees and subcontractors later found to be undocumented, or illegal aliens will be remanded to the proper authorities.

1.8.7.3. The contractor shall submit any request for compensation on delays to the Contracting Office for approval. The contractor shall notify the Contracting Office or authorized representative as soon as the contractor realizes/determines of any potential delays IAW the terms and conditions of this requirement.

1.8.7.4. All contractors and subcontractors when working in a Controlled, Restricted or other sensitive areas must be escorted at all times. The military agency or unit responsible for the project or work is responsible for providing the escorts. The Contractor shall follow existing procedures and instructions for obtaining entrance to restricted or controlled areas.

1.8.8. Physical Security: The contractor shall be responsible for safeguarding all government equipment, information and property provided for contractor use. At the close of each work period, government facilities, equipment, and materials shall be secured.

1.8.9. Key Control: The Contractor shall establish and implement methods of making sure all keys/key cards issued to the Contractor by the Government are not lost or misplaced and are not used by unauthorized persons. NOTE: All references to keys include key cards. No keys issued to the Contractor by the Government shall be duplicated. The Contractor shall develop procedures covering key control that shall be included in the Quality Control Plan. Such procedures shall include turn-in of any issued keys by personnel who no longer require access to locked areas. The Contractor shall immediately report any occurrences of lost or duplicate keys/key cards to the CO.

1.8.9.1. In the event keys, other than master keys, are lost or duplicated, the Contractor shall, upon direction of the CO, re-key or replace the affected lock or locks; however, the Government, at its option, may replace the affected lock or locks or perform re-keying. When the replacement of locks or re-keying is performed by the Government, the total cost of re-keying or the replacement of the lock or locks shall be deducted from the monthly payment due the Contractor. In the event a master key is lost or duplicated, all locks and keys for that system shall be replaced by the Government and the total cost deducted from the monthly payment due the Contractor.

1.8.9.2. The Contractor shall prohibit the use of Government issued keys/key cards by any persons other than the Contractor’s employees. The Contractor shall prohibit the opening of locked areas by Contractor employees to permit entrance of persons other than Contractor employees engaged in the performance of assigned work in those areas, or personnel authorized entrance by the CO.

1.8.10. Lock Combinations: The Contractor shall establish and implement methods of ensuring that all lock combinations are not revealed to unauthorized persons. The Contractor shall ensure that lock combinations are changed when personnel having access to the combinations no longer have a need to know such combinations. These procedures shall be included in the Contractor’s Quality Control Plan.

1.8.11. Contractor Badge Polices: All requests for contractor badges will be submitted through the JPED Security Office. The Security Office will then fill out an Operational Risk Management Assessment Form (ORM) for the requesting agency and submit it to the Pass and Registrations section for approval IAW with Operational Plan 31-101. As a minimum the ORM will be submitted 10 days prior to the requested date of employment.

1.8.11.1. All contactor employees who’ll be granted unescorted access to the Installation are required to consent to a CBI prior to being granted entry to the Installation. Continued employment is contingent upon successful completion and favorable reporting of the CBI.

1.8.11.2. Dover AFB Contractor badges will be issued for a maximum period of one year. Prior to reissuing new badges, all old badges must be returned to 436 Security Forces Squadron (SFS), Pass and Registration for destruction. Also, before a new badge is issued an ORM must be resubmitted to the Pass and Registration section for approval again. In the event a badge is lost or stolen, immediately contact the JPED Security Office. The badge holder must accomplish the Loss/Theft of Identification Worksheet and provide it to his/her supervisor. The supervisor of the contractor will investigate the loss and report in writing the circumstances in which the badge was lost to the JPED Security Office and submit a new request for badge before a new badge can be reissued.

1.8.11.3. JPED Security Office will immediately notify 436 SFS, Pass and Registration when a contractor’s employment has been terminated. The Site Supervisors are responsible for notifying and returning the contractor’s badge to JPED Security Office when this occurs. At no time will a contractor contact Security Forces directly regarding badge denial; they need to contact the JPED Security Office.

1.8.12. Installation Access: The Contractor shall obtain personal contractor identification badge for all employees and vehicle passes for all contractors and personal vehicles requiring entry onto Dover AFB from 436 SFS, Pass and Registration, for the duration of the contract. Employees are only permitted to enter the Installation during the date and time periods indicted on their contractor badge.

1.8.12.1. Vehicle registration, proof of insurance and a valid driver’s license must be presented for all vehicles while operating on the Installation. All vehicles entering the Dover AFB Main Base, Military Family Housing or sensitive areas are subject to search. Any refusal or non-consent by an employee will result in termination of their base access and immediate confiscation of this access badge.

1.8.12.2. During Force Protection Condition (FPCON) Normal and Alpha, personnel without base issued badges must be sponsored onto the installation.

1.8.12.3. During FPCON Bravo, Charlie and Delta, personnel without base issued identification shall be physically escorted onto the installation.

1.8.12.4. During Higher FPCONs (Charlie and Delta) the base will normally curtail non-essential operations/functions; access by non-essential Contract operations will be suspended as the direction of the Installation Commander.

1.8.13. Antiterrorism Awareness Level I Training: DoD Contractors or subcontractors without a Common Access Card (CAC) or who do not have access to a government Non-classified Internet Protocol Router Network (NIPRNET) computer performing construction on the installation should consider completing AT Awareness Level I training IAW AFI 10-245, Antiterrorism, Standard 25, by completing the― Force Protection computer based training (CBT) course through the Joint Knowledge Online (JKO) Learning Management System (LMS) at http://jko.jten.mil/courses/atl1/launch.html IMPORTANT: The standalone course MUST be completed on the computer in which it is started. Course progress is not transferable between computers. The standalone course does provide a completion certificate but will not be tracked on JKO and no record will be maintained. AT Awareness Level I Training should be provided by the requiring unit after contract award or the sponsoring organization.

1.8.14. Special Qualifications: Contractor staff involved with system design, configuration, acceptance testing, and Federal Identity, Credential, and Access Management (FICAM) processes corrective maintenance shall have proven competencies and be certified as a Certified Systems Engineer Identity, Credential and Access Management (ICAM) Personnel Access Control System (PACS) (CSEIP) and provide certificates. All certifications must be current and maintained throughout the contract period.

Contractor’s technician names shall be listed on the Registry of Certified System Engineer ICAM PACS. A http://jko.jten.mil/courses/atl1/launch.html link to this registry is below; the link can also be reached by going to the GSA IDManagement.gov web site. https://www.securetechalliance.org/activities-cseip-registry/

1.8.14.1. The contractor shall have on its staff at least two CSCIP/G certified professionals: Certified Smart Card Industry Professional with a specialty in Government smart cards. The Registry of the certified professionals can be found at: https://www.securetechalliance.org/activities-leap-cscip-registry/#cscipg_registry.

1.8.14.2. The contractor shall have an enterprise level dealership for the manufacturer of purposed solution and the contractor’s on-site staff shall have valid PACS manufacturer training and certification.

1.8.14.3. Contractor must be a pivCLASS certified reseller as issued by HID Global.

1.8.14.4. Contractor must hold a certification to the ISO 9001:2015 standard, an internationally recognized standard that sets out the requirements for a quality management system (QMS).

1.8.14.5. The contractor shall be a specialist in maintaining all the security equipment currently installed at the JPED. The contractor should be an active certified Vindicator dealer and have factory trained technicians to configure and maintain the system. On-site contractor (technician) personnel shall possess an in-depth knowledge and should have experience with the maintenance and service of existing Vindicator IDS Security Management. Technicians shall have requisite skills and certifications to perform the maintenance, installation, operations, and administrative tasks associated with systems mentioned above.

1.8.15. Post Award Conference/Periodic Progress Meetings: The Contractor agrees to attend any post award conference convened by the contracting activity or contract administration office IAW Federal Acquisition Regulation Subpart 42.5. The CO, COR, and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor's performance. At these meetings the CO will apprise the contractor of how the government views the contractor's performance and the contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the government.

1.8.16. COR: The COR will be identified by separate letter. The COR monitors all technical aspects of the contract and assists in contract administration The COR is authorized to perform the following functions:

assure that the Contractor performs the technical requirements of the contract: perform inspections necessary in connection with contract performance: maintain written and oral communications with the Contractor concerning technical aspects of the contract: issue written interpretations of technical requirements, including Government drawings, designs, specifications: monitor Contractor's performance and notifies both the CO and Contractor of any deficiencies; coordinate availability of government furnished property, and provide site entry of Contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the Contractor, states the responsibilities and limitations of the COR, especially regarding changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting order.

1.8.17. Key Personnel: The COR will be the CO’s authorized representative in monitoring the contract. The Contractor’s representative shall be available to discuss any problems that the Contractor’s personnel may be experiencing during the performance of this contract. Problems experienced by the Government with the https://www.securetechalliance.org/activities-cseip-registry/ https://www.securetechalliance.org/activities-leap-cscip-registry/#cscipg_registry https://www.securetechalliance.org/activities-leap-cscip-registry/#cscipg_registry

Contractor’s performance will be discussed and resolved. Unresolved problems will be referred to the CO for resolution.

CO:

Victoria H. Barra 436th Contracting Squadron Phone: 302-677-5033 Email address: victoria.barra@us.af.mil

Contract Specialist:

2d Lt Travis D. Ambrose 436th Contracting Squadron Phone: 302-677-5033 Email address: travis.ambrose.1@us.af.mil

436 CONS/PKB Org Box:

Email Address: 436CONS.PKB.ORG@us.af.mil

COR:

Jared L. Popp

JPED

Phone: 302-346-7961 Email address: jared.l.popp.civ@army.mil

Alternate COR:

Matthew M. Moye

JPED

Phone: 302-346-7980 Email address: matthew.m.moye2.civ@army.mil

1.8.18. Identification of Contractor Employees: All contract personnel attending meetings, and/or working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. They must also ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed.

1.8.19. Data Rights: The Government has unlimited rights to all documents/material produced under this contract. All documents and materials, to include the source codes of any software, produced under this contract shall be Government owned and are the property of the Government with all rights and privileges of ownership/copyright belonging exclusively to the Government. These documents and materials may not be used or sold by the contractor without written permission from the CO. All materials supplied to the Government shall be the sole property of the Government and may not be used for any other purpose. This right does not abrogate any other Government rights.

1.8.20. Safety: In order to provide safety control for protection to the life and health of employees and other persons; for prevention of damage to property, materials, supplies and equipment; and for avoidance of work interruptions in the performance of this contract, the Contractor shall comply with Occupational Safety and Health Act (OSHA) and all pertinent provisions of publication 29-Code of Federal Regulations (CFR) 1910. The contractor shall formulate and submit within 30 days after the conditional contract award date a written safety plan for acceptance by the government.

1.8.20.1. The Contractor shall train their personnel to recognize fire and safety hazards and encourage personnel in the performance of their duties to report fire and safety hazards and unsafe conditions to their mailto:victoria.barra@us.af.mil mailto:travis.ambrose.1@us.af.mil mailto:436CONS.PKB.ORG@us.af.mil mailto:jared.l.popp.civ@army.mil mailto:matthew.m.moye2.civ@army.mil supervisor. The Contractor shall take corrective action to remedy reported deficiencies IAW terms of this contract. The COR shall be notified of deficiencies beyond the terms for this contract.

1.8.20.2. The Contractor shall comply will all local, State, and Federal environmental and occupational safety laws, rules, and regulations. Any apparent conflict between compliance with such local, State, and Federal laws, rules and regulations, and compliance with the requirements of the contract shall be immediately brought to the attention of the CO or authorized representative for final resolution. The Contractor shall notify the CO or authorized representative in writing in addition to any verbal notification of such conflicts. The Contractor shall be liable for all fines, penalties, and costs which result from violations of, or failure to comply with, all such local, State, or Federal laws, rules, and regulations. All unsafe acts or conditions fostered by the Contractor or Contractor personnel may be grounds for the CO or authorized representative to halt any and all Contractor performance with a commensurate deduction of monies due the Contractor until such unsafe conditions are corrected. The Contractor shall take due caution not to endanger personnel during performance of this contract. Upon discovery of a serious hazard such as, but not limited to, fall, electrical, fire, or amputation, the Contractor shall notify the CO or authorized designated representative.

1.8.20.3 The Contractor shall immediately correct all safety deficiencies upon notification of the deficiencies by the KO or COR and shall notify the KO or COR of the corrective action to be taken.

1.8.21. Operational Security (OPSEC):

1.8.21.1 Avoid revealing or discussing information/media related to work conducted on/for the installation to any persons without a valid need to know and adhere to a 100% shred policy when discarding written/printed materials.

1.8.21.2 Contractors or subcontractors possessing a Common Access Card (CAC) will complete DAF- Operations Security Awareness Training (CBT) course through the MyLearning site. This training site is available through the AF Portal at https://lms-jets.cce.af.mil/moodle/. This site automatically records members completion of training and enables the user to print a certificate if needed by the Unit or Base Training Manager.

1.8.21.3 For contracts that require additional OPSEC measures, elevated security requirements will be conducted utilizing DD Form 254, Department of Defense Contract Security Classification Specification and appropriately annotated IAW DODM5220.22V2_AFMAN 16-1406v2, NATIONAL INDUSTRIAL

SECURITY PROGRAM: INDUSTRIAL SECURITY PROCEDURES FOR GOVERNMENT

ACTIVITIES. Additionally, if the OPSEC block is checked on the DD Form 254, the 436th Contracting Squadron unit OPSEC coordinators shall: Task the contractor to develop an OPSEC program plan to address how the contractor plans to protect critical and sensitive contracted information, and upon organization acceptance, implement an OPSEC program plan crafted for nature of work and operational concerns.

1.8.21.4. The contractor must immediately notify the Government/COR upon the discovery of any non-conformance with OPSEC requirements.

1.8.22 Records Management: The contractor understands that when creating, handling and maintaining records for the Air Force, either electronic or paper, you must meet the requirements established in AFRIMS Records Disposition Schedule (RDS), AFI 33-322, Records Management Program. In order to meet the requirement established IAW the above-mentioned regulations, contact the Base Records Management Office (436 CS/SCXK, Bldg. 310) at 302-677-5157 for guidance and training.

Part 2

APPLICABLE PUBLICATIONS

3. APPLICABLE PUBLICATIONS (CURRENT EDITIONS)

3.1. The Contractor must abide by all applicable regulations, publications, manuals, and local policies and procedures.

3.1.1. Department of Defense Instruction 5200-8, Incorporating Change 3, Effective 20 Nov 15, Security of DoD Installations and Resources and the DoD Physical Security Review Board (PSRB).

3.1.2. Federal Information Processing Standard Publication 201-2, Personal Identity Verification (PIV) of Federal Employees and Contractors, August 2013.

3.1.3. Homeland Security Presidential Directive 12, Policy for a Common Identification Standard for Federal Employees and Contractors, 27 August 2004.

3.1.4. NIST Special Publication 800-53, Security and Privacy Controls for Federal Information Systems and Organizations, March 2019.

3.1.5. Department of Defense Instruction 8500.01, Cybersecurity, October 2019.

3.1.6. Department of Defense Instruction 8510.01, Risk Management Framework (RMF) for DoD Information Technology (IT),” March 2014.