CHRIS PWS 2026 Finalized Draft.pdf

Performance Work Statement (PWS)

Command Human Resources Intelligence System (CHRIS)

1. DESCRIPTION OF SERVICES

1.1 Organization.

The Command Human Resources Intelligence System (CHRIS) program office is managed at Headquarters (HQ) Air Force Materiel Command (AFMC); Manpower, Personnel and Services;

Readiness and Integration (HQ AFMC/A1RI), Wright- Patterson Air Force Base (AFB), OH, 45433. HQ AFMC/A1RI shall be hereafter referred to as the Program Management Office

(PMO).

1.2 Background.

CHRIS is a Human Resources Management reporting tool that integrates data from Department of Defense (DoD) Defense Civilian Personnel Data System (DCPDS), AF Military Personnel Data System (MilPDS), AF Manpower Programming and Execution System (MPES), and other less significant data sources such as the Acquisition Career Management System (ACMS). This system is the tool used to meet the workforce management reporting needs of the user communities. It is centrally managed and maintained at Wright-Patterson AFB, Ohio by HQ AFMC/A1. The primary users of the CHRIS tool are located around the globe supporting AFMC and Air National Guard, but CHRIS is not restricted to these locations. CHRIS is a web based Human Resource (HR) reporting tool using Oracle, Informatica and Business Objects on three (3) production, two (2) development/test and one (1) backup server configuration.

2. SCOPE OF WORK

This contract covers all tasks necessary to provide daily operations, maintenance, sustainment, modifications, enhancements, and security support of CHRIS.

2.1 Non-Personal Services

The Government will neither supervise contractor employees nor control the method by which the contractor performs the required tasks. Supervision of employees in a non-personal services contract is the sole responsibility of the contractor and establishes the employer-employee relationship it has with its employees. Supervision includes, but is not limited to, the continuous employee management of recruitment, hiring, termination, compensation, benefits, career development, human resources management infrastructure, security clearance management, work location, contract assignment, and evaluations of contractor employees. Under no circumstances shall the Government assign tasks to, or prepare work schedules for, individual

HQ AFMC/A1 Performance Work Statement Command Human Resource Intelligence System, Sustainment, Maintenance and Process Improvement Support, 25 July 2025 contractor employees. The Government may provide guidance on the completion of work products or services and will maintain the right to reject the finished product or results.

The contractor shall manage its employees and guard against any actions that are of the nature of personal services or give the perception of personal services. If the contractor believes that any actions constitute or are perceived to constitute personal services, or are outside the scope of this task order, it shall be the contractor’s responsibility to notify the Contracting Officer (CO) and Contracting Officer’s Representative (COR) immediately. These services shall not be used to perform work of a policy/decision making or management nature, i.e., inherently Governmental functions. All decisions relative to programs supported by the contractor shall be the sole responsibility of the Government.

2.2 Inherently Governmental Functions

The contractor shall not perform any inherently governmental functions as defined by Federal Acquisition Regulation (FAR) Subpart 7.5. All decisions shall be the sole responsibility of the Government. These services shall not be used to perform work of a policy/decision making or management nature, i.e., inherently Governmental functions.

The contractor shall not counsel, mentor, make judgments and/or discretionary decisions, or perform any other activities related to supervision of Government personnel.

If the contractor believes that any actions constitute or are perceived to constitute inherently Governmental functions, the contractor shall notify the CO and COR immediately.

2.3 Ethics

The contractor shall have access to highly visible HR Military and Civilian data as a result of providing assistance to the Government. The contractor shall present an unblemished appearance in regards to ethics, discretion, and protection of information. The contractor shall follow the guidelines for usage of electronic mail listed in Air Force Manual (AFMAN) 17-1301 Computer Security (COMPUSEC) and for Internet usage as described in Department of the Air Force Instruction (DAFI) 17-130 Cybersecurity Program Management.

3 TASK DESCRIPTIONS

The contractor shall deliver the products and services as set forth in this PWS in support of CHRIS. The term CHRIS, as used in this PWS, includes all existing sub-modules and new sub-modules that may be added during the performance of this PWS.

3.1 Program Management

The contractor shall manage the project by organizing, directing, and coordinating plans and execution of contract activities. The contractor shall coordinate and schedule work and submittal of contract deliverables; provide a point of contact, submit a monthly status report (MSR) and a recurring program review to address: program status, technical items/accomplishments and schedule, review Active Plan of Actions and Milestone (POA&M) items; personnel and budget issues; and inform the COR of all matters that will or may impact CHRIS status, operation, or schedule.

Deliverable: Monthly Status Report (CDRL A001)

3.2 Systems Operations, Maintenance and Sustainment

Contractor must sustain CHRIS, a Business Intelligence environment, by providing system administration, software/hardware installation, maintenance, sustainment and development utilizing the following Commercial Off-the-Shelf (COTS) software: Oracle, Windows Server Operating System, Informatica PowerCenter and Business Objects. These software packages must be maintained to the latest authorized software version approved to operate on Non-classified Internet Protocol Router Network (NIPRNet) to include all security patches.

Contractor must also support the project with Web application services, Tomcat, JAVA, Backup Software, Active Server Pages (ASP), Java Server Pages (JSP), Procedural Language/Structured Query Language (PL/SQL) and hardware—such as local Government owned servers, storage area networks (SAN), tape backup units or in collaboration with networked data center.

3.2.1 Database Services

The contractor is required to develop and sustain the Oracle database for CHRIS.

3.2.1.1 Using Oracle, the contractor shall design, construct, and support a scalable data warehouse and database structures; administer logins and security; utilize advanced security encryption, apply security measures and/or mitigations per the Security Technical Implementation Guide (STIG) scans or any 88th Communications Group (88 CG) scans; apply constant database optimization and tuning; ensure adequate database testing following all software updates, structure modifications and patches.

3.2.1.2 The contractor shall perform database management administrative functions.

These functions include analyzing, planning, and implementing the import and export of data; coordinating system and data backups, performing system and data restoration, implementing user administration and access control, maintaining optimal performance and installing, upgrading and configuring relational database management software.

3.2.1.3 The contractor shall research, analyze, design, program, test, deploy, document, and implement code to meet user defined business rules supporting system and functional requirements. Documentation requires annual review and update of the Database Design Description document. The Database Design document will be housed on the project SharePoint site.

Deliverable: Database Design Description document (CDRL A003)

3.2.1.4 Contractor shall ensure retention of historical data in various table structures covering monthly and annual recurring requirements. Requirements and business rules shall be provided by PMO. Historical data exists as snapshots in time to include MPES, Civilian and Military History and Loss Probability.

This data will also be included in tape backups and contingency planning.

3.2.2 Extract, Transform and Load (ETL). The contractor shall provide data integration services using Informatica PowerCenter to extract source data from various database sources in various formats, transform the data using business rules and upload to the CHRIS Oracle database. To the greatest extent possible ETL procedures must be automated. Data refreshes shall occur weekly, at a minimum. Documentation requires annual review and update of the Application Design Description. The Application Design Description will be housed on the project SharePoint site.

Deliverable: Application Design Document (CDRL A004)

3.2.2.1 The contractor shall perform regularly scheduled data refreshes from all data sources as required by the PMO at a minimum weekly, delivered by Monday 8:00 am ET.This task shall include data pulls, stage loading, application of business rules, and advancing to final reporting schema.

3.2.2.2 The contractor shall apply business rules during data normalization and transformation, to ensure conformance of database structure.

3.2.3 Reporting Instance. Contractor shall serve as Business Objects (BO) Administrator to develop, monitor, and sustain BO reporting instances and user security in CHRIS.

The contractor shall install, configure, and maintain BO software.

3.2.3.1 The contractor shall utilize BO to design, create, modify, and maintain universesThe contractor shall apply object security, row level security, user security, and ensure business rules are applied.

3.2.3.2 The contractor shall utilize BO to create, modify and maintain corporate reports, report metadata, user reports, and report repositories.

3.2.3.3 The contractor shall use the BO Central Management Console (CMC) in daily administration of CHRIS.

3.3 Human Resource Data. The contractor shall have knowledge of, and be capable of, understanding human resource applications and data structures. This shall include specific knowledge of Air Force and DoD personnel and manpower data systems to enable effective data integration and application of business rules.

3.4 System Interfaces. The contractor shall work closely with the appropriate 88 CG program office and external system POCs to: determine system interface requirements, attend system integration and other meetings, and provide system documentation, data schema, database and metadata information. The contractor shall design, develop, and thoroughly document systems and data import/export processes. The contractor shall accomplish data imports and exports, anticipate technical interchange problems and develop appropriate solutions.

3.5 Loss Probability. The contractor shall maintain a statistical trend analysis predictive model projecting seven (7) years of probable losses. The model shall be based on historical loss data in the civilian workforce due to death, disability, retirements, and resignations in accordance with the business rules. The model shall be updated annually. The referenced probabilities must be reportable from within CHRIS BO universes and adhoc reporting.

Deliverable: Loss Probability (CDRL A005)

3.6 Continuity of Operations Planning and Support: The contractor shall develop and maintain the CHRIS contingency plan for the reconstitution and recovery of CHRIS in the event of extended disruption in operations. The plan must be able to be implemented within 2 hours of notification. The contractor shall implement and test the plan on a recurring basis and in support of annual testing requirements. The contractor shall improve/revise the plan throughout the life of the contract.

3.6.1 Backups. Contractor shall maintain full restore capability. Backups are performed on a scheduled basis. A full copy of backup media shall be stored at an alternate location on a quarterly basis.

Deliverable: Contingency Plan (CDRL A006)

3.7 Security: The contractor shall adhere to the Federal Information Security Management Act (FISMA) and the Risk Management Framework (RMF) for DoD Information Technology (IT) from design to implementation. Contractor shall follow DAFI 17-101 Risk Management Framework and DAFI 90-802 Risk Management regulations for system accreditation. The goal is to protect information and information systems from unauthorized access, disclosure, disruption, modification or destruction to ensure integrity, confidentiality and availability.

3.7.1 System accreditation. The contractor shall maintain an approved CHRIS

Certification and Accreditation (C&A); Approval to Connect (ATC) and Authorization to Operate (ATO). The contractor shall ensure that any change in configuration, mode of operation, or other modification is analyzed to determine system security impact(s) is appropriately addressed through the CHRIS configuration management process; and is properly acted upon to maintain a level of security consistent with the requirements established in FISMA and RMF.

Additionally, the contractor shall utilize the Enterprise Mission Assurance Support Service (eMass) to maintain all applicable artifacts and supporting documentation, andupdate artifacts when there is any change affecting the security posture, architecture or configuration of the system. The contractor shall facilitate accreditation process through all cycles to authorization andwork closely with approvers to comply with all tests and documentation. A POA&M shall be developed and maintained to address known vulnerabilities in the system.

Reference DoDI 8510.01, Risk Management Framework, Enclosure 6.

3.7.2 The contractor shall maintain and/or develop documents required for system operations and security to maintain system accreditation. Any documents that require Government review must be submitted to the Government no later than 120 days prior to ATO expiration. System documentation shall be reviewed/updated when system configuration changes to include documents such as, but not limited to, System Security Plan, Incident Response Plan, System Architectural Document and System Categorization.

3.7.3 Annual Security Review (ASR). The contractor shall implement a plan to review all security controls and safeguards annually based on current ATO policy requirements.

The security review shall consist of examining and reviewing each assigned control to ensure the controls are current and provide the level of protection required for the system. The contractor shall recommend changes if necessary.

3.7.4 Annual Contingency Plan Testing (ACPT). Contractor shall perform an annual review/test of the system’s Contingency plan. Testing can be in the form of table top exercises, scheduled interruption to the production environment and/or simulated scenarios. Testing results shall be documented and the plan modified, if necessary.

Documents shall be placed on the project SharePoint site.

Deliverable: Contingency Plan Testing Report (CDRL A007)

Deliverable: Maintain an approved ATO in accordance with ATO timeline and current ATO policy requirements currently housed in the eMass system (CDRL A008)

3.7.5 Contractor shall work closely with local Communications Group to comply with all security requirements. Security requirements include: Installing all DoD mandated patches, ensuring compliance with all Time Compliance Network Orders (TCNO) and ensuring Public Key Infrastructure (PKI), and CAC restrictions are applied.

Scans and checks shall be executed, assessed and all security findings resolved or mitigated in accordance with the Security Technical Implementation Guide (STIG) or applicable scan. Audit logs shall be maintained and reviewed in accordance with automated information systems security directives.

3.8 System Management and Administration Services. The contractor shall perform Systems Administrative functions for servers in support of both production and development environments. Ensure application is accessible by all users, monitor system and server performance; monitor system, server and application security; configure system hardware and software, maintain optimal system performance; coordinate system backups; perform data restoration; and implement user administration and access control. The contractor shall research, analyze, design, program, test, deploy, document and support code meeting user defined business rules supporting system and functional requirements. The contractor shall troubleshoot, diagnose and resolve outages and other problems with web servers, data processing servers and database servers.

3.8.1 The contractor shall identify and provide hardware and software installation including all patches and configuration of the servers where the application resides. If architectural changes to the environment are required, (i.e. additional application servers, database servers), the contractor shall manage the installation of hardware and related software.

3.8.2 The contractor shall perform/coordinate all database, application and server backups and restorations associated with CHRIS.

3.8.3 Contractor shall configure and maintain all servers and software to comply with DoD, Air Force and 88th Communications Group (88 CG) requirements, maintaining passwords and user accounts.

3.8.4 The contractor shall work with 88 CG to request, configure and comply with the Firewall Exception Process for any special port, protocol, or service necessary to operate application.

3.9 Configuration Management (CM). The contractor shall provide acceptable approach to Configuration Management.

Deliverable: Configuration Management Plan (CDRL A010)

3.9.1 The contractor shall maintain tracking to include audit trail of decisions and design modifications. The contractor shall identify configuration items and be responsible for all configuration items and baselines under their control, including hardware, software, and contractor produced documentation.

3.9.2 As required by Information Assurance (IA) controls, access to CM libraries for source code shall be limited to official need to know. In addition, a current and comprehensive inventory of all COTS software (to include manufacturer, license type and quantity, and installation manuals and procedures) required to support CHRIS shall be maintained and delivered to the CHRIS Program Manager. A backup copy of the software inventory shall be stored in a fire-rated container or otherwise not collocated with the original.

3.9.3 Contractor ensures all software installs are within license agreements.

Deliverable: Software Inventory (CDRL A002)

3.9.4 Contractor maintains inventory of hardware components including support agreements and effective dates.

Deliverable: Hardware Inventory (CDRL A009)

3.10 Technical Meetings. The contractor shall conduct/participate in program reviews and technical meetings in support of CHRIS.

3.11 Transition Requirement

3.11.1 Transition Requirements for Contract Start-up. The contractor shall work in concert with the incumbent contractor for a period of 30 calendar days. This transition includes the transfer of all items required to maintain and modify CHRIS, to include source code, configuration management process tools and data, documentation, software (Informatica/Business Objects) to include licenses and government furnished hardware and equipment related to CHRIS. In addition, the contractor shall receive training from the incumbent. The transition activities shall be in accordance with Transition Plan.

3.11.2 Transition Requirements for Contract Conclusion. The contractor shall be required to develop a non-proprietary Phase-Out Transition Plan for a new maintainer in an orderly transfer of all items related to the maintenance of CHRIS, to include but not limited to, source code, configuration management tools, data documentation, status and documentation of work-in-process, software licenses, Government furnished hardware and equipment. The plan shall cover a 60 calendar day period, include assisting the follow-on maintainer in learning the system and result in minimal to no downtime to CHRIS. According to the approved transition schedule, the new contractor shall have assumed the responsibility to perform CHRIS sustainment, but the incumbent contractor shall continue to provide support to the new contractor and to Government personnel during the transition period.

Deliverable: Phase-Out Transition Plan (CDRL A012)

3.12 CHRIS End User Support

3.12.1 The contractor shall provide account management to CHRIS by utilizing Central

Management Console (CMC), Web Intelligence, and SharePoint in creating, modifying and maintaining CHRIS accounts.

3.12.2 The contractor shall be responsible for monitoring the CHRIS account management organizational email box. The contractor shall provide account support services and respond to all emails within 1 business day. The contractor shall create new user accounts within 2 business days of receiving completed DD Form 2875 and User Agreement, and notify the user immediately upon account creation. If a new access clause is required prior to creating the account, the contractor shall notify appropriate government personnel within 1 business day of receipt. Additionally, the contractor shall forward any requests received in the organizational email box that do not fall under their purview to the appropriate party for action within 1 business day. The contractor shall complete the above tasks using appropriate professional tone and customer service skills, and courtesy copy government personnel on all internal and external correspondence for monitoring.

3.12.3 The contractor shall conduct an annual CHRIS user account audit.

Deliverable: User Account Audit (CDRL A011)

4. CONTRACT DELIVERABLES

CDRL Data Item Title/Subtitle Frequency Medium/Format/Submit

To

A001 Monthly Status Report (MSR) Monthly on 15th E-mail to Program

Manager (PM)

A002

Technical Report - Commercial Off-the- Shelf (COTS) Software Inventory and Installation Tracking

Annual by 1 March and with every software installation

E-mail to PM, Save as FISMA Artifact and SharePoint filing

A003

Database Design Description

Annual by 1 March and with major changes to system configuration.

Document maintained in Microsoft Word.

Save document in project SharePoint and e-mail PM upon deliverable completion.

A004

Application Design Document

Annual by 1 March and with major changes to system configuration.

Document maintained in Microsoft Word.

Save document in project SharePoint and e-mail PM upon

A005

Loss Probability Model

Annual by 1 November

Email PM and Document in Requirement tracker

A006

Contingency Plan

Annual by 1 July

Document maintained in Microsoft Word.

Save document in project SharePoint, FISMA Artifact upon

A007

Contingency Plan Testing Report

Annual by 1 August

E-mail Results to PM

CDRL Data Item Title/Subtitle Frequency Medium/Format/Submit

To

A008

Maintain an Authorization to Operate (ATO)/Accreditation package

Prior to Accreditation Termination Date.

Provide approved documentation package to PM upon deliverable completion

A009

Technical Report - Hardware Inventory

Annual by 1 Feb or when new hardware installed.

Document maintained in Microsoft Excel.

Save as FISMA Artifact, and file in project SharePoint.

Email PM upon

A010 Configuration

Management Plan

Annual by 1 April

Email to PM, Save as FISMA Artifact, and SharePoint filing

A011 User Account Audit Annual by 1 July Email Results to PM

A012

Phase-Out Transition Plan

Due upon contract conclusion if transitioning to different follow-on contractor.

Data Item Description:

DI-MGMT-81945.

A013

Technical Reports

As requested

As requested

A014 Safety and Health

Plan 10 calendar days after contract award

Submit to Contracting Office

A015

Quality Control Plan 30 calendar days after contract award Submit to Contracting Office

A016 Weekly Accounts Created or Modified

Weekly by 1200 each Monday

Email to CHRIS Analysts

4.1 Monthly Status Report (MSR). The contractor shall document the efforts performed in the completion of this requirement in a detailed MSR. The contractor shall include at a minimum, the following information in the MSR. (1) Narrative review of work accomplished during the reporting period and/or significant events; (2) deliverable process/status; (3) problem areas encountered and recommendations; (4) anticipated activities for the next reporting period; description of any unique services provided; and (5) Man-hour expenditure report. Additional items that may be included are outlined in Section 3.1.3. (CDRL A001)

4.2 Software Inventory. Annually, the contractor shall review, create, or update software inventory document to include current tracking requirements such as: Software title, vendor, version, specific license type (core, processor, numbered user, concurrent user, etc.,) quantity owned, quantity installed, physical location of media, version control/end of life (EOL) and physical location of software installation. Final document provided to PMO and loaded to shared document storage. Document shall be reviewed/updated annually. (CDRL A002)

4.3 Database Design Description. Annually, the contractor shall maintain a database design document in accordance with Air Force Instruction 33-114, Software Management. E-mail notification of annual review must be sent to PM. PM must approve Database Design Description as final. The final report must be maintained in SharePoint and uploaded as FISMA/RMF Artifact. (CDRL A003)

4.4 Application Design Document. Annually, the contractor shall review Application Design Document/Software Design Description in accordance with DAFI 33-114, Software Management. E-mail notification of annual review must be sent to PM. PM must approve Application Design Document as final. The final report must be maintained in SharePoint and uploaded as FISMA/RMF Artifact. (CDRL A004)

4.5 Loss Probability Model. The contractor shall update and maintain a loss probability model with probability statistics refreshed every fiscal year and representative of actual organizational behavior. Email PMO upon availability of FY Loss reporting instance. (CDRL A005)

4.6 Contingency Plan. The contractor shall maintain the Contingency Plan in accordance with National Institute of Standards and Technology (NIST) SP 800-34. The document should be reviewed annually in conjunction with annual contingency exercise and updated if necessary.

E-mail notification of completion must be sent to PM. PM must approve report as final. The final report must be maintained in SharePoint and uploaded as FISMA/RMF Artifact. (CDRL A006)

4.7 Contingency Plan Testing. Annually, the contractor shall provide a summary report documenting test results of Contingency Plan testing. Contingency plan testing can be in the form of table top exercises, scheduled interruption to the production environment and simulated scenarios. E-mail notification of completion must be sent to PM. PM must approve Contingency test report as final. The final report must be maintained in SharePoint and uploaded as FISMA/RMF Artifact. (CDRL A007)

4.8 Authorization to Operate (ATO)/Accreditation Package. The contractor shall maintain an approved accreditation package, in accordance with agency information systems security policies. (CDRL A008)

4.9 Hardware Inventory. The contractor shall review, create, or update hardware inventory documentation. E-mail notification of document creation/update must be sent to PM. PM must approve the document as final. The final report must be maintained in SharePoint and uploaded as FISMA/RMF Artifact. (CDRL A009)

4.10 Configuration Management (CM) Plan. The contractor shall review, create, or update the CM Plan. The CM details the methodology that will be used to control program documentations and configuration items. Annually, the CM will be reviewed and updated to reflect changes in procedures, rules, regulations to maintain proper CM practices. (CDRL A010)

4.11 User Account Audit. The contractor shall be required annually to conduct a user audit based on Government provided audit factors. (CDRL A011)

4.12 Phase-out Transition Plan. Reference Data Item Description (DID) DI-MGMT-81945.

The Phase-Out Transition Plan provides a detailed description of the transfer of full assumption of duties at each site to the follow-on contractor. This Data Item Description (DID) contains format and content preparation instructions for the data product generated by the specific and discrete task requirement as delineated in the contract and described in the PWS. It should be tailored to the minimum data requirements of the applicable contract or purchase order. (CDRL A012)

4.13 Technical Reports. The contractor shall be required on an “as requested” basis to provide technical reports as related to CHRIS. These reports shall be provided as the result of requests from the PMO. The contractor may also identify to the PMO the need to provide technical reports. (CDRL A013)

5 QUALITY ASSURANCE

5.1 Quality Control

A Quality Assurance Surveillance Plan (QASP) will be developed by the Government, which will include the Services Summary below. The Contractor shall develop, implement, and maintain a comprehensive inspection system that assures compliance with all requirements of this contract IAW FAR part 46, Quality Assurance.

The contractor shall submit a Quality Control Plan (QCP) to ensure that Contractor services conform to contract requirements and standards. This shall include, but not be limited to, documented procedures, inspections, tests (taken at the point of performance) and training.

5.2 Quality Control Plan

The Contractor shall develop a QCP that demonstrates how the Contractor shall maintain an inspection system acceptable to the Government covering the services under this contract (CDRL A004). The Contractor shall provide the final QCP to the CO no later than 30 days after contract award date. If at any time during the PoP the Contractor revises the QCP after initial submission, the updated version shall be submitted to the CO within 15 days. The QCP shall demonstrate the Contractor’s documented processes and procedures to monitor and control, to include but not limited to:

• Objectives in the Services Summary

• Subcontractor relationships

• Contract and subcontractor invoicing

• Non-conformances

• Contractor employee qualifications and certifications

Deliverable: Quality Control Plan (CDRL A014)

5.3 Government Inspection

Contractor performance is subject to surveillance by the COR/ACOR to ensure compliance with this contract to include all elements of the Service Summary.

The contract identifies two types of non-conformances: minor and major. All records of non-conformance and corrective actions will be documented in Corrective Action Reports (CAR), Monthly Surveillance Reports and Contract Performance Assessment Ratings (CPAR).

5.4 Nonconformance

The Contractor shall identify and control non-conformances through root cause analysis, corrective actions and preventive actions. The Contractor shall focus on proactive identification and transparency of issues, and on eliminating the cause to prevent reoccurrences. The Contractor shall maintain records of non-conformities and actions taken.

The Contractor shall correct and provide response to all Government-identified non-conformances IAW timeframes specified by the CO.

5.5 Minor Nonconformance

A minor non-conformance is a non-conformance, which by itself does not adversely impact the overall HQ AFMC/A1 mission, safety of personnel and/or equipment, performance (quality), schedule (delivery), or cost. Minor non-conformances are typically low risk, and may be communicated through a CAR form with the minor box checked.

Minor CARs are normally issued for any identified non-conformances. Second notice minor CARs are normally issued for repeat non-conformances or failing to correct issues within a reasonable amount of time or non-conformances that increases risk to one specific technical element or program. Upon receipt of a minor CAR addressing minor non-conformance, the Contractor shall complete applicable sections and return it to the CO within the time specified in the notice. A formal corrective action plan is not required for minor CARs. Minor non-conformances shall be documented in order to be used in support of a Quarterly Surveillance Report or CPAR rating.

5.6 Major / Critical Nonconformance

A major non-conformance is a nonconformance, other than critical, that is likely to result in failure of the supplies or services, or to materially reduce the usability of the supplies or services for their intended purpose. A critical nonconformance means a nonconformance that is likely to result in hazardous or unsafe conditions for individuals using, maintaining, or depending upon the supplies or services; or is likely to prevent performance of a vital agency mission. These non-conformances adversely impact (or has the potential to impact) mission, safety of personnel and/or equipment, performance (quality), schedule (delivery), or cost. These type of non-conformances increases risk to the Government and therefore have a risk assessment rating of moderate or high. Additionally, a CO may find that a situation of increasing risk exists where there are a significant number of recurring minor non-conformances creating an indication of inadequate preventive measures/actions which lowers the Government’s confidence that the Contractor can provide quality services on time and within cost.

The CO will communicate major/critical non-conformances on a CAR form with the major box checked. A suspense date for the Contractor’s corrective action plan will be included as well as a summary of the minor CARs and documented customer complaints, if any, that have preceded this issuance. Major/Critical Non-conformances shall be documented in order to be used in support of a quarterly surveillance or CPAR rating. The Contractor shall generate a formal corrective action plan for major CARs and other documented Government complaints/concerns that will address at a minimum:

• Action taken to fix the immediate problem

• Root cause analysis of the problem to determine cause

• Corrective action on the cause of the problem

• Actions taken to prevent recurrence

• Furthermore, any unresolved, validated major/critical non-conformance issue(s) will result in less than satisfactory performance on the Contractor’s quarterly ratings, CPAR and past performance ratings.

5.7 Contractor Performance Assessment Reporting System (CPARS) Applicability FAR 42.1502 directs all Federal agencies to collect and report past performance information on services contracts with a value of $1M or more. The CPAR assesses a contractor’s performance and provides a written record on a given contract during a specific period of time. All CPARs are accomplished using the automated CPARS found on the web at <http://www.cpars.gov>. This system requires the contractor to provide a designated representative to receive CPARs.

Performance standards shall include the contractor’s ability to provide or satisfy the following:

• Provide satisfactory solutions to requirements with the necessary customer support

• Provide solutions and services that meet or exceed specified performance parameters

• Deliver timely and quality deliverables to include accurate reports and responsive proposals

• Ensure solutions to requirements are in compliance with applicable policy and regulation

6 SERVICES SUMMARY (SS). Defines performance thresholds expected in delivery of services.

http://www.cpars.navy.mil/

Performance Objective PWS Para Performance Threshold SS1 - Quality of Service:

System Availability.

3.2 Performance is considered satisfactory when CHRIS is

available 98% of the time, excluding scheduled downtime.

SS2 - Timeliness: Data refresh completed on schedule.

3.2.2 100% of the time refreshed data must be available to users within 4 hours of the refresh schedule.

Functional project manager must approve exceptions and corrective action within 2 hours of the scheduled refresh date and time.

SS3 - Quality of Service:

Content of deliverables meet the requirements of the

CDRL

4.0 Performance is considered satisfactory when 95% or

more of the deliverables are approved as delivered.

SS4 - Quality of Service:

Compliance with security requirements

3.7 Performance is considered satisfactory when there is

100% compliance with security requirements and there are no reported security incidents.

SS5 - Timeliness: Problem reports and enhancements

3.9.1 Performance is considered satisfactory when reported

problems are resolved within the requested time frame submitted by COR and accepted by the contractor in SharePoint. Exception only with approved time extension.

SS6 – Quality of Service:

Authorization to Operate

3.7.1 Performance is considered satisfactory when an

approved ATO is accomplished prior to the previous ATO expiration date. At the COR’s discretion, an exception/extension may be approved if the delay is not in the Contractors control. The ATO approval process must be in stage 4 for a minimum of 60 days prior to ATO expiration date.

SS7 - Quality of Service Maintain full CHRIS recovery capability

3.6.1 Performance is considered satisfactory when 100% of

the time backups exist to fully recover CHRIS.

SS8 – Quality of Service:

Account Maintenance

3.13.2 Performance is considered satisfactory when 95% of

user accounts have adequate security applied to their accounts.

6.1 Surveillance Methods

The Contractor shall support the Government’s surveillance of performance objectives.

Surveillance methods may include, but are not limited to, random sampling, 100% inspection, periodic inspection of the process or output, or customer surveys. The Contractor shall conduct its own surveillance of its performance to include customer surveys at a minimum. The approach for development of the survey and its implementation shall be coordinated and approved by the Government.

The Government's surveillance method is a monthly review-based SS, which is identified in this section of the PWS. The review is based on requirements identified in the PWS. The CO will provide notification to the Contractor should any monthly surveillance indicate performance not meeting the acceptable performance standard identified in the SS. Once notified by the CO, the Contractor shall provide a mitigation strategy and correct all defects detected during surveillance by the COR/ACOR within five (5) business days.

7 GENERAL INFORMATION

The contractor shall accomplish tasks by providing qualified personnel possessing the appropriate education, training, trustworthiness determination/security clearance, and experience/skills IAW the PWS requirements. Additionally, the contractor shall provide qualified replacement/substitute personnel, which meet or exceed the same position standards.

All documentation supporting the fulfillment of education, training, certification, clearance and experience requirements (or possible waiver as appropriate) of each person shall be retained for five (5) years from the date of employment. The contractor shall conform to the contract requirements, specifications and standards of good workmanship (technical, professional, environmental and safety and health standards).

7.1 Place of Performance

7.1.1 Place of Performance shall be in 4375 Chidlaw Road, Building 266, Wright-Patterson AFB, Ohio or an alternate duty location identified by the COR in the event of an HQ AFMC/A1RI organizational relocation due to natural disaster, pandemic, or terrorist threat.

7.1.2 Property protection for the facility where the contractor’s primary work center is located shall be the responsibility of the local facility manager and local Government Security Manager, or their duly authorized representative in IAW DAFI 31-101, Integrated Base Defense and command/local directives. The contractor must safeguard all Government-owned equipment and materials in its possession or use.

7.2 Time of Performance

7.2.1 Contract performance generally consists of 40-hour workweeks. The contractor must provide on-site or virtual support (if required) during core duty hours from 0800 to 1700 Monday through Friday, except for Government observed holidays and data import/refresh support. Contractor shall provide support for the Data import/refresh beginning 0500 Saturday and completed by 0800 Monday. Other circumstances such as system maintenance, failures, or training may be required. Anytime an individual needs to work in excess of 40 hours in one week’s time period, advance notice must be given to the COR for coordinating with the Contracting Officer.

7.2.2 Weather or other unusual situations, such as increased Force Protection, dictate changes to the normal duties. The contractor shall adjust their duty schedule according to AFMC/A1 instructions. In the event of installation or facility closure, the contractor shall develop and implement, with AFMC/A1 approval, a temporary work environment (telework) that will allow the contractor to meet contract requirements.

7.3 Legal Holidays

7.3.1 The following legal holidays are observed by federal employees:

• New Year's Day

• Martin Luther King's Birthday

• President's Day

• Memorial Day

• Juneteenth Day

• Independence Day

• Labor Day

• Columbus Day

• Veteran's Day

• Thanksgiving Day

• Christmas Day

7.3.2 Any of the above holidays falling on a Saturday are observed on the preceding

Friday, holidays falling on a Sunday are observed on the following Monday. Access to Government employees and services may be limited on holidays, down days or family day, weekends, and in the case of Government furloughs.

7.4 Training

The Contractor shall be responsible for the employment, training, guidance, and supervision of qualified personnel to accomplish this contract. Contractor personnel are required to possess the skills necessary to support their company’s minimum requirements of the labor category under which they are performing. Employee time spent in the above-mentioned training or training necessary to meet minimum requirements to include certifications will not be paid for by the Government or charged to the contract.

Unique Training: Training of Contractor employees in subjects unique to the Government, which is necessary for employees to function in their assigned working environment, is only permitted with prior approval by the CO. The Contractor’s employees may participate in other Government provided training under the following circumstances:

• The Contractor employees’ participation is on a space-available basis

• The Contractor employees’ participation does not negatively impact performance of this contract

• The Government incurs no additional cost in providing the training due to the

Contractor employees’ participation, and labor hours spent due to the Contractor employees’ participation in such training are not invoiced to the contract, unless necessary to meet for employees to function in their assigned work environment.

7.5 Contractor Furnished Facilities, Supplies and Services

The contractor shall furnish appropriate facilities, support, and services for any off-site support related to this contract. As directed and approved by the CO, the contractor shall acquire, install, maintain, and provide hardware, software, or supplies needed to accomplish the specific task.

Exceptions include any computer equipment/software required for the contractor to meet the requirement of the contract either on base or teleworking.

7.6 Base Support

The Government shall provide workspace, desks, chairs, storage space, computer equipment, software, phones, routine office supplies, and network access. Equipment may be taken TDY or to an alternate duty location. The COR must be notified of any equipment being removed from the normal work location.

Any Government equipment (e.g., laptops, phones) provided to contractor personnel shall be returned at the termination of the engagement or at another time mutually agreeable to by both parties.

7.7 Performance of Services during Emergency Conditions

In the event an emergency is declared, necessitating the implementation of an alternate work schedule (other than a standard eight (8) hour day, Monday-Friday work week) and/or work location the COR will make notification to the contractor point of contact. The CO will make notification to the Contractor point of contact and a modified work schedule shall be agreed to by both parties and implemented for the duration of the declared emergency. Contractor will modify work schedules and/or work locations as necessary to meet production requirements.

7.8 Telecommuting/Telework

Telecommuting/telework is defined as authorization for an employee that would generally work at the above place of performance be approved to work at an alternate location (i.e., at the employee’s home or contractor location). This alternate location can be either on a permanent or temporary status, at the discretion of the COR and CO.

Telecommuting/telework is generally Customer-specific and all telework approved equipment must be authorized by the Government for use. Contractors with approval to telework must ensure to comply with DAFMAN 17-1301, section 5.6. Additionally approved contractors shall maintain availability during core hours via e-mail, government instant messenger (currently Microsoft Teams) and phone. All telecommuting/telework expenses for Internet, telephone connectivity and other equipment services shall be borne by the contractor.

Classified work is not authorized under telecommuting or the alternate worksite. Authorized telecommuting or alternate worksite locations does not abrogate the contractor’s requirement for complying with the protection of information IAW DoD and USAF regulations, Security and Protection of Information sections of this PWS.

At alternate duty locations, the contractor shall be available at all times during core hours via e-mail and phone. Operating costs associated with the contractor using an alternate worksite will not be assumed by the Government.

7.9 Use of Personal Equipment

Personal computer equipment as outlined in DAFMAN 17-1301 Section 5.8 is not approved for Government work.

7.10 Security Requirements

The contractor shall comply with the contract security requirements identified in the following subparagraphs. The contractor shall pass down tailored security requirements, as stated in the contract, to all subcontractors.

7.10.1 The contract requires all personnel, to include subcontractors and Independent Consultants, performing work on this contract with access to unclassified information systems, including e-mail shall have a minimum favorable Tier 1 (formerly known as National Agency Check with Written Inquiries (NACI)). Work on this project may also require personnel to possess a Tier 3 (previously known as National Agency Check Local Agency Check (NACLC)) personnel security investigation (PSI) for purposes other than access to classified information and will not result in security eligibility for Secret. The Defense Information System for Security (DISS) is the system of record for verifying clearance information. Tier 3 investigation is required for Building access to support CHRIS hardware.

7.10.2 Physical security is applicable only to personnel performing work on a DoD installation. All Contractors located on military installations shall also comply with OPSEC requirements as set forth in DoD Directive 5205.02E, Operations Security Program dated June 20, 2012 change 1 dated 11 May 2018 and DAFI 10- 701dated 24 July 2019. OPSEC requirements are necessary to reduce program vulnerability from successful adversary collection and exploitation of critical information.

Contractor personnel will participate in OPSEC program activities. OPSEC will be applied to all activities under this contract. Critical Information lists will be provided by the Government. OPSEC Surveys to measure the effectiveness of the OPSEC program may be conducted by the Government.

7.10.3 Contractor will be required to have a current SECRET clearance. As required

Contractor personnel supporting this contract shall possess a SECRET clearance based on an investigation completed within the past 10 years. Exceptions to this requirement may be approved by the CO or COR/ACOR on a case-by-case basis.

7.10.4 The Government reserves the right to deny the suitability of Contractor personnel and recommend denial of access to Government facilities for those (a) who are security risks, (b) whose performance is unsatisfactory, or (c) who constitute a disruptive influence in the facilities. No products or CDRLs shall be developed or stored at the

Contractor’s facilities. The Contractor must be briefed to SECRET access one day after contract award.

7.10.5 The Contractor shall ensure their employees and their subcontractors have the proper credentials allowing them to work in the applicable country. Persons found to be undocumented immigrants shall be remanded to the proper authorities.

7.10.6 Contractor personnel shall hold the designated clearance level required for a position at the time of appointment/award as indicated by the Government. “Exceptions to the above” will be reviewed and approved by the Government point of contact, the COR.

All exceptions will include a justification, which at a minimum, will include the following: the reason for the exception, what skill is being provided and why the position cannot be filled with personnel cleared at the designated level. The contractor shall maintain this clearance throughout the contract period of performance to provide support for multiple tasks and meetings at various classification levels.

7.10.7 Personnel Security Investigations

7.10.7.1 Contractors performing functions under the identified Impact Levels (ILs), as defined in, DoD Cloud Computing Security Requirements Guide (DoD CC SRG) will require a trustworthiness determination based on the appropriate personnel security investigation (PSI).