Attachments_FA8538-21-R-0001.pdf

PR: FD2060-21-00038 PWS REVISION: 0 1

Distribution Statement: C

Performance Work Statement for

Repair of the F-15E Air Data Processor

Purchase Request: FD2060-21-00038

07 April 2020

Distribution Statement C: Distribution authorized to the U.S. Government Agencies and their contractors: Administration & Operational use (29 January 2020). Other requests for this document shall be referred to the responsible program manager, USAF AFMC 409 SCMS/GUMCA, 235 Byron St. Ste. 19-A, Robins AFB, GA 31098. Questions concerning technical content should be directed to the Procuring Contracting Officer (PCO), USAF AFMC AFSC/PZAAB for routing to USAF AFMC AFLCMC/WWQE. Questions concerning non-technical content should be directed to PCO for routing to USAF AFMC SCMS/GUMCA.

WARNING - This document contains technical data whose export is restricted by the Arms Export Control Act (Title 22, U.S.C., S3c. 2751 et seq.) or the Export Administration Act 1979, as amended (Title 50, U.S.C., App. 2401 et seq.). Violators of these export laws are subject to severe criminal penalties.

HANDLING AND DESTRUCTION NOTICE - Comply with distribution statement and destroy by any method that will prevent disclosure of the contents or reconstruction of the document.

1.0 Description of Services

PR: FD2060-21-00038 PWS REVISION: 0 2

1.1 Objective(s): This Performance-Based Work Statement (PWS) identifies the scope of Honeywell’s repair program for the Honeywell F-15E Air Data Processor under the Depot Avionics Partnering (DAP) Initiative. The objective of this program is to provide support for the system and its repair requirements. Services are required to continue the DAP for Honeywell and the United States Air Force to combine their resources to provide superior support for the ADP to the F-15 E Warfighter. The National Stock Number (NSN) and Part Number (PN) for the ADP is 6610-01432-8459FX and 2118952-5.

This effort will allow for increased efficiency during the repair process, which will result in increased aircraft availability to the end user. The repair program from FY2022 to FY2029 will provide the depot with repair capability and continuous technical support for the F-15E ADP during the contract timeframe. Contractor shall develop, implement, and manage the repair program through the follow-on ADP repair contract. A Direct Sales Partnering Agreement (DSPA) will be established to facilitate repairs with 402 EMXG at Robins AFB. The program will include Contractor Repair Technical Assistance and Maintenance of Government furnished equipment (GFE), Program Management, Parts Obsolescence Management, and also Adequate Parts Management to support required Turn-Around Time (TAT).

1.2 Benefit to United States Air Force (USAF): This acquisition will benefit the United States Air Force (USAF) by allowing for increased efficiency during the repair process, which will result in increased aircraft availability to the end user.

1.3 Background: The Air Data Processor (ADP) is a Line Replaceable Unit (LRU) on the F-15E.

There are two (2) identical and independent ADPs installed on the F-15E that control the engine inlet ramps; one (1) unit is located on the left side of the aircraft and the other is on the right side.

The ADP monitors the flow of air pressure and adjusts the ramps as necessary. If the right-side ADP fails, the left-side takes over operation of both sets of ramps. The ADP was developed to improve the accuracy and reliability for the Air Data Computer and Electronic Air Inlet Controller (EAIC) and functions by providing more accurate sensors and allowing expanded and selectable Source Error Corrections (SEC). The ADP was developed by Honeywell to replace the Air-Inlet Controller, the Flap Blowup Switch, and the Dynamic Pressure Switch. The two (2) ADPs on the F-15E provide the aircraft dual redundancy if one (1) should fail in flight. The ADP was developed by Honeywell International and is a highly specialized and military-unique item.

2.0 Services Summary

Performance Objectives

PWS

Paragraph

Number

Performance Threshold

Repair requirements on-time

4.5.1 & 4.5.2 Perform all repairs within the agreed number of days on the contract

PR: FD2060-21-00038 PWS REVISION: 0 3

Maintain Quality of Service

4.5.3 Maintain a Product Quality Deficiency Report

(PQDR) rate of no more than four (4) per period of performance

Promptly deliver the Quality Control Plan

5.9 The Contractor shall maintain a Quality Control

Plan (QCP).

3.0 Government Property

3.1 Contractor Responsibility: The Contractor shall be responsible for Government property in accordance with the Federal Acquisition Regulation (FAR) and as specified in the contract/order.

3.2 Government Property to be Provided: Government property to be provided includes the ADP assets submitted to the contractor for repair. Government will provide the list of equipment with quantities as an attachment to the contract to be transferred from the previous contract FA8538-15-D-0001. These items will remain the property of the US Government at the end of the contract and will follow disposition instructions by the PCO. Government property to be provided in accordance with contract attachment.

3.3 Base Support: The Government will furnish property incidental to the place of performance including office space and equipment, i.e., computer equipment, software, output device(s), phone/phone line, facsimile equipment, reproduction equipment and office supplies.

3.4 Reporting of Government Property: The Contractor shall create and maintain records of all Government property accountable to the contract/order. The Contractor shall record receipt and return of Government-Furnished Property (GFP) in the Item Unique Identification (IUID) Registry. Government shall provide Contractor with access to applicable government data and reporting systems: Logistics, Installations, and Mission Support-Enterprise View (LIMS-EV), Lean Depot Maintenance System (LDMS), and others if needed.

3.5 Loss of Government Property

3.5.1 Definition of Loss of Government Property: “Loss of Government property” means unintended loss of or damage to Government property including property that cannot be found after a reasonable search, loss due to inadequate storage, loss due to lack of security, theft, damage requiring repair to restore the item to usable condition, or damage that renders the property useless for its intended purpose or Beyond Economical Repair (BER). Loss of Government property does not include manufacturing defects, obsolescence, normal wear and tear, or purposeful destructive testing. Unless otherwise stated in the contract/order, loss of Government property does not include normal and reasonable inventory adjustments, i.e., losses of low priority consumable material, such as common hardware, as agreed to by the Contractor and the Government Property Administrator.

3.5.2 Reporting Loss of Government Property: The Contractor shall report loss of Government property using Defense Contract Management Agency (DCMA) / Access To eTools.

PR: FD2060-21-00038 PWS REVISION: 0 4

3.6 Return or Retention of Government Property: All property provided by the Government remains the property of the Government and shall be returned to the Government as directed, but no later than completion of the contract/order, unless the Procuring Contracting Officer (PCO) directs the Contractor to retain the property for continued use under a successor contract. All Government property shall be returned to the Government in the condition provided unless approved in advance by the PCO. All material generated under the contract/order becomes the property of the Government and shall be returned to the Government as directed, but no later than completion of the contract/order, unless the PCO directs the Contractor to retain the material for continued use under a successor contract.

4.0 Technical Requirements

4.1 Period and Place of Performance

4.1.1 Contract/Order Period of Performance: The period of performance for the contract/order will extend through a seven (7) year period with a 6-month services option per 52.217-8, Option to Extend Services.

4.1.2 Place of Performance: These services will be performed at Robins Air Force Base, Building 640.

4.2 Contract Data Requirements List(s) (CDRL)

Document Identifier

DID Title PWS Reference(s)

A001 DI-ADMIN-81250B/T PMR Meeting Minutes 4.3.2 A002 DI-NDTI-80566A Test Plan 4.6.1 A003 DI-SESS-80639D Engineering Change Proposal 4.6.2 A004 DI-MGMT-81941 Obsolescence Alert Notice 4.12.2 & 4.12.3 A005 DI-MGMT-82001 Risk Management Framework

Package 4.13.2.1

A006 DI-MGMT-82001 Risk Management Framework Project Plan

4.13.2.2

A007 DI-MGMT-81842/T Vulnerability Scan 4.14.3

4.2.1 Quality of CDRL Deliverable: There shall be no more than one (1) rejection of any deliverable. There shall be no more than one (1) total rejection(s) of deliverables per contract year. The Government will reject a deliverable if two (2) or more technical errors or three (3) or more minor errors are found within the deliverable. A technical error is defined as the format not being in accordance with the CDRL or the content not being accurate and complete in accordance with the CDRL, PWS or contract. A minor error is exemplified by a typographical error, a grammatical error, etc. The rejected deliverable shall be corrected and resubmitted within five (5) business days of notification of Government rejection.

4.2.2 Receipt of CDRL Deliverable: CDRL deliverables shall be submitted via Wide Area WorkFlow (WAWF) and submitted directly to the MFT member identified on the CDRL. There

PR: FD2060-21-00038 PWS REVISION: 0 5

shall be no more than one (1) late submission(s) of deliverables per contract year. The Contractor shall notify the Government if the delivery of any data/document will not meet the scheduled delivery date and negotiate a revised delivery date. The data/document shall be delivered by the revised delivery date acceptable to the Government.

4.3 Maintenance and Capability

4.3.1 Program Manager: The Contractor shall provide a Program Manager who has the authority and the necessary staff to accomplish the F-15 ADP requirements. The Program Manager shall be the Contractor's single point-of- contact to the Government on all program/operational issues.

Responsibilities of the Program Manager shall include, but not be limited to:

a. Schedule and support customer Program Management Review (PMR) meetings

b. Coordinate program requirements and information with the customer, and other

Government representatives as directed by the customer

c. Ensure timely resolution of business and technical problems

d. Implement corrective action in accordance with the terms and conditions of this Contract

e. Report against mutually agreed to performance measurements (metrics)

f. Provide financial information showing actual expenditure versus what was planned

4.3.2 Program Management Review (PMR): PMRs provide a forum to review Contractor performance, technical issues, outstanding action items, and any other Program issues raised by the Contractor and/or the Government. The Contractor shall provide an agenda with slides so that the Contractor and Government representatives shall address program issues and formulate action plans to resolve significant issues in a timely manner. The PMRs shall be held at Robins AFB, twice a year. Tentatively, the first PMR will be held in April of that fiscal year (FY) and the second PMR will be held in the November after the end of the FY. The ADP PMR can be combined with the Advance Display Core Processor (ADCP) and the Digital Mapping System (DMS) PMR. The Agenda will be to review ADP production, failure trending metrics, obsolescence, and other issues/actions as they arise. The contractor will provide PMR minutes.

(CDRL A001, DI-ADMIN-81250B/T, PMR Meeting Minutes)

4.3.3 Depot Management: Contractor shall manage F-15E ADP depot repair capability and provide on-going repair operations by way of the following activities:

a. Program Management - The Contractor shall be responsible for directing program operations to meet the obligations under this Contract

b. On-site Engineering Support - Contractor shall provide on-site support to facilitate repairs on the ADP

c. Support Equipment Calibration and Maintenance - Contractor shall be responsible for maintaining Government owned F-15 ADP test/support equipment and Test Program Set (TPS). Calibration will be handled by USAF IAW AFCAV

d. Technical Data Management and Maintenance - Contractor shall provide technical data in a format that will aid in the repair of the ADP

e. Depot Repair Training - Contractor shall provide technical training required to maintain depot F-15 ADP repair capability

f. Repairs - Contractor shall accomplish USAF F-15 ADP repairs utilizing 402 EMXG labor. The Contractor shall be responsible for providing adequate parts to support the

PR: FD2060-21-00038 PWS REVISION: 0 6

contracted turnaround time. Units received damaged beyond normal wear and tear will be considered outside of the standard repair scope and will be quoted on an individual basis

g. Surge Capability - Contractor shall maintain a surge capability plan

4.4 Quality of Services

4.4.1 Beyond Economic Repair (BER): Requests for condemnations shall be submitted in writing to the Procuring Contracting Officer (PCO) for items received by the Contractor that are deemed to be Beyond Economical Repair (BER) due to gross negligence on the part of the Government or acts of God. The Government IPT will have final approval for all condemnations of items.

The Government retains the right to examine any condemned items and test results for any items after the Contractor submits a condemnation request. The Contractor shall notify the COR and the 409 SCMS Program Manager via email if an item is awaiting examination for an excessive amount of time. All items condemned that contain precious metals and/or all precious metals bearing scrap shall be reported to the Defense Reutilization and Marketing Service, DRMS-SM, Federal Center 74 N. Washington, Battle Creek, MI 49017-3084 for disposition instructions unless other specific instructions are furnished by the PCO. Once condemnation authority has been received, the contractor will be responsible for the demilitarization of the asset and disposing of the asset properly. All crash damaged units and their internal parts cannot be recycled into the spares pool, they may be utilized for test benches with appropriate engineering approval.

Items condemned under provisions of this contract will be replaced by the Government with replacement assets for repair at no additional cost to the Government. BER scenarios considered under this contract are below:

• Physical Damage: Physical damage destroys 75% of the physical and electrical integrity of the unit (e.g. crushed, dropped, etc.)

• Internal Component Destruction: Overheating and subsequent destruction of 80% of the internal electrical components and electrical connections

• Other Specified Damage: Damage due to fire, explosion, flood, aircraft crash, or enemy combat action

• Undefined Damage: Any item not meeting the above descriptions are required to be repaired or submitted to the PCO for further consideration. Such considerations might include wear and tear, repairs to point of exhaustion, etc.

4.4.2 Over and Above: Over and above work as defined by this PWS requires prior approval by the PCO. Over and above work is defined as Line Replaceable Units (LRUs) which do not include a full complement of Shop Replaceable Units (SRUs), units that are not in a proper configuration, units that are returned due to operation outside designed limits, mishandling, and misuse or battle damage. Over and above charges may also be approved to cover the cost of disposing of any assets deemed “beyond economical repair.” In addition, this line can be used to charge for items that come in for repair and no fault is found.

4.4.3 Accessory and Component Reuse, Repair and Replacement: Cannibalization of bond room assets and in-work assets to ensure TAT of reparable components is authorized when shortage of

PR: FD2060-21-00038 PWS REVISION: 0 7

parts prevents completion of repair. It is the contractor’s responsibility to ensure parts that are cannibalized from these units are replaced so the units can be returned to supply in serviceable condition

4.5 Metrics: Contractor performance shall be evaluated against the following performance measurements:

4.5.1 Repair Turn-Around-Time (TAT): The rolling average TAT for repairs shall be completed within 21 business days. TAT shall be calculated using the following formula: Total Days in Repair of Units Sent to Supply during the last 12 months/Total number of Units Sent to Supply during the last 12 months. Contractor shall be relieved from TAT commitment when units are awaiting government action such as BER or Over and Above.

4.5.2 Surge and Mission Impaired Capability Awaiting Parts (MICAP) Turn-Around-Time: The TAT for a Surge/MICAP requirement is within 10 business days from receipt of notification and/or receipt of asset at the repair facility, whichever occurs later. The contractor may be provided relief from TAT requirements if there is a reallocation of manpower resources to meet higher priority items.

4.5.3 Product Quality Deficiency Report (PQDR) Process: The Government will use the PQDR process to return an item that was manufactured, repaired, or modified by the Contractor for which a quality problem is suspected. There shall be no more than four (4) PQDRs and/or QDRs per contract year. Validity of PQDRs shall be mutually agreed upon between the Contractor and Government and based on the definition of PQDR provided by TO 00-35D-54. In the event that the Government determines the issuance of a PQDR is required:

• Contractor quality representative of the pending PQDR will provide all information necessary

• The Contractor shall perform all evaluations, tests, and analysis required to:

confirm/non-confirm the stated discrepancy and actual failure mode; ascertain the applicable root cause and corrective action.

• The Contractor shall request disposition from Government if Contractor is not at fault. If at fault, the Contractor shall repair the item to a serviceable condition at no extra charge to the Government.

4.6 Engineering Services: The contractor shall perform engineering services and support to determine the cause of equipment failure on LRUs and/or SRUs and automated test equipment (ATE) and recommend corrective actions for failures or improvements for the system including test voids and aircraft/LRU/SRU/component test verticality issues. To accomplish this, the contractor shall provide engineering services in response to non-recurring tasks to include JDRS deficiency reporting monitoring, and resolution in accordance with TO 00-35D-54, as well as ATE malfunction, test voids and failures resolution. The 409 SCMS/GUEA Office will provide the Contractor with a focal point for reporting and resolution of deficiency reports.

4.6.1 All changes to the TPS, such as updates for cyber security, shall require qualification testing. As part of qual testing, the Contractor shall include regression testing analysis to

PR: FD2060-21-00038 PWS REVISION: 0 8

confirm that changes have not adversely affected existing technical requirements. Contractor shall provide a test plan for updates to the TPS. (CDRL A002, DI-NDTI-80566A, Test Plan)

4.6.2 Engineering Changes: In the event of an obsolescence issue or other technical problem requiring a change to the technical data package, the Contractor shall submit an Engineering Change Proposal. All Class 2 ECPs shall require class concurrence from the Government prior to execution. Class 1 ECPs will be incorporated using a modification contract action. (CDRL A003, DI-SESS-80639D, Engineering Change Proposal)

4.7 Repair Services

4.7.1 Repair Items: The contractor shall perform all actions necessary to return a reparable item to a serviceable but not like new condition. Repaired end items shall be labeled in accordance with the applicable Contractor drawing. End items should not be refinished to a like new condition merely for appearance. The extent of work required to assure a serviceable end item shall efficiently serve its intended purpose shall be determined by visual inspection, electrical testing and disassembly as necessary. Material or parts used for replacement shall be equal to or exceed the quality of the original material or parts. The material or parts used shall be entirely suitable for repair of the ADP. Parts which bear a national stock number designation may be replaced by a similar part, provided the alternate part is designated as an acceptable replacement by a federal catalog and approved by 409 SCMS/GUEA Engineering or AFLCMC/WWQE System Engineering Office.

4.7.2 Repair Parts: The contractor shall provide all necessary parts to repair the ADP Systems.

4.7.3 Parts Lay-In (Piece Part Material): Contractor shall use the remaining piece part materials acquired to support the repairs of the ADP from contract FA8538-18-D-0001 until exhausted.

Once these piece parts are exhausted, it will be the contractor’s responsibility to provide all piece parts for the repair and delivery of remaining assets to the Government in “A” condition.

4.7.4 Calibration: Calibration standards for test equipment must be traceable to the National Institute of Standards and Technology in accordance with ANSI/NCSL Z540.3. All test and measurement equipment shall be verified to have a current calibration prior to use, at such intervals and in the manner described under Contractor’s established calibration procedures.

4.8 Item Unique Identification (IUID)

4.8.1 IUID Requirements: Item Identification and Valuation, unique item identification is a method of permanently marking items with unique item identifiers which have machine-readable data elements. Unique item identification is required for all items to be delivered to the DoD that meet the criteria established in accordance with the FAR and applicable supplements and shall be in compliance with all applicable guidance and clauses listed in the contract. All assets subject to marking must be recorded in the DoD IUID Registry.

4.9 Packaging, Handling, Receiving, and Storage

PR: FD2060-21-00038 PWS REVISION: 0 9

4.9.1 Packaging and Marking: The Contractor shall package and mark Government Property in accordance with the contract (basic or order, as applicable) Air Force Materiel Command (AFMC) Form 158, Packaging Requirements; MIL-STD-129R, Department of Defense Standard Practice / Military Marking for Shipment and Storage; MIL-STD-130N, Department of Defense Standard Practice / Identification Marking of U.S. Military Property; and MIL-STD-2073-1E, Standard Practice for Military Packaging. The Contractor shall ensure that classified material is packaged, marked and shipped in accordance with DoD 5220.22-M, National Industrial Security Program Operating Manual (NISPOM). The Contractor shall package and mark Government property in accordance with other applicable Government regulations including, but not limited to, those regarding security, safety, and environmental concerns.

4.9.2 Preservation and Protection: The Contractor shall package and mark material for movement, shipment, receipt, and storage in a manner that ensures the protection and preservation of the material for shipment to and storage at the destination. The Contractor shall package electronic parts susceptible to static discharge damage in accordance with MIL-STD- 1686C, Military Standard: Electrostatic Discharge Control Program for Protection of Electrical and Electronic Parts, Assemblies and Equipment (Excluding Electrically Initiated Explosive Devices).

4.9.3 Shipping Containers: In accordance with MIL-STD-2073-1E, shipping containers received, which meet the requirements of the AFMC Form 158 and are suitable for return shipment of serviceable assets, shall be reclaimed and stored for reutilization. Unsuitable shipping containers shall be disposed of and replaced with new containers that meet the requirements of the AFMC Form 158.

4.9.4 Receiving and Handling: End items inducted for repair shall be handled in accordance with industry best accepted practices for receiving Government Equipment. The end items shall be handled and stored in such a manner as to prevent damage and theft. The Contractor shall secure and process end items returned for repair in accordance with the contract security requirements.

Contractor shall annotate the applicable receiving document (DD1348 and DD1149) with National Stock Number, Part Number, and Serial Number. The DD Form 250, Material Inspection and Receiving Report shall include National Stock Number, Part Number, and Serial Number. The Contractor shall provide early identification and reporting of Government repairables, which are misidentified, misdirected, or are missing recoverable modules/subassemblies to the PMS for disposition instructions.

4.10 Counterfeit Prevention Plan: The Contractor shall maintain a counterfeit electronic part detection and avoidance system to mitigate the risk of counterfeit electronic parts being installed in end items or otherwise entering the USAF/DoD inventory. The system shall incorporate process/procedures to address the requirements listed in accordance with the FAR and applicable supplements and shall be in compliance with all applicable guidance and clauses listed in the contract.

4.11 Configuration Management

PR: FD2060-21-00038 PWS REVISION: 0 10

4.11.1 The Government will maintain configuration management control of the end items associated with this contract. The Contractor shall work closely with the Government to ensure the integrity and compatibility of the system, subsystem, assembly, and subassembly for each end item, as applicable. Neither design nor functional capabilities will be changed, modified, or altered except when an Engineering Change Proposal (ECP) is submitted and approved in accordance with Electronic Industries Alliance (EIA) 649 (National Consensus Standard for Configuration Management). Major changes (Class I) will be submitted to the customer for approval. Minor changes will be submitted to AFLCMC/WWQE System Engineering Office and 409 SCMS/GUEA Engineering for Class concurrence only. The Contractor shall submit to the Government a courtesy copy of any change notice, document change notice, engineering change order, or specification change notice that would affect the configuration of the item. Changes to the configuration shall be made only when approved by the Government.

4.11.2 Configuration Control: The Contractor shall not incorporate any engineering changes to the end item that will affect form, fit, or function of the end item or any updates to associated documents prior to obtaining approval from the 409 SCMS/GUEA Engineering or AFLCMC/WWQE System Engineering Office through the Procuring Contracting Officer (PCO).

Any changes made without written approval from WR-ALC shall require removal at Contractor’s expense.

4.12 Obsolete Parts and Diminishing Manufacturing Sources and Material Shortages

4.12.1 The Contractor is responsible for managing obsolescence over the entire period of the contract to ensure compliance with all performance and contract requirements. The Contractor shall develop a plan for managing the loss, or impending loss, of manufacturers or suppliers of components, assemblies, or materials used in the system that prevents impact to contract performance and prevents additional costs from being incurred by the Government due to obsolescence. Changes considered necessary by the Contractor to ensure the continued manufacture and/or repair of the end item shall be made in accordance with the configuration management requirements of this PWS.

4.12.2 When the Contractor identifies an impending component obsolescence issue, or receives an unanticipated Diminishing Manufacturing Sources (DMS) discontinuance notice from a supplier, fulfillment of orders will continue until the stock of the obsolete component is exhausted. The Contractor will notify the Government of the DMS issue within five (5) days of discovery and will provide the Government Contracting Officer a resolution plan for approval via email. (CDRL A004, DI-MGMT-81941, Obsolescence Alert Notice)

4.12.3 If the DMS or obsolescence resolution impacts delivery performance or cost material, the material lay-in will be updated and the item delivery performance will be suspended. A mutually agreed upon ramp-up period will be under taken to allow for material lay-in delivery to once again meet the required performance delivery of this PWS. (CDRL A004, DI-MGMT-81941, Obsolescence Alert Notice)

4.13 Cyber Security Requirements

PR: FD2060-21-00038 PWS REVISION: 0 11

4.13.1 System Security

4.13.1.1 The contractor shall provide system security, which is defined as the secure design, implementation, configuration, operation, and continuous monitoring of security control. System security also depends on ongoing risk management, which requires active situational awareness of external and internal threats and attacks, as well as a process for identifying issues, assessing impact, and taking action. The contractor shall perform cyber security support to include, but not limited to, engineering and technical analysis and assessment of system cybersecurity, the design, integration, testing, and document of solutions for enhanced system cybersecurity development, delivery and sustainment of Risk Management Framework (RMF) package, to include all required artifacts in accordance with NIST 800-37, DoDI 8500.01, DoDI 8510.01, the DoD Joint Special Access Program (SAP) Implementation Guide (JSIG), and AFI 17-101.

4.13.2 Risk Management Framework

4.13.2.1 The Contractor shall develop, but not limited to: System Security Plan, Security Control Traceability Matrix, Risk Assessment Report, Security Assessment Plan, Security Assessment Report, Plan of Action & Milestone (POA&M), and Continuous Monitoring Plan (ConMon).

(CDRL A005, DI-MGMT-82001, RMF Package)

4.13.2.2 Risk Management Framework Project Plan: The contractor shall document the actions and timeline required to develop the artifacts listed at 4.13.2.1 60 days after contract award. The plan shall define the various tasks and milestones needed to achieve an Authority to Operate (ATO). (CDRL A006, DI-MGMT-82001, RMF Project Plan)

4.13.2.1.1 Plan of Action & Milestones (POA&M): The Contractor shall utilize the Government approved Plan of Action & Milestones format in order to provide information on the current state of the network security infrastructure. The POA&M shall be considered a ‘living’ document and shall regularly be updated throughout the entire lifecycle of the System through Decommission contract period of performance (PoP). The POA&M shall contain all Non-Compliant RMF Controls, and all Non-Compliant Vulnerability Findings as identified in the Vulnerability Scans, Security Technical Implementation Guides (STIGs), System Security Requirements Guide (SRGs), and Security Content Automation Protocol (SCAP) Benchmarks. At a minimum, the POA&M shall be updated quarterly unless otherwise stated and submitted to the Information System Security Manager (ISSM).

4.14 Security Patch Management

4.14.1 The Contractor shall develop and maintain a process for administering the security patching process for all systems. All patches must be tested prior to installation on fielded systems.

4.14.2 Vulnerability Scans: The Contractor shall scan the System using the approved vulnerability scanning tools as identified by the Information System Security Manager (ISSM).

The vulnerability scanner shall be updated with the latest signatures and scanning engines before

PR: FD2060-21-00038 PWS REVISION: 0 12

the execution of each vulnerability scan. At a minimum, vulnerability scans shall be conducted at least quarterly or when new vulnerabilities are potentially affecting the system are identified by the Contractor. Any time a High or Medium vulnerability is identified or discovered, the contractor shall notify the Government PM/ISSM within seven (7) calendar days. The Contractor shall install security-relevant software and firmware updates within thirty days of the release of the updates. Vulnerability scans shall be protected in accordance with the classification levels of the information and accordance with the system security classification guidelines. Non-compliant findings shall be documented in the System POA&M on a minimum monthly basis.

With the Government’s approval, the contractor shall fix findings in accordance with the Government’s priorities and schedule.

4.14.3 Vulnerability Scan Compliance Report: A Vulnerability Scan Compliance (VSC) Report shall be submitted after any vulnerability is conducted or when new vulnerabilities are identified. Vulnerability reports shall be in a format approved by the Government ISSM.

Vulnerability scans shall be handled and transmitted in accordance with the System's classification level. The Contractor shall also include and identify any new software or firmware updates that were made in the VSC Report. (CDRL A007, DI-MGMT-81842/T, Vulnerability Scan Compliance Report)

4.15 Workforce Certification

4.15.1 The contractor shall comply with DoD directive 8140.01 and DoD 8570.1-M for workforce training and certification requirements to perform information management, security patch management, vulnerability analysis and artifact development. The Contractor shall maintain the certification is in good standing or their privileged user access will be suspended. The AF does not fund certification training, maintenance fees or exam vouchers.

4.16 Information Technology Management

4.16.1 The Contractor shall maintain a process where all Information Technology is managed, but is not limited to: Configuration Management Plan, System Information, Concept of Operations (CONOPS), Environment, Operating and Computing Environment, System Architecture Description, Components, Configurations, Accreditation Boundaries supporting documents, System Diagrams, Data Flow Diagram, Hardware Lists, Software Lists, Ports, Protocols, and Services (PPS), Contingency Plan, and Patch Management Plan. The contractor shall submit all plans for Government approval prior to implementation. All system changes must be approved through a configuration management process when new information systems are under development, being procured, or delivered for operation.

4.16.2 Operating Systems and Software Licenses: The Contractor shall purchase all Operating Systems (OS) and software licenses that support the systems. The contractor shall obtain Government approval for the inclusion of all third party software (e.g., open-source, freeware, mobile code, source code or binaries) proposed for use on the system prior to its use or integration, and meet the requirements defined in the current DISA Application Security and Development Security STIG (Technical Implementation Guide). Approval is accomplished by submitting a Software Request through the Government Authorizing Official (AO). The

PR: FD2060-21-00038 PWS REVISION: 0 13

Contractor must also develop a hardened image using the required and approved STIGs, SRGs, SCAP Benchmarks, and other approved hardening tools. The hardened image must be approved by the Government prior to installation on to an operational system. Non-compliant STIG, SRG, SCAP Benchmark, and other findings shall be documented in the System POA&M on a minimum quarterly basis unless otherwise requested. Updates to the STIGs, SRGs, and SCAP Benchmarks are released on a monthly, quarterly, and yearly basis. Updates to the STIGs, SRGs, and SCAP Benchmarks shall be implemented into the System as they are released. STIG, SRG, and SCAP Benchmark artifacts shall be provided in a format approved by the ISSM. STIG, SRG, and SCAP Benchmark artifacts shall be handled in accordance with the System’s classification level.

4.17 Holidays and Facility Closings: Contractor/subcontractor personnel shall observe holidays and facility closings as authorized for government personnel. Contractor/subcontractor personnel shall only be permitted access to Government facilities when Government personnel are present.

4.18 Travel: Travel requests for contractor/subcontractor personnel shall be submitted for approval to the Contracting Officer prior to costs being incurred and a minimum of 15 business days in advance of departure. Receipts must be presented with the invoice for reimbursement of actual travel costs.

5.0 General Information

5.1 Continuation of Mission-Essential Services During a Crisis: The Functional Commander or civilian equivalent has determined these services are not mission-essential and will not continue in the event of a crisis.

5.2 Security Requirements

5.2.1 Security Regulations: The Contractor shall ensure personnel, information, system, property, facility and, if applicable, international security requirements are met. The Contractor shall ensure contractor/subcontractor personnel who perform work on a Government facility comply with the security requirements of the facility. The Contractor shall comply with the security regulations and clauses listed in the contract, including DoD 5200.2-R, Personnel Security Program; DoDD 5205.02E, DoD Operations Security (OPSEC) Program; DoD Manual 5205.02-M, DoD Operations Security (OPSEC) Program Manual; and AFI 31-101, Integrated Defense.

5.2.2 Operations Security (OPSEC): The purpose of OPSEC is to reduce the vulnerability of USAF missions to adversary collection and exploitation of critical information. The Contractor shall comply with DoDD 5205.02E and DoD Manual 5205.02-M to protect United States (U.S.)

Government interests. The Contractor shall ensure Contractor personnel who perform work on a Government facility comply with the OPSEC procedures of the facility.

5.2.3 Communications Security (COMSEC): The Contractor shall use only secure communications methods and/or equipment to transmit or otherwise transfer classified

PR: FD2060-21-00038 PWS REVISION: 0 14

information and/or Controlled Unclassified Information (CUI) in accordance with DoD 5220.22- M. Applicable equipment shall be safeguarded, maintained and operated in accordance with DoD 5220.22-M.

5.2.4 Security Clearance: The Contractor shall ensure applicable contractor/subcontractor personnel have security clearance(s) at the SECRET level for proper accomplishment of contract/order requirements. The security clearance(s) shall be obtained in accordance with the Department of Defense (DD) Form 254, Department of Defense Contract Security Classification Specification.

5.2.5 Security Incident or Violation: The Contractor shall immediately notify the Government Security Office of any potential or actual security incident or violation.

5.2.6 Access to Government System(s): The Government will provide contractor/subcontractor personnel access to system(s) necessary to perform tasks under the contract/order. The Contractor shall ensure contractor/subcontractor personnel who require access to an unclassified or classified Government Automated Information System (AIS) have the respective background check or security investigation conducted. At a minimum, the Contractor shall ensure contractor/subcontractor personnel who require access to an unclassified AIS have a National Agency Check with Inquiries (NACI) conducted. Upon completion/termination of the contract/order or transfer/termination of contractor/subcontractor personnel, the Contractor shall ensure the system account(s) are closed.

5.2.7 Access to Robins Air Force Base (AFB): The Contractor shall ensure contractor/subcontractor personnel who require access to Robins AFB comply with the security requirements of the installation. The Contractor shall provide the PCO a list of all contractor/subcontractor personnel requiring access to Robins AFB, the contract/order number and the period of performance. The Contractor shall also provide, if possible, the location of the work site and the days/hours during which the contractor/subcontractor personnel will require access to Robins AFB.

5.2.8 Common Access Card (CAC)

5.2.8.1 The Contractor shall ensure a CAC is obtained by all contractor/subcontractor personnel who require access to DoD computer networks/systems, for DoD facility entry control and/or for physical access to facilities and buildings to perform tasks under the contract/order. The Contractor shall provide a list of contractor/subcontractor personnel who require a CAC to the PCO. The Government will provide the Contractor instruction on how to complete a Contractor Verification System (CVS) application and notify the Contractor of approval/disapproval of contractor/subcontractor personnel application. Contractor/subcontractor personnel shall obtain the CAC from the local Real Time Automated Personnel Identification Documentation System (RAPIDS) issuing facility [usually the Military Personnel Flight (MPF)].

5.2.8.2 The Contractor shall immediately report a lost or stolen CAC as directed by local Government policy. The Contractor shall notify the PCO of any change to the list of contractor/subcontractor personnel who require a CAC and provide an updated list within five

PR: FD2060-21-00038 PWS REVISION: 0 15

(5) business days. The Contractor shall return a CAC within five (5) business days once contractor/subcontractor personnel no longer require computer network/system access and/or facility access. The Contractor shall return an expired CAC within five (5) business days after the expiration date. The Contractor shall return any and all CACs within five (5) business days after completion/termination of the contract as directed by local Government policy.

5.3 Environmental Management System (EMS): Contractor/subcontractor personnel who perform work on any Government facility shall comply with the EMS requirements established by the facility. Contractor/subcontractor personnel may be required to complete EMS training prior to beginning work.

5.4 Agency Affirmative Procurement Programs: This acquisition does not require the purchase of Environmental Protection Agency (EPA)-designated products or United States Department of Agriculture (USDA)-designated products; therefore, the requirement does not apply.

5.5 Safety Requirements

5.5.1 Contractor Compliance: The Contractor shall comply with Government Safety and Health regulations including, Public Law 91-596 as amended by Public Law 101-552 [Occupational Safety and Health Act of 1970 (OSHA)] and DoDD 4715.1E, Environment, Safety, and Occupational Health (ESOH).

5.5.2 Safety and Health Plan/Program: The Contractor shall maintain a Safety and Health Plan and provide in a reasonable timeframe to the MFT upon request. The Contractor shall establish and maintain a safety program in accordance with the contract/order, applicable Government regulations and the Safety and Health Plan.

5.5.3 Mishap Notification/Investigation: The Contractor shall report mishaps including damage to DoD property; occupational illness to DoD military or civilian personnel; injury to on- or off-duty DoD military personnel; injury to on-duty DoD civilian personnel; and damage to public or private property or injury or illness to non-DoD personnel caused by Government operations.

The Contractor shall ensure the Safety Office and the PCO are notified of mishaps. The Contractor shall contact the MFT (COR, if available, or another MFT member) by telephone within 24 business hours. The Contractor shall cooperate with Government safety investigations.

5.5.4 Voluntary Protection Program (VPP): Contractor personnel performing work on a USAF installation shall participate in the local VPP. Information on the VPP can be accessed at http://www.osha.gov/dcsp/vpp/index.html.

5.6 Inspection of Services: In accordance with the Inspection of Supply/Services clause(s) identified in the contract/order, the Government reserves the right to inspect Contractor performance.

5.7 Contractor Manpower Reporting: In accordance with 10 United States Code 2330a, the Contractor shall provide an annual count of contractor/subcontractor personnel performing work for each fiscal year if the DoD is the requiring activity and if the acquisition is in excess of http://www.osha.gov/dcsp/vpp/index.html

PR: FD2060-21-00038 PWS REVISION: 0 16

$3,000,000.00. The Contractor shall report all Contractor labor hours, including subcontractor labor hours, required for performance of the services provided under the contract in the Enterprise-wide Contractor Manpower Reporting Application (eCMRA). Reporting shall be conducted for each fiscal year, which extends October 1 through September 30. While inputs may be made any time during the fiscal year, all data shall be reported no later than October 31 of the following fiscal year. The Contractor shall establish a record for the contract/order in eCMRA no later than 30 calendar days after contract/order award. The Contractor shall enter Order Data, Contact Data and Location Data. Data for Air Force service requirements must be input at the Air Force CMRA link. Additional information and user manuals for government personnel and contractors are available at the Army CMRA link at http://www.ecmra.mil.

5.8 Invoicing/Payment and Receipt/Acceptance: The Contractor shall submit/process payment requests and receipt/acceptance documents via WAWF.

5.9 Quality Control Plan/Quality Management System (QMS): The Contractor shall ensure the quality of services through a quality and/or inspection system. The Contractor shall maintain a Quality Control Plan (QCP) addressing detection of quality program problems and defects, identification of root causes for quality related problems/defects, correction of root causes related to detected problems/defects, and follow-up to ensure quality related problems/defects do not recur. The plan shall include the schedule of quality assurance/control inspections planned by the Contractor. 100% compliance with the QMS is required.

5.10 Trafficking in Persons: The Contractor shall comply in accordance with the FAR and applicable supplements and shall be in compliance with all applicable guidance and clauses listed in the contract as it relates to Trafficking in Persons. Additional information about Trafficking in Persons is available at the site for the Department of State’s Office to Monitor and Combat Trafficking in Persons. http://www.state.gov/j/tip

6.0 Appendices

6.1 Appendix A, Reference(s)

Publication Title of Publication Date of Publication Sections(s) that Apply

DoD 5220.22-M

National Industrial Security Program Operating Manual (NISPOM).

February 28, 2006 Change 1 - March 28, Entire

DoDD 4715.1E

Environment, Safety, and Occupational Health

(ESOH)

March 19, 2005 Entire

DoDD) 5205.02E

DoD Operations Security (OPSEC) Program June 20, 2012 Entire

DoD Manual 5205.02-M

DoD Operations Security (OPSEC) Program Manual November 3, 2008 Entire

Public Law 91-596 as amended by

Occupational Safety and Health Act of 1970 December 29, 1970 as amended through January 1, 2004

Entire http://www.ecmra.mil/ http://www.state.gov/j/tip

PR: FD2060-21-00038 PWS REVISION: 0 17

Public Law 101-552 AS5553A Fraudulent /Counterfeit Electronics Parts; Avoidance, Detection, Mitigation, and Disposition Revision A 2013-01-21

Entire

FAR and supplements

Federal Acquisition Regulation http://farsite.hill.af.mil

Sections applicable to contract and PWS

DoDI 8500.01

Cybersecurity March 14, 2014 Entire

DoDI 8510.01

Risk Management Framework for DoD Information Technology

March 12, 2014 Change 1 – May 24, Entire

NIST 800-37 Guide for Applying the Risk Management Framework to Federal Information Systems

June 5, 2014 Entire http://farsite.hill.af.mil/

PACKAGING REQUIREMENTS

PURCHASE INSTRUMENT NUMBER: FD20602100038-00 VERSION: 2

MIL-STD 129 REVISION: R MIL-STD 2073-1 REVISION: E

THE FOLLOWING STATEMENT IS IN COMPLIANCE WITH THE UNITED NATIONS-IMPLEMENTED RESTRICTIONS ON WOOD PACKAGING MATERIAL (WPM). THIS REQUIREMENT IS SPECIFICALLY CONCERNED WITH INVASIVE SPECIES SUCH AS THE PINEWOOD NEMATODE. WPM IS DEFINED AS WOOD PALLETS, SKIDS, LOAD BOARDS, PALLET COLLARS, WOODEN BOXES, REELS, DUNNAGE, CRATES, FRAMES, AND CLEATS. THE STATEMENT BELOW CITES THE REQUIREMENTS IN DETAIL AND COVERS LUMBER FOR BUILDING CONTAINERS AND PALLETS USED FOR DELIVERIES RESULTING IN SHIPMENTS WORLDWIDE (DIRECT, OR THROUGH AIR LOGISTICS CENTERS (ALC), CONTAINER CONSOLIDATION POINTS (CCP), OR OTHER BASES). WOODEN LUMBER, WOODEN

PALLET AND PACKAGING/CONTAINER STATEMENT:

ALL WOODEN LUMBER, WOODEN PALLET'S, AND WOODEN CONTAINERS PRODUCED ENTIRELY OR IN PART OF WOOD PACKING MATERIAL (WPM) SHALL BE CONSTRUCTED FROM DEBARKED WOOD IN ADDITION TO THE APPLICATION OF HEAT-TREATED (HT) MATERIAL (HT TO 56 DEGREES CENTIGRADE OR 133 DEGREES FAHRENHEIT FOR 30 MINUTES). CERTIFICATION/MARKING IS REQUIRED BY AN ACCREDITED AGENCY RECOGNIZED BY THE AMERICAN LUMBER STANDARDS COMMITTEE (ALSC). FOR REFERENCE DOCUMENTATION, SEE LATEST REVISION OF "INTERNATIONAL STANDARDS FOR PHYTOSANITARY MEASURES" (ISPM)NO.15), "REGULATION OF WOOD PACKAGING MATERIAL IN INTERNATIONAL TRADE."

PACRN: PACKAGING REQUIREMENT: PRESERVATION LEVEL: PACKAGING LEVEL: SPI: SPI REV: SPI DATE:

AAA No Packaging Data Required

ITEM(S):

6610OSL200347FX

CODED DATA:

QUP ICQ

PRES

METH CD

PRES

MTL

WRAP

MTL

CUSH

DUNN CT

UNIT

CONT

INT

CONT UCL

SPEC

MKG

UNIT PACK

WEIGHT

UNIT PACK

LENGTH

UNIT PACK

WIDTH

UNIT PACK

DEPTH

UNIT PACK

CUBE OPI

ADDITIONAL PACKAGING AND CONTAINER MARKING REQUIREMENTS:

When shipping containers are received that meet the requirements of the AFMC Form 158 and are suitable for return shipment of serviceable assets, they shall be reclaimed, stored and protected for reuse. Unserviceable containers shall be disposed of and replaced with new containers by the contractor that meet the requirements of the AFMC Form 158.

SUPPLEMENTAL PACKAGING INSTRUCTION TEXT:

VENDOR PACKAGING INSTRUCTIONS:

Military Packaging and Marking Items shall be packaged in accordance…