Attachment 1 STAAS PWS May 2024 v2.pdf

PERFORMANCE WORK STATEMENT

FOR

AIR FORCE RESERVE COMMAND

On-Site Information Technology Storage-As-A-Service

10 May 2024

1.0 DESCRIPTION OF SERVICES.

1.1 Scope. AFRC A6 Directorate of Cyberspace & Technology requires program and consulting services in support of the Information Technology Storage-As-A-Service (STAAS) Management System. This Performance-based Work Statement (PWS) describes the services required for AFRC’s Command Wide Enterprise Storage portfolio of Air Force (AF) programs that ensure effective design, deployment, and maintenance of all AFRC bases, fixed-base, high-speed, high-capacity, reliable and secure digital communications infrastructure. The AFRC Enterprise system consists of enterprise-wide tools, equipment, and media that provide traditional and wireless based network infrastructure, network monitoring, and network defense at all our Air Force Reserve (AFR) bases. AFRC infrastructure provides the Warfighter with full access to real-time Command and Control information for day-to-day operations and contingencies. These services require on-site Dell-EMC Direct-Badged specialist support with full reach-back and proprietary tools. This requisite of engineering support provides Subject Matter Expert’s (SME) support to meet AFRC and alternate failover site mission critical support. This effort will continue to provide routine SME support for individual systems within all 12 AFRC sites (see Attachment 2). The IT STAAS Contractor, hereinafter referred to as the Contractor, shall provide SME support for the AFRC projects/systems included in this PWS. The Contractor shall perform the tasks outlined in this PWS to support programs/projects during all acquisition life cycle phases. The Contractor shall provide management oversight for the work performed under this effort. In addition, the Contractor shall ensure that the transition-in/out of the STAAS effort is to minimize interruptions and delays that would negatively impact the mission. The Contractor shall provide Certified Specialists with the responsibility for storage configuration management and storage operations management, along with daily storage management tasks across the command. The requirement also includes planning and assignment of multiple storage-based solutions to ensure best practices are followed for the environment; analysis and reporting of usage trends for all storage and fabric equipment; capacity planning; and recommendations to AFRC staff for future initiatives. This AFRC effort is in support of approximately 543 storage devices across AFRC bases. This requirement necessitates full-time, on-site certified specialist(s) with expertise for overall architectural design, administration, planning, and mission support for the implementation and interface support of hardware and software solutions related to network storage and fabric.

1.2 Organization. The AFRC organization with primary responsibility for this requirement is the Directorate of Cyberspace & Technology (AFRC/A6), Robins AFB GA 31098.

1.3 Place of Performance. These onsite support and services will be performed at AFRC/A6, Robins AFB, GA & 94th CS, Dobbins ARB, GA. For this requirement, Robins AFB, GA is considered the Primary site and Dobbins ARB GA is the Alternate site.

1.4 Required Services.

1.4.1 STAAS Sustainment Services. The Contractor shall provide certified Dell-EMC Direct- Badged technical experts with direct access to Dell-EMC product engineering, IP, knowledge databases, and tools relevant to AFRC needs. The Contractor shall maintain all storage solution platform environments IAW Dell-EMC disciplined engineering best practices and sustain compliance with applicable AF/DoD standards (See Attachment 1). These specialists will have full responsibility for the storage configuration and operation management across AFRC bases, along with daily storage management tasks in this complex environment. These specialists shall have full authority to act for the Contractor on all contract matters relating to the daily operation of the contract. The name(s) and phone number(s) shall be provided, in writing, to the HQ AFRC/PKA Contracting Officer (CO) and the HQ AFRC/A6CN Contracting Officer Representatives (CORs) upon contract award.

1.4.2 Operational and Management (O&M). The Contractor shall provide operational management of all AFRC Command Wide Dell-EMC hardware & software platforms, (See Attachment 2 Appendix B current Dell Solutions), including future new product purchases. The Contractor shall generate Monthly Status Reports (MSR) and recommendations using Contractor’s diagnostic tools, such as Dell-EMC Ionix Control Center. These MSRs and recommendations are to be included within the MSR. (CDRL A001, Monthly Status Report, DI-MGMT-80368A/T).

1.4.3 Progress Status Meetings. The Contractor shall participate in status meetings with Government representatives to discuss current tasks’ performance status, open issues, pending changes, schedule updates, new projects, and action items. The meeting shall be held monthly via telecom or in person, as determined by the COR in advance.

1.4.4 Status/Progress Reporting. The Contractor shall produce MSR of routine, or emergency (critical) maintenance progress being accomplished on any storage solution such as performance tuning, optimization, provisioning, layout, infrastructure, fabric, management analyses and data migration utilizing Dell-EMC standardized procedures, including disaster recovery and the Operational Run Book no later than (NLT) the first duty day of the following month within the MSR. Each report shall include, as a minimum, information from the weekly status report (WSR) summaries, including a narrative of work accomplished and significant events, problem areas, trip reports, anticipated activity of the next MSR period. Report shall be delivered to the COR no later than the first duty day of each month. Occurs 80% of time with complete, accurate and timely deliverables and reporting. Remaining 20% will be resolved within 72 hrs. (CDRL A001, Monthly Status Report, DI-MGMT-80368A/T) (CDRL A002, Weekly Status Report, DI-MGMT-80368A/T).

1.4.5 Inventory. The contractor shall verify current inventory of all Government-owned, Dell- EMC equipment no later than 30 calendar days after contract start. Contractor shall conduct an Annual Inventory Report (AIR) verification NLT 31 March each year, or as directed by COR.

Occurs 100% of time. Any items not accounted for and/or items that are lost, damaged, or destroyed beyond use must be logged within the WSR folder. (CDRL A002, Weekly Status Report, DI-MGMT-80368A/T) (CDRL A006, Annual Inventory Report, DI-MGMT- 80441D).

1.5 Network Systems Operations & Management Support.

1.5.1 The Contractor shall provide Certified On-Site Dell-EMC Operational Residents to provide day-to-day operational management of the IT infrastructure from planning, analysis, troubleshooting, integration, installation, operations, and documentation of systems administration services. The Contractor shall ensure optimal systems performance IAW manufacturer’s best practices with 24/7 hour access to the storage platforms.

1.5.2 Provide administration and technical assistance in support of IT Command-wide storage systems/platforms/solutions/applications.

1.5.3 Configure, integrate, and troubleshoot support for storage for multiple virtual platforms supporting AFRC’s total virtual storage environment across the command on both high and low side of the network supporting virtual management (VM) servers, virtual desktop infrastructure (VDI), scan to network printers/scanners and associated software applications.

1.5.4 Mission Critical Storage Outages. Emergency unplanned Repairs/Outages support, including client server disaster recovery and On-Call Support. All Critical Outages shall be recorded within the WSR. Contractor shall acknowledge within 4 consecutive hours of reported outage. Occurs 100% of time. Repairs complete within 8 consecutive hours of reported outage with no further action required. Occurs 100% of time. COR and AFRC/A6’s Major Command Coordination Center (MCCC) notified of actions completed within 4 consecutive hours of completion and recorded within WSR. Occurs 100% of time. (CDRL A002, Weekly Status Report, DI-MGMT-80368A/T).

1.5.4.1 Critical Outage interoperability and connectivity. Contractor shall coordinate emergency support requirements with AFNET/INOSC/AFRC A6 personnel or contractors to address interoperability and connectivity issues for the enterprise network, including recommendations on re-configuration of LAN/WAN equipment to meet virtual storage operational requirements.

1.5.4.2 Critical Outage Recovery. Provide emergency recovery support services for mission essential virtual clustered client server environment, client server application, client server file structure, security, operational data storage and recovery/retrieval on diverse enterprise clustered storage environments.

1.5.5 Non-Mission Critical Storage. Repair completed by next business day after problem identified with no further action required. Occurs 80% of time & the other 20% will be resolved within 72 hrs. COR and MCCC notified of actions completed within 4 consecutive hours of completion and recorded within WSR. Occurs 100% of time. All Non-Critical Outages shall be recorded within the WSR. (CDRL A002, Weekly Status Report, DI-MGMT-80368A/T).

1.5.5.1 Non-Mission Outages. Contractor shall conduct Routine (Planned) Repair/Outages support, performance tuning, optimization, provisioning, layout, infrastructure, fabric, management analyses, data migration, including client disaster recovery and On-Call Support.

1.5.5.2 Non-Critical Change Request. Coordinate and track job requests to ensure that all customer requests are handled in accordance with the timeframe outlined in paragraph 1.5.5 while keeping Government apprised of significant changes in workload status through the Air Force Remedy tracking system.

1.5.5.3 Non-Critical Data Migrations. Test interfaces that transparently integrate with storage system platforms. Plan and perform data migrations and establish data validation routines.

1.5.5.4 Non-Critical Inventory. Maintain Annual Inventory Report (AIR) for control and location of Government-owned Dell-EMC hardware equipment and software. (CDRL A006, Annual Inventory Report, DI-MGMT-80441D)

1.5.5.5 Non-Critical Management. Manage and administer user ID, password, and security keys (public/private, unique); and administer domain addresses as required.

1.5.5.6 Non-Critical Unavailable. Advise COR when services are unavailable, what the difficulties are and when services can be expected to resume.

1.6 Information System Security (ISS) Support

1.6.1 The Contractor shall apply DoD and Air Force network security protocols to provide security for Dell-EMC command wide storage applications and storage platform systems.

1.6.2 Contractor shall provide operational and analytical support related to security for storage related security and LAN/WAN information assets.

1.6.3 The Contractor shall perform analysis and evaluation of new and emerging security technologies as well as vendor security products for their applicability and feasibility of use for LAN/WAN network.

1.6.4 Data Protection Advisory Plan (DPAP). Initial DPAP to be provided 30 days from contract award. Contractor shall ensure DPAP includes daily, weekly, and monthly backups, both electronic and manual IAW DoD standards (See Attachment 1). Conduct quarterly testing and restoration of random stored virtual server clients. Test results will be placed within the WSR. (CDRL A002, Weekly Status Report, DI-MGMT-80368A/T).

1.6.5 Contractor shall remediate existing security weaknesses IAW AFRC’s weekly network vulnerability security scans provided by MCCC. Conduct network security monitoring to detect intrusions. Conduct electronic vulnerability assessments of systems.

1.6.6 Contractor shall conduct storage assessments and design recommendations as needed.

1.6.7 Contractor shall address the impact of new Operating System (OS)/Firmware (FW) software (SW) releases/version updates on existing storage and provide verbal recommendations on how to mitigate the impacts.

1.6.8 Contractor shall upgrade the storage OS/SW/FW to limit disruptions for end users.

1.6.9 Contractor shall document changes to storage operations resulting from software version upgrades and installations. Contractor shall follow-up on the updates to ensure integrity and functionality of the storage maintained and new features are working correctly. (CDRL A002, Weekly Status Report, DI-MGMT-80368A/T).

1.6.10 Contractor shall make recommendations to the COR and maintain procedures to test and monitor systems security to ensure only authorized individuals have access to required resources.

1.6.11 Contractor shall notify the COR and record any security-related events on the system(s) within the WSR. (CDRL A002, Weekly Status Report, DI-MGMT-80368A/T).

1.6.12 Contractor shall maintain existing Standard Operating Procedures (SOP) for storage platforms for maintenance of storage.

1.6.13 Contractor shall maintain baseline records to identify significant parameters, chronology of changes, and reason for the changes related to the application.

1.6.14 Contractor shall maintain records to identify storage systems demand and usage.

Contractor shall recommend to the COR capacity adjustments based on the records. (CDRL A001, Monthly Status Report, DI-MGMT-80368A/T).

1.6.15 Contractor shall ensure all interfaces function properly.

1.6.16 Contractor shall add or delete user accounts and maintain records of user and administrator account changes.

1.6.17 Contractor shall monitor and maintain information security using provided tools and notify COR upon discovery of security breaches.

1.7 User Customer Support

1.7.1 Help Desk. The contractor shall provide Senior Dell-EMC Direct-Badged storage technicians for Help Desk Tier 1, Tier 2, and Tier 3 storage support for customer assistance. The contractor shall provide these Tiered level services is in support of all our current & future Dell- EMC software/hardware configurations, installation, implementation, systems administration, back-up, recovery, contingency planning, system management, including day-to-day operational support. The contractor shall provide both critical and non-critical assistance to isolate, identify and repair failures of multiple storage platforms. Normal hours of support, excluding federal holidays, are Monday–Friday, 0730–1630 (Eastern Standard Time) and on-call for each month’s UTA weekend(s) (two weekends per month). The Government reserves the right to change the core hours at any time. The Contractor shall provide a backfill for a position if projected to be vacant for more than one (1) week. AFRC Help Desk & AFRC MCCC are the central point for users with technical, systems/application and program problems, data query and change requests.

1.7.2 Federal Holidays. The Contractor shall not have staff present at the Government installation facilities on federal holidays, unless directed by the COR, to repair mission critical systems due to failure. The federal holidays observed are as follows: New Year’s Day, Martin Luther King’s Birthday, President’s Day, Memorial Day, Juneteenth, Independence Day, Labor Day, Columbus Day, Veterans Day, Thanksgiving Day, and Christmas Day.

1.7.3 Tier 1 is defined as the following: Basic storage application software and/or hardware support. Tickets are resolved within one hour, those not resolved within specified timeframe are coordinated with COR for estimated completion.

1.7.4 Tier 2 is defined as the following: More complex support on storage application software and/or hardware. Tickets are resolved within four hours, those not resolved within specified timeframe are coordinated with COR for estimated completion.

1.7.5 Tier 3 is defined as the following: Subject matter expertise, support on complex programmatic, storage hardware and OS software issues. Tickets are resolved within six hours, those not resolved with specified timeframe are coordinated with COR for estimated completion.

1.8 System/Application Recovery Support

1.8.1 The Contractor shall provide the capability for recovery of all critical data, software programs, and sensitive Government information. The requirements for system recovery support services include an analysis of strategic planning factors; the strengths and weaknesses of the system, as obtained through threat assessment and risk analyses; and cost and benefit trade-offs.

The Contractor shall provide the capability to:

1.8.1.1 Detail and diagram hierarchical access and storage systems.

1.8.1.2 Provide disaster recovery recommendations and contingency planning support for application/system. The Contractor shall also provide continuity of operations and implement mitigation strategies after disaster recovery events. These actions shall be recorded and tracked within the WSR until resolved. (CDRL A002, Weekly Status Report, DI-MGMT-80368A/T).

1.9 Storage Life Cycle Management Support

1.9.1 The Contractor shall provide resources to support any or all phases and stages of our storage life cycle management, including planning, analysis, troubleshooting, integration, installation, migration, operation, maintenance, documentation, and administration.

1.9.2 The Contractor shall conduct feasibility studies, risk analyses, and prepare recommendations to the COR to justify the need for tech-refreshing, upgrade, implementing new/redesign of existing storage platforms as directed by COR. The study, analysis, and decision paper shall include, at a minimum, an executive summary, information on the criticality/sensitivity of data and detail documentation to support the decision for a future system implementation within the WSR. (CDRL A002, Weekly Status Report, DI-MGMT- 80368A/T).

1.9.3 The Contractor shall export a solutions runbook as needed for each platform solution life cycle that captures full configuration, capacity, interface, setting, security, internal security control requirements and specifications. These runbook reports will be placed in a locked down secure folder within our A6C Storage file-share structure and documented within the WSR.

(CDRL A002, Weekly Status Report, DI-MGMT-80368A/T).

1.9.4 The Contractor shall provide storage support for data migration and implementation of new or reclaimed storage of a solution. The Contractor shall review current data solutions, develop recommended migration strategies, and execute upon A6C approval. A runbook must be exported before and after migration and included within the WSR. (CDRL A002, Weekly Status Report, DI-MGMT-80368A/T).

1.9.5 The Contractor shall conduct periodic performance measurement and evaluation activities to reengineer existing storage platforms for improved productivity, changes in functional and technical requirements at a minimum. The Contractor shall document proposed or directed implementation actions within WSR. (CDRL A002, Weekly Status Report, DI-MGMT- 80368A/T).

1.9.6 The Contractor shall maintain a remote client (configured by AFRC) to administer and troubleshoot storage solutions after hours when directed. The Contractor shall comply with AFRC/A6 requirements to acquire a LAN and Administrator account to remotely manage the system.

1.10 System Engineering Requirements

1.10.1 Life-Cycle Systems Engineering. The contractor shall employ disciplined systems engineering processes in accomplishing contract taskings, using Dell-EMC storage best practices IAW AFI 63-1201, Life Cycle Systems Engineering, for systems engineering processes in planning, architecting, requirements development and management, design, technical management and control, technical reviews, technical measurements, integrated risk management, configuration management, data management, interface management, decision analysis, test, evaluation, verification and validation. Mission Technical Orders (MTO) may further refine the systems engineering processes according to MAJCOM policies and practices.

All services provided under this contract shall follow the Federal Desktop Core Configuration (FDCC), Information Assurance guidelines and Security Technical Implementation Guides (STIGS) for collateral networks and systems. Services for Top Secret and SCI networks, systems and applications will follow standards, policies and guidelines identified in the MTO.

1.10.2 Business Capability Acquisition Cycle (BCAC). The contractor shall utilize and follow the BCAC as guidance when it has been approved for the definition, design, acquisition, implementation, and delivery of warfighter capabilities. The BCAC is applicable to large- and small-scale problems and can be used to implement IT capabilities of all sizes and types across all mission areas and all security domains. The BCAC is captured in AFMAN 63-144, Business Capability Requirements, Compliance, and System Acquisition and implements AF Policy Directive 10-6, Capabilities-Based Planning & Requirements Development, and AF Instruction 10-601, Capabilities-Based Requirements Development, by providing guidance for developing and implementing Doctrine, Organization, Training, Materiel, Leadership, Personnel and Facilities (DOTMLPF) requirements, including IT capabilities.

1.10.3 The Contractor shall participate with AFRC Configuration Control Board (CCB), which is chaired by the Government. These activities include baseline identification, change control, status accounting, and auditing. The Contractor shall document and follow/maintain all configuration changes through the CCB, when directed. The CCB will control changes to the software/hardware configuration and record the change request and implementation status. The Contractor shall log any major change within the MSR. (CDRL A001, Monthly Status Report, DI-MGMT-80368A/T).

1.11 Information Assurance (IA)

1.11.1 The Contractor shall ensure that all storage platform deliverables meet the requirements of DoD and AF Information Assurance (IA) policy. Furthermore, the contractor shall ensure that personnel performing IA activities obtain and remain current with required technical management certifications.

1.11.2 System IA. For those solutions that will not inherit existing network security controls, and, thus, integrate an entirely new application system consisting of a combination of hardware, firmware and software, system security assurance is required at all layers of the TCP/IP DoD Model. The Contractor shall ensure that all system deliverables comply with DoD and AF IA policy, specifically DoDI 8500.2, Information Assurance Implementation. The Contractor shall also support activities and meet the requirements of DoDI 8520.02, Public Key Infrastructure (PKI) and Public Key (PK) Enabling, to achieve standardized, PKI-supported capabilities for biometrics, digital signatures, encryption, identification, and authentication.

1.11.3 Personnel IA. Personnel performing Information Assurance (IA) activities are required to be current and maintain currency with, technical and/or management certifications to ensure compliance with DoD 8570.01-M, Information Assurance Workforce Improvement Program.

1.11.4 Application IA. The Contractor shall ensure that all storage deliverables adhere to Public Law 111-383, which states the general need for application assurance. Specifically, the Contractor shall ensure that all application deliverables comply with the Defense Information Systems Agency (DISA) Application Security & Development Security Technical Implementation Guide (STIG), which includes the need for source code scanning, the DISA Database STIG, and a Web Penetration Test to mitigate vulnerabilities associated with SQL injections, cross-site scripting, and buffer overflows. The Contractor shall also support activities and meet the requirements of DoDI 8520.02, Public Key Infrastructure (PKI) and Public Key (PK) Enabling, to achieve standardized, PKI-supported capabilities for biometrics, digital signatures, encryption, identification, and authentication.

2.0 Services Summary (SS)

Performance Objectives PWS Para

Performance Threshold

Complete and accurate reports deliverables

1.4.2, 1.4.4, 1.4.5, 1.5.4, 1.5.5, 1.6.4, 1.6.9, 1.6.11, 1.6.14, 1.8.1.2, 1.9.2, 1.9.3, 1.9.4, 1.9.5 and 1.10.3

Occurs 80% of time with complete, accurate and timely deliverables and reporting.

Remaining 20% will be resolved within 72 hrs.

Perform Initial Verification, Routine (Annual) or Directed Inventories

1.4.5 Initial Inventory complete NLT

30 days after contract award.

Occurs 100% of time.

Annual Inventories complete NLT 31 Mar yearly. Occurs 100% of time.

Provide Emergency unplanned Repairs/Outages support, client

1.5.4

Acknowledge within 4 consecutive hours of reported outage. Occurs 100% of time.

server disaster recovery and On- Call Support

Repair completed within 8 consecutive hours of reported outage with no further action required. Occurs 100% of time.

COR and MCCC notified of actions completed within 4 consecutive hours of completion and recorded within WSR. Occurs 100% of time.

Provide Routine (Planned) Repair/Outages support and On- Call Support

1.5.5

Repair completed by next business day after problem identified with no further action required. Occurs 80% of time & the other 20% will be resolved within 72 hrs. COR and MCCC notified of actions completed within 4 consecutive hours of completion and recorded within WSR. Occurs 100% of time.

3.0 GOVERNMENT PROPERTY AND SERVICES

3.1 Base Support. The Government shall furnish items incidental to the place of performance (Ex: cubicle space, desk, chair, desktop or laptop computer, and access to copier, fax, and a networked printer). In addition, the Government shall provide telephone service, to include the Defense Switched Network (DSN). The Contractor shall ensure use is limited to performance of contract-related official Government business. Upon completion or termination of the contract or expiration of employee identification passes, the prime contractor shall ensure that all items to include base ID passes, desktop computer, laptop computers, peripherals, and other software/hardware is returned to the Contracting Officer’s Representative (COR) and everyone is processed through the directed Out-processing checklist.

3.2 Access to Equipment and Facilities. The Government will provide the Contractor access to systems and equipment necessary to perform tasks under the contract. Upon completion/termination of the contract or transfer/termination of Contractor personnel, the system account(s) will be closed.

3.3 Reporting of Government Property. The Contractor shall have a system of internal controls to manage (control, use, preserve, protect, repair, and maintain) Government property in its possession in accordance with FAR 52.245-1, and its property management system shall be adequate to satisfy the requirements of this clause. The contractor shall record receipt and return of all Government Furnished Property (GFP), as well as the reporting of shipment, consumption, disposal, or transfer to another contract, in the GFP Module in Procurement Integrated Enterprise Environment (PIEE), https://piee.eb.mil, as stipulated by DFARS 252.245-7005. This reporting requirement does not change any liability provisions or other reporting requirements that may exist under the contract. GFP training and guidance is located at the DoD Procurement Toolbox at https://dodprocurementtoolbox.com/.

3.4 Loss of Government Property

3.4.1 Definition of Loss of Government Property. “Loss of Government property” means unintended loss of or damage to Government property including property that cannot be found after a reasonable search, loss due to inadequate storage, loss due to lack of security, theft, damage requiring repair to restore the item to usable condition, or damage that renders the property useless for its intended purpose or Beyond Economical Repair (BER). Loss of Government property does not include manufacturing defects, obsolescence, normal wear and tear, or purposeful destructive testing. Unless otherwise stated in the contract/order, loss of Government property does not include normal and reasonable inventory adjustments, i.e., losses of low priority consumable material, such as common hardware, as agreed to by the Contractor and the Government Property Administrator.

3.4.2 Reporting Loss of Government Property. The Contractor shall report loss of Government property in the GFP Module located in PIEE, https://piee.eb.mil/piee-landing/.

3.4.3 Return or Retention of Government Property. All property provided by the Government remains the property of the Government and shall be returned to the Government as directed, but no later than completion of the contract/order, unless the Procuring Contracting Officer (PCO) directs the Contractor to retain the property for continued use under a successor contract. All Government property shall be returned to the Government in the condition provided unless approved in advance by the PCO. All material generated under the contract/order becomes the property of the Government and shall be returned to the Government as directed, but no later than completion of the contract/order, unless the PCO directs the Contractor to retain the material for continued use under a successor contract.

4.0 GENERAL REQUIREMENTS

4.1 Post Award Meeting. The Contractor shall attend a one (1) day post award meeting convened and hosted by the COR. The post award conference will be held within two (2) weeks of contract award. The location will be a mutually agreed upon site to be determined after award.

The Functional Commander, CO and COR will participate with Contractor Representatives. The meeting will provide an orientation and overview of the contract scope, terms, and conditions.

The meeting will detail the roles and responsibilities of AFRC team members, QASP, performance evaluations and contract closeout.

4.2 Training Requirements

4.2.1 Certification. Contractor personnel shall complete mandated training required for performance of this contract, as stated below and/or as required by the AFRC/A6 COR. Security Plus Certification is required for System Administration privileges and is required before contract award and through the end of the contract. All other required training shall be completed not later than 30 calendar days after award with evidence of course completion submitted to the COR. Performance cannot begin until all mandated training is complete. (CDRL A003, Training Certificate, DI-ILSS-80872/T)

‐ Dell EMC Proven Professional Storage Certification (Blade technologies experience in a virtualized environment; Enterprise storage experience in integration and migration of Storage Area Network (SAN) and Network Attached Storage (NAS) technologies)

‐ CompTIA Security+ Certification or equivalent DoD 8570 certification ‐ DoD Cyber Awareness Challenge (ZZ133098) ‐ DoD Information Protection (ZZ133078) ‐ DoD Force Protection (ZZ133079) ‐ DoD Integrated SAPR/Suicide Prevention Annual ‐ DoD Combating Trafficking in Persons (CTIP) General Awareness ‐ Notification and Federal Employee Antidiscrimination and Retaliation Act (No FEAR)

(ZZ133081)

4.2.2 All authorized users of DoD information systems (ISs)/Platform Information Technology (PIT) systems must receive initial cybersecurity user awareness training as a condition of access to an IS IAW DoD 8570.01-M; thereafter, all users will complete annual cybersecurity awareness refresher training. This training can be found on the Defense Information Systems Agency (DISA) Information Assurance Support Environment (IASE) portal:

http://iase.disa.mil/eta/Pages/index.aspx

4.3 Contractor Identification. The Contractor personnel shall always wear contractor-provided identification while in government facilities to distinguish themselves from Government employees. Contractor personnel may attend meetings, answer phones, and work in other situations where their status is not obvious to third parties; therefore, the Contractor personnel shall always identify themselves as Contractor support to avoid potential misrepresentation as Government personnel or to avoid situations arising where sensitive topics might be better discussed solely amongst government personnel. Electronic mail signature blocks shall identify their company affiliation. Where practicable, Contractor personnel occupying collocated space with their Government program customer shall identify their workspace with their name and company affiliation.

4.4 Travel. Travel to and from AFRC Robins to Dobbins ARB is included in this contract at no extra cost to the government.

4.5 Contractor Manpower Reporting. Per 10 U.S.C. 2330a, the Contractor shall provide an annual count of contractor personnel performing work for each fiscal year if the DoD is the requiring activity, if the acquisition is using U.S. Government appropriated funds, and if the acquisition is greater than or equal to the simplified acquisition threshold (SAT). The Contractor shall report all Contractor labor hours, including subcontractor labor hours, required for performance of the services provided under the contract in the Enterprise-wide Contractor Manpower Reporting Application (eCMRA). Reporting shall be conducted for each fiscal year, which extends October 1 through September 30. While inputs may be made any time during the fiscal year, all data shall be reported no later than October 31 of the following fiscal year. The Contractor shall establish a record for the contract/order in eCMRA no later than 30 calendar days after contract/order award. The Contractor shall enter Order Data, Contact Data and Location Data. Data for Air Force service requirements must be input at the Air Force CMRA link at http://www.emra.mil. The Contractor may direct questions to the help desk at the eCMRA site: http://www.ecmra.mil.

4.6 Continuation of Mission-Essential Services during a Crisis.

4.6.1 Designation of Services as Mission-Essential. The Functional Commander or civilian equivalent has determined, by placing the decision in writing, that all or a portion of the contractor services performed under this contract are mission essential (M-E) and will continue in the event of a crisis. The M-E services under this contract/order include section 1.5.4 Mission Critical Storage Outages.

4.6.2 Mission-Essential Contractor Services Plan. Within 30 calendar days after contract award, the Contractor shall submit a plan describing procedures for continuing performance of M-E services during a crisis. The Contractor shall identify provisions for ensuring required personnel and resources are available to support continuity of operations for up to 30 calendar days or until normal operations can be resumed. The Contractor shall submit any revision to the plan to the COR and Contracting Officer within 5 business days for approval prior to implementation. The Contractor shall activate the plan only if authorized by the PCO acting under the direction of the A6 or civilian equivalent. (CDRL A004, Management Plan, Mission- Essential, DI-MISC-80508B/T).

4.7 Non-personal Services. The Government will neither supervise contractor personnel nor control the method by which the contractor performs the required tasks. Under no circumstances shall the Government assign tasks to, or prepare work schedules for, individual contractor personnel. It shall be the responsibility of the Contractor to manage its personnel and to guard against any actions that are of the nature of personal services or give the perception of personal services. The Contractor shall notify the AFRC/PKA CO immediately if any task requires action by the Contractor personnel that constitutes or are perceived to constitute personal services.

These services shall not be used to perform work of a policy/decision making or management nature, i.e. inherently governmental functions. All decisions relative to the STAAS program supported by the Contractor shall be the sole responsibility of the Government.

4.8 Security. The Contractor shall comply with all security regulations and directives identified herein and other security requirements as shown elsewhere in this contract.

4.8.1 Information Security Program. The Contractor shall be integrated into the sponsoring Government activity’s Information Protection Program (IPP) which participates in the host Servicing Security Activity’s IPP.

4.8.1.1 Controlled Unclassified Information. The Contractor shall mark, handle and safeguard Controlled Unclassified Information in accordance with the DoD Manual 5200.1-M, Volume 4, DoD Information Security Program: Controlled Unclassified Information (CUI), and the DD254, DoD Contract Security Classification, if applicable.

4.8.1.2 Classified Information. The Contractor shall mark, handle and safeguard classified information IAW DoD Manual 5200.1-M, Volume 1, DoD Information Security Program: Marking of Classified Information, DoD Manual 5200.1-M, Volume 2, DoD Information Security Program:

Marking of Classified Information, and Volume 3, DoD Information Security Program:

Protection of Classified Information, and the DD254, DoD Contract Security Classification.

4.8.1.3. Classified Access. The Contractor personnel who require access to classified information or materials shall: (A) Possess a valid and appropriate security clearance, (B) Execute a Non-Disclosure Agreement (NDA), and (C) Have a valid need for access to the information to perform a lawful and authorized Government function. The Contractor personnel shall possess appropriate clearances prior to commencing work that requires access to classified information, facilities, or materials. These personnel shall be briefed on their responsibilities to safeguard classified information prior to access.

4.8.1.4. Clearance Level. The Contractor shall require access to classified information, classified information systems, and/or unescorted access to a facility or room which requires a Secret level security clearance to perform work on this contract, reference:

DD254 block 10j, the contractor will require access to controlled unclassified information

(CUI).

DD254 block 10k, unescorted access to the SIPRNet Data Centers & MCCC.

DD254 block 11c, received, store, and generate classified information or material.

DD254 block 11d, fabricate, modify, or store classified hardware.

DD254 block 11j, have operations security (OPSEC) requirements.

DD254 block 11l, receive, store, or generate controlled unclassified information (CUI).

The Contractor shall conform to the provisions of DoD 5220.22M, National Industrial Security Program Operating Manual (NISPOM), DoD 5220.22-R, Department of Defense Industrial Security Program, DoDM 5200.01 V2 and V3, Department of Defense Information Security Program and AFI 16-1404, Air Force Information Security Program, and AFI 16-1406, Air Force Industrial Security Program.

4.8.2 Industrial Security Program.

4.8.2.1 DD Form 254. The Contractor shall comply with the DD254, DoD Contract Security Classification, attached to Section J of this contract. Contract performance is restricted to the Federal installations and government facilities identified by the government in the DD254. The DD254 shall specify the classified information the contractor is required to know or access to perform tasks and services essential to the fulfillment of the contract, subcontracts, projects, or programs.

4.8.2.2 Visitor Group Security Agreement (VGSA). The Contractor shall enter a VGSA with the Servicing Security Activity at the installation. The VGSA shall comply with the provisions of all applicable AF instructions. Coordination of the VGSA shall be accomplished by the signatures of personnel identified on the coordination page. The Contractor shall comply with AFFARS 5352.204- 9000, Notification of Government Security Activity and Visitor Group Security Agreements (JANUARY 2017). Work will not commence until the requirements of the AFFARS Security Clause are signed and in the possession of the host Servicing Security Activity.

4.8.2.3 Facility Clearance. The Contractor shall comply with AFFARS 5352.215-9000, Facility Clearance (MAY 1996) in Section H of this contract.

4.8.2.4 Foreign Ownership, Control & Influence. The Contractor will comply with paragraphs 2- 303C(2) of the National Industrial Security Program Operating Manual (NISPOM), 28 February

2006, to include Change 1, 28 March 2013 and Enclosure 3, Paragraph 3a of DoDM 5220.22- V3, National Industrial Security Program: Procedures for Government Activities Relating to FOCI, 17 April 2014, AFI 16-1406, Air Force Industrial Security Program, 25 August 2015, ODAN 17-12, and DTM 15-002, Policy Guidance for the Processing of an NID in Connection with FOCI, 25 February 2016, contain clarifications to policy regarding NIDs.

4.8.3 Personnel Security Program.

4.8.3.1 Background Investigation Requirements. The Contractor shall be responsible for processing background investigations for all employees that require access to classified information. The Servicing Security Activity at the installation will be responsible for processing background investigations for contractor personnel that do NOT require a National Security determination.

4.8.3.2 Contractor Notification. The Contractor is notified by Servicing Security Activity at the installation Personnel Security section of the results of the Contractor personnel background investigation for Trustworthiness Determinations.

4.8.3.3 COR Notification. The Servicing Security Activity at the installation will document the HSPD-12 credentialing determination when the case file is returned to the submitting office number (SON) for a local decision. The Contractor personnel shall not have access to sensitive information, automated information systems, or restricted areas until a final determination is made. The Servicing Security Activity at the installation provides final credentialing determinations to the COR and sponsoring unit security manager.

4.8.3.4 Terminations. If Contractor personnel are terminated before the Government completes the Trustworthiness Determination, the Contractor’s PM shall immediately forward written notice to the Servicing Security Activity at the installation with a copy of the notice to the COR.

4.8.4 Physical Security Program.

4.8.4.1 Installation Perimeter Access Control. The requirements for installation perimeter access are detailed in Air Force Federal Acquisition Regulation Supplement (AFFARS) clause 5352.242-9000 entitled, Contractor Access to Air Force Installations, in Section I, Contract Clauses, of the basic contract. Contractors merely requiring unescorted access to the installation to perform services, that don’t require access to classified information or network access, will be vetted IAW AFI 31-113, Installation Perimeter Access Control para 4.3 and issued a DBIDS Identification Card. The Contractor is only allowed to visit the installations specified in the contract and/or DD254.

4.8.4.2 Resource Protection and Integrated Defense. The Contractor shall safeguard all government property in accordance with AFI 31-101, Integrated Defense, and any forms provided for Contractor use. The Contractor shall immediately report all thefts, vandalism, or destruction of property and equipment (Government- or Contractor-owned) to the COR of this contract.

4.8.4.3 USAF Restricted Area and Controlled Area Access. The requirements for USAF Restricted Area and Controlled Area access are detailed in AFI 31-101, Integrated Defense, and governed at each installation by the Integrated Defense Plan, if required.

4.8.4.4 HQ AFRC Facility Access. The Contractor personnel shall be issued Common Access Cards (CAC), which will allow access to work centers, as applicable.

4.8.4.5 Common Access Card (CAC). The Contractor shall ensure a CAC is obtained by all contractor/subcontractor personnel who require access to DoD computer networks/systems, for DoD facility entry control and/or for physical access to facilities and buildings to perform tasks under the contract/order. The Contractor shall provide a list of contractor/subcontractor personnel who require a CAC to the PCO. The Government will provide the Contractor instruction on how to utilize Mission Partner Identity, Credential and Access Management (MP- ICAM) and notify the Contractor of approval/disapproval of contractor/subcontractor personnel application. Contractor/subcontractor personnel shall obtain the CAC from the local Real Time Automated Personnel Identification Documentation System (RAPIDS) issuing facility [usually the Military Personnel Flight (MPF)].

4.8.4.6 Lost or Stolen CAC. The Contractor shall immediately report a lost or stolen CAC as directed by local Government policy. The Contractor shall notify the PCO of any change to the list of contractor/subcontractor personnel who require a CAC and provide an updated list within five business days. The Contractor shall return a CAC within five business days once contractor/subcontractor personnel no longer require computer network/system access and/or facility access. The Contractor shall return an expired CAC within five business days after the expiration date. The Contractor shall return any and all CACs within five business days after completion/termination of the contract as directed by local Government policy.

4.8.4.7 Privacy Act of 1974. The Contractor personnel shall have access to Privacy Act information that requires adherence with the Privacy Act of 1974, Title 5 of the U.S. Code, Section 552a, AFI 33-332, Air Force Privacy Act Program, and other applicable agency rules and regulations. The Contractor personnel shall follow agency procedures to identify and safeguard reports and data accordingly. The Contractor shall ensure that Contractor personnel assigned to this requirement are briefed annually on properly identifying and handling Privacy Act data and reports.

4.8.5 Network Security.

4.8.5.1 Overview. Network access is a privilege extended to Contractor personnel. Network access will be granted by the Government after all criteria have been met and may be suspended for cause as defined in AFI 33-115V2, Section 5.6. Network access will be approved by the Government in accordance with AFI 31-501, AFI 16-1406, AFI 33-115V2 and V3, AFI 33-200, DoDI 8510.01, and DoDM 5220.22-M and its supplement. Pursuant to AFI 33-115V2, every individual who has access to the USAF network (af.mil or af.smil domain), specialized systems, and mission systems is a network user. Before becoming an Air Force network user, the Contractor personnel shall have a favorable background investigation for the designated IT level and system, be trained, and licensed. This process of training and licensing ensures every USAF network user is trained and aware of the basic principles of network security and their role in Information Assurance (IA). The Government will issue a Common Access Card (CAC) in accordance with Air Force FAR Supplement clause 5352.242-9001 entitled, Common Access Card for Contractor Personnel, to Contractor personnel that meet the criteria (favorable trustworthiness determination, training, and licensing).

4.8.5.2 Information Technology (IT) Level and Investigation Required. Contractor personnel shall possess an IT LEVEL 1 (Privileged): An individual that has elevated administrative access to make or change network configuration. Tier 5 background investigation (formerly referred to as a SSBI) for IT Level I positions as mandated by DoD Regulation 5200.2-R, Personnel Security Program, paragraph C3.6.15 and DoD Instruction 8500.1, Cybersecurity, para 3i. These background investigations will be submitted by the Government, and they do not result in security clearance eligibility. Contractor personnel shall possess a current and favorable background investigation for designated level IT LEVEL 1 (Privileged) access prior to contract performance. Contractor personnel without a current investigation shall follow the procedures in paragraph 4.8.3.1 above.

4.8.5.3 Foreign National Network Access. All Contractor personnel that are Foreign Nationals shall meet the requirements of AFI 31-501, Personnel Security Program Management prior to network access. The Contractor shall ensure the request for network access for Foreign Nationals in their employ are processed and approved by the Foreign Disclosure Office (FDO) in accordance with Air Force Manual 17-1301, Computer Security (COMPUSEC), section 4.2.3.

All requests for access must be staffed through the AFRC Foreign Disclosure Office at least 30 calendar days in advance of the intended visit.

4.9 Contractor Environmental, Safety, and Occupational Health Compliance: The Contractor shall comply with Government Safety and Health regulations including, but not limited to, Public Law 91-596, Occupational Safety and Health Act (OSHA), and DoD Directive 4715.1E, Environmental, Safety, and Occupational Health (ESOH). The Contractor shall establish and maintain a safety and health program detailed in a written Contractor’s Safety and Health Plan. The Contractor shall require all subcontractors to comply with required safety, health, and fire standards.

4.10 Mishap Notification/Investigation: In accordance with AFI 91-204, Safety Investigations and Reports, the Contractor shall report mishaps involving damage or injury to USAF assets/interests. The Contractor shall ensure the USAF is notified of mishaps. The Contractor shall contact the COR, if available, or another MFT member by telephone within 2 hours. The Contractor shall immediately secure the mishap scene (and damaged property) and impound pertinent maintenance and training records until released by the Government’s Safety Office (78 ABW/SE). Such release shall be accomplished through the CO. The Contractor shall cooperate and assist Government personnel in the investigation of the mishap and submit an Accident/Incident Report within 24 hours of the mishap.

4.1…