Attachment 1 - Performance Work Statement PWS.pdf

PWS AWC Information Systems Security Officer

16 Jul 24 P a g e 1 of 18

Information System Security Officer

Performance Work Statement (PWS)

Date: 16 JULY 24

16 Jul 24 P a g e 2 of 18

1.0. Introduction: Work is to be accomplished for the U.S. Air Force (USAF), Air University (AU) and Air War

College (AWC), Maxwell Air Force Base (AFB), Alabama, herein referred to as the Client.

2.0. Background: AWC (hereafter referred to as the Client) has a defined requirement for non-personal- services to assist the ISSM and oversees their respective facility’s information assurance program and ensure information security considerations are integrated into programming/planning/budgeting cycles, enterprise architectures, and acquisition/system development life cycles of their respective areas of responsibilities. They must ensure all systems on their site have an Authorization to Operate and that they meet all security controls not met by IC systems’ enclave Core Services.

3.0. Purpose: The purpose of this requirement is to provide support and expertise in the following areas:

3.1. Meet the responsibilities of the Information System Security Manager (ISSM) in the event an ISSM is not present/available.

3.2. Maintain certification per DoDM 8140.03

3.3. Manage and configure Tier 1 thru 3 adminstrator access, as defined by the Office of the National

Couterintelligence Executive (OCNIX) in EIS 00514 to IC Information Technology Enterprise (ITE)

Information Technology (IT) component networks, systems and applications as described in the policy section.

3.4. Conduct periodic reviews for privileged user accounts quarterly IAW with NIST SP 800-53; Security

Controls AC-2 Access Control and CM-5(5) Access Restrictions for change.

3.5. Archive all completion of security awareness and training records as listed in section 8.2 for each user and AF IC Privileged Access Agreenent (Attachment 13).

3.6. Participate in all Configuration Management Boards.

3.7. Follow established policy in ICD 503 – “InformationTechnology System Security Risk management, certification and Accreditation”.

3.8. Follow established policy in CNSSP-22 – “Information Assurance Risk Management for National

Security Systems”.

3.9. Responsible for responding to information system spills and breaches.

3.10. Access to classified information and systems.

4.0. Objective: AWC (hereafter referred to as the Client) has a defined requirement for non-personal- services to assist the ISSM and oversees their respective facility’s information assurance program and ensure information security considerations are integrated into programming/planning/budgeting cycles, enterprise architectures, and acquisition/system development life cycles of their respective areas of responsibilities. They must ensure all systems on their site have an Authorization to Operate and that they meet all security controls not met by IC systems’ enclave Core Services

5.0. Scope: The contractor shall provide executive/administrative management and consulting functions to the

Client as well as overall support management of the Information Systems Security Officer in accordance with this PWS.

6.0. Performance Requirements:

6.1. Must have demonstrated knowledge and expertise in administrative support as evidenced by:

6.1.1. Minimum 3 years of experience in facility’s information assurance program.

6.1.2. Demonstrated mastery of Microsoft Office software.

6.1.3. Must have and be able to maintain a Top Secret/SCI clearance.

16 Jul 24 P a g e 3 of 18

6.2 Perform administrative organizational calendar maintenance for Client personnel and contractors in support of Information Systems Security Officer client activities, including internal meeting arrangements.

6.3 Research, prepare, present, and participate in meetings, reviews, briefings, and teleconferences/Video teleconferences (VTC).

6.4 Develop, manage, and maintain documentation for Standard Operating Procedures (SOP) necessary to execute the contractor’s program support activities in accordance with the existing GCA Continuity of

Operations (COO) plan. The contractor will provide a current version of this documentation that reflects current procedures to the Client in standard electronic format semi- annually, with the last provision occurring no later than one week prior to the end of the period of performance. (A001)

6.5 Perform Security control continuous monitoring, security audits, risk analysis and developing mitigation strategis for DoD information systems.

6.6 Conduct and document information seucirty compliance reviews.

7.0. Quality Control Plan: The contractor shall establish and maintain a complete Quality Control Plan (QCP) to ensure the requirements of the contract are provided as specified. One copy of the contractor's QCP shall be provided to the contracting officer not later than 30 days after the post award date and an updated copy must be provided to the contracting officer as changes occur throughout the life of the contract. The QCP must include staffing to ensure that the required position listed above will have adequate coverage when required. (A003)

8.0. Required Deliverables: The contractor shall comply with the documentation requirements in the Contract

Data Requirements List (CDRL) (see Table 8.1) and provide the Client all deliverables per the CDRL formats, quantities, and timelines. The contractor shall document provision of deliverables using DD Form 1423-1, Contract Data Requirements List. For those deliverables that are due from the contractor per a Client-approved timeline, the Client will coordinate the required timeline for each deliverable with the contractor to establish a project plan with deliverable dates. The projected workload hours in Paragraph 5.0. are intended to account for the contractor’s workload required to fulfill deliverables due per Client-approved timeline. The contractor shall be responsible for providing the following CDRL deliverables to meet the documentation requirements for services performed that are described in this PWS.

The contractor shall prepare the documents below described as the CDRL dictates in accordance with the following list:

TABLE 8.1.

CDRL Acronym Description Due Date From Contractor Quantity Due from

Contractor

A001

Standard

Operating

Procedures

(SOP)*

Maintained and kept current to reflect existing activities and requirements in accordance with the

GCA continuity of operations plan

(PWS 6.4.)

Semi-annually, with the last provision occurring no later than one week prior to the end of the period of performance

1 Soft Copy

(common format, HTML, word, pdf, etc.)

& 1 Hard Copy

16 Jul 24 P a g e 4 of 18

TABLE 8.1.

CDRL Acronym Description Due Date From Contractor Quantity Due from

Contractor

A002 Monthly Status

Report (MSR).

The contractor shall identify and report all program management actions and the financial management status in a Monthly

Status Report (MSR), and as requested by the Client. (PWS 3.2.)

Delivery within fourteen (14) calendar days following the close of the calendar month

1 Soft Copy

A003 Quality Control

Plan (QCP)

The contractor shall establish and maintain a complete Quality Control

Plan (QCP) to ensure the requirements of the contract are provided as specified. The QCP must include staffing to ensure that the required position listed in paragraphs 3.0. will have adequate coverage when required. (PWS 9.0.)

One copy of the contractor's

QCP shall be provided to the contracting officer not later than 30 days after the post award date and an updated copy must be provided to the contracting officer as changes occur throughout the life of the contract.

1 Soft Copy

*The Vendor may include inputs in, or append them to, documents prepared by other vendors, as practical and appropriate, to avoid redundant work.

9.0. Monthly Status Report: The contractor shall identify and report all major program management actions and the financial management status in a Monthly Status Report (MSR), and as requested by the Client. Report shall be due fourteen (14) calendar days following the close of the calendar month. An invoice may not be used in lieu of any portion of this report. This report shall be electronically delivered to the COR and, at a minimum, contain the following information: (A002)

9.1 Task order number

9.1.1 Task order title

9.1.2 Reporting period

9.1.3 Brief description of requirements, to include the status of the service/material (e.g., in progress, complete), estimated completion dates of in-progress tasks, the name of organization/unit for which the service/material was provided, and the name of the contractor employee performing the service

9.1.4 Significant events occurring during the reporting period,

9.1.5 Any current or anticipated problems

9.1.6 Staffing changes

9.1.7 Brief Summary of activity planned for the next reporting period

9.1.8 Description of any travel or unique services provided

9.1.9 Deliverable summary (deliverable name, due date, % completed, submittal date, comments)

16 Jul 24 P a g e 5 of 18

Note: Travel charges must include the traveler’s name, dates of travel, destination, purpose of travel and cost for each trip.

Service Summary:

Performance Objective PWS Para

Performance Threshold Method of

Assessment

High Quality Technical

Performance

6.1, 6.4, 6.5, & 6.6 Contractor delivery of products and/or services meets all task order requirements.

Performance occurs with no required rework/re-performance at least 90% of time.

Problems that are encountered are minor and resolved in a satisfactory manner.

Costumer

Complaint/Feedback

Adherence to Schedule 6.2 & 6.3. Contractor meets task order delivery requirements at least 90% of the time

(excluding Government caused delays).

Periodic Assessment/ Inspection

Control of Labor Resources

6.5 Actual task order labor resource mix is

maintained within 10% of originally awarded task order resource mix.

Costumer Complaint/Feedback

Inspections 6.6 Contractor meets requirements within 60 day notice with at least 90% accuracy (excluding

Government caused delays).

Periodic Assessment/ Inspection

10.0. Task Order Terms and Conditions:

10.1. Place of Performance: The Place of Performance is Maxwell AFB. The work will be performed will be spilt between two of the customers facilities; building 1401 and building 800 on Maxwell AFB, Alabama. On-site personnel may temporarily perform work at other locations (TDY, alternate work locations, etc.) with Contracting Officer approval. On-site, the Customer will provide dedicated work spaces, Air Force standard desktop configuration computers, and office supplies.

10.2. Hours of Operation: The normal on-site full-time work schedule will consist of eight working hours each day, Monday through Friday, between 8:00 a.m. and 5:00 p.m. local time (excluding Federal holidays and base closures). Variations will require prior written approval by the Contractor Officer’s

Representative (COR) and the Program Manager (PM).

10.3. Clearances:

10.3.1. Facility Security Clearance Requirements: The Contractor must possess or obtain an appropriate facility security clearance as identified below prior to performing work on a classified Government contract: (X) Top Secret ( ) Secret

16 Jul 24 P a g e 6 of 18

10.3.2. Personnel Security Clearance Requirement: The personnel performing work on this contract will require a current security clearance as identified below: (X) Top Secret ( )

Secret

10.3.3. Security Manager Appointment: The contractor must provide an on-site security point of contact to the host information protection office IAW DoDM 5220.22v2_AFMAN 16-

1406, section 3.8.a(4)(a).

10.3.4. Visit Request: Contractors participating in the National Industrial Security Program will use Defense Information System for Security (DISS) to send Visit Request the unit security assistant. Send Visit Request to SMO Code: SSO – AU.

Each contractor performing work on the contract will require a separate SMO Code Visit

Request from the contractor. The visit request must include all prime and subcontract workers on the contract. Visit Requests will need to be renewed each time there are employee changes or a change of period of performance.

Note: The contractor’s Facility Security Office is responsible for initiating the required security clearance or verifying personnel for this contract have a current security clearance.

10.4. Travel: Travel may be required in performance of this PWS for operational purposes determined by the Client.

11.0. Security Requirements

11.1. Facility Security Clearance requirements: The Contractor must possess or obtain an appropriate facility security clearance as identified below prior to performing work on a classified Government contract:

( X ) Top Secret

( ) Secret

( ) Confidential

If contractor does not possess a facility clearance, the government will request one.

11.2. Personnel Security Clearance Requirements: The personnel performing work on this contract will require a current security clearance as identified below:

( X ) Top Secret/Sensitive Compartmented Information

( ) Top Secret

( ) Secret:

( ) Confidential

Note: If the security clearance varies by position, indicate the clearance requirements for each of the different contractor positions listed by title and clearance requirement.

The contractor’s Facility Security Office is responsible for initiating the required security clearance or verifying personnel for this contract have a current security clearance.

16 Jul 24 P a g e 7 of 18

11.3.As prescribed by DAFFARS 5352.204-9000, Notification of Government Security Activities, this contract contains a DD Form 254, DOD Contract Security Classification Specification, and requires performance at a government location in the U.S. or overseas. Prior to beginning operations involving classified information on an installation identified on the DD Form 254, the contractor shall take the following actions. At least thirty days prior to beginning operations, notify the Information Protection

Office shown in the distribution block of the DD Form 254 as to:

11.3.1. The name, address, and telephone number of this contract company’s representative and designated alternate in the U.S. or overseas area, as appropriate.

11.3.2. The contract number and military contracting command.

11.3.3. The highest classification category of defense information to which contractor employees will have access.

11.3.4. The Department of the Air Force installations in the U.S. (in overseas areas, identify only the APO number(s)) where the contract work will be performed.

11.3.5. The date contractor operations will begin on base in the U.S. or in the overseas area.

11.3.6. The estimated completion date of operations on base in the U.S. or in the overseas area.

11.3.7. Any changes to information previously provided under this clause.

11.4.Obtaining and Retrieving Identification Media: As prescribed by the DAFFARS 5352.242- 9000, Contractor access to Air Force installations, DAFFARS 5352.242-9001, Common Access Cards

(CAC) for Contractor Personnel, and FAR 52.204-9, Personal Identity Verification of Contractor

Personnel, the contractor must comply with the requirements set forth in these guidance.

11.4.1. The contractor shall obtain base identification and vehicle passes, if required, for all contractor personnel who make frequent visits to or perform work on the Air Force installation(s) cited in the contract. Contractor personnel are required to wear or prominently display installation identification badges or contractor-furnished, contractor identification badges while visiting or performing work on the installation.

11.4.2. The contractor shall submit a written request on company letterhead to the contracting officer listing the following: contract number, location of work site, start and stop dates, and names of employees and subcontractor employees needing access to the base. The letter will also specify the individual(s) authorized to sign for a request for base identification credentials or vehicle passes. The contracting officer will endorse the request and forward it to the issuing base pass and registration office or Security Forces for processing. When reporting to the registration office, the authorized contractor individual(s) should provide a valid driver’s license, current vehicle registration, valid vehicle insurance certificate to obtain a vehicle pass. Government ID card holders may not use their credentials to sponsor an individual on to the base to perform work that’s been contracted to an official contractor.

11.4.2.1. When work under this contract requires unescorted entry to controlled or restricted areas, the contractor shall comply with AFLCMC/GB Security OI, DAFI 31-101, Integrated Defense, and DODM 5200.02_DAFMAN 16-1405, Air Force Personnel Security Program.

11.4.3. Common Access Cards (CACs). For contractors who require a CAC, contractors shall provide a listing of personnel who require a CAC to the contracting officer. The government will provide the contractor instruction on how to complete the Trusted

16 Jul 24 P a g e 8 of 18

Associate Sponsorship Systems (TASS) application and then notify the contractor when approved. Contractor personnel shall obtain a CAC from the nearest Real Time

Automated Personnel Identification Documentation System (RAPIDS) Issuing Facility

(typically the local Military Personnel Flight (MPF)). While visiting or performing work on installation(s)/location(s), contractor personnel shall wear or prominently display the

CAC as required by the governing local policy.

11.4.4. During performance of the service, within 7 working days of any changes to the listing of the contract personnel authorized a CAC, provide an updated listing to the contracting officer who will provide the updated listing to the authorizing government official.

Return CACs in accordance with local policy/directives within 7 working days of a change in status for contractor personnel who no longer require logical or physical access.

11.4.5. Upon completion of the contract, termination of the contract, or expiration of the identification passes/CAC, the prime contractor shall ensure that all base identification passes/CACs issued to employees and subcontractor employees are returned to the contracting official representative or the issuing office within seven (7) working days.

Contractor shall report any lost or stolen CACs. Failure to return all government issued identification upon termination of contract or service, termination of employees, or expiration of the identification may result in withholding of final payment.

12.0. Computer and Network Access Requirements: Contractor personnel that required access to classified government computers and operations systems Information Technology (IT) Systems are required to have the appropriate security clearance. Account access will be processed through the local organizations Information

System Security Officer (ISSO) and the local communications squadron.

12.1. Contractor personnel that only require access to unclassified government computers and operations systems Information Technology (IT) Systems will be designated as Non-sensitive Positions.

Contractor personnel must have at a minimum a Tier 1 and the Tier 1 be favorability adjudicated before operating government furnished computer workstations or systems that have access to Air

Force e-mail systems. These investigations shall be submitted by the government at no additional cost to the contractor. NOTE: Since the background investigation process can take up to 18 months, contractor personnel may be issued a CAC before the process is completed after a favorable fingerprint return (3-5 working days) and investigation package submitted to the investigative service provider and the investigation is scheduled.

12.2. These investigations shall be submitted by the Government at no additional cost to the Contractor.

The servicing Information Protection Office (IPO) is responsible for submitting Tier 3 and Tier 5 investigations for contractor personnel in positions designated as “national security positions” but without a requirement for access to classified information. The servicing IPO will submit these investigation requests based on contract requirements, which will be validated through the Office of

Personnel Management’s Position Designation Tool (PDT). The Contractor shall comply with DoDM

5200.02_DAFMAN 16-1405, Air Force Personnel Security Program; and AFI 10-701, Operations

Security (OPSEC) instructions, OUSD(I) Memorandum, Clarification of Clearance Requirements for

Access to Investigative and Adjudicative Relevant Data, 27 Jun 2019, and DoDI 5200.46, DoD

16 Jul 24 P a g e 9 of 18

Investigative and Adjudicative Guidance for Issuing the Common Access Card, and Homeland

Security Presidential Directive-12 (HSPD-12) requirements.

12.3. Contractor personnel will complete the current DoD IAA CyberAwareness Challenge course located in the Air Force Learning Management System (LMS) or https://public.cyber.mil/training/cyber-awareness-challenge/.

13.0. Visitor Group Local Security Policies: For contractors with a performance on base of more than 90 days:

The Wing Information Protection Office will provide the Visitor Group contractor with a VGLSP identifying specific security requirements how the contractor integrates security requirements for contract operations with the Air Force to ensure classified information is properly safeguarded and to protect national security.

14.0.Information Security: Contractors performing duties associated with this contract must adhere to all the standards for protecting classified information as specified in DoDM 5200.01, volumes 1-3, DoD Information

Security Program, DoDM5200.01 Volume 3_DAFMAN16-1404 Volume 3, Information Security Program

Protection of Classified Information and all applicable supplements and operating instructions.

15.0. Unescorted Entry to Secure Rooms: Contractor personnel requiring unescorted entry to secure rooms must have a current Top Secret or Secret clearance and will be granted by the program manager and secure room monitor and will adhere to DoD 5200.02-DAFMAN 16-1405, Air Force Personnel Security Program, and

DoDM 5200.01 Vol 1-3, DoDM 5200.01 Volume 3_DAFMAN16-1404 Volume 3, Information Security

Program Protection of Classified Information and all applicable supplements and operating instructions.

Contractor personnel shall be the subject of a favorably adjudicated Tier 3 investigation to qualify for unescorted entry to a secure room. Contractor personnel shall contact their Contracting Officer Representative and the appropriate Secure Room Monitor for permission.

16.0. SIPRNet Access: Contractors must have a current Secret security clearance and complete Derivative

Classification and Marking Classified Information training. The Derivative Classification course #IF103.16 and

Marking Special Categories of Classified Information Course IF105.16are available at the Defense Security

Service Center for Development of Security Excellence (CDSE) Security Awareness Hub at:

• Derivative Classification Course #IF103.16 - Annually https://securityawareness.usalearning.gov/derivative/index.htm

• Marking Special Categories of Classified Information Course IF105.16 - One Time https://securityawareness.usalearning.gov/markings/index.htm

Training certificate(s) must be provided to the unit security assistant prior to granting access to the

SIPRNet. Derivative Classification training must be completed annually. Marking Special Categories of

Classified Information course is completed one time.

17.0. Access Lock Combinations: Access lock will be protected from unauthorized personnel. The contractor will adhere to the Air Force activity operating instructions ensuring lock combinations are not revealed to unauthorized persons and ensure the procedures are implemented. The contractor is not authorized to record lock combinations without written approval by the government functional director or area chief.

https://securityawareness.usalearning.gov/derivative/index.htm https://securityawareness.usalearning.gov/markings/index.htm

16 Jul 24 P a g e 10 of 18

18.0. Security Combinations: Combinations to security containers, secure rooms, or vaults are classified information and shall be marked and safeguarded at the highest classification level as the classified material maintained inside the approved containers. Only contractor employees, who have the proper security clearance and need-to-know, will be given combinations to security containers, secure rooms, or vaults. Contractor employees are responsible for properly safeguarding combinations. Contractor employees will not record security containers, secure rooms, or vaults combinations without written approval by the government functional director. Contractors will not change combinations to security containers, secure rooms, or vaults without written approval by the security officer and the government functional director.

19.0. Freedom of Information Act Program (FOIA): The contractor shall comply with DODM

5400.07_AFMAN 33-302, DoD Freedom of Information Act (FOIA) Program, requirements. The regulation sets policy and procedures for the disclosure of records to the public. The contractor shall comply with AFI 33-

332, Air Force Privacy and Civil Liberties Program, when collecting and maintaining information protected by the Privacy Act of 1974 authorized by Title 10, United States Code, section 8013. The contractor shall maintain records in AFI 33-322, Records Management and Information Governance Program; and disposed of in accordance with Air Force Records Information Management System (AFRIMS) Records Disposition

Schedule (RDS) located at https://www.my.af.mil/gcss-af61a/afrims/afrims/.

20.0. Controlled Unclassified Information (CUI): The contractor shall comply with DoDI 5200.48_DAFI 16-

1403, Controlled Unclassified Information, DoDM 5200.01v1_AFMAN 16-1404v1, Information Security

Program, and Freedom of Information Act Program. The contractor shall monitor CUI aggregation and compilation based on the potential to generate classified information pursuant to security classification guidance addressing the accumulation of unclassified data or information.

20.1.1. All CUI associated with this contract must be safeguarded to prevent unauthorized public disclosure. CUI such as PII, Security Classification Guides (SCG), and other technical information with Distribution Statements B, C, D, E or F are not authorized for public release and cannot be placed on a publicly accessible web site or web server. All emails containing such information or attachments must be appropriately marked, and digitally signed and encrypted if being transmitted. All transmissions to personal email accounts (AOL, Yahoo, Hotmail, Comcast, etc.) and posting on social media websites

(Facebook, Instagram, Twitter, LinkedIn, etc.) are prohibited. Destroy all CUI associated with this contract by any of the following approved methods: A cross-cut shredder (that produce 1mm x 5mm or 0.04in x 0.2in particles or smaller); a certified commercial destruction vendor; a central destruction facility; incineration; chemical decomposition;

pulverizing, disintegration (pulverize or disintegrate with a 3/32in or 2.4mm security screen); or methods approved for classified destruction.

20.2. General: There are types of information that are not classified but require application of access and distribution controls and protective measures developed for DoD Controlled Unclassified Information for a variety of reasons. The types of CUI identified for the program are identified in DODI 5200.48 and have replaced legacy formats such as For Official Use Only (FOUO), Law Enforcement Sensitive

(LES), as well as some of those developed by other Executive Branch agencies of the U.S.

Government and technical data described below as well as protective measures for CUI material.

https://www.my.af.mil/gcss-af61a/afrims/afrims/

16 Jul 24 P a g e 11 of 18

Formats such as FOUO, LES, et al. are legacy formats no longer in use but are protected as if they have CUI markings. Protections and restrictions can be found in DoDI 5200.48, CUI 06 March 2020.

20.3. Technical Data Description: Any recorded information related to experimental, developmental, or engineering works that can be used to define an engineering or manufacturing process, or can be used to design, procure, produce, support, maintain, operate, repair, or overhaul program material. The data may be graphic or pictorial delineations in media (e.g., computer software, drawings, photographs, etc.), text in specifications, related performance or design documents, or computer printouts. Examples of technical data include research and engineering data, engineering drawings, and associated lists, specifications, standards, process sheets, manuals, technical reports, catalog-item identifications, related information, and computer software documentation. The DoD Scientific and Technical

Information Program (see DoDI 3200.12.).

20.4. CUI Markings: Prescribed marking of CUI documents will be in accordance with DoDI 5200.48, CUI 06 March 2020. CUI may also be identified in security classification guides to ensure the information receives appropriate protection.

20.5. Access: CUI may be released to an individual who has a valid need for such access within the scope of their assigned duties, furthering the accomplishment of a lawful and authorized government purpose and would not be detrimental to the interests of the DoD or U.S. Government. Information in any media format will be disseminated on a need-to-know basis. This restricts the use or dissemination of CUI data to those with direct affiliation with the given program/project to conduct official business for the DoD, provided that dissemination is consistent with any further controls imposed by a distribution statement. Personnel no longer requiring access to CUI must surrender any information in their possession to the program lead, who will take action to terminate further access.

20.6. Storing and Handling: During working hours, take reasonable steps to minimize the risk of access to

CUI by unauthorized personnel (e.g., not reading, discussing, leaving CUI information unattended where unauthorized personnel are present or display CUI in public places to include the internet).

After working hours, store CUI information in locked desks, file cabinets, bookcases, locked rooms, locked/controlled e-files or similar means to prevent theft of program information. Computers used to process CUI do not need to be accredited for classified use. Do not process CUI on public computers

(e.g., those available to the public in kiosks, hotels, café’s, etc.) or computers that do not have Public

Key Infrastructure (PKI) access controls. Personally owned computers are not authorized to process

CUI. Authorized electronic devices provided by the government agency (e.g., laptops, cell phone) used to store CUI must be physically protected and use NIST/NIAP-approved cryptographic products, e.g., DoD approved PKI Certification available at http://iase.disa.mil/pki/eca or http://csrc.nist.gov/cryptval/, which require encryption passcodes to teleconferences/web conferences where CUI may be discussed.

20.7. Dissemination: CUI printed documents and material may be transmitted through mail channels or hand-carried without formal courier orders. CUI information may be disseminated to DoD personnel and DoD contractors to conduct official business for the program. If dissemination is required outside of DoD channels contact the program lead, contracting officer, and security manager for approval.

Release of technical data will follow the release instructions identified in the distribution statement.

16 Jul 24 P a g e 12 of 18

Use secure communications whenever available for discussions involving CUI. Send voice and facsimile transmissions only when authorized recipients have acknowledged positive control measures are in place to receive the information.

20.8. Destruction: CUI documents shall be disposed of according to provisions of EO 13556, CUI; DoDI

5200.48, CUI 06 March 2020. Component records management directives. Non-record CUI documents may be destroyed by any methods that prevents compromise, e.g., tearing, burning, or shredding of the means approved for the destruction of classified information or by any other means that would make it difficult to recognize or reconstruct the information.

20.9. Reporting: Report any loss or unauthorized attempt to gain access to CUI information to the organization’s security manager immediately, but no later than the end of the first duty day. If additional information is required after initial notification, guidance will be provided at that time.

20.10. Contractors must complete the DoD Mandatory Controlled Unclassified Information (CUI) training. The CUI training course #IF141.06 at the Defense Security Service Center for Development of Security Excellence (CDSE) Security Awareness Hub at:

DoD Mandatory Controlled Unclassified Information (CUI) Training #IF141.06 – Annually https://securityawareness.usalearning.gov/cui/index.html

21.0. Reporting Requirements: The contractor shall comply with AFI 71-101, Volume-1, Criminal Investigations, and Volume-2, Protective Service Matters, requirements. Contractor personnel shall report to 42 Air Base

Wing Information Protection Office, any information or circumstances of which they are aware may pose a threat to the security of DoD personnel, contractor personnel, resources, and classified or unclassified defense information. Contractor employees shall be briefed by their immediate supervisor upon initial on-base assignment and as required thereafter.

22.0. Physical Security: Areas controlled by contractor employees shall comply with base operations plans/instructions for FPCON procedures, Random Antiterrorism Measures (RAMS) and local search/identification requirements. The contractor shall safeguard all government property, including controlled forms, provided for contractor use. At the close of each work period, government training equipment, ground aerospace vehicles, facilities, support equipment, and other valuable materials shall be secured.

23.0. Internal Operating Instructions: The contractor will adhere to the Air Force activity operating instructions

(OI) for internal circulation control, protection of resources, and to regulate entry into Air Force controlled areas during normal, simulated, and actual emergency operations.

24.0. Traffic Laws: The contractor and their employees shall comply with base traffic regulations set forth in AFI

31-218, Motor Vehicle Traffic Supervision and DoDM 5200.08v3_AFMAN 31-101v3, Installation Perimeter

Access Control. Personnel in violation may be issued a Central Violations Bureau Form 1805 traffic ticket.

25.0. Random Installation Entry/Exit Checks: Entry/exit vehicle checks are conducted by order of the 42 ABW

Commander. These checks are conducted for the purpose of safeguarding the base and protecting government property by discovering and seizing stolen property, classified information, and contraband. Refusal to submit

16 Jul 24 P a g e 13 of 18 to an installation (entry/exit) vehicle check may result in the loss of base driving privileges, revocation of base registration, or debarment action.

26.0. Cellular Phone Operation Policy: The use of cellular phones while operating a motorized vehicle is prohibited on Maxwell-Gunter. Although discouraged, drivers are authorized to use devices, i.e., ear bud or ear boom, which allows their cellular phone to be operated hands-free. The device must not cover both ears. This policy applies to everyone driving on Maxwell-Gunter AFB. Personnel in violation may be issued a Central

Violations Bureau Form 1805 traffic ticket.

27.0. Security Education and Training: The contractor will be required to participate in the government’s in-house and web-based security training program under the terms of the contract. The government will provide the contractor with access to computer-based training at the Air Force MyLearning web site. Contractor personnel are required to complete the following training and any additional training identified by Government

Contracting Agency or Security personnel: Annual Cyber Awareness Training, Force Protection Training

(ZZ133079), and DoD Mandatory Controlled Unclassified Information (CUI) Training.

28.0. Operation Security (OPSEC): The contractor will comply with installation and organizational OPSEC requirements in accordance with AFI 10-701 and applicable supplements. They will also receive a local threat briefing.

29.0. Wireless Electronic Devices: The contractor will not establish their own Information Technology (IT) systems or networks (Local Area Networks [LAN], Wide Area Network [WAN], Cellular phone/USB Modem as WAN, Wi-Fi as WAN, etc.), or camera system without the direct permission of the Program Manager and governing communications and responsible information systems office (42 CS).

30.0. Firearms and Ammunition: Transporting weapons or ammunition, concealed or otherwise, IS NOT permitted by any non-law enforcement personnel on Maxwell AFB/Gunter Annex at any time regardless of state issued concealed weapons permits. Violations may result in criminal prosecution under the applicable federal laws.

31.0. Illegal Weapons. The below weapons are considered illegal, unless specifically authorized by competent authority and are prohibited on Maxwell AFB/Gunter Annex. Violations may result in criminal prosecution under the applicable federal laws.

31.1. Switchblade knives or knives with any type of automatic blade release.

31.2. An incendiary/explosive weapon (e.g., grenades, flash bangs).

31.3. Fireworks

31.4. Homemade mortars, aka "tennis ball launchers" or similar devices.

12.0. Workload Projection. Below is the estimated annual workload based on the requirements in this performance work statement, and indicates a broad range of the expected workload (minimum/maximum) based on historical and future needs. This projection is for orientation purposes only, and is not binding. This is a performance-based acquisition so offers may vary with respect to the labor mix (labor categories/skill levels) and level of effort quoted.

The Government reserves the right to prioritize efforts that may impact the temporal execution of certain activities to

16 Jul 24 P a g e 14 of 18 address emerging requirements or changes to existing requirements. All such changes will incorporate the same contractor capabilities discussed in this document. The Government will approve the specified planned efforts and recommendations for each of the functional areas prior to the contractor beginning any efforts. In addition, the

Government will approve changes to the priorities, levels of effort, etc., within the scope of these requirements.

PWS

Reference

Base

Period

Option

One

Option

Two

6.0 1908 1908 1908

13.0. Appendices

Appendix I Abbreviations and Acronyms

Appendix II Applicable Publications

16 Jul 24 P a g e 15 of 18

3C Cross-Cultural Competence

ADLS Advanced Distributed Learning Service

AF Air Force

AFB Air Force Base

AFCLC U. S. Air Force Culture and Language Center

AFNC Air Force Negotiation Center

AU Air University

AR Academic Centers

ARP Analytics Requirements Panel

AUTV Air University Television

AWC Air War College

BH Blue Horizons

BPA Blanket Purchase Agreement

CCAF Community College of the Air Force

CCB Configuration Control Board

CCC Introduction to Cross-Cultural Communication

CD Compact Disc

CDRP Curriculum Development Requirements Panel

CMS Certification Management Section

COR Contracting Officer Representative

CPARS Contractor Performance Assessment Reporting System

CR Client Representative

CSAT U. S. Air Force Center for Strategy and Technology

CSI Contract Support Item

CSP Cultural Studies Project

CSDS U. S. Air Force Center for Strategic Deterrence Studies

DLPT Defense Language Proficiency Test

DoD Department of Defense

DOE Department of Energy

DTS Defense Travel System

ECFG Expeditionary Culture Field Guide

EMS Education Management System

ES Education Section

EST Expeditionary Skills Training

PAC Pre-deployment/Assignment Acculturation Course

ILR Interagency Language Roundtable

IRAs Interface Requirement Agreements

ISD Instructional System Development

IT/NSS Information Technology/National Security Systems (IT/NSS)

ITC Introduction to Culture

JAD Joint Application Design/Development

JAR Java Archives

JDBC Java Database Connectivity

LEADER Language Enabled Airmen Development Resource

16 Jul 24 P a g e 16 of 18

LEAP Language Enabled Airman Program

LDM Logical Data Models

LITE Language Intensive Training Event

LREC Language, Regional Expertise, and Culture

LRCN Language, Region, Culture, and Negotiation

MAJCOM Major Command

MilPDS Military Personnel Data System

MOA Memoranda of Agreement

MOU Memoranda of Understanding

MSR Monthly Status Report

NSSC National Space Studies Center

OL Operating Location

ORP Outreach Requirements Panel

PME Professional Military Education

PPIRS Past Performance Information Retrieval System

PWS Performance Work Statement

QCP Quality Control Plan

QEP Quality Enhancement Plan

SACS Southern Association for Colleges and Schools

SCORM Shareable Content Object Reference Model

SEB Security and Effects Branch

SEI Special Experience Identifier

SLC Strategic Leadership Communication

SME Subject Matter Expert

USAF U. S. Air Force

WMD Weapons of Mass Distruction

Appendix II

Publications

Publications and forms applicable to the PWS are listed below. The Contractor is obligated to follow these publications. These publications are available at http://www.e-publishing.af.mil/ and maintained by AF publishing.

The Client has coded publications as mandatory (M) or advisory (A). The contractor shall follow those publications coded as mandatory to the extent (that is, the specific procedure in a paragraph, section, chapter or volume) specified in the PWS. The contractor shall be guided by those coded advisory to the extent necessary to meet requirements in this PWS. The Client may issue supplements or amendments to listed publications from any organizational level during the life of the contract. It is the responsibility to use the most current version of all publications. The contractor shall immediately implement those changes in publications that result in a decrease or no change in the contract price. Before implementing any such revision, supplement, or amendment that will result in an increase in contract price, the contractor shall submit to the Contracting Officer (CO) a price proposal for approval. Price proposals shall be submitted within 30 calendar days from the date the contractor receives notice of the revision, supplement, or amendment giving rise to the increase in cost of performance. The Client will consider changes in the contract price due to supplements and amendments shall be considered under the FAR 52.212-4 "Contract Terms and Conditions-Commercial Items" clause. The Client will continue to supply the government forms needed for daily operations. Upon completion of the contract, the contractor shall return to the Client all issued publications and unused forms.

M = Mandatory Guidance, A = Advisory or Supplemental Information

16 Jul 24 P a g e 17 of 18

The following documentation will provide all needed background to offer insight and direction.

Reference Number Title (and Website, if applicable) Date M/A Applicable

Paragraph

AFI 36-

2909_AETCSUP

Air Force Professional Relationship and Conduct

27 Oct 2020 A Chapter 2

AFI 10-701 Operations Security (OPSEC)

Instructions

24 Jul 2019 M All

DAFI 31-101 Integrated Defense 25 Mar 2020 M

DoDM 5220.32v1 National Industrial Security Program:

Industrial Security Procedures for

Government Activities

1 Aug 2018, Change 2, 10

Dec 2021

A

DAFI 16-1401 Information Security Program 3 Feb 2023 A

DoDM

5200.02_DAFMAN

16-1405

Department of the Air Force Personnel

Security Program

29 Nov 2023 A

DoDM

5200.01_DAFMAN

16-1404

Department of the Air Force

Information Security Program, Vols 1-

M

DoDM

5220.22v2_AFMAN

16-1406v2.

NATIONAL INDUSTRIAL

SECURITY PROGRAM:

INDUSTRIAL

SECURITY PROCEDURES FOR

GOVERNMENT ACTIVITIES

8 May 2020 M All

AFM 17-1203 INFORMATION TECHNOLOGY (IT)

ASSET MANAGEMENT (ITAM)

21 Jan 2022 M All

AFI 17-130 Cybersecurity Program Management 13 Feb 2020 M

AFI 33-332 Air Force Privacy and Civil Liberties

Program

10 Mar 2020, Corrective

Actions, 12 May

M

DAFI 36-3026, Vol 1 Identification Cards for Members of the

Uniformed Service, Their Family

Members, and Other Eligible Personnel

1 Jun 2023, DAFGM2024-

01, 16 Jan 2024

M

DAFI 36-3026, Vol 2 Common Access Card (CAC) 24 Jan 2023 M

AFI 71-101 Vol 1 Criminal Investigations and Vol

2 Protective Security Matters

1 Jul 2019

21 May 2019

M

AFPD 16-14 Information Security 31 Dec 2019 M

DoDM 5200.01 Information Security Program, Vols 1-

4, and Enclosure 5

24 Feb 2012, Change Dates 27

Jul 2020

M All

DoDM 5200.02 Procedures for the DoD Personnel

Security Program (PSP)

3 Apr 2017, Change , 29 Oct

M

DoDI 5200.48 Controlled Unclassified Information 6 Mar 2020 M All

DoDI 5200.48_DAFI

16-1403

Controlled Unclassified Information 5 Oct 2021 M All

32 CFR, Part 117, National Industrial Security Program

Operating Manual (NISPOM)

21 Dec 2020 M All

16 Jul 24 P a g e 18 of 18

Reference Number Title (and Website, if applicable) Date M/A Applicable

Paragraph

AFI 33-322 Records Management and Information

Governemence Program

23 Mar 2020, Change 1, 28 Jul

M All

DAFH 36-2675 Information for Designers of

Instructionsal Systems

15 Apr 2022 A All