CSS3_Draft_PWS 2.1.docx

Performance Work Statement (PWS) for Cyber Support Services 3 (CSS3)

XX XX XXX

Prepared by:

AFIN Ops & Sustainment Branch (AFLCMC/HNIB) Enterprise IT & Cyber Infrastructure Division (AFLCMC/HNI) Air Force (AF) Life Cycle Management Center (AFLCMC) Hanscom AFB, MA

CSS3 Performance Work Statement (PWS) ii

Page intentionally left blank

DOCUMENT CHANGE RECORD

Revision

iii

Table of Contents

LIST OF FIGURES

LIST OF TABLES

CSS3 Performance Work Statement (PWS)

1 Background The Air Force Information Network (AFIN) is a multibillion-dollar portfolio of Department of the Air Force (DAF) (Air Force and Space Force) programs that ensure an effective worldwide, fixed-base, high-speed, high-capacity, reliable and secure digital communications infrastructure. The AFIN system consists of enterprise-wide tools, equipment and media that provide traditional and wireless base network infrastructure, network monitoring and network defense at Active-Duty Air Force (ADAF), Air Force Reserve (AFR), and Air National Guard (ANG) bases worldwide. The AFIN infrastructure provides the Warfighter with full access to real-time Command and Control (C2) information for day-to-day operations and contingencies. The size and makeup of the AFIN will change over time and the requirements for this contract will evolve to support those changes.

The organizations that the CSS3 contract primarily supports are Cyber Security and Control Systems (CSCS), Air Force Intranet Control (AFINC), Base Information Transport Infrastructure (BITI), and Theater Deployable Communications (TDC) programs under the Air Force Life Cycle Management Center (AFLCMC) Enterprise IT & Cyber Infrastructure Division (HNI) portfolio.

In addition to the fielded network, there are currently three (3) separate Integration and Test Facilities (ITF) located at Hanscom Air Force Base (AFB). Two of the ITFs (building 1607 and the building 1435), contain a subset of the systems and equipment that mirror the deployed DAF programs across the DAF Non-Classified Internet Protocol Router Network (NIPRNet)/Secure Internet Protocol Routed Network (SIPRNet). These ITF’s provide the ability to configure, test, and support computer, data network, and communication system software and equipment, system designs and architectures currently being acquired and implemented throughout the Air Force. The three (3) ITFs are also used for testing new capabilities needed to respond to customer requirements, sustain existing capabilities, research, evaluate, and test technologies designed to address new threats to the DAF system/networks.

During the contract Period of Performance (PoP), the quantities of systems and equipment will change as systems are added and subtracted.

Scope The Contractor shall support fielded AFIN Systems deployed by HNI portfolio organizations listed above., ITFs, and their associated capabilities using Government, Contractor, and Industry best processes and practices. The Contractor shall support the DAF system/networks to include the running of the Tier II and Tier III AFIN Response Center (ARC), purchasing network equipment and services supporting break/fix and out of cycle obsolescence equipment replacement efforts. Also included are Technical Publications, Engineering, Management Services, and reporting for the three (3) ITFs, providing Inventory Control and Management services, Field Engineering Representatives (FERs) and Subject Matter Experts (SMEs).

To the greatest extent possible, the Government and the Contractor will work with the Enterprise Information Technology as a Service (EITaaS) organization within the Enterprise Services Branch (HNIT) who is responsible for defining and deploying the information technology framework tools and processes that will eventually support all DAF IT deployments. These tools and processes are part of a EITaaS Wave 1 effort that is currently under development and the CSS3 Contractor will be expected to utilize some or all of those tools and processes where applicable. Additional information on these tools and processes will be provided by GFI as it becomes available.

EITaaS is an DAF-wide initiative to leverage industry to provide standardized, innovative, and responsive IT services across the enterprise using worldwide commercial business services and best practices. The EITaaS initial focus is replacing the current DAF base level IT infrastructure with vendor deployed and sustained systems and services. The CSS3 focus will be on sustainment and technical refresh of existing base infrastructure IT equipment and other IT systems outside of the initial EITaaS objectives. It is an important objective of the Government that the EITaaS vendor-based systems and DAF deployed and sustained systems utilize a common set of information framework tools and processes where possible. The Government will assist the CSS3 Contractor in transitioning any legacy tools and processes to the new EITaaS tools and processes.

Applicable documents The Government reserves the right to provide the contractor with updated versions of any of the following Government Furnished Information (GFI) during the course of the contract.

Cyberspace Operations Security Classification Guide Contractor Verification System (CVS) request Change Proposal Form Form ID-0134 - Product Support Information Form Form ID-0014 - Asset Management Form (AMF) Form ID-0024 - Asset Management Procedures Program Protection Plan (PPP) Enterprise IT Service Management (EITSM) User Guides AFIN TO Framework and Supporting Documentation Customer Service Guide CLASS Inventory Control Guide AFNet Urgent Action Template AFLCMC AFNet HNIB to Lifecycle Management Process AFNet TO Title Page, Front Matter and Word Template AFNet Routine Action Template AFLCMC AFNet HNIB Time Compliance Technical Order (TCTO) Process AFLCMC AFNet HNIB TO Sustainment Process AFNet Record Template AFNet Supplement Template

Requirement 1 – Management The Contractor shall provide program management, as described within this section, for all aspects of this contract including all awarded options. The Contractor shall summarize the work performed, including any significant events/issues/accomplishments within a Monthly Status Report (MSR).

(Contract Data Requirement List (CDRL) A001: Monthly Status Report) Personnel Management The Contractor shall provide a minimum of one (1) full-time Program Manager (PM) and a minimum of one (1) full-time Deputy PM. The PM shall be an employee of the prime Contractor.

The PM shall be responsible for:

· Serving as the focal point for Government/Contractor management communications. If unavailable, the Deputy PM shall be the POC

· Ensuring host unit processes are followed across the various locations supported

· Managing DAF unit/Contractor relationships in coordination with the Government

· Ensuring appropriate manning to accomplish tasks and notify Program Management Office (PMO) in accordance with (IAW) this PWS The Contractor shall oversee and manage the personnel required to execute all requirements in this PWS. The Contractor shall ensure adequate number, type, and experience of personnel is available to execute all requirements in this PWS. The Contractor shall ensure personnel have a thorough understanding of AFIN applications and systems. Contractor personnel shall complete all initial and recurring training required to gain access to host-base facilities and information networks.

The Contractor shall provide the Government with a roster listing all personnel assigned to this contract.

Following a gap or notification of a gap in fulfilling a skill set, location requirement or tasking requirement due to personnel actions (i.e., employee turnover, employment notice, promotion, etc.), the Contractor shall notify the Government PM by way of email no later than one (1) business day of the Contractor becoming aware of the gap. The Contractor shall restore certification requirements within twenty (45) calendar days following the first day of the gap. The Contractor must maintain capability during the period of the gap.

Integrated Digital Environment (IDE) The contractor shall utilize a Government provided online IDE (currently SharePoint and Microsoft Teams) to host data generated or otherwise relevant in the performance of the CSS3 contract per the PWS. The contractor shall follow directed steps to obtain access to the Government IDE and follow all security regulations when operating within the IDE.

Organizational Breakdown Structure (OBS) The Contractor shall maintain the OBS that was submitted in the proposal within the Government IDE and upon changes to the OBS, the contractor shall update the Government at the next bi-weekly management meeting. The OBS shall depict a hierarchical team structure broken out by position and location. The OBS shall show lines of reporting internal to the Contractor’s team including from the program manager to his/her direct supervisor and communication points with organizations external to the Contactor’s team. The OBS shall include, at a minimum, the title, location, for the required positions included in the OBS. Each position (ex. Technical Order (TO) editor, ITF Manager, ARC technician, etc.) shall be correlated to the section(s) of the PWS that the position primarily supports (Technical Publications, ITF Administration, ARC, etc.)

Work Locations All on-site personnel shall follow current local Health Protection Condition (HPCON) onsite work policy. For task not at Hanscom, teleworking shall be authorized per the local unit teleworking policy.

Telework may be authorized on a full time, part time, or temporary basis in writing by the Government PM or COR. The Contractor shall provide all telework requests in writing to the PM or COR for approval, with copy to the PCO. Telework requests may be individual or for an entire requirement, location, or portion thereof.

Full time telework requests will not be authorized for the following requirements:

Requirement 2: ITF Requirement 2: Duplication Services Requirement 4: FERs

Table 1. Work Locations for Reqt 5

Hanscom AFB, MA

JB San Antonio -Lackland, TX

Maxwell AFB Gunter Annex, AL

Scott AFB, IL

Wright Patterson AFB, OH

Duty Hours and Dress Code Except where otherwise noted in a specific requirement, the Contractor’s personnel shall work a standard forty (40) hour duty week, eight (8) hours per day, five (5) days per week (Monday – Friday). Most work shall occur during the normal day shift, nominally 0700 – 1700 local time. The Contractor shall be authorized to work at alternate locations when traveling or when working on-call.

The Contractor’s personnel shall comply with local unit requirements regarding dress code.

The Contractor’s personnel shall comply in accordance with local duty hours and policy direction variations to these requirements and will be coordinated in advance.

The Contractor shall be able to support differing work shifts as required to support authorized service times and reduce impact of downtime to the DAF.

Hanscom AFB Duty Hours Hanscom normal duty hours are between 0700-1700 EST.

Enterprise IT Service Management (EITSM) Duty Hours The Contractor shall provide on-site EITSM support between 0700-1800 local time, Monday through Friday. The Contractor shall also provide on-call EITSM support (telephonic or on-site if required) on a twenty-four (24) hours per day, seven (7) days a week, every day of the year basis.

Emergency Mass Notification Service (EMNS) Duty Hours The contractor shall provide routine support to the assigned unit during the unit’s normal duty hours (typically 0730-1630 or 0800-1700 local time). The Contractor may be required to provide services outside of typical duty hours to support AF site specific requirements such as exercises or contingencies/emergencies.

Travel

The Contractor shall be required to travel to support equipment installs, attend training, support various meetings, or for other purposes authorized by the Program Manager (PM), Contracting Officer Representative (COR) or Procurement Contracting Officer (PCO) in support of this contract. The Contractor shall obtain pre-travel authorization by submitting estimated travel requirements using a Travel Authorization Request (TAR). The TAR is required in order for the Contractor to be reimbursed by the Government. Allowable travel costs are specifically covered at Federal Acquisition Regulation (FAR) 31.205-46. Travel costs not specifically covered at FAR 31.205-46 may be addressed on an as-needed basis. The Joint Travel Regulation (JTR) does not apply to contractors; however, may be used to aid the contracting officer in making individual decisions regarding travel rules. The Contractor shall travel using the lower cost mode transportation commensurate with the mission requirements. When necessary to use air travel, the Contractor shall use the tourist class, economy class, or similar accommodations to the extent they are available and commensurate with the mission requirements. Travel will be reimbursed on a cost reimbursable basis, no profit or fee will be paid. Travel costs shall be captured under the appropriate Travel Contract Line-Item Number (CLIN).

Minimum Skills, Experience, and Certifications (SEC) The Contractor shall provide personnel to fulfill the requirements of this Contract. The minimum required SECs per requirement are listed below. Should a SEC listed become obsolete as Hardware/Software (HW/SW) is replaced within the AFIN, the Contractor shall propose the change to the contact Program Manager.

The Contractor shall ensure personnel with the required SEC are available to execute all requirements in this PWS. The Contractor personnel shall complete all initial and recurring training required to gain access to host-based facilities and information networks.

A single individual may fulfill multiple SECs. Each individual fulfilling a requirement must have at least three (3) years relevant industry or Government experience for the requirement which they are fulfilling.

Upon PCO or COR approval, the Contractor shall request the use of a higher SEC to fulfill SEC requirements. The Contractor shall NOT rely on reach-back to corporate resources not assigned to this contract and located at the PWS designated locations to fulfill SEC requirements, but may use reach back as temporary surge support. The contractor shall maintain a current roster of employees along with current certifications/experience to fulfil contract requirements.

The contractor shall maintain copies of the applicable certificates listed below and provide them on the DAL for the Government to review as needed.

(CDRL A010: SEC Matrix)

NOTE:

· Unless specified otherwise, every individual is NOT required to have each and every SEC listed

· SECs for TDC only primarily applies to Tech Pubs, ITF and/or Duplication service tasks

Listing of Minimum SECs

All except Tech writers

All except Tech writers

· iDirect Satellite Modem

· Joint IP Modem

· Viasat EBEM Modem 1+

· TACLANES KG-175D

· KG-250 Encryptors

· KIV-7M Encryptors

· SecNet 54’s 1+

· Acme Packet Edge Boundary Controller Appliance

· Analog VoIP Telephony Gateways

· Voice Compression and management software

· REDCOM LSCs

· Sectéra Wireline Terminal (SWT) 1+

· Cambium radios

· Omni-directional antennass

· Flat Panel Antennas

· 10 & 15 Meter masts

· WDM ProximVision

· Fluke Networks Air Magnet WiFi Analyzer w/Air Magnet WLAN Design & Analysis Suite Software 1+

All

• Getting Started with BIG-IP: Part 1 – Administration

• Getting Started with BIG-IP: Part 2 – Application Delivery

• Getting Started with Local Traffic Manager: Part 1 – HA and Traffic Processing

• Getting Started with Local Traffic Manager: Part 2 – iRules and Accelerating Traffic

• Getting Started with BIG-IP DNS 1+

5j: SME (S&V-General)

5j: SME (S&V-General)

5j: SME (S&V-General)

5j: SME (S&V-General)

5j: SME (S&V-General) Certified to Information Assurance (IA) Technician (IAT) Level II (DODM 8140)

All

5j: SME (S&V-General)

5j: SME (S&V-General)

5j: SME (S&V-General)

5j: SME (S&V-General)

• The ability to implement high-availability controller configurations.

• Detailed knowledge of technologies such as Recover Point which is used to manage and protect mission-critical data.

2+

5j: SME

(S&V-OEM)

5j: SME

(S&V-OEM)

5j: SME

(S&V-OEM)

Expert level skills required to install, configure, and administer a CommCell® environment. Expert level skillset in all of the following areas:

CommCell Administration – user and group security, configuring administrative tasks, conducting data protection and recovery operations, and CommCell monitoring.

Storage Administration – deduplication configuration, disk library settings, media management handling, and snapshot administration.

CommCell Implementation – CommServe® server design, MediaAgent design and placement, indexing settings, client and agent deployment, and CommCell maintenance.

Disaster Recovery –Expertise in risk reduction, Hot/Warm site Disaster Recovery architecture, high availability, planning for disaster situations, and CommCell environment rebuild procedures.

Virtualization – Expertise in protecting and managing virtual environments using the Simpana Virtual Server Agent, application agents, hardware snapshots, Virtualize Me and VM lifecycle policies.

1+

5j: SME

(S&V-OEM)

5j: SME

(S&V-OEM)

DoD 8140-01-M Certification Requirement The IA Certification Requirements DoD 8140-01-M “Information Assurance Workforce Improvement Program” identifies specific training and certifications required for personnel working on Information Technology (IT) programs within the DoD. The Contractor shall ensure personnel requiring privileged access to certain DoD systems shall conform with the requirements of DOD 8140-01-M for those systems. The Contractor shall ensure all personnel working on this Contract comply with all certifications, evaluation, training, background investigation and experience requirements of DoD 8140-01-M. The Contractor shall ensure all personnel meet IA Baseline Certification Requirements, within forty-five (45) business days of assuming any duties involving Government information systems.

Hands-on Refresher Training Upon PCO or COR approval of travel, the Contractor shall coordinate with AFLCMC/HNIB to determine if there is an opportunity for hands-on refresher training. If a hands-on training opportunity is available at a location where an existing trip is occurring, the Contractor shall modify their trip as approved by the Government PM to allow training on current and/or upcoming AFIN equipment. Training will concentrate on increasing personnel proficiency to troubleshoot AFIN equipment.

PMO Recommended Training and Conferences Additional training and conference events will be recommended to the Contractor at the Government’s discretion. If a training or conference event is approved by the PCO or COR, the Contractor shall attend and charge to the contract. An abbreviated trip report including the agenda shall be provided as part of the MSR.

(CDRL A001: Monthly Status Report) Manpower Reporting The Contractor shall report ALL contractor labor hours for all labor hour and cost CLINs (including subcontractor labor hours) required for performance of services provided under this contract via a secure data collection site. The Contractor shall fill in all required data fields using the following web address: http://www.sam.gov consistent with existing service contract reporting requirements under the FAR. Reporting inputs will be for the labor executed during the period of performance during each Government fiscal year (FY), which runs 1 October through 30 September. While inputs may be reported any time during the FY, all data shall be reported no later than 31 October of each calendar year beginning with award of this contract.

Security Clearances The Contractor shall ensure all personnel on this contract requiring access to evaluate, modify, change or touch AFIN systems have a valid and current SECRET (or higher) security clearance.

· FER Contractor personnel who perform tasks at Joint Base San Antonio - Lackland, TX and Peterson AFB, CO shall possess, at a minimum, a valid TOP SECRET/Single-Scope Background Investigation (SSBI) security clearance and be eligible for SCI (Sensitive Compartmentalized Information) access.

· SME Contractor personnel who perform tasks at, or in support of the 624 Operations Center (OC) at Joint Base San Antonio (JBSA) - Lackland, TX shall possess, at a minimum, a current and valid NATO SECRET clearance, TOP SECRET/ Single-Scope Background Investigation (SSBI) security clearance, favorably adjudicated for SCI eligibility access.

· SME Contractor personnel who perform tasks at, Joint Base San Antonio (JBSA) - Lackland, TX shall possess, at a minimum, a valid and current Secret clearance and/or up to a current and valid NATO SECRET clearance, TOP SECRET/ Single-Scope Background Investigation (SSBI) security clearance, favorably adjudicated for SCI eligibility access, as determined/designated by the 690 COG/CC for performance of assigned duties. 8 Contractor personnel may require access to DAF NIPRnet, SIPRnet, etc. in order to execute their responsibilities in the performance of this contract. Contractor personnel located in Europe shall follow Technical Expert Status Accreditation (TESA) security guidelines.

Security Management Requirements DD Form 254 The Contractor shall comply with the security requirements specified in the Contractor’s DD Form 254, Contract Security Classification Specification. The Contractor shall flow down the security requirements to subcontractors as applicable.

Operations Security (OPSEC) The contractor shall ensure OPSEC is incorporated into the appropriate area of the contract IAW DoD Directive 5205.02E, DoD Operations Security (OPSEC) Program and AFI 10-701 Air Force OPSEC Program. The Contractor shall flow down all OPSEC requirements to subcontractors that handle Critical Information (CI). CI is defined as specific facts about friendly intentions, capabilities, or activities needed by adversaries to plan and act effectively against friendly mission accomplishment.

Controlled Unclassified Information (CUI) The contractor shall comply with DoDI 5200.48_DAFI16-1403, Controlled Unclassified Information, DoDM 5200.01, Vol 1_AFMAN16-1404, Vol 1, Air Force Information Security Program, and DoDM 5400.07_AFMAN33-302 Air Force Manual, DoD Freedom of Information Act (FOIA) Program. The contractor shall monitor CUI aggregation and compilation based on the potential to generate classified information pursuant to security classification guidance addressing the accumulation of unclassified data or information.

The Contractor shall distribute controlled unclassified information IAW DoD Instruction 3200.14, Principles and Operational Parameters of the DoD Scientific and Technical Information Program, and DoD Instruction 2040.02, International Transfer of Technology, Articles, and Services. The Contractor shall properly mark all such documents IAW DoD Instruction 5230.24, Distribution Statements on Technical Documents. Technical documents not subject to distribution are defined in DoD Instruction 5230.24, DoD Directive 5230.25, and DoD Manual 5010.12-M, Procedures for the Acquisition and Management of Technical Data.

Protection of Information Controlled Unclassified Information (CUI) [Required if Contractor requires access to CUI] Controlled Unclassified Information is any information that law, regulation, or government wide policy requires to have safeguarding or disseminating controls, excluding information that is classified under Executive Order 13526, Classified National Security Information, December 29, 2009, or any predecessor or successor order, or the Atomic Energy Act of 1954, as amended.

The National Archives and Records Administration (NARA) CUI Registry (http://www.archives.gov/cui/registry/category-list.html) identifies approved CUI categories and subcategories, provides general descriptions for each, identifies the basis for controls, and sets out procedures for the use of CUI.

The contractor shall comply with DoDI 5200.48_DAFI16-1403, Controlled Unclassified Information, and DAFMAN 16-1404 Vol 1-3 Air Force Information Security Program. The contractor will consult the applicable security classification guide to monitor CUI aggregation for potentially generating classified information by compilation.

The Contractor shall comply with DODM 5400.07_AFMAN 33-302, DoD Freedom of Information Act (FOIA) Program, requirements.

Protection of CUI and unclassified DoD information not approved for public release on non-DoD Information Systems will be protected IAW DoDI 8582.01, Security of Non-DoD Information Systems Processing Unclassified Nonpublic DoD Information. Unless specific categories of CUI require more stringent controls, non-DoD Information Systems must be protected using the guidelines set forth in NIST Special Publication 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations.

Covered Defense Information [Required for all solicitations and contracts, including solicitations and contracts using FAR part 12 procedures for the acquisition of commercial items].

The Contractor shall comply with DFARS 252.204-7012 Safeguard Covered Defense Information and Cyber Incident Reporting (Dec 2019) This subpart applies to contracts and subcontracts requiring contractors and subcontractors to safeguard covered defense information that resides in or transits through covered contractor information systems by applying specified network security controls. It also requires reporting of cyber incidents. The subpart does not abrogate any existing contractor physical, personnel, or general administrative security operations governing the protection of unclassified DoD information, nor does it impact requirements of the National Industrial Security Program.

Personnel Security The Contractor shall ensure applicable Contractor personnel have security clearances at the appropriate level for proper accomplishment of contract/order requirements. The security clearance shall be obtained in accordance with the DD Form 254, Department of Defense Contract Security Classification Specification. Contractor personnel whose clearances have been suspended or revoked shall immediately be denied access to classified information and/or CUI and classified items.

Security Incidents and Violations The Contractor shall notify the Government Contracting Activity and the Government Security Manager within 48 hours of any incident involving the actual or suspected compromise/loss of classified information to enable the Government to conduct immediate assessments of potential impact pending formal inquiry/investigation. Actual or suspected compromise of Covered Defense Information will be reported IAW DFARS Clause 252.204-7012.

DoD Identification / Common Access Card (CAC) The Contractor shall ensure a CAC is obtained by all contractor/subcontractor personnel who require access to DoD computer networks/systems, for DoD facility entry control and/or for physical access to facilities and buildings to perform tasks under the contract/order. The Contractor shall provide a list of contractor/subcontractor personnel who require a CAC to the PCO. The Government will provide the Contractor instruction on how to complete a Contractor Verification System (CVS) application and notify the Contractor of approval/disapproval of contractor/subcontractor personnel application. Contractor/subcontractor personnel shall obtain the CAC from the local Real Time Automated Personnel Identification Documentation System (RAPIDS) issuing facility [usually the Military Personnel Flight (MPF)].

The Contractor shall immediately report a lost or stolen CAC as directed by local Government policy. The Contractor shall notify the PCO of any change to the list of contractor/subcontractor personnel who require a CAC and provide an updated list within five business days. The Contractor shall return a CAC within five business days once contractor/subcontractor personnel no longer require computer network/system access and/or facility access. The Contractor shall return an expired CAC within five business days after the expiration date. The Contractor shall return all CACs within five business days after completion/termination of the contract as directed by local Government policy.

Theatre/Country Clearances The Contractor shall obtain special theatre and/or country clearances and comply with theater/country specific requirements for applicable outside continental U.S. work. The DoD 4500.54-E and DoD Foreign Clearance Guide states the requirements for travel to specific countries.

Prior to deploying to OCONUS locations, the contractor shall perform proper due diligence to determine entry requirements and assume that work visas may not be obtained with appropriate timeliness and may require personnel rotation.

Passports, Visas, Licenses, And Permits The Contractor shall be responsible for timely and complete submittal of the necessary information and forms directly to the appropriate Government Agency for the required passports, visas, licenses, and permits. The Contractor shall be responsible for the sponsorship of its employees and their dependents and shall process said permits directly through the appropriate Government Agency.

Visit Requests The Contractor shall be subject to all DoD rules and regulations while working on or visiting a military installation. After obtaining Government PM or COR travel approval, the Contractor shall prepare and send visit request(s) via Defense Information System for Security (DISS) to the Security Management Office (SMO) point of contact for the intended visit location. When submitting a visit request the Contractor shall allow seven (7) working days for the site to obtain COR approval of the visit request.

Non-Disclosure Agreements The Contractor shall ensure all employees working on this contract, both the Prime and Subcontractors, sign a Non-Disclosure Agreement (NDA) prior to starting work. The Contractor shall renew all NDAs annually. The Contractor shall make available copies of signed NDAs to the PCO, should the PCO request them.

Foreign Ownership, Control, or Influence (FOCI) Foreign participation is excluded at the Prime and Subcontractor level, unless authorized through a current approved National Interest Determination.

The Contractor shall disclose any FOCI for the purpose of initial or continued facility clearance eligibility. A Standard Form 328 Certificate Pertaining to Foreign Interests shall be submitted to the Government cognizant security office specified in DD Form 254.

Scientific and Technical Information The Government requires all documents that include Scientific and Technical Information (STINFO) be properly marked IAW the latest versions of DoD Directive 5230.24 and AFI 61-201 prior to initial coordination or final delivery. Failure to mark deliverables as instructed by the Government will result in non-compliance and non-acceptance of the deliverable. The Contractor shall include the proper markings on any deliverable deemed STINFO regardless of media type, stage of completeness, or method of distribution. Therefore, even draft documents containing STINFO and STINFO sent via e-mail require correct markings.

STINFO distribution statements shall contain all four required components: Authorized audience, reason for restriction, date of determination and identity of the controlling DoD office. A destruction notice and, when applicable, an export control notice shall be attached to all distribution statements. See the figures below for sample distribution statements and destruction markings. Refer to Figure 1 and Figure 2.

Figure 1. STINFO Distribution Statement

DISTRIBUTION STATEMENT C: Distribution authorized to U.S. Government agencies and their contractors; administrative/operational use; requirement Other requests shall be referred to AFLCMC/HNIB, Hanscom AFB, MA 01731.

DESTRUCTION NOTICE: Destroy by any method that will prevent disclosure of contents or reconstruction of the document.

Figure 2. Example Distribution Statement and Destruction Notice Financial Management The Contractor shall track all funds for this Contract to ensure that the funded ceilings are not exceeded. The Contractor shall notify the PCO, via a contracts letter, when the limitation of cost threshold has been met (i.e., a specific Cost or Labor Hour CLIN is expected to reach a seventy-five percent (75%) expenditure status within the next sixty (60) days) IAW Federal Acquisition Regulation (FAR) 52.232-22 Limitation of Funds clause. The Contractor shall include an estimated date when the CLIN will reach 100% expenditure. The Contractor shall provide the financial summary in the MSR.

(CDRL A001: Monthly Status Report) Risk Management The Contractor shall implement a risk management approach and tools to identify, track, and mitigate cost, schedule, and performance risks., The Contractor shall include pre and post mitigation rankings for probability of occurrence and consequence. The Contractor shall document the risks within the Monthly Risk Report. The contractor shall host a monthly Risk Board to review the ongoing risks and the recently closed. The contractor shall create a risk report using the government designated framework to be submitted for the Risk Report.

The Contractor’s risk report presentation, at a minimum, shall:

· Identify and mitigate cost, schedule and performance risks using Air Force Instruction (AFI) 63-101, Acquisition and Sustainment Life Cycle Management as guidance.

· Include risk and post mitigation ranking for probability of occurrence and consequence.

· Incorporate risk mitigation strategies into program planning and technical activities.

(CDRL A001: Monthly Risk Report) Process Management The Contractor shall document, implement and maintain processes to ensure standardization of work performed. The contractor shall work with the Government to define what processes require documentation, with the expectation that all significant repetitive tasks will be required, as example; incident remediation, procurements, TO and TCTO writing and edits. The Contractor shall work with the Government to ensure that their internal processes are consistent with HNI processes and the PWS requirements. The Contractor shall complete drafts ready for Government review within six months of direction from the Government Sustainment PM and complete edits as directed before the end of the base period. The Contractor shall work with the Government to improve their processes throughout the contract. The Contractor shall post all process documentation to the IDE.

Contractor Quality Assurance Plan (QAP) The Contractor shall prepare and deliver a QAP. The QAP shall detail the Contractor’s processes for ensuring quality services and products provided under this contract. It shall describe the Contractor’s quality assessment and monitoring of subcontractors or suppliers in accordance with contract requirements. It shall describe the processes and systems in place to ensure quality performance of contractor and subcontractor(s) on all inspections and tests. It shall also describe how these processes will be leveraged against the Service Delivery Summary in Section 10 of the PWS.

(CDRL A013: QAP)

Meetings and Communication The Contractor shall initiate, organize, and participate in meetings, to include but not limited to the meetings listed below, whenever necessary to accomplish the tasks of this Contract or in support of reporting requirements to the Government. The Contractor shall keep the HNIB Sustainment PM informed of relevant plans or changes, disseminate knowledge of tasks to be done, and provide situational awareness. A meeting agenda, post meeting summary and all action items shall be tracked by the Contractor and documented as directed by the government. Action items shall include specifics on the action required, person responsible for the action, and the due date for completion of the action.

One Time Meeting The Contractor shall plan and chair a program kickoff meeting at Hanscom AFB, unless pre-coordinated elsewhere, between fifteen (15) and twenty (20) calendar days of contract period of performance start date at a time and date approved by the Government PM. The program kickoff shall be hosted on DAF Teams The Contractor shall conduct Program Management Reviews (PMRs) biannually (twice per calendar year) for all requirements in this contract at Hanscom AFB; unless directed otherwise by the PCO or COR. At the discretion of the PCO or COR, two additional PMR’s shall be conducted virtually or at Hanscom AFB. PMR time, date, location and agenda shall be coordinated with and approved by the Government PM. The Contractor shall include identified program risks and risk management/mitigation strategies for those risks in each PMR agenda.

The Contractor shall coordinate draft briefing slides/agenda with the Government PM ten business days in advance of the event. The Contractor shall provide Kickoff and PMR briefing slides/agenda and meeting minutes in the government IDE.

Monthly Meetings The Contractor shall plan and chair a monthly Incident Review Panel (IRP) to review a subset (up to 100%) of incidents for service desk process and performance review as well as to provide HNIB situational awareness.