Attch 1 Performance Work Statement (PWS).pdf

PERFORMANCE WORK STATEMENT

HQ AETC IT SUPPORT SERVICES

Solicitation Number FA301625R0005

1. Purpose

To provide timely, proactive, high-quality information technology (IT) support to each HQ AETC unit/directorate listed in Appendix 2. The contractor shall be responsible for the administration and technical support of IT equipment on the unclassified and classified Air Force enterprise network and commercial networks, audio & video teleconferencing systems, as well as manage the Unit Software License Management program and IT Asset Management program for the assigned HQ AETC units/directorates.

2. Scope

The contractor shall provide all personnel, supervision, and non-personal services necessary to perform the requirements of this Performance Work Statement (PWS). The contractor shall provide on-site technical and business IT support services relating to the computing and networking needs for each assigned HQ AETC unit/directorate within prescribed timelines.

3. Requirement / Description of Services

3.1. Implementation and Operation

3.1.1. The contractor shall provide candidates with the requisite education, skills, certifications, and experience necessary to complete the following required support:

3.1.1.1. Contractor shall work with Air Force approved Standard Desktop Configurations (SDC) (including but not limited to Windows 7/Windows 10/Windows 11) and approved MS Office software (including but not limited to 2016/2019/O365).

3.1.1.2. Contractor personnel shall have knowledge of Local Area Network (LAN) infrastructure, server hardware and software platforms and related support tools.

3.1.1.3. Contractor shall manage day-to-day configuration and operation of the software environment and operating systems.

3.1.1.4. Contractor personnel shall have experience with mobile device support to include, but not limited to laptops, Slates, Personal Digital Assistant, and cell phones.

3.1.1.5. Contractor personnel shall evaluate potential information assurance security risks and take corrective actions.

3.1.1.6. Contractor personnel shall be knowledgeable in Video Teleconference (VTC) projection systems and associated sub-systems software to meet audiovisual requirements. This includes ensuring VTC equipment is operational and available for utilization. This may include the setup of VTC appointments or conferences at the availability of the contractor.

3.1.1.7. Contractor personnel shall interface with external agencies (such as the Air Force Enterprise Service Desk) to resolve technical issues impacting directorate/unit users.

3.1.2. Client System Administration

The contractor shall perform the following tasks:

3.1.2.1. Provide on-site technical and business IT support services relating to the computing and network needs for users as listed in Table 1. Provide customer service through assessing trouble calls, emails, and ticketing systems to include maintaining problem resolution at the lowest level.

Directorate Approx. # of users 19th AF 326 A2 48

AETC A9 & SAS 130

AETC A3/6 & CSS 404

AETC A5/8 175

AETC/HC 10

AETC/IG 41

AETC/JA 18

AETC/PA 22

AETC/SE 16

AETC/SG 40

TOTAL 1,230

Table 1 – Number of supported users

3.1.2.2. Provide end user support for AF-procured/authorized hardware, operating system software and applications, and ensure workstations and mobile devices are operational.

Government owned mobile devices include laptops, tablets, personal digital assistants, cell phones, and wireless hotspots. The contractor shall limit end user support to device software and configuration only. The contractor shall ensure workstations and mobile device environments are in either of three (3) states: operational, being serviced, or an external trouble ticket was opened for problem resolution.

3.1.2.3. Track and process internal trouble tickets submitted by end users using the current Air Force ticketing system. Trouble tickets submitted to the contractor shall be assessed within four (4) duty hours after notification. Trouble tickets within the contractor’s area of responsibility shall be resolved within two (2) business days after notification.

3.1.2.4. The contractor shall submit an external trouble ticket to the Air Force Enterprise Service Desk's Remedy trouble ticket system for any trouble tickets received that are outside the contractor's area of responsibility. Trouble tickets submitted to the contractor shall be assessed within four (4) duty hours after notification. Provide updates to the customer on a weekly basis until ticket resolution. Telephone Control Officer and Personal Wireless Communication System duties, specifically account management, are outside of the contractor’s area of responsibility. The contractor shall route these requests to their assigned government representatives.

3.1.2.5. The primary/alternate Contracting Officer Representative (COR) has overall responsibility to prioritize high level tickets.

3.1.2.6. Perform network/system administrator duties to include managing the system from the hardware and software operating system level. The management shall include all operating systems, applications software, network interfaces, virus scanning software, and administering printer services. The contractor shall initialize, install, and configure system hardware and software and provide technical support to the users.

3.1.2.7. Assist users in performing routine backups and restoring data to workstations.

3.1.2.8. Routinely implement software patches and security fixes when requested and when AFIN automated processes are unable to install. This shall include tasks assigned by the Air Force Network Operations and Security Centers (AFNOSC) or local network managers. Test and validate the proper operation and configuration with the appropriate patches and fixes, prior to restoring any device to the network. Contractor shall comply with all TCNO mandates and local base Network Control Center (NCC) guidance in time parameters given.

3.1.2.9. Perform hardware maintenance and troubleshooting. This is limited to replacement or reconfiguration of the system, system switches/jumpers, expansion and network interface cards, memory modules, cables, power protection devices, and other peripheral and ancillary equipment as required, consistent with existing computer warranties.

3.1.2.10. Access manufacturer websites to research equipment warranty information and coordinate with them to replace items under warranty that are no longer functional.

3.1.2.11. Install, configure, and manage network and non-network printers to include installation of consumable inventory management (e.g. cartridges, paper, and drums, which are government provided).

3.1.2.12. Plan, instruct end users, and complete hardware connections to the local area network, to include setup and/or relocation of workstations within three (3) days of notification.

3.1.2.13. Provide installation and management of government-owned software for customers and ensure workstations and mobile device environments are operational. Software application trouble tickets submitted to the contractor shall be assessed within four (4) duty hours after notification. Trouble tickets within the contractor's area of responsibility shall be resolved within two (2) business days after notification.

3.1.2.14. Coordinate the creation and administration of network user accounts and groups.

Submit account creation requests through the Air Force Enterprise Service Desk’s Remedy trouble ticket system within one (1) business day after receipt, and complete administrative distribution lists and security groups' updates within one (1) business day after notification.

3.1.2.15. Manage/assign network user permissions and access to file server directories/volumes to provide a functional and secure network environment. Respond to network resource requests within one (1) business day after receipt.

3.1.2.16. Coordinate with Storage Area Network managers on file/volume management and restoration activities.

3.1.2.17. Perform additional computer risk analysis and maintain system access control necessitated by changes to the security of the system.

3.1.2.18. The contractor shall identify network problems, analyze equipment configurations, and shall provide corrective actions support as recommended by AETC A3/6, AFNIC, 24th AF, and/or DISA.

3.1.2.19. Provide on-site assistance/or on-the-job training to users on all supported IT equipment.

3.1.2.20. The contractor shall assist in the acquisition process by providing the government with market research and technical recommendations to assist in the purchasing of laptops, tablets, personal digital assistants, cell phones, and wireless hotspots to support the government’s mission requirements. The contractor shall ensure recommendations are IAW DAFMAN 17-1203 and Air Force interoperability and compliance standards. The contracting officer representative (COR) and/or government PM will provide final verification and execution of all acquisition of IT requirements as per applicable regulations.

3.1.2.21. Provide support for HQ AETC-controlled Video Teleconference (VTC) assets. VTC support shall be limited to equipment support only, which includes software, government-provided hardware replacement, and operational configuration. The contractor may be required to run slides, provide VTC dial-in support and maintain oversight of the VTC equipment throughout the duration of a conference. The contractor shall be available in the event of an equipment emergency.

3.1.3. Software License Management

The contractor shall provide maintenance and support of software licenses and manage its relationship to the overall system life cycle IAW DAFMAN 17-1203, Information Technology Asset Management (ITAM) and Accountability, which would include applications, license agreements and software upgrades. The contractor shall provide and maintain the software asset inventory. The contractor shall provide support summary information to include the general terms and conditions, benefits, strategic and tactical directions, license ordering information, internal billing process, pricing and deployment and support of the products included in the software agreements. The contractor shall support common practices for ordering software assets, tracking orders and tagging the software assets. The contractor shall support application installation, maintenance, sustainment, and configuration control, to include the information needed in the procurement of supporting software licenses.

3.1.4. IT Asset Management

3.1.4.1. The contractor will serve as alternate Property Custodians (PC) for each Information Technology Asset Management (ITAM) account, per Table 2 below. These accounts are located throughout the supported AETC directorates.

Directorate Account Number Inventory (Approx.)

19th AF #065A 632

AETC/A9 #547 42

AETC/SAS #515 288

AETC A3/6 #065 88

AETC A5/8 #037 213

AETC/HC #001 32

AETC/CSS #210 150

AETC/JA #010 58

AETC/PA #044 56

AETC/SE #006 49

AETC/SG #022 110

TOTAL 1,718

Table 2. Equipment accounts

3.1.4.2. Complete ITAM account training as facilitated by the Joint Base San Antonio (JBSA) Base Equipment Control Officer (BECO). Information related to training is located on the 502d Communications Squadron Equipment Control Office website located at:

https://usaf.dps.mil/sites/aetc-jbsa-cs/SCO/SCOS/SCOSE/ECO/SitePages/Home.aspx

3.1.4.3. Maintain an accurate inventory of all assigned ITAM accounts by ensuring the AF system of record (currently DPAS) reflects the current status, location, financial information, and condition of each asset until disposition. NOTE: Inventory is subject to change (increase or decrease 5%-10% depending on the customers’ needs).

3.1.4.4. Assist the primary custodian with performing an annual physical inventory (in coordination with the BECO’s timeline) of 100% of each directorate’s/unit’s IT items currently on each account listing. The BECO may direct an out of cycle inventory for accountability purposes. The government does not anticipate a BECO-directed out of cycle inventory more than once a quarter. Upon completion of the inventory, the PC and the organizational commander or government equivalent shall sign the inventory with the original copy retained by the PC and a copy for the BECO file.

3.1.4.5. Review past inventory records before disposing of old inventory data and ensure source documents are retained to support current inventory records, e.g., Reports of Survey, hand receipts, etc.

3.1.4.6. When IT assets arrive at the BECO, the BECO will notify the PC. The PC will need to pick up, sign for, and secure all IT assets within 10 working days of arrival (approximately 10 times per year) to ensure accountability of IT assets. New equipment received through the BECO is signed for on the receiving notice or invoice. An Asset Inventory Management (AIM)-generated standard product (bar code) is generated by the BECO. After the IT asset is signed for, it is PC’s responsibility to affix the barcode on the IT asset within 48 hours of receipt.

3.1.4.7. Obtain approval from the COR and coordinate all potential transfers of IT assets between ITAM accounts with the applicable BECO where practical.

3.1.4.8. Report all found-on-base (FOB) IT assets to the BECO and unit Accountable Property Officer (APO) IAW DAFMAN 17-1203

3.1.4.9. Follow DAFMAN 17-1203 and BECO procedures and guidance on all shipments, transfers, donations, or turn-ins of excess IT assets.

3.1.4.10. Identify all excess IT assets on a quarterly basis. Schedule, prepare, transport and/or arrange for assets to be turned into the proper DoD agency. Provide appropriate documentation to the BECO to clear the account of equipment that was transferred to another account, shipped to another base/location, donated to a school, or turned-in to the DLA Disposition Services Office at Joint Base San Antonio-Fort Sam Houston.

3.1.4.11. If there is a personnel change to the primary PC, a joint physical inventory will be completed before the primary PC leaves the government facility. Joint inventories shall be conducted 30 days before last duty day or as soon as the contractor and individual know their last duty day. Missing, lost, damaged, or destroyed IT assets are processed IAW

DAFMAN 17-1203

3.1.4.12. Prior to turning in IT assets with hard drives, the contractor shall coordinate with the Information Systems Security Officer (ISSO) to ensure hard drives are sanitized in accordance with (IAW) the procedures outlined in AFSSI 8580 (FOUO).

3.1.5. Qualifications

3.1.5.1. All Contractor personnel shall possess a minimum of “Intermediate” proficiency level certification IAW DoDM 8140.03, Cyberspace Workforce Qualification and Management Program, prior to contract award.

3.1.5.2. Contractor personnel shall have a minimum of three (3) years of asset management experience to be appointed as alternate Property Custodian and/or Unit Software License Manager.

4. General Requirements

4.1. Duty Locations and Duty Hours - The primary location is JBSA Randolph, TX (refer to Appendix 2). Duty hours are from 0730-1630, Monday-Friday, except for all Federal Holidays. In the event that an occasional special project or mission-related incident occurs, the contractor shall be required to work beyond the normal duty hours stated herein, if required by the COR. Alternate working hours or schedule adjustments can be accomplished if the contractor shall be required to work outside scheduled duty hours without any additional payment. Federal Holidays: HQ AETC follows the Federal Government schedule for holidays provided during each work year.

The holidays recognized by the Federal Government are: New Year’s Day, Dr. Martin Luther King Jr’s Birthday, Presidents’ Day, Memorial Day, Juneteenth Day, Independence Day, Labor Day, Columbus Day, Veterans’ Day, Thanksgiving Day, and Christmas Day. Family Days and Down Days do not constitute a Federal Holiday.

Contractor personnel may be required to travel with an active duty or GS escort in government vehicles in performance of this contract. The COR shall coordinate to have an active duty or GS escort in a government vehicle to transport assets to the DLA Disposition Services Office at Joint Base San Antonio-Fort Sam Houston, as needed.

4.1.1. Telework Option (Government Directed) - The government reserves the right to authorize routine or situational telework on a case-by-case basis. Examples include, but are not limited to, the following: 1) an employee has a short-term need for uninterrupted time to complete work on a complex project or report; 2) an employee is recovering from illness or an injury and is temporarily unable to report to the traditional office physically; 3) an employee receives word of inclement weather and notifies her/his supervisor that s/he would like to opt for unscheduled telework that day; 4) occurrence beyond the reasonable control of the contractor such as, acts of God or the public enemy, fires, floods, epidemics, quarantine restrictions.

4.2. Other situations - In the course of business, situations may arise where government facilities may not be available for performance of the requirements (i.e., base closure due to weather, Force Protection conditions, etc.). There may also be occasions when government civilians and military employees participate in morale and recreational activities (i.e., holiday parties, golf outings, sports days, and other various social events). Contractor employees shall not be directed to attend such events by the government. Since a contract employee is not a government employee, the contract employee cannot be granted the same duty time activities as government employees. Participation in such events is not permissible during performance of the tasks required by this contract and contractor employee participation should be IAW the employees’ company policies and compensation system.

4.3. Government Furnished Property and Services

4.3.1. The government shall provide the following facilities, equipment, materials, and services required for the contractor to perform the tasks in this PWS.

4.3.2. Government Furnished Facilities. The government shall furnish or make available workspace in select buildings identified in Appendix 2, JBSA-Randolph, TX. Government facilities have been inspected for compliance with Occupational Safety and Health Act (OSHA) and environmental regulations. The facilities are provided “as-is” and the government does not represent the condition, quality, or completeness of the property. However, no hazards have been identified which would prevent normal use of the facilities or for which workarounds were required. The fact that no such conditions have been identified does not warrant or guarantee that no possible hazard exists, or that work-around procedures will not be necessary or that the facilities as furnished will be adequate to meet the responsibilities of the contractor.

4.3.3. Government Furnished Services. The government will provide workspace, office furniture, computer resources, telephones, office supplies, test data, and tools necessary to perform the task.

4.3.4. The contractor shall have access to government regulations, specifications, standards, technical manuals, design documentation, and task documentation.

4.3.5. Copies of required government furnished materials cited in the solicitation, PWS, DD Form 254, and/or in the contract will be provided to the contractor in hard copy or soft copy.

All materials will remain the property of the government and will be returned to the cognizant government COR upon request or at the end of the contract period of performance.

4.4. Training

Contractor personnel are required to possess the skills necessary to support their company’s minimum requirements of the labor category under which they are performing. Training necessary to meet minimum requirements of this task order will not be paid for by the government.

4.4.1. Government-Provided Training

The contractor’s employees may participate in government provided training, on a non-discriminatory basis as among contractors, under the following circumstances:

a) The contractor employees’ participation is on a space-available basis,

b) The contractor employees’ participation does not negatively impact contract performance, and

c) The government incurs no additional cost in providing the training due to the contractor employees’ participation.

4.4.2. Technology Training

The contractor shall comply with DoDM 8140.03 (formerly DoD 8570.01-M) policy guidelines to include the contractor shall be certified at the “Intermediate” proficiency level and shall also meet the annual cybersecurity training requirements.

5. Contractual Requirements

5.1. Performance Reporting

5.1.1. The contractor’s performance will be monitored by the government-assigned Contracting Officer Representative (COR) and reported in PIEE/SPM monthly. The Contractor Performance Assessment Reporting System (CPARS) will also be utilized annually, when required.

5.1.2. The contractor shall deliver a Monthly Status Report (MSR) by the 10th day of the month for the previous month, documenting all tasks including those completed, ongoing and started during the period, issues that arose during the period with impact assessments and solution recommendations, and requirement changes with impact assessments. The contractor shall submit the MSR to the COR and 502 CONS which outlines all actions taken in support of this PWS. The MSR shall include at a minimum:

a) A narrative description of PWS tasks in paragraph 3.1 and sub-paragraphs describing progress to date, and other information deemed necessary by the contractor or government,

b) Description of all system changes affecting all directorates/units supported and owned IT equipment on both NIPRNet and SIPRNet,

c) A log of end user submitted trouble tickets submitted to the contractor.

5.1.3. Performance standards shall include the contractor’s ability to:

a) Provide quality services, products, and customer support.

b) Meet customers agreed-upon timelines for scheduled delivery of items, warranty, and/or services during contract performance period (emergency/critical, maintenance/warranty).

c) Provide satisfactory product repairs or advance replacement, as appropriate.

d) Provide timely and accurate reports within three (3) working days of government request.

e) Respond to the customer’s requests for proposals and configuration assistance as identified in each task order.

5.1.4. The contractor shall notify in writing within 24 hours of the identification of any personnel changes concerning staffing, qualifications, security clearances and certifications that impact the contractor’s ability to execute/perform responsibilities or meet all requirements as outlined in this

PWS.

5.1.5. The contractor Program Manager shall attend Program Management Reviews (PMR) and deliver the Monthly Status Report in a manner to be determined by the COR.

5.1.6. The contractor shall produce and deliver meeting minutes for any meeting attended, except for the Monthly Program Review Meeting, within 5 business days after the meeting has occurred.

6. Quality Control

6.1. General Guidance

Only the COR or the designated alternate COR has the authority to inspect, accept, or reject all deliverables. The COR will review all written deliverables for accuracy and completeness within five

(5) working days. The contractor shall have five (5) working days to finalize and resubmit deliverables. The COR will have up to five (5) working days to accept or reject final deliverables.

6.1.1. Refer to Appendix 1, “List of Applicable Standards, Instructions, and References”, for the applicable certifications, specifications, standards, policies and procedures that represent documents and standards applicable to this contract.

6.2. Quality Assurance

The government is responsible for evaluating the contractor's performance for those tasks listed on the Service Summary (SS). The COR shall record all surveillance observations. COR surveillance of tasks not listed in the SS or by methods other than those listed in the SS may occur during the performance period of this contract on an as-needed basis.

6.3. Quality Meetings

The Contracting Officer (CO) may require the contractor to meet with the CO, contract administrator (CA), COR, and other government personnel as deemed necessary. The contractor may request a meeting with the CO when it is determined to be necessary. Written minutes of any such meetings shall be recorded by the contractor. A copy of the minutes shall be sent to all attendees via e-mail for their review. A copy of all recorded minutes shall be provided to the COR, and a copy shall be placed in the official contract file for record keeping purposes. In the event the contractor does not concur with any portion of the minutes, exceptions to the minutes shall be provided, in writing, to the CO within 10 working days following receipt of the minutes. Final resolution to exceptions taken by the contractor resides with the CO.

6.4. Contractor’s Quality Control Plan (QCP)

The contractor shall provide and maintain a current QCP, which shall ensure the requirements of the contract are provided as specified. One copy of the QCP shall be provided to the Contracting Officer (CO) as part of the technical proposal.

6.5. Services Summary

The contractor’s performance at the contract level will be assessed monthly by a process that measures success towards achieving defined performance objectives. The Services Summary (SS) will be in accordance with AFI 63-101/20-101, Integrated Life Cycle Management, AFI 10-601, Operational Capability Requirements Documentation and Validation, and FAR Subpart 37.6, Performance-Based Acquisition.

Performance Objective

PWS

Reference

Performance Threshold

1 Track and process internal trouble tickets submitted by end users via email.

Trouble tickets submitted to the contractor shall be assessed within four

(4) duty hours after notification. Trouble tickets within the contractor’s area of responsibility shall be resolved within two (2) business days after notification.

3.1.2.3. No more than three (3)

violation/discrepancy occurrences per month.

2 The contractor shall submit an external trouble ticket to the Air Force Enterprise Service Desk's Remedy trouble ticket system for any trouble tickets received that are outside the contractor's area of responsibility. Trouble tickets submitted to the contractor shall be assessed within four (4) duty hours after notification.

Provide updates to the customer on a weekly basis until ticket resolution.

3.1.2.4. No more than three (3)

violation/discrepancy occurrences per month.

3 Routinely implement software patches and security fixes when requested and when AFIN automated processes are unable to install. This shall include tasks assigned by the Air Force Network Operations and Security Centers (AFNOSC) or local network managers.

Contractor shall comply with all TCNO mandates and local base Network Control Center (NCC) guidance in time parameters given

3.1.2.8. No more than three (3)

violation/discrepancy occurrences per month.

4 Plan, instruct end users, and complete hardware connections to the local area network, to include setup and/or relocation of workstations within three

(3) days of notification.

3.1.2.12. No more than three (3)

violation/discrepancy occurrences per month.

5 Provide installation and management of government-owned software for customers and ensure workstations and mobile device environments are operational. Software application trouble tickets submitted to the contractor shall be assessed within four (4) duty hours after notification. Trouble tickets within

3.1.2.13. No more than three (3)

violation/discrepancy occurrences per month.

the contractor's area of responsibility shall be resolved within two (2) business days after notification.

6 Coordinate the creation and administration of network user accounts and groups. Submit account creation requests through the Air Force Enterprise Service Desk’s Remedy trouble ticket system within one (1) business day after receipt, and complete administrative distribution lists and security groups' updates within one (1) business day after notification.

3.1.2.14. No more than three (3)

violation/discrepancy occurrences per month.

7 Manage/assign network user permissions and access to file server directories/volumes to provide functional and secure network environment.

Respond to network resource requests within one (1) business day after receipt.

3.1.2.15. No more than three (3)

violation/discrepancy occurrences per month.

8 Provide support for HQ AETC-controlled Video Teleconference (VTC) assets.

3.1.2.21. No more than two (2)

violation/discrepancy occurrences per month.

9 Provide maintenance and support of software licenses and manage its relationship to the overall system life cycle IAW DAFMAN 17-1203.

3.1.3. 100% - Annual inventory list shall be compared to existing inventory list.

10 Maintain an accurate inventory of all assigned ITAM accounts by ensuring the AF system of record (currently DPAS) reflects the current status, location, financial information, and condition of each asset until disposition.

3.1.4.3. No more than one (1)

violation/discrepancy occurrence per inspection per each account.

11 Assist the primary custodian with performing an annual physical inventory (in coordination with the BECO’s timeline) of 100% of each directorate’s/unit’s IT items currently on each account listing.

3.1.4.4. 100% - Annual inventory list shall be compared to existing inventory list that is managed by the COR.

12 When IT assets arrive at the BECO, the BECO will notify the PC. The PC will need to pick up, sign for, and secure all IT assets within 10 working days of arrival (approximately 10 times per year) to ensure accountability of IT assets.

After the IT asset is signed for, it is PC’s responsibility to affix the barcode on the IT asset within 48 hours of receipt.

3.1.4.6. No more than two (2)

violation/discrepancy occurrences per month.

13 Identify all excess IT assets on a quarterly basis. Schedule, prepare, transport and/or arrange for assets to be

3.1.4.10. No more than three (3)

occurrences per quarter.

turned into the proper DoD agency.

Provide appropriate documentation to the BECO to clear the account of equipment that was transferred to another account, shipped to another base/location, donated to a school, or turned-in to the DLA Disposition Services Office at Joint Base San Antonio-Fort Sam Houston.

14 Prior to turning in IT assets with hard drives, the contractor shall coordinate with the Information Systems Security Officer (ISSO) to ensure hard drives are sanitized in accordance with (IAW) the procedures outlined in AFSSI 8580.

3.1.4.12. No more than one (1)

occurrences per quarter.

6.6 Non-Personal Services

The government will neither supervise contractor employees nor control the method by which the contractor performs the required tasks. Under no circumstances shall the government assign tasks to or prepare work schedules for individual contractor employees. It shall be the responsibility of the contractor to manage its employees and to guard against any actions that are of the nature of personal services or give the perception of personal services. If the contractor feels that any actions constitute, or are perceived to constitute personal services, it shall be the contractor’s responsibility to notify the Contracting Officer immediately. These services shall not be used to perform work of a policy/decision making or management nature, i.e., inherently governmental functions. All decisions relative to programs supported by the contractor shall be the sole responsibility of the government.

7. Management

7.1. The contractor shall establish and provide a qualified workforce capable of performing the required tasks. The workforce may include a project manager who will oversee all aspects of the contract. The contractor shall use key performance parameters to monitor work performance, measure results, ensure delivery of contracted product deliverables and services, support management and decision-making and facilitate communications. The contractor shall identify risks, resolve problems, and verify effectiveness of corrective actions. The contractor shall institute and maintain a process that ensures problems and action items discussed with the government are tracked through resolution and shall provide timely status reporting. Results of contractor actions taken to improve performance should be tracked, and lessons learned incorporated into applicable processes. The contractor shall establish and maintain a documented set of disciplined, mature, and continuously improving processes for administering all contract efforts with an emphasis on cost- efficiency, schedule, performance, responsiveness, and consistently high-quality delivery.

7.2. Contractor Identification

All contractor/subcontractor personnel shall be required to wear company- or AF-provided picture identification badges to distinguish themselves from government employees. When conversing with government personnel during business meetings, over the telephone or via electronic mail, contractor/subcontractor personnel shall identify themselves as such to avoid situations arising where sensitive topics might be better discussed solely between government employees.

Contractors/subcontractors shall identify themselves on any attendance sheet or any coordination documents they may review. Electronic mail signature blocks shall identify their company affiliation.

Where practicable, contractor/subcontractors occupying collocated space with their government program customer should identify their workspace area with their name and company affiliation.

7.3. Configuration and Data Management

The contractor shall establish, maintain, and administer an integrated data management system for collection, control, publishing, and delivery of all program documents. The data management system shall include but not be limited to the following types of documents: CDRLs, White Papers, Status Reports, Audit Reports, Agendas, Presentation Materials, Minutes, and Contract Letters. The contractor shall provide the government with electronic access to this data, including access to printable reports. Documentation shall also include equipment listing with serial/model numbers, and manufacturer specifications.

7.4. Records, Files, and Documents

All physical records, files, documents, and work papers, provided and/or generated by the government and/or generated for the government in performance of this PWS, maintained by the contractor which are to be transferred or released to the government or successor contractor, shall become and remain government property and shall be maintained and disposed of IAW AFI 33-322, Records Management and Information Governance Program, the Federal Acquisition Regulation, and/or the Defense Federal Acquisition Regulation Supplement, as applicable. Nothing in this section alters the rights of the government or the contractor with respect to patents, data rights, copyrights, or any other intellectual property or proprietary information as set forth in any other part of this PWS.

7.5. Security Management

7.5.1. Safeguarding Classified Information

The contractor shall transmit and deliver classified material/reports up to Secret (S) level. These requirements shall be accomplished as specified in the contract.

JBSA Randolph’s classified process is IAW Federal guidance and FAR Subpart 4.404 along with DD Form 254. When transmitting classified information, the contractor shall ensure all classified information is properly sanitized and/or degaussed of all sensitive/classified information IAW NIST SP 800-88 Rev. 1, Guidelines for Media Sanitization.

7.5.2. Personnel Security

For this Performance Work Statement, the highest level of security required is Secret (S). All contractor employees will be required to possess a Secret clearance.

7.5.3. Protection of Systems Data

The contractor shall protect system design-related documents and operational data whether in written form or in electronic form via a network in accordance with all applicable policies and procedures for such data, including DoDM 5200.01, Volume 3, and applicable service/agency/combatant command policies and procedures. The contractor shall protect system design related documents and operational data at least to the level provided by Secure Sockets Layer (SSL)/Transport Security Layer (TSL)-protected web site connections with certificate and/or user id/password-based access controls. In either case, the certificates used by the contractor for these protections shall be DoD or IC approved Public Key Infrastructure (PKI) certificates issued by a DoD or IC approved External Certification Authority (ECA) and shall make use of at least 128-bit encryption.

7.5.4. Software Security

Most AETC hardware, software, and applications are SENSITIVE UNCLASSIFIED and have a criticality level of CF4. Security shall be managed according to DoD security directives, Air Force instructions, Privacy Act of 1974, and published Air Education and Training Command (AETC) policies and standards. AETC systems will meet or exceed the evaluation criteria defined in Division C, Class C-2 (Controlled Access Protection).

7.5.5. Encryption Mandates

All products that will perform any type of data encryption, it is required that the encryption method being used meets FIPS standards for both information assurance and interoperability testing. For more information on FIPS, go to https://www.nist.gov/. Some example FIPS standards would be FIPS 201 which specifies the architecture and technical requirements for a common identifications standard for Federal employees and contractors (i.e. Common Access Card). Another one is FIPS 140-2 which specifies the security requirements that will be satisfied by a cryptographic module (i.e. the underlying algorithms to process information).

8. Security Requirements

8.1. Security Agreement (SA)

The contractor shall enter into a security agreement if service performance is on base. This agreement shall outline how the contractor integrates security requirements for service operations with the Air Force to ensure effective and economical operation on the installation. The agreement shall include:

a) Security support provided by the Air Force to the contractor shall include storage containers for classified information/material, use of base destruction facilities, classified reproduction facilities, use of base classified mail services, investigation of security incidents, and the use of security forms and conducting inspections required by DoDM 5220.32 Vol 1, National Industrial Security Program: Industrial Security Procedures for Government Activities, Air Force Policy Directive 16-14, Security Enterprise Governance, and Air Force Manual 16- 1406, National Industrial Security Program: Industrial Security Procedures for Government Activities.

b) Security support requiring joint Air Force and contractor coordination includes packaging classified information, mailing and receiving classified materials, implementing emergency procedures for protection of classified information, security checks and internal security controls for protection of classified material and high-value pilferable property.

c) On base, the long-term visitor group security agreement may take the place of a Standard Practice Procedure (SPP).

8.2. Security Monitor Appointment

The contractor shall appoint a security representative for the on base long term visitor group. The security representative may be a full-time position or an additional duty position. The security representative shall work with the host organization to provide employees with training required by DoDM 5200.01, Information Security Program, AFPD 16-14, Security Enterprise Governance, and

AFI 16-1404, Air Force Information Security Program. The contractor shall provide initial and follow-on training to contractor personnel who work in Air Force controlled/restricted areas. Air Force restricted and controlled areas are explained in AFI 31-101, Integrated Defense.

8.3. Obtaining and Retrieving Identification Media

As prescribed by the DAFFARS 5352.242-9000, Contractor Access to Air Force Installations, the contractor shall comply with the following requirements:

a) The contractor shall obtain base identification, and vehicle passes for all contractor personnel who make frequent visits to or perform work on the Air Force installation(s) cited in the contract. Contractor personnel are required to wear or prominently display installation identification badges or contractor-furnished identification badges while visiting or performing work on the installation.

b) No later than three working days prior to contract commencement, the contractor shall submit a written request on company letterhead to the COR listing the following: contract number, location of work site, start and stop dates, and names of contractor employees needing access to the base. The authorized COR will endorse the request and forward it to the issuing base pass and registration office or security forces for processing. Contractors will present government (state or federal) issued ID, and INS Form 9 (I9), before being issued a pass to enter the installation. Before being issued a pass to enter the installation, a Wants and Warrants check will be conducted for every individual requesting a pass. Personnel employed by the contractor must get a pass for their privately owned vehicles at the installation Visitor Reception Center, with proof of following:

i. Liability insurance

ii. Current license plates

iii. Current state inspection sticker (if required)

iv. Valid state driver license

v. A phone number for sponsor on base

c) Vehicles owned by the contractor with the company name permanently printed on them are not required to obtain a pass as long as a current contract is presented at the time of entry.

However, current liability insurance, state inspection sticker, and registration is required. The person driving the vehicle must have a valid operator license for the type of vehicle.

d) The contractor is responsible for ensuring employees report to Visitor Reception Center, to present their Form I-9 (Employment Eligibility Verification).

e) Upon completion or termination of the contract or expiration of the identification passes, the contractor shall ensure that all base identification credentials issued to contractor employees are returned to the issuing office. If a contractor employee has been terminated, the credentials will need to be retrieved and returned to issuing activity so that employee does not have base access. If the credential is not retrieved, then SF will need to be notified so base access is not allowed.

f) Failure to comply with these requirements may result in withholding of final payment.

8.4. Pass and Identification Items

DoD Common Access Card (CAC), (AFI 36-3026 Vol 2, Common Access Card), used for contracts for more than six months and requirement exists for access to the government computer systems and software. CAC applications are accomplished by Mission Partner Identity, Credential and Access Management (MP ICAM)

8.5. Security Clearance Requirements

The contractor must possess or obtain an appropriate facility security clearance, Secret, Confidential prior to performing work on a classified government contract. If the contractor does not possess a facility clearance the government will request one. The government assumes costs and conducts investigations for Top Secret, Secret, and Confidential facility security clearances. The contractor shall request personnel security clearances, at the company’s expense, for employees requiring access to classified information within 15 days after receiving a facility clearance or, if the contractor is already cleared, within 15 days after service award. Due to costs involved with security investigations, requests for personnel security clearances shall be kept to the minimum amount employees required to perform contract requirements.

8.6. Listing of Employees

The contractor shall maintain a current list of employees. The list shall include employee's name, social security number, and level of security clearance. The list shall be validated and signed by the company Facility Security Officer (FSO) and provided to the contracting officer and Information Protection Office (IP Office) at each performance site 30 days prior to the service start date. Updated listings shall be provided when an employee's status or information changes. A Visit Request for all employees with a security clearance is required to be sent through the Defense Information System for Security (DISS) or successor system and must be updated at least annually. The contractor shall notify the Information Protection Office at each operating location 30 days before on-base performance of the service. The notification shall include:

a) Name, address, and telephone number of company key management representatives

b) The Contract number and contracting agency.

c) The highest level of classified information to which employees require access.

d) The location(s) of service performance and future performance, if known.

e) The date service performance begins.

f) Any change to information previously provided under this paragraph.

8.7. Suitability Investigations

Contractor personnel not requiring access to classified shall successfully complete, as a minimum, a Tier 1 (T1) investigation, before operating government furnished workstations. The contractor shall comply with the DoDM 5200.02, Procedures for the Department of Defense Personnel Security Program and AFI 17-130, Cybersecurity Program Management, requirements. T1 investigation requests are initiated using the Standard Form (SF) 85 and are submitted to the installation Information Protection Office through the using agency’s Security Assistant (SA). T1 investigations are different from the Wants and Warrants checks and are provided by the government at no additional cost to the contractor.

For contracts requiring IT-Level I and II access with no access to classified material, the contractor shall complete Tier 5 (T5) formerly called an SSBI or Tier 3 (T3) investigations, respectively. These investigations are submitted using the SF 86 and are submitted to the Information Protection Office through the using agency Unit Security Assistant within five calendar days after contract start. These investigations are provided by the government at no additional cost to the contractor.

8.8. Entry Procedures to Controlled/Restricted Areas

Contractor personnel requiring unescorted entry to areas designated as controlled or restricted areas by the installation commander shall comply with base access requirements and will possess, as a minimum, a favorable suitability determination. These requirements are contained in DAFI 31-101, Integrated Defense (ID), for installation access and DoDM 5200.02, Procedures for the DoD Personnel Security Program (PSP), for suitability determinations. The contractor shall comply and implement local base procedures for entry to Air Force controlled/restricted areas. For on-base cleared facilities over-sighted by the base ISPM, contractors shall comply with the DoDM 5220.32, Volume 1, National Industrial Security Program: Industrial Security Procedures for Government Activities and DoDM 5200.01, Volume 1/DAFM 16-1404, Volume 1, Information Security Program:

Overview, Classification, and Declassification, to implement controlled/restricted area requirements.

The IP Office shall approve the establishment, construction, and modification of all contractor-designated controlled areas before they may be used to limit access.

8.9. Additional Security Requirements

In accordance with DoDM 5200.01, Information Security Program and AFMAN 16-1404, the contractor shall comply with local communications squadron policy.

8.10. Freedom of Information Act Program (FOIA)

The contractor shall comply with DoD Manual 5400.07_AFMAN33-302, DoD Freedom of Information Act Program, requirements.

8.11. Reporting Requirements

The contractor shall comply with AFI 71-101, Volume- 1, Criminal Investigations, and Volume-4, Counterintelligence, requirements, as referenced in DAFMAN 16-1406, para 2.2.e.

8.12. Physical Security

Areas controlled by contractor employees shall comply with AFI 31-101.

8.13. Operating Instructions

For controlled areas used exclusively by the contractor, the contractor shall develop an Operating Instruction (OI) for internal circulation control, protection of resources and to regulate entry into Air Force controlled areas during normal, simulated and actual emergency operations. The OI shall be written in accordance with AFI 31-101 and coordinated through the Information Protection (IP) office.

8.14. Key Control

The contractor shall establish and implement key control procedures in the Quality Control Plan to ensure keys issued to the contractor by the government are properly safeguarded and not used by unauthorized personnel. The contractor shall not duplicate keys issued by the government. Lost keys shall be reported immediately to the Contracting Officer. The government replaces lost keys or performs re-keying. The total cost of lost keys, re-keying or lock replacement shall be deducted from the monthly payment due to the contractor. The contractor shall ensure its employees do not allow government issued keys to be used by personnel other than current authorized contractor employees.

Contractor employees shall not use keys to open work areas for personnel other than contractor employees engaged in performance of duties, unless authorized by the government functional area chief.

8.15. Lock Combinations

The contractor shall comply with DoDM 5200.01, Vol 3 security requirements for changing combinations to storage containers used to maintain classified materials.

8.16. Traffic Laws

The contractor and their employees shall comply with base traffic regulations.

8.17. Healthcare

Healthcare may be provided at the…