Attachment 1 - PWS.pdf

PERFORMANCE BASED WORK STATEMENT

FOR

Intro to Signature Reduction (SIGREDUX) with Digital and

Physical Training

353 SCC

Kadena Air Base, Japan

28 January 2024

TABLE OF CONTENTS

SECTION PAGE

1 DESCRIPTION OF SERVICES 3

2 SERVICES SUMMARY 6

3 GOVERNMENT FURNISHED PROPERTY AND SERVICES 6

4 GENERAL INFORMATION 6

5 QUALITY ASSURANCE 7

6 HOURS OF OPERATION 7

7 SAFETY REQUIREMENTS 7

8 CONTINUATION OF ESSENTIAL DOD CONTRACTOR SERVICES 8

DURING CRISIS

9 APPENDICES 9

1. DESCRIPTION OF SERVICES.

The contractor shall provide all equipment, tools, personnel, labor, supervision, and management to provide Intro to Signature Reduction (SIGREDUX) with Digital Emphasis (ISRC-D) and Advanced Signature Reduction (ASRC) skills to personnel assigned to the 353 SCC, Kadena AB, Okinawa Japan.

1.1. BASIC SERVICES. The contractor shall provide one (1) ten (10) day in person course of instruction for a maximum of 15 personnel and the period of performance shall begin date of 14 April 2025 and finish date of 25 April 2025. The course of instruction shall include the latest proven SIGREDUX tactics, techniques, and procedures currently utilized throughout today’s evolving battlespace. Course of instruction shall combine classroom academics, along with practical and/or scenario-based exercises to facilitate hands-on learning. The course of instruction shall include Open Source Intelligence (OSINT) derived profiles for trainees so they are able to understand their baseline digital signatures as they exist today. The course of instruction shall incorporate the preparation and employment of specific virtual tools such as virtual machines.

The contractor shall provide realistic training scenarios in which personnel will have the ability to utilize many of the SIGREDUX skills taught throughout the course. The course shall also be utilized to provide tactical instruction on emerging threats in the digital and physical space related to SIGREDUX, such as low-signature commercial-off-the-shelf (COTS) drones, hacker multi-tools, and non-standard mesh networks. The course will provide instruction on technical objectives to include OSINT fundamental skills, virtual machine setup and employment, and data-broker opt-outs. The contractor shall provide all required equipment and supplies.

1.2. TRAINING REQUIREMENTS

1.2.1. The objective of the training schedule is to provide introductory SIGREDUX training for up to 15 personnel. The training, which incorporates academics and practical exercises, shall be applicable to the current areas of operation. There shall be a total of ten (10) days of training delivered separated by two (2) days after the initial five (5) days of instruction.

Each day shall end with debrief/lessons learned. All training will take place at a contractor-procured venue, conference center, or facility provided by the vendor. Alternate arrangements for delivery of training at a government furnished facility may be made with sufficient prior coordination.

1.2.2. Instructor to student ratio for this 10-day course shall not exceed 1:5.

1.3 Minimum Contractor Requirements

1.3.1. The SIGREDUX course will take place during two, 5-day blocks. The course of instruction will include (at a minimum) the following topics:

1. Establishing a SIGREDUX baseline

2. Intro to OSINT

3. OSINT Self-Evaluation

4. OSINT Profile Review

5. OSINT Targeting Toolkit

6. Privacy Opt-Outs

7. Understanding the Digital Environment

8. General Exposure in the Digital Environment

9. Malicious Threat in the Digital Environment

10. Case Study: Industrial Internet of Things

11. SIGREDUX Equipment Familiarization

12. Hardening Personal Mobile Devices

13. Personal Computer Setup

14. Fundamentals of SIGREDUX

15. OSINT, SIGREDUX, and Force Protection

16. Options for Open Source Protected Comms

17. Seek & Find Exercise

18. Emerging SIGREDUX COTS Tech

19. Low-signature COTS Drones

20. Non-standard Open-Sourced Mesh Networks

21. COTS Hacker Multi-tools

22. Intro to Virtual Machines

23. Virtual Machine Setup and Employment

24. Establishing a SIGREDUX Policy

25. Border Crossing Scenarios

26. Individual Situational Awareness

27. TSCM+Software-Defined Radio

28. Secure Device Acquisition (Force Protection)

1.4. Instructor Minimum Qualification Requirements

1.4.1. Instructors must be experienced in SIGREDUX as well as have extensive knowledge in the application of these skills in operational environments.

1.4.2. Instructors must have specialized knowledge of USAF Special Operations personnel operations and skill sets.

1.4.3. Instructors must have prior operational experience from a role within the Intelligence Community (IC), as an Information & Technology professional, or as an Intelligence Officer (14N or equivalent).

1.4.4. Technical instructors must hold and maintain at least CompTIA Security+ certs.

1.6. Deliverables

1.6.1. On the final day of instruction, a certificate of completion for each student passing the course shall be provided.

1.6.2. A comprehensive after-action report (AAR) of attending personnel’s performance and a summary report of all activities/training shall be submitted to the 353 SCC point of contact in electronic format no later than 30 days after the final training day. A brief description of the course activities and a brief description of the contractor’s involvement shall be included.

1.6.3. Hardened personal device for each student (Pixel 4a or equivalent) with secure and privacy focused operating system installed. A SIM contract and card will not be included.

Students will receive training on the device and operating system to operate in all theatres securely.

1.8 Licenses and Permits. The contractor shall, without additional expense to the Government, obtain any necessary licenses and permits, and comply with any Federal, State, and local laws, codes and regulations applicable to this PWS. The contractor shall provide proof of such applicable licenses and permits upon submittal of their proposal and at any time on request by the Government. The contractor shall submit any applicable certifications.

1.9. Place of Performance. Unless prior arrangements are made, Contractor will provide a classroom for all instruction for the duration of the 10-day course. The venue or facility shall possess restrooms and adequate classrooms on site. The Government will provide lodging and transportation for all attendees. The contractor may or may not make a specific lodging recommendation depending on course delivery dates, availability, proximity, and specific course dependencies.

2. SERVICES SUMMARY.

The Contractor service delivery requirements are summarized into performance objectives that relate directly to standards of performance required to meet mission essential needs. For the Performance Objective to be met, service delivery must be in substantial compliance with applicable performance standards. The Performance Threshold describes the minimum overall levels of service delivery required for acceptable quality control. Failure to meet these Performance Thresholds means that contractor Quality Control is unacceptable. The following is a list of the key performance objectives that will be verified as contractually compliant by government personnel, however, inspection of any contract requirement is authorized.

3. GOVERNMENT FURNISHED PROPERTY AND SERVICES. Not applicable to this acquisition.

3.1. GOVERNMENT FURNISHED PROPERTY. Not applicable to this acquisition.

4. GENERAL INFORMATION.

4.1. Privacy and Security.

4.1.1. Reporting Requirements. Contractor personnel shall immediately report to an appropriate Government authority any information or circumstances of which they are aware may pose a threat to the security of Department of Defense personnel, contractor personnel, resources, and classified or unclassified defense information.

4.1.2. Privacy Act. Work on this project requires that personnel have access to Privacy Act information. Personnel shall adhere to the Privacy Act, Title 5 of the U.S. Code, Section 552a and applicable agency rules and regulations.

4.1.3. Security. Work on this project requires all personnel having access, knowledge and/or involvement complete Non-Disclosure Agreements (NDAs). Personnel shall adhere to the provisions against sensitive information and/or information that effects national security under 18 U.S.C., Sec 1905 ("Trade Secrets Act") and 5 U.S.C. Secs 552(b )(1) and

(b) ( 4), which prohibit the release of sensitive information trade and national security information, in addition to the provisions under Executive Orders 13526 and 12356 ("National Security information)

4.1.4. Contract Manager. The contractor shall designate a primary Point of Contact (POC)/contract manager with responsibility for the performance of the work. The name of this person, and an alternate, who shall act for the contractor when the contract manager is absent, shall be designated in writing to the contracting officer prior to the contract start date. The contract manager or alternate shall have full authority to act for the contractor on all contract matters relating to daily operation of this contract and have contract authority to provide the services and obligate the contractor.

4.1.5. The contractor shall not employ persons for work on this contract if such employee is identified as a potential threat to the health, safety, security, general well-being, or operational mission of the Installation and its population.

4.1.6. The contractor shall not employ any person who is an employee of the US Government if employing that person would create a conflict of interest. Additionally, the contractor shall not employ any person who is an employee of the Department of the Air Force, either military or civilian, unless such person seeks and receives approval according to Department of Defense (DoD) Regulation 5500.7R, Joint Ethics Regulations (JER). The contractor shall not employ any person who is an employee of the Department of the Air Force if such employment would be contrary to the policies in AFI 64-106, Air Force Industrial Labor Relations Activities.

5. QUALITY ASSURANCE.

Not applicable to this acquisition.

6. HOURS OF OPERATION.

6.1. Period of Performance. The following is the projected training course date

10-day Training Course(s): Dates 14-25 April, 2025 (80 hours)

7. SAFETY REQUIREMENTS.

In performing work under this contract, the contractor shall:

7.1. Conform to the safety requirements contained in the contract for all activities related to the accomplishment of the work.

7.2. Develop and provide at the start of the orientation period a safety plan to provide a safe work environment for government and contractor personnel.

7.3. Include a clause in all subcontracts to require subcontractors to comply with the safety provisions of this contract as applicable.

7.4. Record and report promptly (within one hour) to the Contracting Officer or designated government representative (GR), all available facts relating to each instance of damage to government property or injury to either contractor or government personnel.

7.5. In the event of an accident/mishap, take reasonable and prudent action to establish control of the accident/mishap scene, prevent further damage to persons or property, and preserve evidence until released by the accident/mishap investigative authority through the contracting officer.

7.6. If the government elects to conduct an investigation of the accident/mishap, the contractor shall cooperate fully and reasonably assist government personnel in the conduct of investigation until the investigation is completed.

7.7. Include a clause in each applicable subcontract requiring the subcontractor's cooperation and assistance in accident reporting and investigation.

8. CONTINUATION OF ESSENTIAL DOD CONTRACTOR SERVICES DURING

CRISIS

This service is determined to be non-essential for performance during crisis according to DODI 3020.41, Operational Contract Support, paragraph 2.c. In the event of crisis, the contractor will be notified by the Contracting Officer of the need to discontinue services due to contingency, base closure or other causes. If notification to discontinue services is not received, the contractor will be expected to continue performance in accordance with this PWS.

APPENDIX A

ACRONYMS AND ABBREVIATIONS LIST

Acronym/Abbreviation Definition

AF Air Force

AFB Air Force Base

CFR Code Federal Regulation

CO Contracting Officer

COR Contracting Officer Representative

DEPT Department

DOD Department of Defense

FAR Federal Acquisition Regulation

GR Government Representative

OSHA Occupational Safety and Health Act

PBSA Performance Based Service Acquisition

PWS Performance-Based Work Statement

QA Quality Assurance

QCP Quality Control Program

SS Services Summary

USAF United States Air Force