Borescope_SOW - 10 Apr 2026.pdf

22 April 2026

Statement of Work (SOW) for

Borescope

Prepared by

SUPPORT EQUIPMENT AND VEHICLES DIVISION

236 MILLEDGEVILLE STREET, SUITE F30

ROBINS AFB GA 31098-1813

DISTRIBUTION STATEMENT A. Approved for public release: Distribution is unlimited.

TABLE OF CONTENTS

1. SCOPE

2. APPLICABLE DOCUMENTS

2.1 Government documents

2.1.1 Specifications, standards, and handbooks

2.1.2 Other Government documents, drawings, and publications

2.2 Non-Government publications

2.3 Order of precedence

3. DEFINITIONS

3.1 Definitions list

3.1.1 Beyond Economical Repair (BER)

3.1.2 Beyond Physical Repair (BPR)

3.1.3 Controlled Unclassified Information (CUI)

3.1.4 Repair

3.1.5 Risks

4. REQUIREMENTS

4.1 Program management

4.1.1 Common Access Card (CAC)

4.1.2 Access to Government systems

4.1.3 CUI

4.1.4 Data delivery and transfer

4.1.5 Program manager

4.1.6 Monthly status report

4.2 Conferences and program reviews

4.2.1 Post award conference

4.2.2 System Engineering Technical Reviews (SETRs)

4.2.2.1 Test Readiness Review (TRR)

4.2.2.2 SETR documentation

4.2.3 Program Management Reviews (PMRs)

4.2.4 Production Readiness Review (PRR)

4.2.5 Conference room

4.2.6 Meeting agendas

4.2.7 Meeting minutes

4.2.8 Item Unique Identification (IUID) marking plan

4.3 Systems engineering

4.3.1 Environment, Safety, and Occupational Health (ESOH)

4.3.1.1 System safety

4.3.1.2 Hazardous materials

4.3.2 Interface Control Document (ICD)

4.4 Logistics

4.4.1 Technical Order (TO) requirements

4.4.2 Provisioning

4.4.2.1 Provisioning Guidance Conference (PGC)

4.4.3 Training and familiarization

4.5 Testing and evaluation

4.5.1 Design analysis

4.5.2 Test support

4.5.3 First production test

4.5.3.1 First production test procedures

4.5.3.2 First production testing

4.5.3.3 First production test report

4.5.4 Restoration

4.5.5 Disposition

4.5.6 Conformance test

4.5.7 Calibration certificate/report

4.6 Configuration management

4.6.1 Configuration requirements

4.6.1.1 Baselines

4.6.1.1.1 Functional baseline

4.6.1.1.2 Allocated baseline

4.6.1.2 Production release

4.6.2 Engineering Change Proposals (ECPs)

4.6.3 Request for Variance (RFV)

4.7 Cybersecurity

4.7.1 Cybersecurity analysis

4.7.2 Software and Application Certification Assessment (SACA)

4.7.3 Computer program identification number (CPIN)

4.8 Repairs

4.8.1 Repair authorization

4.8.2 Commercial Asset Visibility Air Force (CAV-AF)

4.8.2.1 Contract Depot Maintenance (CDM) production monthly status report

4.8.3 Beyond Economical Repair (BER) and Beyond Physical Repair (BPR)

4.8.4 Quality of repair

4.8.5 Repair turn-around

4.8.5.1 Repair delays

4.8.6 Packaging

4.8.7 Shipment of equipment

1. SCOPE

This document defines the tasks associated with the procurement of Borescope as described by A-A-59883A and is to be used in conjunction with A-A-59883A.

2. APPLICABLE DOCUMENTS

The following documents are cited in Section 4 and form a part of this SOW to the extent specified herein.

2.1 Government documents.

2.1.1 Specifications, standards, and handbooks. The following specifications, standards, and handbooks of the exact revision listed below form a part of this SOW to the extent specified herein.

FEDERAL STANDARDS

FED-STD-313F Material Safety Data, Transportation Data, and Disposal Data for Hazardous Materials Furnished to Government Activities

DEPARTMENT OF DEFENSE STANDARDS

MIL-STD-882E NOT 1 Department of Defense Standard Practice: System Safety

2.1.2 Other Government documents, drawings, and publications.

DATA ITEM DESCRIPTIONS (DIDs)

DI-SAFT-80101D System Safety Hazard Analysis Report (SSHAR) DI-MGMT-80441D Government Property (GP) Inventory Report DI-MISC-80508B Technical Report - Study/Services DI-NDTI-80603A Test Procedure DI-SESS-80639E NOT 1 Engineering Change Proposal (ECP) DI-SESS-80640E NOT 1 Request for Variance (RFV) DI-SESS-80642E NOT 1 Notice of Revision (NOR) DI-AVCS-80700A NOT 1 Computer Software Product End Items DI-QCIC-80798C Calibration Certification/Report DI-NDTI-80809B NOT 3 Test/Inspection Report DI-ILSS-80872 NOT 2 Training Materials DI-SESS-81248B NOT 1 Interface Control Document (ICD) DI-ADMN-81249C Meeting Agenda DI-ADMN-81250C Meeting Minutes DI-MISC-81454D Computer Program Identification Number Catalog

Information DI-SAFT-81626A System Safety Program Plan (SSPP) DI-SESS-81758A NOT 2 Logistics Product Data DI-MFMT-81803A Item Unique Identification (IUID) Marking Plan DI-MGMT-81838 NOT 1 Commercial Asset Visibility (CAV) Reporting DI-SESS-81874A Engineering Data for Provisioning (EDFP) DI-MGMT-81928 NOT 2 Contractor's Progress and Status Report DI-PSSS-81995A Contract Depot Maintenance Production Report

(Copies of these documents are available online at http://quicksearch.dla.mil/.)

AIR FORCE INSTRUCTIONS

AFI 17-101 Risk Management Framework (RFM) for Air Force Information Technology (IT)

(Copies of this document are available online at https://www.e-publishing.af.mil/.)

DEFENSE FEDERAL ACQUSITION REGULATION SUPPLEMENT (DFARS)

252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting

(Copies of this document are available online at https://www.acquisition.gov/dfars/.)

DEPARTMENT OF DEFENSE DIRECTIVES (DoDD)

DoDD 5205.02E DoD Operations Security (OPSEC) Program

(Copies of this document are available online at https://www.esd.whs.mil/.)

DEPARTMENT OF DEFENSE INSTRUCTIONS (DoDI)

DoDI 8500.01 Cybersecurity DoDI 8510.01 Risk Management Framework (RMF) for DoD Information

Technology (IT)

(Copies of these documents are available online at https://www.esd.whs.mil/.)

DEPARTMENT OF DEFENSE MANUALS

DoDM 5200.02 Procedures for the DoD Personnel Security Program (PSP) DoDM 5205.02-M DoD Operations Security (OPSEC) Program Manual DoDM TM-86-01R Air Force Technical Manual Contract Requirements

(Copies of these documents are available online at https://www.esd.whs.mil/.)

http://quicksearch.dla.mil/ https://www.e-publishing.af.mil/ https://www.acquisition.gov/dfars/ https://www.esd.whs.mil/ https://www.esd.whs.mil/ https://www.esd.whs.mil/

FEDERAL ACQUSITION REGULATION (FAR)

4-805 Storage, Handling, and Disposition of Contract Files

(Copies of this document are available online at https://www.acquisition.gov/far/.)

NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY (NIST)

SP 800-88 Rev. 2 Guidelines for Media Sanitization SP 800-171 Rev. 3 Protecting Controlled Unclassified Information in

Nonfederal Systems and Organizations

(Copies of these documents are available online at https://nvlpubs.nist.gov/.)

COMMERCIAL ITEM DESCRIPTION (CID)

A-A-59883A BORESCOPE

(Copies of this document are available from the PCO.)

TECHNICAL ORDERS (TO)

TO 00-5-16 Technical Order Life Cycle Management

(Copies of this document are available from the PCO.)

2.2 Non-Government publications. The following documents of the exact revision listed below form a part of this document to the extent specified herein.

SAE INTERNATIONAL

GEIA-HB-0007B Logistics Product Data Handbook

(Application for copies should be addressed to SAE International, Inc., 400 Commonwealth Drive, Warrendale PA 15096, http://www.sae.org/.)

2.3 Order of precedence. In the event of a conflict between the text of this document and the references cited herein, the text of this document takes precedence. Nothing in this document, however, supersedes applicable laws and regulations unless a specific exemption has been obtained.

3. DEFINITIONS

3.1 Definitions list. The following definitions are applicable to this SOW:

3.1.1 Beyond Economical Repair (BER). BER is defined as an estimated cost to repair in excess https://www.acquisition.gov/far/ https://nvlpubs.nist.gov/ http://www.sae.org/ of 75% of the replacement cost.

3.1.2 Beyond Physical Repair (BPR). BPR is defined as an asset that is physically impossible to repair or when the damage is so extensive that restoration to a functional state is not possible with current technology or resources.

3.1.3 Controlled Unclassified Information (CUI). CUI is defined as unclassified information that laws, regulations, or Government-wide policies allow for, or require, safeguarding.

3.1.4 Repair. Repair is defined as the restoration or replacement of parts or components of the item as necessitated by wear and tear, damage, or failure of parts, in order to return the item to serviceable condition and to maintain it in efficient operating condition.

3.1.5 Risks. Risks are potential future events or conditions that may have a negative effect on achieving program objectives for cost, schedule, and performance. Risks are defined by (1) the probability (greater than 0, less than 1) of an undesired event or condition and (2) the consequences, impact, or severity of the undesired event, were it to occur.

4. REQUIREMENTS

4.1 Program management.

4.1.1 Common Access Card (CAC). The contractor shall ensure a CAC is obtained by all contractor/subcontractor personnel who require access to Department of Defense (DoD) computer networks/systems, for DoD facility entry control, and/or for physical access to facilities and buildings to perform tasks under the contract/order. The contractor shall provide a list of contractor/subcontractor personnel who require a CAC to the Procuring Contracting Officer (PCO). The Government will provide the contractor with instructions on how to complete a Contractor Verification System (CVS) application and notify the contractor of approval/disapproval of contractor/subcontractor personnel application.

Contractor/subcontractor personnel shall obtain the CAC from the local Real Time Automated Personnel Identification Documentation System (RAPIDS) issuing facility (usually the Military Personnel Flight (MPF)).

The contractor shall notify the PCO of any change to the list of contractor/subcontractor personnel who require a CAC and provide an updated list within seven calendar days. The contractor shall immediately (within the same day) report a lost or stolen CAC to the PCO. The contractor shall return any issued CAC to the PCO within seven calendar days once contractor personnel no longer require computer network/system access. The contractor shall return all CACs to the PCO within seven calendar days after completion/termination of the contract.

4.1.2 Access to Government systems. The procuring activity will provide and/or arrange contractor personnel access to system(s) necessary to perform tasks under the contract/order. The contractor shall ensure contractor personnel who require access to an unclassified Government computer network/system have the appropriate background check or security investigation conducted. The procuring activity will provide and/or arrange system access subject to approval of the DD Form 2875, System Authorization Access Request (SAAR). Upon completion/termination of the contract/order or transfer/termination of contractor personnel, the contractor shall ensure the system account(s) are closed.

4.1.3 CUI. CUI is defined as unclassified information that laws, regulations, or Government-wide policies allow for, or require, safeguarding. Knowledge and/or generation of CUI is required for performance of the contract/order. This SOW governs work that contains the development and transfer of CUI between contractors and the United States (U.S.) Government.

All CUI shall be controlled until authorized for public release. The contractor shall ensure personnel, information, system, property, and facility security requirements are met. The contractor shall comply with Government security regulations including, but not limited to, Department of Defense (DoD) Manual 5200.02, Procedures for the DoD Personnel Security Program (PSP); National Institute of Standards and Technology (NIST) Special Publication (SP) 800-88 Rev. 2, Guidelines for Media Sanitization; DoD Directive (DoDD) 5205.02E, DoD Operations Security (OPSEC) Program; and DoD Manual 5205.02-M, DoD Operations Security (OPSEC) Program Manual to protect Government interests. The contractor shall ensure the security of any Information Technology (IT) environment at the contractor's facility that hosts CUI. The contractor shall maintain a cyber-secure environment for all components of a non-federal IT system that processes, stores, and/or transmits CUI as defined in NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, to preclude potential security incidents or violations including potential unauthorized disclosure or compromise of CUI. The contractor shall ensure its employees have been trained in the proper marking of CUI; authorized and approved training material will be provided to the contractor prior to contract award. The contractor shall ensure that all personnel handling CUI associated with this contract have been properly trained, have been approved to handle CUI, have a valid need to handle CUI, and shall safeguard any CUI in their possession at all times. The contractor shall maintain a cyber-secure IT environment that reduces and manages risk by meeting the intent of Cybersecurity Maturity Model Certification (CMMC) Level I. The contractor shall also take necessary precautions and actions to ensure that the IT environment for any software development is secure and free of malware and malicious code. The contractor shall report any cyber incidents to the Government in accordance with DFARS Clause 252.204-7012 (Safeguarding Covered Defense Information and Cyber Incident Reporting) as applicable.

4.1.4 Data delivery and transfer. To promote effective schedule management, email shall be utilized to the maximum extent possible for tasks identified in this SOW. Department of Defense (DoD) Secure Access File Exchange (SAFE) shall be the secondary (backup) electronic data exchange, located at https://safe.apps.mil/, and utilized when temporary circumstances do not permit use of AF365 Teams or encryption is required for proper CUI handling.

4.1.5 Program manager. The contractor shall identify to the Government and maintain a single point of contact (program manager) for all matters under this contract. The contractor shall also ensure that all program management personnel assigned to the program shall be available, as required, to meet program objectives.

4.1.6 Monthly status report. The contractor shall submit a monthly status report that shall cover https://safe.apps.mil/ actions to date as well as a projection of planned work for the remaining effort. Reports shall document tasks, issues, actions, and deliverables. Problem areas shall be identified with proposed solutions and outcomes. (DI-MGMT-81928, Contractor's Progress and Status Report)

4.2 Conferences and program reviews. Throughout the Period of Performance (POP) of the contract, conferences, meetings, and technical or programmatic reviews may be supplemented with a virtual environment as directed by the Procuring Contracting Officer (PCO) if travel restrictions, safety measures, or other program specifics prevent or limit the number of in-person attendees. Virtual meetings can utilize, but shall not be limited to, AF365 Teams. The contractor shall adhere to any Federal, State, or local health and well-being regulations and guidelines for contractor-hosted in-person gatherings with Government personnel.

4.2.1 Post award conference. If the Government determines that a post award conference is necessary, the Government will convene a post award conference with the contractor at the contractor's facility, Robins AFB, or on AF365 Teams within 60 calendar days after contract award. The PCO will coordinate the actual date, time, and location of the conference with the contractor.

4.2.2 System Engineering Technical Reviews (SETRs).

4.2.2.1 Test Readiness Review (TRR). The contractor shall conduct a TRR 14 calendar days prior to the start of the test. The TRR shall assess test objectives, test methods and procedures, scope of tests, and determine if required test resources have been properly identified and coordinated to support planned tests. The TRR shall be held at the contractor's facility. The PCO will coordinate the actual date and time of the TRR with the contractor.

4.2.2.2 SETR documentation. The contractor shall prepare all necessary detailed status reports for the SETR meetings, Meeting Agendas, and Meeting Minutes. The contractor shall prepare formal documentation of the TRR. (DI-ADMN-81249, Meeting Agenda; DI-ADMN-81250, Meeting Minutes; DI-MISC-80508, Technical Report - Study/Services)

4.2.3 Program Management Reviews (PMRs). The contractor shall participate in and support all reviews, audits, and meetings as requested by the PCO or the contractor. PMRs shall be conducted quarterly or as required at a mutually agreeable location or via AF365 Teams. (DI- ADMN-81249, Meeting Agenda; DI-ADMN-81250, Meeting Minutes)

4.2.4 Production Readiness Review (PRR). A PRR shall be conducted to ensure the contractor is ready to begin production. The PRR shall include an evaluation of the contractor's manufacturing readiness processes, quality management system, production planning (that is, facilities, tooling and test equipment capacity, personnel development and certification, process documentation, inventory management, supplier management, etc.). Unless otherwise specified or directed by the PCO, the PRR shall be conducted at the contractor's facility within 30 days following procuring activity approval of the test report.

4.2.5 Conference room. The contractor shall provide a conference room suitable for meetings of up to 10 Government representatives, plus contractor personnel, in support of scheduled meetings at the contractor's facility. The conference room shall support AF365 Teams access for virtual attendees.

4.2.6 Meeting agendas. The contractor shall publish an agenda for all meetings and conferences specified in 4.2.2 - 4.2.4. The contractor shall request from the Government any items or issues to be discussed or presented at the meetings and shall include such items in the agenda. Agendas shall be submitted not less than seven calendar days prior to any meeting. (DI-ADMN-81249, Meeting Agenda)

4.2.7 Meeting minutes. The contractor shall provide a written record of the discussions, decisions, and action items identified at each meeting. Minutes shall include presentation material. (DI-ADMN-81250, Meeting Minutes)

4.2.8 Item Unique Identification (IUID) marking plan. The contractor shall establish, conduct, document, and maintain an IUID marking plan. (DI-MFMT-81803, Item Unique Identification (IUID) Marking Plan)

4.3 Systems engineering.

4.3.1 Environment, Safety, and Occupational Health (ESOH).

4.3.1.1 System safety. The contractor shall establish, conduct, document, and maintain a system safety program in accordance with MIL-STD-882. The contractor shall document their approach for analyzing, eliminating, or minimizing ESOH hazards during all phases of the program. The contractor shall initiate changes in the system design based on safety analysis results such that the associated risk is reduced to a level acceptable to the Government. An initial system safety hazard analysis shall be provided 14 calendar days prior to the TRR; an updated version of the analysis shall be provided with the test report. (DI-SAFT-81626, System Safety Program Plan;

DI-SAFT-80101, System Safety Hazard Analysis Report (SSHAR))

4.3.1.2 Hazardous materials. The contractor shall manage hazardous materials, including those embedded in the system or used during operation or maintenance, as an element of the Systems Engineering process. The system shall not generate or use Class I or Class II Ozone Depleting Substances (ODS) during operation, maintenance, or disposal. The use of hexavalent chromium is also prohibited. The contractor shall list any hazardous materials to be delivered under this contract, including locations, quantities, and special handling and disposal procedures. This information shall be documented in the monthly status report (see 4.1.6) and reviewed at the PMRs; it shall be in accordance with FED-STD-313.

4.3.2 Interface Control Document (ICD). The contractor shall develop, implement, and maintain an ICD that defines and documents all system external interfaces. The ICD shall include interface definitions, communication protocols, data formats, and physical connections required for the proper integration and operation of the system. The ICD shall also provide the necessary information to manage and control interfaces throughout the system lifecycle, ensuring compatibility and interoperability with interfacing systems. All interfaces shall be described in sufficient detail to allow independent verification of compliance with system requirements. (DI-

SESS-81248, Interface Control Document (ICD))

4.4 Logistics.

4.4.1 Technical Order (TO) requirements. The contractor shall develop and deliver technical manuals in accordance with TM-86-01. No production Borescope will be accepted prior to Government approval of the technical manuals. (TM-86-01, Air Force Technical Manual Contract Requirements)

4.4.2 Provisioning. The contractor shall identify and recommend logical spare and repair parts sufficient to meet system and equipment operation and supportability in accordance with the Air Force Initial Provisioning Performance Specification (IPPS). GEIA-HB-0007B (Logistics Product Data Handbook) should be used as a guide. The format shall be consistent with existing Government Provisioning data system (D220). The following DIDs apply:

a. DI-SESS-81758, Logistics Product Data. Specific Logistics Product Data to be submitted:

i. Common and Bulk Items List (CBIL)

ii. Short Form Provisioning Parts List (SFPPL)

iii. Design Change Notices (DCNs)

iv. Statement of Prior Submission (SPS)

v. Long Lead Items List (LLIL)

b. DI-SESS-81874, Engineering Data For Provisioning (EDFP).

(DI-SESS-81758, Logistics Product Data; DI-SESS-81874, Engineering Data For Provisioning

(EDFP))

4.4.2.1 Provisioning Guidance Conference (PGC). A Provisioning Guidance Conference (PGC) shall be scheduled by the Prime Provisioning Activity (PPA) and should be held within 45 days after receipt of contract in conjunction with the post award conference. The PGC is normally held at AFGLSC PPA for approximately two days to ensure both the contractor and the Government understand the provisioning requirements on contract. If a PGC is not desired, the contractor shall submit a written request for waiver of the PGC to the PPA. In the event a waiver is approved, a mutual understanding of the Provisioning requirements shall be communicated in some forum in which the AFMC Form 718 (Provisioning Performance Schedule (PPS)) shall be documented/completed, signed by both the Government and contractor, and a contract modification issued, if required. (DI-ADMN-81249, Meeting Agenda; DI-ADMN-81250, Meeting Minutes)

4.4.3 Training and familiarization. Training shall be provided so that users and maintainers can operate and maintain the Borescope properly. Video training shall be provided with each unit on a CD/DVD-ROM. Video training in the CD/DVD-ROM shall have multiple videos labeled according to the specific tasks for easy search. A hard copy of the training manual shall be supplied with each unit; an electronic copy of the training manual shall also be provided on the video training CD/DVD-ROM. The training manual shall contain written descriptions and procedures with images that explain step by step how to operate and maintain the unit. A copy of all training materials shall be provided to and approved by the procuring activity prior to providing them with each unit. (DI-ILSS-80872, Training Materials)

4.5 Testing and evaluation.

4.5.1 Design analysis. A design analysis of the system and each subsystem shall be performed to verify compliance with this SOW and each applicable requirement of the CID. The analysis shall include, but is not limited to, environmental and hazardous material management (see 4.3.1.2). A Material Safety Data Sheet (MSDS) shall be provided for each hazardous material identified for use in the program (see 4.3.1.2). (Note that the system safety hazard analysis is addressed in 4.3.1.1.) An initial design analysis shall be provided 14 calendar days prior to the TRR and an updated version of the analysis shall be provided with the test report. (DI-MISC-80508, Technical Report - Study/Services)

4.5.2 Test support. The contractor shall ensure common repair parts are available during all phases of testing specified herein so that failures do not delay the test beyond the repair time required to return the equipment to serviceable condition. In the event that one or more replacement parts are required to repair a failure, the contractor shall ship the part(s) to the test location via same-day or overnight service at the direction of the procuring activity. Copies of the latest draft TOs shall be available for Government use during compatibility testing and operational test and evaluation.

4.5.3 First production test.

4.5.3.1 First production test procedures. The contractor shall develop detailed test procedures, which shall address all requirements identified in the CID and this SOW. The test procedures shall include data record sheets, charts, graphs, identification of test instruments by manufacturer, model number, and serial number. The test procedures shall address modeling and simulation (M&S); if M&S is not applicable, the test procedures shall be so noted. (DI-NDTI- 80603, Test Procedure)

4.5.3.2 First production testing. After Government approval of the first production test procedures, the contractor shall schedule the testing to be conducted. If shipping is required to move the item(s) to and from a test site away from the contractor's facility, the contractor shall be responsible for all costs associated with the shipment. The contractor shall notify the Government of the date, time, and location of first article testing 30 calendar days prior to the start of testing. The test will be witnessed by one or more Government representatives.

4.5.3.3 First production test report. The contractor shall submit a first production test report upon completion of the first production test. The test report shall document all testing performed, including results of any unsuccessful test attempts. (DI-NDTI-80809, Test/Inspection Report)

4.5.4 Restoration. After completion of first production acceptance, the contractor shall be responsible for any repairs that may be necessary to restore the first production Borescopes to a serviceable, "like new" condition while retaining configuration integrity.

4.5.5 Disposition. One approved unit shall be retained at the contractor's facility, to serve as a manufacturing standard, until the last shipment. The remaining units shall be shipped to the location(s) specified in the contract.

4.5.6 Conformance test. The contractor shall test each production item in accordance with 5.3 of the CID utilizing a subset of the first production test procedures.

4.5.7 Calibration certificate/report. The contractor shall submit a calibration certificate or report which shall address all requirements identified in 3.8.2 of the CID. (DI-QCIC-80798, Calibration Certification/Report)

4.6 Configuration management.

4.6.1 Configuration requirements.

4.6.1.1 Baselines.

4.6.1.1.1 Functional baseline. The functional baseline is the CID.

4.6.1.1.2 Allocated baseline. All of the documents used to produce and define the configuration at the conclusion of the TRR shall constitute the allocated baseline.

4.6.1.2 Production release. Production release is acknowledgment by the procuring activity that the contractor has satisfied all requirements to proceed with delivery of hardware to be furnished under the contract. The contractor assumes all risks in initiating production before the test report and TOs have been delivered and approved by the procuring activity.

4.6.2 Engineering Change Proposals (ECPs). Notwithstanding any other provision in the contract, no contractor or subcontractor's change in design, fabrication, assembly, part, material, process, or source of supply shall be made to the allocated or product baseline unless such change is submitted in writing by ECP and approved by the procuring activity. Any request for change shall be accompanied by complete documentation supporting the need for the change. A system safety impact statement shall be provided as part of the submittal; it shall quantify and qualify the system safety risk identified and how it impacts the system safety risk already identified for the system. A Notice of Revision (NOR) shall be submitted with each ECP. Should the Government approve an ECP, the contractor shall be responsible for submitting updated TOs and the system safety hazard analysis report (see 4.3.1.1) to reflect the changes made in the ECP.

(DI-SESS-80639, Engineering Change Proposal (ECP); DI-SESS-80642, Notice of Revision

(NOR)).

4.6.3 Request for Variance (RFV). The contractor shall prepare an RFV whenever a departure from the contractually specified base line is proposed for a specific number of units or for a specific time. (DI-SESS-80640, Request for Variance (RFV))

4.7 Cybersecurity. The contractor shall implement cybersecurity in accordance with Department of Defense Instruction (DoDI) 8500.01, DoDI 8510.01, and AFI 17-101. The contractor shall provide cybersecurity support to include, but not limited to, engineering and technical analysis and assessment of system cybersecurity, development and delivery of Risk Management Framework (RMF) artifacts, design, integration, testing, and documentation of implemented cybersecurity controls. The contractor shall address technical details of cybersecurity requirements as part of applicable SETRs.

4.7.1 Cybersecurity analysis. The contractor shall perform an engineering analysis and risk and technical assessment of system cybersecurity for each end item. The engineering analysis shall include, but not be limited to, system hardware and software architecture, I/O data flow, supply chain integrity, and operational conditions as it relates to system cybersecurity. The contractor shall perform a comprehensive risk assessment based on the system cyber vulnerabilities and threats. The contractor shall also conduct analysis for any commercial-off-the-shelf and/or non-developmental items to ensure that they are appropriately configured, software, hardware and firmware is controlled, and any unique risks they pose are mitigated. (DI-MISC-80508, Technical Report - Study/Services, Cybersecurity Analysis)

4.7.2 Software and Application Certification Assessment (SACA). Software products planned for use on the AF Network (AFNET) shall be certified via the Software and Application Certification Assessment (SACA) process. HQ CCC/SACA conducts security testing, evaluates supportability and compatibility then forwards the documents to the Air Force Enterprise Security Control Assessor for certification in accordance with AFI 17-101. Once certified, the software is placed on the AF Evaluated Products List (AF EPL) for use on AFNET. Details of the SACA process can be found at https://usaf.dps.mil/teams/ccc/fpu/CZZE_TE_SACA.aspx.

The procuring activity will function as the PM/Sponsor for the process, and the contractor shall provide technical support to include analysis, assessment, technical documentation delivery, input/completion of Government forms and paperwork, and any software modification needed to satisfy the certification requirements. Figure 1 below is a summary of the SACA process.

https://usaf.dps.mil/teams/ccc/fpu/CZZE_TE_SACA.aspx

Figure 1. Software and Application Certification Assessment (SACA) process.

4.7.3 Computer program identification number (CPIN). The contractor shall submit a request for CPIN assignment of all custom and/or commercial software and/or firmware to be delivered to the Government. CPIN assignment requests shall be accomplished by direct on-line data entry into Enhanced Technical Information Management System (ETIMS) in accordance with TO 00- 5-16 guidelines. The contractor shall deliver the final Computer Software Configuration Items (CSCIs) on CD/DVD-ROM and shall contain all files, drivers, and other data necessary for installation and operation of the software/firmware. The CPIN media label information shall match the information in ETIMS. (DI-MISC-81454, Computer Program Identification Number Catalog Information; DI-AVCS-80700, Computer Software Product End Items)

4.8 Repairs.

4.8.1 Repair authorization. The user will contact the procuring activity for approval of any repair(s). The procuring activity will authorize repairs by using the information submitted by the user and determining warranty status. After authorization is approved, the procuring activity will communicate to the owners of the equipment that they can send it into the contractor's facility for repair based on priority.

4.8.2 Commercial Asset Visibility Air Force (CAV-AF). CAV-AF provides a web-based, automated method of tracking Government owned reparable assets as they flow through the repair cycle at the contractor's repair facility. The main purpose of CAV is to provide an inventory management system for reparable assets while they are at commercial repair vendors.

The web-based system allows the contractor to report transactions as they occur and automatically update the CAV database. An integrated, relational database allows the commercial repair vendors to access their repair data to produce all the required status and activity reports. The contractor shall report production using CAV-AF. The contractor shall provide data on the actions conducted for each unit. The contractor shall report the actions as they occur within the timeline as stated in the Contract Data Requirements List (CDRL). (DI- MGMT-81838, Commercial Asset Visibility (CAV) Reporting; DI-MGMT-80441, Government Property (GP) Inventory Report)

4.8.2.1 Contract Depot Maintenance (CDM) Production Monthly Status Report. The contractor shall provide the Government with monthly maintenance production figures, status of assets, performance schedule, anticipated production, and a summary of unresolved problems at the end of the report period. Data shall be submitted to the Government in accordance with the Contract Data Requirement List (CDRL). (DI-PSSS-81995, Contract Depot Maintenance Production Report)

4.8.3 Beyond Economical Repair (BER) and Beyond Physical Repair (BPR). The contractor shall notify the Government of BERs and BPRs in writing through the Administrative Contracting Officer (ACO) to the PCO within five workdays of identifying the BER or BPR requirements. The Government Program Office will provide specific instructions for disposal.

This shall be reported on the contract CAV-AF Reporting system as an asset destroyed in place.

The contractor shall retain and maintain disposal records as described by FAR 4-805, Storage, Handling, and Disposition of Contract Files. Items instructed to be destroyed shall be disposed of in a manner that the parts are never to be re-issued or re-used. Proposals shall identify BER and BPR components to the greatest extent possible.

4.8.4 Quality of repair. The equipment shall be repaired in accordance with best commercial practices to restore operational capability as defined in the manufacturer's operation manual.

Equipment returned to the contractor shall be tested to verify proper repair. The contractor shall provide all materials required to accomplish repair, inspection, testing, and calibration. Parts and materials used to repair equipment shall be equivalent to the quality of original materials or parts.

The form, fit, and function of the equipment shall not be changed, modified, or altered without consent of the procuring activity.

4.8.5 Repair turn-around. Equipment received for authorized repair shall be repaired and shipped back to the user within 30 calendar days of receipt of the asset by the contractor. The contractor shall notify the procuring activity if the delivery of any asset will not meet the scheduled delivery date and negotiate a revised delivery date. The late assets shall be delivered by the revised delivery date acceptable to the procuring activity.

4.8.5.1 Repair delays. If for any reason the contractor is unable to initiate repair of equipment within 15 calendar days of receiving equipment at the contractor's facility, the contractor shall immediately notify the PCO and provide the reason repair cannot be initiated and an estimated date of when repair of identified items will resume.

4.8.6 Packaging. The contractor shall package and mark material in accordance with the contract’s AFMC Form 158, Packaging Requirements. The contractor shall package and mark material in accordance with other applicable Government regulations including, but not limited to, those regarding security, safety, and environmental concerns.

4.8.7 Shipment of equipment. The contractor shall be responsible for the shipping cost of assets from the user location to the contractor's facility. Upon completion of repair the contractor shall return the equipment to the user who requested the repair free on board (FOB) destination. The user and the procuring activity shall be supplied with a tracking number and identity of the carrier used to convey the shipment.