Attachment 3 - 20th AF IT Support Performance Work Statement - 7 March 25.pdf

PERFORMANCE WORK STATEMENT

FOR

20th Air Force Information Technology Support

F.E. Warren Air Force Base, Wyoming

7 March 2025

7 March 2025 Page 2 of 17

Table of Contents

1. Description of Services

1.1. Scope

1.2. System Administration

1.3. VTC Administration

1.4. Network Administration

1.5. Cybersecurity Liaison (CSL)

1.6. Training

1.7. COMSEC User

1.8. Deliverables

2. Services Summary

3. Government Furnished Property and/or Services

3.1. Government Furnished Property

3.2. Government Furnished Services

3.3. Government Property Incidental to the Place of Performance

4. General Information

4.1. Quality Control

4.2. Quality Assurance

4.3. Security Requirements

4.4. Operational Security (OPSEC)

4.5. Location/Hours of Operation

4.6. Anti-Terrorism

4.7. Conservation of Utilities

4.8. Environmental Controls

4.9. Safety Requirements

4.10. Continuation of Essential DoD Contractor Services During Crisis

4.11. Contractor Personnel

4.12. Records

4.13. Special Qualifications and Training

5. Appendices

APPENDIX A – Publications and Instructions

APPENDIX B – Deliverables

7 March 2025 Page 3 of 17

1. Description of Services.

The contractor shall provide all management, tools, supplies, equipment, and labor necessary to perform information Technology (IT) Support services for Headquarters, 20th Air Force at F.E. Warren Air Force Base, Wyoming, in accordance with applicable federal, state, local laws and regulations, and this perform ance work statement (PWS).

1.1. Scope. The contractor shall provide IT resources to 20th Air Force (20 AF) Headquarters in support of Command, Control, Communications, Computers & Intelligence (C4I) systems, administrative networks, and other systems. Intended support of C4I systems includes such systems and application programs as Non‐classified Internet Protocol (IP) Router Network (NIPRNET), Secret Internet Protocol (IP) Router Network (SIPRNET), Top Secret‐Collateral network, Strategic Automated Command & Control System‐Secure Desktop Terminal (SACCS‐SDT), Joint World‐Wide Intelligence Control System (JWICS) network, Video Teleconference (VTC), Special Access Program (SAP) network/video equipment, Audio/Video Matrix, and other systems. Also included are tasks such as system analysis and engineering, system integration and implementation, IT planning, concept development, modeling and simulation, exercise support, training, Operations and Maintenance (O&M) activities, Communications Security (COMSEC) user, and some Information Assurance duties.

1.2. System Administration. The IT Contractor shall support system administration activities for NIPRNET, SIPRNET, Top Secret‐Collateral network, Video Matrix, Audio System, VTC, SACCS SDT, JWICS, SAP, and other C4I based systems (to include hardware, software, and firmware) within the Intelligence Facility. The IT Contractor will also support secure (and non‐secure, when time allows) IT systems (i.e.

SIPRNET) within the 20 AF headquarters building. At a minimum, administrator shall have a background in system setup, user maintenance, system security, backups and restores, e‐mail administration, TCP/IP, DNS, network interfaces, connectivity and workstation troubleshooting, client/server technology, disk space management, virus management, user training, help desk support, software patches/modifications, NOTAM compliance, and configuration management. The contractor will manage nine VTC suites within the 20 AF building. This includes providing VTC scheduling services, pre‐conference setup/dial‐in, in‐call monitoring and troubleshooting, and post‐conference tear‐down. The contractor will be appointed as a Cyber Security Liaison (CSL) for Wing collateral systems, to mitigate threats and vulnerabilities, employ appropriate security measures and identify required physical, personnel, and procedural security for information systems.

1.3. VTC Administration. The contractor shall perform VTC scheduling and support for the Commander and senior staff. The contractor shall work closely with senior leadership administrative support staff for scheduling VTC support for the headquarters staff to include General Officers. Support shall include ensuring VTC equipment, computers and video matrix systems are functioning properly.

1.4. Network Administration. The IT Contractor shall support network administration by troubleshooting/correcting issues when problems arise, conduct modifications, upgrades, and contingency/exercise support to include on‐call support during non‐duty hours. This is considered Tier one type maintenance, which includes maintenance/sustainment of all software products including databases, configurations, NOTAM compliance, troubleshooting and corrective actions of the computer systems located in the Intelligence Facility, and secure (and non‐secure, when time allows) systems throughout the 20 AF headquarters building. Anything outside this level of maintenance is the responsibility of the unit military appointed Cyber Security Liaison, local communication squadron, and other unique systems IT personnel, as appropriate.

7 March 2025 Page 4 of 17

1.5. Cybersecurity Liaison (CSL). The contractor shall ensure all operational systems within the Intelligence Facility adhere to System Program Office (SPO) system security requirements as well as DoD 5200.01, Vol 1, DoD Information Security Program, AFI 17‐130, Cybersecurity Program Management, DoD Information Technology Security Certification and Accreditation (C&A) Process, and the Intelligence Facility Operating Instructions/local procedures. The contractor shall be responsible for all required IT systems technical security certifications and accreditations, such as Authority to Operate (ATO), and will maintain all completed packages on file. Also, the contractor shall inform the Senior Intelligence Officer (SIO) and/or Special Security Officer (SSO) whenever a change is made to classified equipment; i.e., swapping servers, hard drives, PC’s, etc.

1.6. Training. The contractor shall ensure all Intelligence Facility personnel and other applicable 20 AF personnel are proficient on all systems/application software listed in para. 1.2.

1.7. COMSEC User. The contractor may be required to perform duties as COMSEC user to include:

inventory, destruction, receipt and transfer of COMSEC materials as well as using keying material to key crypto equipment and the daily advancement of keyed crypto equipment assigned to the Intelligence Facility.

1.8. Deliverables. The IT contractor shall provide the Contracting Officer’s Representative (COR) with a Weekly Activities Report (WAR). The report will be due at the end of each week. The below format will be utilized using Microsoft Word/PowerPoint. All reports shall become the sole property of the government.

IT Contractor Weekly Activity Report (WAR):

• Brief narrative of work accomplished during the week.

• Significant equipment/software problems.

• Forecasted future equipment/software implementations/changes.

• Status of Certifications/Accreditations.

• Status of any pending/open training requirements

7 March 2025 Page 5 of 17

2. Services Summary.

The contractor service delivery requirements are summarized into performance objectives that relate dir ectly to standards of performance required to meet mission essential needs. For the Performance Objecti ve to be met, service delivery must be in substantial compliance with applicable performance standards. T he Performance Threshold describes the minimum overall levels of service delivery required for acceptabl e quality control. Failure to meet these Performance Thresholds means that contractor Quality Control is unacceptable. The following is a list of the key performance objectives that will be verified as contractually compliant by Government personnel; however, inspection of any contract requirement is authorized.

Performance Objective PWS Para. Performance Threshold SS‐1. Operate and maintain systems.

Duty Hours: Available to respond and resolve problems as soon as possible.

Supporting General Officer/Senior Leadership VTCs and issues take priority.

Contractor will prioritize response based on who, and what systems need attention. This will be coordinated in advance with the Commander’s Executive Officer, Director of Staff and COR.

Non‐Duty Hours: Based on who, and what system needs attention, respond within 2 hours of notification.

Vacation time and sick leave absences will be coordinated in advance with COR and SAL.

1.2 & 1.3

Zero validated customer complaints per month

SS‐2. Maintain user configurations and training on all applicable systems/software.

1.2 & 1.3 Zero (0) lapse in standards

SS‐3. Ensure all system certifications / accreditations are maintained current and on file.

1.4 Zero (0) lapse in standards

7 March 2025 Page 6 of 17

3. Government Furnished Property and/or Services

3.1. Government Furnished Property.

3.1.1. See para 3.3.

3.2. Government Furnished Services.

3.2.1. Utilities. The Government will furnish the electricity, water, and sewage services (as necessary) for the accomplishment of service IAW this PWS.

3.3. Government Property Incidental to the Place of Performance.

3.3.1. Workspace, supplies and services: 20 AF will provide IT Contractor with a desk, telephone, personal computer, and access to unclassified and classified fax capability in the facility. IT contractor will have acc ess to office supplies, such as: pencils/pens, paper supplies, and other miscellaneous office supplies.

3.3.2. Hardware/Software. 20 AF will provide the IT contractor with a personal Unclassified and Secret classified computer with common Microsoft software installed. Contractor will establish user/admin acco unts, as applicable, on other common shared, systems throughout the facility.

3.2.3. Documentation: IT Contractor shall comply with all applicable security regulations and operating instructions (secure facility entrance/exit, emergency evacuation, escort procedures, etc.) (See Appendix A). Furthermore, contractor is required to comply with all current system accreditation/certifications and any applicable policy letters. Contractor will have access to any of the above referenced documentation.

Documentation will remain the property of the U.S. Air Force.

7 March 2025 Page 7 of 17

4. General Information.

4.1. Quality Control.

The contractor is required to control the quality of service delivery and offer to the Government for acceptance only services which conform to contract requirements. The overall control of quality must meet the specified performance thresholds for each requirement in the Services Summary.

4.2. Quality Assurance

The Government will evaluate the contractor’s performance by appointing a representative(s) to monitor performance to ensure services are received. The Government representative will evaluate the contractor’s performance through on‐site inspections, weekly WARs, and receipt of customer complaints.

The Government will inspect each task as completed. The Government will investigate complaints received from customers. The Government representative shall make final determination of the validity of customer complaint(s) in cases of disagreement with customer(s). Remedies for non‐conforming services will be resolved IAW the applicable Inspection/Acceptance clause attached within the contract.

4.2.1. The Contracting Officer’s Representative (COR) is the authorized Government representative(s) who will perform assessments of the contractor’s performance. Subsequent to contract award, the identity of the COR(s), with a letter defining their duties and authority will be promptly furnished to the successful bidder/offeror. The Contractor shall participate in performance review meetings with the COR (quarterly or semi‐annually, as determined by the COR) to discuss service delivery, challenges, and improvement plans.

4.2.2. The COR(s) will inform the contract manager when discrepancies occur and will request corrective action. The COR(s) will make a notation of the discrepancy on their surveillance checklist with the date and time the discrepancy was noted and will request the contract manager (or authorized representative) to acknowledge the discrepancy.

4.2.3. Any matter concerning a change to the scope, prices, terms or conditions of this contract shall be referred to the Contracting Officer and NOT to the COR(s).

4.2.4. The services to be performed by the contractor during the period of this contract shall (at all times and places) be subject to review by the Contracting Officer or authorized representative(s).

4.3. Security Requirements.

The contractor shall be responsible for all passes issued to their employees under this contract.

Applications shall be coordinated through the Contracting Officer or designated representative. The 20 AF Special Security Officer (SSO) will coordinate with Wing Information Protection and Contractor Facility Security Office (FSO) to ensure onsite employee is properly cleared, and clearance eligibility is current and accurate. A Visitors Group Security Agreement (VGSA) will be accomplished after contract award. A DD Form 254, Department of Defense Contract Security Classification Specification will be required for the IT Contractor. Upon termination of employment or contract completion, the contractor shall be responsible for returning identification Common Access Card (CAC) to the Military Personnel Flight (MPF)customer service CAC issuing station.

4.3.1. Privacy Act.

7 March 2025 Page 8 of 17

Work on this project requires that personnel have access to Personal Information. Personnel shall adhere to the Privacy Act, Title 5 of the U.S. Code, Section 552a, applicable agency rules, and regulations.

4.3.2. Non‐Disclosure Agreement.

Due to the sensitive nature of the data and information being worked with on a daily basis, completion of an NDA will be required by on‐site Contractor personnel to ensure information that is considered sensitive or proprietary is not compromised.

4.3.3. Levels of Security.

The contract company will have a functioning Facility Security Officer (FSO). On‐site employee must be a U. S. Citizen. Individuals performing work under this contract shall comply with applicable program security requirements. Contractors will support the following levels of security: The normal work location for the contractor will be in government facilities which require Top Secret (TS), Special Compartmented Information (SCI), Special Access Program (SAP), level security clearances, as well as, access to Nuclear Command and Control‐Extremely Sensitive Information (NC2‐ESI) material, Critical Nuclear Weapons Design Information (CNWDI), and Restricted Data (RD) material. Contractor will be, and maintain IT certifications in compliance with AFMAN 17‐1301 and DoD 8570.01‐M. Normally, IT System Administration Level II certification, such as the Certified Information Systems Security Professional (CISSP) certification or equivalent.

4.3.4. Background Check.

The contractor must maintain a Top Secret with SCI DCID 704 security clearance eligibility. Contractor is likely required to be indoctrinated into SAP and is subject to undergo polygraph testing.

4.4. Operational Security (OPSEC).

The contractor shall adhere to the following minimum requirements in support of this requirement:

4.4.1. Contractor personnel shall not discuss government operations in public or over unprotected or unencrypted communications. Official Business, Controlled Unclassified Information (CUI), and classified information may only be transmitted as directed in the PWS, via appropriate means.

4.4.2. The Contractor shall not post to company websites, publications, newsletters or other media any images, data or information that reveal sensitive government operations, personnel, equipment, and/or classified or CUI. When in doubt, company press releases related to this contract should be coordinated through the Contracting Officer Representative (COR) or Contracting Officer, as applicable.

4.4.3. Because observation of events, operations, physical changes, etc. may reveal National Security information, specific restrictions are needed to preclude unintentional release of this information to unauthorized parties. (Unauthorized disclosure and transfer of National Security Information is punishable under 18 USC § 793.) Therefore, contractor personnel shall not disclose to unauthorized third parties, post to unofficial sites (including Social Networking sites) any images, data or information, or observed events that reveal sensitive government operations, personnel, equipment, including, but not limited to:

4.4.3.1. Tactics, techniques and procedures, production or work schedules, any visible or concealed

7 March 2025 Page 9 of 17 modifications, upgrades, additions to vessels, aircraft, or weapons or equipment; increases, change, or decreases in work/deployment frequency or government personnel, vehicle, vessel or aircraft movements; specialized equipment orders, deliveries, shipments, etc., Unauthorized disclosures and attempts to solicit this type of information by unauthorized third parties or others not affiliated with this contract shall be reported to the COR or Contracting Officer, as applicable.

4.4.3.2. Government issued badges, identification shall be removed and/or concealed from plain sight when off base and shall not be left in vehicles or unprotected. Badges and passes may not be duplicated, copied or loaned to others. Lost or stolen identification badges, vehicle passes etc. will be immediately reported to the COR, Contracting Officer, and/or installation Security Office.

4.4.3.3. Practice OPSEC and implement countermeasures to protect critical information (CI) and other sensitive unclassified information, if applicable. Protection of CI will include the adherence to and execution of countermeasures which the contractor initiates or as provided by the COR/CO, for CI on or related to this PWS.

4.4.4. Where a contract requires long term access to on‐base facilities or other government facilities, such as embedded contractors or participates in operations, they must complete applicable training and awareness familiarization.

4.4.4.1. Initial training may be provided by computer‐based training, live training or a combination of both.

4.4.4.2. OPSEC training is required initially within 30 days of assignment.

4.4.4.3. The contractor is required to maintain individual training records for compliance purposes.

4.5. Location/Hours of Operation.

4.5.1. Location. Place of performance is at F. E. Warren AFB, WY. Telework/Standby is permitted for this contract on a case by case basis. Contractor will coordinate with COR for these periods.

Normally, during inclement weather when the base populate is released by the Wing Commander.

4.5.1.1. Telework. Telework is a work arrangement that allows an employee to perform work, during any part of regular, paid hours, at an approved alternative worksite (e.g., home, telework center, etc.). The Government may request that the Contractor implement Telework procedures under certain conditions, therefore the Contractor must have established Telework Agreements in place with their employees.

Upon award, the Contractor telework agreement must be submitted to the COR for review and documentation of compliance with Government safety and property guidelines. The Contractor telework agreement should be submitted annually to incorporate updates as necessary. The Contractor is responsible for their employees, labor hours, assignments, and government property while in telework status.

4.5.1.2. Unscheduled telework is when a manager approves a request to telework from a telework ready employee on a non‐telework day due to emergency related conditions (e.g., inclement weather, building closures, or other agency announced emergencies). The process for requesting unscheduled telework of

7 March 2025 Page 10 of 17

Contractor employees is as follows:

• The Government request will be coordinated with the CO and the Contractor.

• The request will identify the unscheduled telework condition (e.g., inclement weather, building closures or other agency announced emergencies),

• The request will identify what Contractor labor category is eligible for telework.

• The COR will identify tasks and approve the deliveries for the specific telework date, time and tasks.

NOTE: All scheduled or unscheduled telework will be at no additional cost to the Government.

4.5.2. Normal Hours of Operation. The contractor shall provide coverage at the specified government site between the hours of 0730 and 1630, or as agreed to by the using activity. Normal duty days will be Monday through Friday, excluding Federal Holidays. Work is normally conducted in an office environment on a 40 hour per week basis. The schedule may be adjusted, on occasion, to support after‐hour services or the contractor shall charge the hourly rate alotted for all other services performed outside of duty hours, as listed in para. 4.5.4.

4.5.3. Recognized Holidays. The contractor is not required to provide service on the following days:

• New Year's Day (January 1).

• Birthday of Martin Luther King, Jr. (Third Monday in January).

• Washington's Birthday (Third Monday in February).

• Memorial Day (Last Monday in May).

• Juneteenth National Independence Day (June 19).

• Independence Day (July 4).

• Labor Day (First Monday in September).

• Columbus Day (Second Monday in October).

• Veterans Day (November 11).

• Thanksgiving Day (Fourth Thursday in November).

• Christmas Day (December 25).

4.5.4. Emergency Services. On occasion, services may be required to support an activation or exercise of contingency plans outside the normal duty hours described above. The contract employee will coordinate compensatory hours with their company and COR while working extended, or hours outside the normal duty schedule, to support the Commander and mission during contingencies/exercises, or other higher states of readiness. The contract employee will coordinate with the COR to take compensatory hours during duty hours, when the calendar and schedule permit.

If the schedule does not allow for compensatory hours, the contractor will charge the hourly rated alotted for additional work performed outside of duty hours.

4.6. Anti‐Terrorism

4.6.1. Notification: If the Contractor (contract employees/subcontractors) identify any suspicious activity, they shall contact the Base Defense Operations Center (BDOC) at 307‐773‐3501 (On‐ installation)/Missile Security Control (MSC) at 307‐773‐2701 (Off‐installation) and notify the CO and COR (if appointed) that they contacted the BDOC and/or MSC.

7 March 2025 Page 11 of 17

4.6.2. Training. Contractor employees that require routine physical access to a Federally‐controlled facility or military installation shall complete Level I antiterrorism awareness training within 30 days of requiring access and annually thereafter and send a copy of their employees’ training certificate(s) to the CO and COR (if assigned). Training is located at Joint Knowledge Online (JKO) website:

https://jkodirect.jten.mil/Atlas2/page/login/Login.jsf

4.7. Conservation of Utilities.

The contractor shall instruct employees in utilities conservation practices. The contractor shall be responsible for operating under conditions which prevent the waste of utilities which include the following:

4.7.1. Lights shall be used only in areas where and when work is actually being performed.

4.7.2. Mechanical equipment controls for heating, ventilation, and air conditioning systems shall not be adjusted by the contractor or by contractor employees unless authorized.

4.7.3. Water faucets or valves shall be turned off after the required use has been accomplished.

4.7.4. Government telephones shall be used only for official Government business.

4.8. Environmental Controls.

4.8.1. Compliance with Laws and Regulations. The contractor shall be knowledgeable of and comply with all applicable Interstate, Federal, State, and Local laws, regulations, and requirements regarding environmental protection, to include Section 01 57 19.05 32, Environmental Protection. In the event environmental laws/regulations change during the term of this contract, the contractor is required to comply as such laws come into effect. If there is an increase or decrease in cost as a result of the change, the contractor shall inform the Contracting Officer pursuant to notice requirements and negotiate a modification to the contract.

4.8.2. Notification of Environmental Spills. If the contractor spills or releases any substance contained in 40 CFR 302 into the environment, the contractor or its agent shall immediately report the incident to the F.E. Warren AFB Fire Dept at 911 (landline) or 307‐773‐2931 (cell phone). The liability for the spill or release of such substances rests solely with the contractor and its agent.

4.8.3. Hazardous Material (HM). In the event that hazardous materials will be used in the execution of this contract, the contractor shall comply with all federal, state and local regulations concerning the use, storage, and reporting of HM in accordance with AFI 32‐7086 Hazardous Materials Management and AFMAN 32‐7002, Environmental Compliance and Pollution Prevention. The contractor shall be required to obtain authorization per the Installation Hazardous Materials Management Program before ordering or purchasing any hazardous product and may not may not bring a HM onto F.E. Warren AFB property, nor use a HM, until the contractor receives all required authorizations. This authorization process may take up to three weeks.

https://jkodirect.jten.mil/Atlas2/page/login/Login.jsf

7 March 2025 Page 12 of 17

4.8.4. Green Procurement Program (GPP). In performance of this contract, contractors shall use Environmental Protection Agency (EPA) designated recycled content products, Information Technology (IT) Energy Star products/appliances, Federal Energy Management Program (FEMP) Designated Energy Efficient Low Stand By Power products/appliances, U.S. Department of Agriculture (USDA) Bio based/Bio preferred products, Environmentally preferable products, Electronic Product Environmental Assessment Tool (EPEAT) registered products, Water Sense or other water efficient products, non‐ or Low Ozone depleting substances under the Significant New Alternatives Policy (SNAP), non or Low toxic or hazardous constituents (e.g. non‐VOC paint) and any other environmentally sustainable product/method, to the greatest extent possible.

4.9. Safety Requirements.

4.9.1. In performing work under this contract, the contractor shall:

4.9.1.1. Conform to the safety requirements contained in the contract for all activities related to the accomplishment of the work.

4.9.1.2. Record and report promptly (within one hour), to the contracting officer or designated COR, all available facts relating to each instance of damage to Government property or injury to either contractor or Government personnel.

4.9.1.3. In the event of an accident/mishap, take reasonable and prudent action to establish control of the accident/mishap scene, prevent further damage to persons or property, and preserve evidence until released by the accident/mishap investigative authority through the contracting officer.

4.10. Continuation of Essential DoD Contractor Services During Crisis.

In accordance with DFARS 237.7602(a), it is determined that the services provided under CLINs 0001‐ 4002 have been identified by the 20 AF Commander as key and mission essential services. VTC administration or troubleshooting critical communications equipment, supporting the commander and senior staff during higher states of readiness, or mission critical operations, may require contract personnel to work outside of normal duties hours. Reference para 4.5.4 for further details.

4.11. Contractor Personnel.

4.11.1. Contract Manager: The contractor shall provide a contract manager who shall be responsible for the performance of the services. The name of the contract manager shall be provided to the CO in writing prior to the beginning of the first performance period. The contract manager must be able to read, write, speak, and understand English.

4.11.1.1. The contract manager shall have full authority to act for the contractor on all contract matters relating to daily operations of this contract.

4.11.2. Contractor Employees: The contractor shall not employ persons for work on this contract if such employee is identified to the contractor by the CO as a potential threat to the health, safety, 7 March 2025 Page 13 of 17 security, general wellbeing or operational mission of the installation and its population.

4.11.2.1. Contractor personnel shall present a neat appearance. Daily office attire in 20 AF is business casual. On occasion, contractor may wear clothing more appropriate during periods such as office clean out days, moving IT equipment for turn‐in/pick up, pulling cables, etc.

4.12. Records. The contractor shall be responsible for creating, maintaining, and disposing of only those government required records that are specifically cited in this PWS, or required by the provisions of a mandatory directive listed in Appendix A. If requested by the Government, the contractor shall provide the original record, or a reproducible copy of any such record within five working days of receipt of the request.

4.13. Special Qualifications and Training.

4.13.1. The contractor must have a minimum of five (5) years of experience performing VTC system administration and Senior IT system administration duties on unclassified and classified systems.

4.13.2. Contractor will be, and maintain IT certifications in compliance with AFMAN 17‐ 1301 and DoD 8570.01‐M.

4.13.3. Training. 20 AF does not have the resources or expertise to provide in‐depth IT contractor training on local equipment. Intelligence directorate personnel may provide some basic system/application training. IT contractor will be responsible for training his/her replacement if such a situation occurs.

4.13.4. Contractors shall complete the customer‐provided Intelligence Oversight training as required by customer requirements and will report any Questionable Intelligence Activity (QIA), Significant/Highly Sensitive Matter (S/HSM), and/or Federal Crimes IAW procedures established in DoD Directive 5148.03, Intelligence Oversight, and AFI 14‐104, Intelligence Oversight. For contracts involving cryptographic matters in addition to DoDD and AFI reference, USSID 18, Legal Compliance and U. S. Persons Minimization Procedures.

7 March 2025 Page 14 of 17

5. Appendices

APPENDIX A – Publications and Instructions

Publication/Instruction /Name Date Applicable

Paragraph/Chapter PWS Paragraph

DoDM 5200.01 Vol 1, DAFM 16‐ 1404 Vol 1 DoD Information Security Program: Overview, Classification, and Declassification

24 Feb 2012 6 Apr 22 All 1.2., 3.2.2., 4.3.‐4.5.3.

DoDM 5200.01 Vol 2, DAFM 16‐1404 Vol 2 DoD Information Security Program: Marking of Information

24 Feb 2012 IC 3: 14 May 2019 7 Jan 21

All 1.2., 3.2.2., 4.3.‐4.5.3.

DoDM 5200.01 Vol 3, DAFM 16‐1404 Vol 3 DoD Information Security Program: Protection of Classified Information

24 Feb 2012 IC 2: 19 Mar 2013 12 Apr 22

All 1.2., 3.2.2., 4.3.‐4.5.3.

DoDM 5200.48, DAFI 16‐1403 DoD Information Security Program: Controlled Unclassified Information (CUI)

6 Mar 20 5 Oct 21 All 1.2., 3.2.2., 4.3.‐4.5.3.

DoDM 5200.02/AFMAN 16‐ 1405, Procedures for the DoD Personnel Security Program (PSP)/AF Personnel Security Program

3 Apr 2017 1 Aug 2018 29 Nov 2023

All 1.2., 3.2.2., 4.3.‐4.5.3.

DoDM 5220.22 Vol 2/AFMAN 16‐1406 Vol 2, National Industrial Security Program:

Industrial Security Procedures for Government Activities

1 Aug 2018 8 May 2020 All 1.2., 3.2.2., 4.3.‐4.5.3.

7 March 2025 Page 15 of 17

National Industrial Security Program Operating Manual (NISPOM), 32 CFR 117, 24 Feb

24 Feb 21

All Entire PWS

DoDM 5105.21 Vol 1, SCI Administrative Manual:

Administration of Information and Information Systems Security

19 Oct 2012 IC 2, 6 Oct 2020 All 1.2., 3.2.2., 4.3.‐4.5.3.

DoDM 5105.21 Vol 2, SCI Administrative Manual:

Administration of Security, Visitor Control, and Technical Security

19 Oct 2012 IC 2:

2 Nov 2020

All 1.2., 3.2.2., 4.3.‐4.5.3.

DoDM 5105.21 Vol 3, SCI Administrative Manual:

Administration of Personnel Security, Industrial Security, and Special Activities

9 Oct 2012 IC 2: 14 Sep 2020 All 1.2., 3.2.2., 4.3.‐4.5.3.

Intelligence Community Technical Specifications for Construction and Management Of Sensitive Compartmented Information Facilities (SCIFs) ICD/ICS 705_v1.5.1

26 Jul 2021 All 1.2., 3.2.2., 4.3.‐4.5.3.

AFM 17‐1301 Cyber Security Computer Security

(COMPUSEC)

12 Feb 2020 All All

20th Air Force Sensitive Compartmented Information Facility (SCIF) Standard Operating Procedures (SOP)

2016 All 1.2., 3.2.2., 4.3.‐4.5.3.

DoDM 8140.03, Cyberspace Workforce Qualification and Management Program

15 Feb 2023 All All (as applicable)

7 March 2025 Page 16 of 17

AFMAN 17‐1302‐O,

Communications Security (COMSEC) Operations

21 Nov 22 All 1.7.

Publications available at:

https://www.e‐publishing.af.mil https://www.esd.whs.mil/dd/ https://www.e-publishing.af.mil/ https://www.esd.whs.mil/dd/

7 March 2025 Page 17 of 17

APPENDIX B – Deliverables

All deliverables must meet professional standards and the requirements set forth in the applicable contractual documents. The Contractor shall be responsible for delivering all specified end items. The end items listed in the table below are outputs, which fall within the scope of this effort and are illustrative of the type of work the Government expects to require.

Title Submission Date As of Date Distribution Copies Weekly Activity Report (PWS para 1.8)

Last day of the week

Each Week COR 1 each

Records (PWS Para 4.11)

5 working days Date of Request CO/COR As specified in request

Mission Essential Services Plan

With offer Date of Request CO 1 each

Time Card Monthly (before invoicing)

Each Month COR/CO 1 each

APPENDIX B – Deliverables