CTAS PWS RQMT-21677 31AUG26 - Wood Update.docx

PERFORMANCE WORK STATEMENT (PWS)

FOR

Malign Influence Actors and Malicious Cyber Threat & Analysis Services (CTAS)

16 Air Force (AF)/Joint Force Headquarters-Cyber (JFHQ-C)

12 August 2026

1 DESCRIPTION OF SERVICES.

1.1 Introduction.

This is a non-personal services contract. The Government will neither supervise contractor employees nor control the method by which the contractor performs the required tasks. The contractor shall manage its employees and guard against any actions that are of the nature of personal services or give the perception of personal services. The contractor shall notify the Contracting Officer (CO) immediately if they perceive any actions constitute personal services. These services shall not be used to perform any Inherently Governmental Functions.

1.2 Background.

16 AF/JFHQ-C AF A39, assigned cyber forces, and other staff elements require open-source investigative products to identify malign influence/malicious cyber actors and attribute their actions back to the country and organization who sponsors them. Foreign Malign Influence (FMI) operations/cyber actors remain a critical threat to the United States (US) democratic pillars and institutions including influencing how we vote, choose our leaders, and use news and information online to make decisions, and pose a fundamental threat to US national security. Malign influence/cyber actors operate openly on the internet, using social media, news sites, and other publicly available capabilities to push propaganda and mis/disinformation. To combat these actors, JFHQ-C AF entities need the ability to identify and investigate the organizations that are behind these influence campaigns. This requires investigative research skills, significant experience in using a variety of social media platforms to collect data from, and native language skills to acquire, translate, and provide context to information gathered.

1.3 Scope.

1.3.1 Development of an intelligence-driven enterprise that integrates advanced Artificial Intelligence (AI) capabilities and data analytics to equip 16 AF/JFHQ-C and its mission partners with strategies to counteract peer adversaries and their ever-evolving tactics and techniques.

1.3.2 Analysis solution fluent in multiple languages that can analyze both cyber and influence threats across traditional and future social media platforms arising from global threat actors. In following with the 2026 National Defense Strategy, key regional languages should include, but not be limited to, Latin America - Spanish / Portuguese, China – Mandarin / Cantonese, Europe – Russian / Ukrainian, Persian Gulf - Persian / Farsi / Arabic, and Korean Peninsula – Pyojuneo / Munhwao.

1.3.3 Comprehensive intelligence service that combines advanced AI capabilities, data science, and insights into digital influence-related threats.

1.3.4 Tailored reports, briefings, and training sessions to customer. Publish articles, editorials and other materials in support of 16 AF/JFHQ-C mission areas.

1.4 Period of Performance.

The period of performance shall be for one (1) Base Year of 12 months and four (4) 12-month option years.

2 SPECIFIC TASKS.

The contractor shall be responsible for providing the following services:

2.1 Initial Assessment

2.1.1 The contractor shall establish the baseline for influence-focused research and analysis, coordinate product delivery mechanisms and any collaboration requirements (Contract Data Requirements List (CDRL) A002).

2.1.2 The contractor shall set conditions to begin work illuminating adversarial influence and propaganda within established global regions (CDRL A002).

2.1.3 The contractor shall include specific geographic locations, languages, traditional and social media platforms, named actors, organizations or networks which may be refined throughout the period of performance (PoP) (CDRL A002).

2.2 Data Collection

2.2.1 The contractor shall collect publicly available information through a combination of human and automated resources for integration (CDRL A002).

2.2.2 The contractor shall ensure the data is integrated within a data model which leverages relevant AI and data science methods (CDRL A002).

2.3 Implementation & Analysis

2.3.1 The contractor shall leverage AI-driven capabilities to monitor foreign influence campaigns (CDRL A002).

2.3.2 The contractor shall provide insight to 16 AF/JFHQ-C on evolving tactics, techniques, and procedures used by adversarial actors through established workflows (CDRL A002).

2.3.3 The contractor shall provide applications focused on propaganda-related digital content creation and consumption patterns within a specified region (CDRL A002).

2.3.4 The contractor shall analyze and triage data through investigation and sound judgement (CDRL A002).

2.4 Delivery

2.4.1 The contractor shall provide thirty (30) intelligence-focused UNCLASSIFIED reports detailing FMI operations and their impact on political, economic, military, and social landscapes. Support will focus on enduring monthly support to 3x planning teams for a period of 5 months with a summary of activities during the 6th month in concurrence with the quarterly briefing, repeating semiannually (i.e. JAN-JUN / JUL-DEC). (CDRL A002).

2.4.2 The contractor shall provide quarterly intelligence briefings on significant influence activities and/or actors observed during the previous three (3) months. These briefings will be conducted in person at up to Top Secret/Sensitive Compartmented Information (TS/SCI) level within the 16AF / A39 Sensitive Compartmented Information Facility (SCIF) spaces (CDRL A002).

2.4.3 The contractor shall conduct a monthly engagement to help identify information gaps and provide recommendations to better support 16 AF/JFHQ-C and its mission partners These briefings will be conducted in person at up to TS/SCI level within the 16AF / A39 SCIF spaces or via secure conferencing system at the governments discretion (CDRL A005).

2.4.4 The contractor shall develop and conduct in-person FMI Analysis training tailored to 16 AF/JFHQ-C up to TS/SCI level within the 16AF / A39 SCIF or other appropriate facility at the governments discretion (CDRL A002).

2.4.5 The contractor shall provide follow-up customer support to address one (1) request for information (RFIs) monthly (CDRL A002).

3 SERVICES SUMMARY (SS).

3.1. Service Requirements.

3.1.1 The contract service requirements are summarized in performance objectives that relate directly to mission essential services. The performance threshold briefly describes the minimally acceptable levels of service required for each requirement. The SS provides information on contract requirements and the expected level of contractor performance to be successful. These thresholds are critical to mission success. Procedures as set forth in the applicable Inspection clause in the contract will be used to remedy all deficiencies. The Government retains the right to inspect any item included in the contract.

SS # 1

The contractor shall provide CDRL Deliverables 2 (All), 5.1.4, 5.1.5, 5.2.3, 6 (All)

SS # 2

Compliance with organizational guidance, policies, and procedures.

SS # 3

The contractor shall efficiently perform all PWS requirements, including timely and accurate documentation, reports and responses for customer support and assistance. The contractor shall maintain a professional business appearance and correspondence.

2 (All), 5.1.4, 5.1.5, 5.2.3, 6 (All)

100% compliance required on final products.

100% Surveillance

SS #4

The contractor shall support all identified travel requirements based on deliverables.

2. 100% compliance on required trip reports.

100% Surveillance

SS # 5

Compliance with Security Requirements.

100% Surveillance

3.2 Quality Assurance Surveillance Plan (QASP).

3.2.1. The SS items will be used as the baseline to develop a Government QASP. The QASP will identify the audit methods/procedures the Government will use to evaluate the contractor's performance.

4 GOVERNMENT FURNISHED SUPPLIES AND SERVICES.

4.1 Services.

The Government will provide the necessary services for the contractor staff to provide the support outlined in the PWS.

4.2 Facilities.

The Government will provide the necessary workspace for the contractor staff to provide the support outlined in the PWS to include desk space, telephones, computers, and other items necessary to maintain an office environment.

4.3 Utilities.

The Government will provide or make available the necessary utilities in the facility for the contractor’s use in performance of tasks outlined in this PWS.

4.4 Equipment.

The Government will provide phones, desks, personal computers, software and video teleconferencing hardware/software.

4.5 Materials.

The Government will provide or make available Standard Operating Procedures and Policies and standard office supplies.

5 SPECIAL REQUIREMENTS/INSTRUCTIONS.

5.1 Contractor Identification in the Government Workplace.

5.1.1 All contractor personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public or Congress that they are Government officials, unless, in the judgment of the agency, no harm can come from failing to identify themselves. They must also ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed. The contractor shall identify themselves on any attendance sheet or any coordination documents they may review. Electronic mail signature blocks shall identify their company affiliation.

5.1.2 All contractor personnel shall be required to wear AF-approved or provided picture identification badges so as to distinguish themselves from Government employees. The contractor shall ensure all employees properly display and wear ID badges at all times during duty performance on a government facility. The contractor shall ensure that contractor personnel comply with base policy regarding badge requirements as directed. All contractor personnel are required to wear or prominently display ID badges at all times while visiting or performing work at any Government facility or installation when performing work under this PWS. The contractor shall observe and comply with all Government and site-specific security provision in effect during the contract period of performance.

5.2 Industrial Security.

5.2.1 Visitor Group Security Agreement. The contractor shall sign a Contractor Visitor Group Security Agreement to protect classified information involved in performance under this PWS. The Agreement shall outline responsibilities in the following areas: Contractor security supervision, Standard Practice Procedures, access, accountability, storage, and transmission of classified material, marking requirements, security education, personnel security clearances, reports, security checks, security guidance, emergency protection, protection of government resources, DD Form 254, periodic security reviews, and other responsibilities, as required.

5.2.2 The following devices are not allowed in facilities where classified information is electronically stored, discussed, briefed, processed or transmitted: cell phones, camera cell phones, cordless telephones, wireless microphones, wireless keyboards, wireless mice, wireless or infrared Local Area Networks (LANs). The term “Area” above refers to a room and/or to a space the size of a 3-meter radius sphere, centering on the classified source. All other Personal Electronic Devices (PEDs) not specifically addressed above, such as Fitbit, pens with built-in drives, cameras, etc., that are used for storing, processing, and/or transmitting information shall not be operated in areas where classified information is electronically stored, discussed, briefed, processed or transmitted.

5.3 Physical Security.

The contractor shall safeguard all Government property provided for contractor use. At the close of each work period, Government facilities, property, and materials shall be secured. All Government furnished property/equipment (including badges, tokens, etc.) shall be returned to the COR upon employee or contract termination.

5.3.1 Key Control. The contractor shall establish and implement methods of ensuring that all keys and key cards issued to the contractor by the Government are not lost or misplaced and are not used by unauthorized persons.

5.3.1.1 The contractor shall immediately report the occurrences of a lost or duplicate key to the COR.

5.3.1.2 In the event keys, other than master keys, are lost or duplicated, the contractor shall, upon written direction of the CO, rekey or replace the affected lock or locks; however, the Government, at its option, may replace the affected lock or locks or perform rekeying. When the replacement of locks or rekeying is performed by the Government, the total cost of rekeying or the replacement of the lock or locks shall be deducted from the monthly payment due the contractor. In the event a master key is lost or duplicated, all locks and keys for that system will be replaced by the Government and the total cost shall be deducted from the monthly payment due the contractor.

5.3.1.3 The contractor shall prohibit the use of keys issued by the Government by any persons other than the contractor’s employees. The contractor shall prohibit the opening of locked areas by contractor employees to permit entrance of persons other than contractor’s employees engaged in the performance of assigned work in those areas, or personnel authorized entrance by the COR.

5.3.2 Combinations and Codes. The contractor shall establish and implement methods of ensuring that all combinations and codes are not revealed to unauthorized persons. The contractor shall ensure that lock combinations are changed when personnel having access to the combinations no longer have a need to know such combinations.

5.3.2.1 Access lock combinations are “For Official Use Only” and shall be protected from unauthorized personnel.

5.3.2.2 Combinations to security containers, secure rooms, or vaults are classified information and shall properly safeguarded. Only the contractor employees with proper security clearance and need-to-know will be given combinations to security containers, secure rooms, or vaults.

5.3.2.3 Security alarm access codes are “For Official Use Only” and shall be protected from unauthorized personnel. Security alarm access codes will be given to contractor employees who require entry into areas with security alarms. The contractor shall properly safeguard alarm access codes to prevent unauthorized disclosure.

5.4 Privacy Act.

Work on this contract requires the contractor to have access to Privacy Information. The contractor shall adhere to the Privacy Act, Title 5 of the US Code, Section 552a and applicable Agency rules and regulations.

5.5 Location(s) of Work.

The work to be performed under this contract shall be performed at locations where eligible members are located. If required, the work may iteratively be performed at any/all facilities under current or future control of 16th AF in the Joint Base San Antonio (JBSA) geographical area.

5.6 Hours of Operation.

5.6.1 Normal workdays are Monday through Friday except US Federal Holidays. Workers typically work eight (8) hours per day, 40 hours per week. Flextime workers start not earlier than 0600 and not later than 0900. Core hours of work are from 0900 to 1500 daily, Central Standard Time (CST). All employees are expected to be available during core duty hours. The contractor shall be notified in advance of any event requiring additional support beyond the normal eight-hour day. Special circumstances may require the extension of normal duty hours. Prior coordination with the Government is required if contractor requires access to the secure facility during non-standard work hours.

5.6.2 Recognized Holidays. The contractor is not required to provide service on the following days:

Independence Day

5.6.2.1 If the holiday falls on Saturday, it is observed on Friday. If the holiday falls on a Sunday, it is observed on Monday.

5.6.2.2 The contractor shall not report for duty and will not be reimbursed by the Government when the Government facility is closed due to a Federal holiday, local or national emergencies, administrative closings, or similar Government directed facility closings.

5.7 Conservation of Utilities.

The contractor shall operate under conditions which prevent the waste of utilities which include the following:

5.7.1 Lights shall be used only in areas where and when work is actually being performed.

5.7.2 Mechanical equipment controls for heating, ventilation, and air conditioning systems shall not be adjusted by the contractor unless authorized.

5.7.3 Water faucets or valves shall be turned off after the required use has been accomplished.

5.7.4 Government telephones shall be used only for official Government business.

5.8 Records.

The contractor shall create, maintain and dispose of only those Government required records that are specifically cited in this PWS. If requested by the Government, the contractor shall provide the original record, or a reproducible copy of any such record within five (5) workdays of receipt of the request.

5.9 Contractor Manpower Data Reporting.

5.9.1 Effective FY2020, the Department of Defense will no longer require contractors to report into the Enterprise-wide Contractor Reporting Application (eCMRA). IAW DFARS clause 252.204-7023, Reporting Requirements for Contracted Services, contractors shall begin reporting manpower data relating to the performance of services contracts into the System for Award Management (www.sam.gov).

5.9.2 The following contracts are subject to Service Contract Reporting (SCR): Any purchase of services by a military department or Defense Agency, in excess of $3 Million, for services in the following Service Acquisition Portfolios:

5.9.2.1 Logistics management services;

5.9.2.2 Equipment related services;

5.9.2.3 Knowledge-based services;

5.9.2.4 Electronics & comms services.

5.9.3 SAM receives contract information from FPDS-NG. It will only enable reporting for entities with contracts that meet the above stated SCR thresholds.

5.9.4 Contractor shall be an entity registered in SAM, an individual SAM user account with the Entity Administrator, Entity Registration Representative, or Reporter role for that entity, and one or more contracts awarded to that entity which meet the SCR reporting thresholds.

5.9.5 Steps for Submitting a Service Contract Report (SCR).

5.9.5.1 Go to www.sam.gov and log in.

5.9.5.2 Select Entity Registrations and then select Service Contract Reporting.

5.9.5.3 SAM displays your entities which have service contracts and meet the reporting criteria. Select View by entity to see the service contracts for each entity.

5.9.5.4 Next, select Add for the service contract against which you want to create a Service Contract Report. Each service contract which meets the FAR Subpart 4.1703 reporting thresholds is displayed.

5.9.5.5 Next, the Complete Service Contract Report page will be displayed. SAM displays the contract details and allows you to report. Contractor is required to enter the following information:

5.9.5.5.1 Total Amount Invoiced: Total dollar amount invoiced for services performed during the previous Government fiscal year under the contract (this amount should include the prime and any subcontract amount).

5.9.5.5.2 Prime Contractor Hours Expended: Prime contractor direct labor hours expended on the services performed during the previous Government fiscal year. The amount you enter is automatically divided by 2080 hours to calculate a Full Time Employee (FTE) equivalent, displayed under the Prime Contractor Hours Expended as Prime Contractor FTEs.

5.9.5.6 Report any required Tier 1 subcontractor information by selecting the Add Tier 1 Subcontract Information button.

5.9.5.7 When you are ready to submit the report, select Submit. This saves your report and returns you to the Select Service Contract page where you can create other SCRs or edit an existing SCR.

5.9.6 Annual Reporting. Reporting inputs will be for the direct labor executed during the period of performance (PoP) for each Government fiscal year (FY), which runs 1 October through 30 September. While inputs may be reported any time during the FY, all data shall be reported no later than 31 October of each calendar year. The contractor shall provide reporting inputs for the final PoP of this contract no later than 30 calendar days after contract expiration. The contractor may direct technical questions about the SAM Service Contract Reporting tool to the Federal Service Desk FSD at https://www.fsd.gov/fsd-gov/home.do

5.10 Environmental Controls.

5.10.1 Compliance with Laws and Regulations. The contractor shall be knowledgeable of and comply with all applicable Interstate, Federal, State, and Local laws, regulations, and requirements regarding environmental protection. In the event environmental laws or regulations change during the term of this contract, the contractor shall comply as such laws come into effect. If there is an increase or decrease in cost as a result of the change, the contractor shall inform the CO pursuant to notice requirements and negotiate a modification to the contract.

5.10.2 Notification of Environmental Spills. If the contractor spills or releases any substance contained in 40 CFR 302 into the environment, the contractor shall immediately report the incident to the COR. The liability for the spill or release of such substances rests solely with the contractor.

5.11 Safety Requirements (If Applicable).

In performing work under this contract, the contractor shall:

5.11.1 Conform to the safety requirements contained in the contract for all activities related to the accomplishment of the work.

5.11.2 Take such additional immediate precautions as the CO may reasonably require for safety and mishap prevention purposes.

5.11.3 Record and report promptly (within one hour) to the CO or COR, all available facts relating to each instance of damage to Government property or injury to either contractor or Government personnel.

5.11.4 In the event of an accident/mishap, take reasonable and prudent action to establish control of the accident/mishap scene, prevent further damage to persons or property, and preserve evidence until released by the accident/mishap investigative authority through the CO.

5.11.5 If the Government elects to conduct an investigation of the accident/mishap, the contractor shall cooperate fully and support Government personnel conducting the investigation.

5.12 Contractor Personnel Training.

The Contractor shall accomplish training requirements as required by the Government. In order to work in a secure Government facility, certain training is required to provide information for personnel well-being. This includes several and various security, safety, and procedural online courses. The Contractor shall complete any agency-mandated in-house training requirements for all personnel. Government training requirements include security, safety, emergency management, and IA. Training shall be completed as required by 16 AF training procedures. No Contractor personnel shall be more than thirty (30) days overdue on any required training item.

5.13 Special Training, Certifications and Qualifications.

N/A

5.14 Kick-off Meeting and Periodic Progress Meetings.

The contractor shall attend an initial kick-off meeting 14 days after contract award. The CO, COR, and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor's performance. At these meetings the CO will apprise the contractor of how the Government views the contractor's performance and the contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. The contractor shall provide minutes of these meetings to the Government. (CDRL A003).

5.15 Contractor Travel.

5.15.1. The contractor shall be required to travel to other Government facilities during the performance of this contract in support of specific tasks to include attend meetings, conferences, and providing training. All travel requirements (including destination, purpose, plans, agenda, itinerary, number and names of personnel, and dates) shall be pre-approved by the COR.

5.15.2. The Contractor shall travel using the lower cost mode transportation commensurate with the mission requirements.

5.15.3. All travel requirements (including plans, agenda, itinerary, or dates) shall be pre-approved by the COR and is on a strictly cost reimbursable basis.

5.15.3.1. Costs for travel shall be billed in accordance with (IAW) the regulatory implementation of Public Law 99-234 and Federal Acquisition Regulation (FAR) 31.205-46 Travel Costs (subject to local policy & procedures; may reference FAR.

5.15.4. The Contractor shall submit a trip report to the COR within five business days after return. The trip report provides a summary of the event, location, attendees, key personnel, action items, and key points of discussion and shall detail the work completed, lessons learned, and applicable recommendations. Report shall include a copy of the traveler’s submitted travel voucher (CRDL A004).

6 DELIVERABLES.

6.1 CDRLs.

6.1.1 Reports and other data required in this PWS shall be submitted IAW this Contract Data Requirements List (CDRL).

Shall be provided NLT three

(3) calendar days after the completion of travel.

6.2 Contractor Personnel Roster.

6.2.1. The roster shall contain an alphabetical listing of the names of all contractor personnel assigned to the contract.

6.2.2. The roster shall identify the contractor name, title/position, phone, email address, work address, Government POC.

6.2.3. The roster shall identify the following security clearance information for each employee: place of birth, level of security clearance, issue date/expiration date, security clearance validation by contractor Facility Security Officer (FSO), FSO name, and phone and email address.

APPENDIX A - ACRONYMS AND ABBREVIATIONS LIST

Acronym/Abbreviation Definition