Draft_A3_MAA_CARM_PWS.pdf

AF/A3

A3 MISSION ASSURANCE ASSESSMENT

Support

Performance Work Statement (PWS)

16 Nov 23

I. BACKGROUND/INTRODUCTION

The United States Air Force (USAF), Air Force Operations Group, Mission Assurance Division (AF/A3OB), is responsible for policy development, oversight, and management of Critical Asset Risk Management (CARM) programs and Mission Assurance (MA) activities. CARM performs the basic functions of MA defense critical infrastructure (DCI) requirements for identifying, assessing, prioritizing, and overseeing risk management actions for the most critical USAF and Department of Defense (DoD) assets in accordance with Department of Defense Instruction

(DODI) 3020.45.

In order to support USAF Mission Assurance Assessment (MAA) requirements, it is imperative that AF/A3OB be properly staffed to (1) conduct Mission Assurance Assessments; (2) provide support to ensure the successful operation of USAF Mission Assurance Assessments within the Critical Asset Risk Management Programs and (3) conduct risk analysis in support of DoD and USAF efforts. The resource needs of each mission assurance assessment and/or stakeholder request will be identified and managed by contract lead in coordination with AF/A3OB.

1.0.1 SCOPE

Mission Assurance Assessments are accomplished through a three-phased approach as outlined in DoD Instruction 3020.45 (Mission Assurance Construct) and CJCSI 3209.01A Mission Assurance Construct Implementation. The three phases are the Pre-Assessment Phase: mission analysis and pre-site survey; the Assessment Phase: vulnerability/risk assessment; and the Post-Assessment Phase: post analysis and report. The objective of the MAA is to integrate the various MA-related programs and activities into a comprehensive, standardized, risk management assessment. This approach assesses probabilistic risk to assets, systems, and essential capabilities that support strategic missions. , Conducting AF MAAs requires (1) specialized Mission Assurance Assessment Teams, (2) Support Staff, and (3) knowledge/use of DoD databases.

1.1 USAF MISSION ASSURANCE ASSESSMENT TEAM

The Contractor shall provide personnel for the execution of MAA missions, ensuring logistical and ancillary support to accomplish the agreed number of MAAs annually. The composition of each JMAA team will be determined by MAA Team Lead in coordination with the government Critical Asset Risk Management Program/Branch Chief. Team. The contractor must fulfill the stipulated number of MAAs and deliver the Mission Assurance Assessment Report (MAAR) within the allotted timeframe. With the exception of the contractor provided Mission Assurance Assessment Team Lead/PM team members are not required to report to AF/A3OB on a daily basis.

The contract mission assurance assessment team will coordinate closely with AF/A3OB Mission Analysts throughout the MAA process. The contractor provided assessment team will work with the A3OB Mission Analysts to receive and review the list of locations and assets to be assessed. This includes examination of previous inspections and MAA reports. The contractor provided team will actively participate in the pre-assessment phase including participating in Pre-site survey meetings/discussions via SVTC, coordinate and assist installations in completing the All Hazard Threat

Assessment (AHTA) in the system of record.

The contractor provided assessment team is responsible for coordinating with the installation and Major Command (MAJCOM) as necessary ahead of the assessment to ensure a successful assessment. The contractor is responsible to directly liaison with the Installation MAA Coordinator to develop schedule of events/interviews for MAA to include in/out brief, and coordinate all other pre assessment required access requirements, documents review and preparation, and other logistical requirements as necessary.

The contractor will conduct a Mission Assurance Assessment vulnerability analysis according to OSD and JS established Mission Assurance Assessment standard practices (IAW CJCSI3209.01A Enclosure D Section 3.d. Vulnerability, Section and other DoD MA policy and guidance) and any pertinent DAF/USAF supplemental/Benchmark requirement. The contractor will analyze each identified vulnerability and develop a proposed viable, cost-effective Courses of Action (COAs) in coordination with perinate installation stakeholders. The contractor will develop a MAA Reports (MAAR) IAW CJCSI Enclosure D Section 4, Mission Assurance Assessment Reports and other direction from the AF/A3OB office, and be submitted in the format approved by OSD (P) DC&MA for standardization. The contractor may be required to conduct their assessment analysis and provide data within a DoD or DAF data system. The contractor will be responsible for presenting the findings of their report to AF/A3OB, and other DAF offices as required as well as being available to answer any requests for information on the methodology of the report.

Security Operations Specialist (Physical Security): conducts assessments of the installation and facility’s ability to protect personnel, critical assets, and missions from physical attacks and ability to deter, detect, defend and respond to an attack.

General Engineer: The General Engineer is required to be a Subject Matter Expert (SME) in the Department of Defense (DoD) and United States Air Force (USAF) built infrastructure, including an in-depth understanding of Unified Facilities Criteria (UFCs) and the application of the DoD Mission Assurance Benchmarks for Supporting Infrastructure The general engineer should also have a working knowledge of USAF Civil Engineering governance, programming, and processes. The general engineer will conduct a thorough vulnerability assessments across various infrastructure elements, such as water, wastewater, electricity, heating, ventilation, and air conditioning (HVAC), petroleum products, fire protection systems, generators, and natural gas systems. A crucial aspect of this position involves performing structural engineering vulnerability assessments that address perimeter security, Access Control Points, facility standoff, and overall facility protection, aligning with the Mission Assurance Program.

Information Operations Specialist: performs technical communications vulnerability assessments of computer networks, Industrial Control Systems, radio, wireless, and other communication systems that directly support the Mission Assurance Programs or mission critical assets on DoD installations or other agencies’ facilities.

Telecommunications Specialist: reviews and assesses the telecommunications infrastructure that supports the installation protection programs; customer’s missions and supporting facilities to include equipment and routing. Additionally, identify all aspects of communications-related vulnerabilities, impacts of communications on mission execution capability, and provide recommendations to mitigate or eliminate identified vulnerabilities.

Information Systems Auditor: Conducts technical cyber and communications vulnerability assessments of computer networks, other technology (OT) systems telecommunications and other communication systems that directly support Mission Assurance Programs on DoD installations and other agencies’ facilities.

Additional skills required for this position are as follows:

Possess a Bachelor's degree in a Computer Science, Computer Engineering, Electrical Engineering, or a related technical discipline. In lieu of a degree, commensurate operational experience may be substituted.

Possess IAT Level II certifications and CSSP Analyst computing environment certification as defined and described in Joint Publication 3-13 Information Operations and 3-12 Cyberspace Operations, DoDI 8500.1and DoD 8570.01 and 8570.01-M.

Possess a working knowledge of computer network architecture and network diagraming.

Possess a working knowledge of Computer Network vulnerability/compliance analysis software.

Emergency Management Specialist: Conducts assessment of Emergency Management (EM);

Chemical, Biological, Nuclear, Radiological, and High-Yield Explosives (CBRNE); and Continuity of Operations (COOP) programs to protect personnel, critical assets, and missions from hazards and threats that may impact the installation, facility, or asset.

All Source Analyst: The primary tasks are to characterize the broad array of threats to DoD installations, sites, critical infrastructure, and assets. Identifying and evaluating potential threat actors, capabilities, and tactics and prioritize the data based on impact to military operations by assisting installation in the development of all hazard and threat assessments. Additionally, the All Source Analyst will be responsible for the identification and assessment of assets and threat abilities outside of the installation and integrate this information into a finished assessment product.

Electromagnetic Spectrum Analyst: The primary tasks are to conduct assessments of supporting Defense Critical Infrastructure to identify vulnerabilities which can be exploited by the UAS threat.

Ability to apply Radio Frequency (RF) engineering principals to evaluate spectrum dependent technologies. Familiarization with a wide variety of spectrum dependent systems including radars, communications, data links, SATCOM, GPS technologies. Additionally, the analyst will need to determine root causes and recommend methods of resolution; and provide expert advice on the development, integration, operation of and planning for spectrum specific countermeasures.

Mission Assurance Team Lead: Responsible for the pre-assessment coordination requirements with AF/A3OB Mission Analyst and providing installation support for the development and publication of the All Hazards and Threat Assessment (AHTA) product in EPRM and coordinating analysis of information gathered from applicable systems, orders, and plans as it relates to the assessment mission focus. This position along with Support Staff are responsible for reporting to AF/A3OB on a regular basis.

Additional SMEs as need to support MAA requirements as determined by the MAA Team Lead and CARM Branch Chief.

1.2 SUPPORT

The Support Section provides required resource management, administrative, planning, and professional document development, coordination, and distribution of MAA Team and AF/A3OB documents.

Mission Support Specialist: Primary duties are to provide logistical coordination/support for MAA team, to include coordinating team travel, but on as needed basis support the coordination of AF/A3OB task related to the four phases of the Mission Assurance Construct. To include responding to AF/A3OB task and RFIs. The Mission Support Specialist supports the assigned Team Chief or senior government person for each assessment.

Technical Editor: Responsible for reviewing, editing, and formatting products produced by the MAA Team to include in/out briefs, formatting/finalized AF MAA Reports, reviewing, formatting, and finalizing MAA COAs for presentation to MACB, background papers, memorandums, and other such documents related to the four phases of the Mission Assurance Construct. Contractor will ensure accurate and professional products are released/uploaded intro the appropriate DOD and AF MA systems of record in the required timeline.

1.3 IT SOFTWARE AND HARDWARE

The Government requires MAA Team and support staff to be familiar with and utilize computer systems that comprise the Mission Assurance Risk Management system (MARMS). This requires the contractor to have access to EPRM, eMAAP, SMADS, AFCAMS, and other un/classified systems to perform this work.

1.4 PROVIDE PROJECT MANAGEMENT SUPPORT

The Contractor shall actively manage this contract by coordinating closely with the CARM COR. The Contractor shall submit all reports on-time and with strict adherence to the instructions specified in each CDRL. At the COR’s request, the Contractor shall review statuses on any open task or assignment and travel reports with the COR.

Additionally, the Contractor shall attend and present contract performance data at semi-annual Program Management Reviews (PMRs). The program review will take place at DTRA-designated location(s). The Contractor shall provide a briefing for the PMR prior to the meeting.

1.4.1 MISSION ASSURANCE DIVISION (AF/A3OB) SUPPORT

The Contractor shall provide personnel with the requisite skills, certifications and/or licenses, to fully support AF/A3OB requirements and successfully accomplish assigned Mission Assurance Assessments as defined in DoDI 3020.45 and CJCSI 3209.01A Mission Assurance Construct Implementation. AF/A3OB Division support consist of a mix of contractor personnel and Government personnel. The Contractor is responsible for ensuring that its personnel are cleared at the TS/SCI level, ready to be in-processed, and ready to begin orientation to be an AF MAA assessor.

The Government must be prepared to adapt to the changing needs of the environments and the threats to critical infrastructure.

Furthermore, the Contractor shall ensure that personnel assigned to this contract complete any and all specialized training in order to maintain professional expertise and certifications in SME functional areas. The Contractor shall maintain and keep updated, training records, including certifications, for all personnel assigned to this contract for the duration of the contract. Additionally, the contractor shall identify certifications attained, schools, conferences attended etc. to maintain required professional expertise in the Monthly Status and Progress Report. Contract personnel assigned to this contract will support and participate in Mission Assurance Department Training as directed by the Mission Assurance Department Chief and NE-MA COR.

All positions identified are “Deployable” and must meet and maintain the following criteria. To ensure an effective workforce, the Contractor shall maintain an equitable distribution of required skillsets.

Accept worldwide deployments which include high threat permissive areas presenting some risks to personal safety.

Submit to immunization for worldwide travel.

Be able to travel on short notice, work non-standard hours and take on-call duty.

Obtain a Passport.

Possess effective oral and written communication skills.

Expert knowledge of Microsoft Office Suite. Ability to prepare written reports, white papers, and Power-Point presentations.

Be capable of operating in all operational and physical environments and work closely with USG military and/or civilian personnel.

The Contractor shall ensure that all on-site personnel assigned to this contract are ready to begin work within 45 days of contract award. The Contractor shall provide support to AF/A3OB Division by attending and participating in all Division trainings, meetings, or other efforts to enable the Division to execute its missions. The Contractor personnel must be ready to brief, present or collaborate on its area of expertise.

1.4.2 REPORTING

The Contractor is responsible for providing services to Mission Assurance Division AF/A3OB at the Pentagon, Alexandria, VA location or other location as the mission requires, except on Federal holidays or when the office is closed for business due to local or national emergencies, administrative closings, or similar Government directed closings. The Contractor will not be reimbursed when the government facility is closed for the above reasons. However, when the government is open for business but the AF/A3OB facility is closed, the Contractor may conduct business offsite (telework) as directed by the CARM Branch PM and AF/A3OB COR. With the exception of facility closures, the Contractor will have access to the facility during normal duties hours and as needed to conduct meetings and to meet deadlines. The Contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons.

1.4.3 RECRUITMENT, RETENTION, REPLACEMENT, AND PERSONNEL PLAN

The Government reserves the right to review qualifications of each substitution or replacement prior to consenting to the substitution or replacement.

When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the workforce are essential. The Contractor shall establish a transition plan for its personnel to ensure a seamless transition between in-coming and out-going contractor personnel. The Contractor shall also maintain a Personnel Recruitment, Retention, Replacement, and Surge Personnel plans to ensure that it remains agile and ready to meet the AF MAA missions requirements.

The Contractor shall notify the CARM Contracting Officer’s Representative (COR) and/or PM within 10 days of a personnel loss or notice of resignation and replace lost personnel within 45 days.

1.4.4 LEVEL OF EFFORT (LOE)

The LOE for this requirement may increase or decrease based on the program’s requirement and existing funding. Each full time equivalent (FTE) should be based on the Government’s estimated 1880 hours per year. Key Personnel are designated with a double asterisk (**)

The JMAA and support labor categories for the Joint Mission Assurance program are divided into three (3) separate categories for funding purposes:

Support. Includes all labor categories aligned with paragraph 1.2 in the PWS.

Mission Support (administrative and logistical) Specialist Technical Editor Expertise. Includes labor categories aligned with paragraph 1.1 in the PWS.

Physical Security Specialist Telecommunications Specialist Information Operations Specialist Emergency Management Specialist All-Source Analyst Mission Analyst Advanced Expertise. Includes labor categories aligned with paragraph 4.1 in the PWS.

General Engineer Information System Auditor Electromagnetic Spectrum Analyst

II. SERVICE DELIVERY SUMMARY

PERFORMANCE REQUIREMENTS SUMMARY

The contractor service requirements specified above are summarized into performance objectives that relate directly to mission essential items. The performance threshold briefly describes the minimum acceptable levels of service required for each requirement. These thresholds are critical to mission success. Contractor service requirements, performance metrics, and remediation plans are provided below.

PWS

Section

Performance Objective

Performance Threshold

Method of Surveillance

Incentive/Disincentive

1.1 Complete

scheduled Mission Assurance Assessment as indicated in the IAS

100% COR oversight and administrative need to cancel, re-schedule or obtain waiver

If Contractor meets or exceeds the performance threshold, it will:

(i) contribute to a positive Schedule rating in CPARS.

(ii) increase likelihood of option exercise

1.1 All TCAs and

dependencies were assessed IAW the

AFS

Assess 100% of TCAs and dependencies 90% of the time

Review of final report by COR

If Contractor meets or exceeds the performance threshold, it will:

(i) contribute to a positive Schedule rating in CPARS.

(ii) increase likelihood of option exercise

1.0 MAA Reports are

completed on time and submitted for final review within 90 days post MAA

MAA Reports are received and published to the DOD/AF System of record within 90 days of completing the MAA 90% of time

COR Oversight via final document review

If Contractor meets or exceeds the performance threshold, it will:

(i) contribute to a positive Schedule rating in CPARS.

(ii) increase likelihood of option exercise

1.2 MAA Reports are

in correct format, contain at least one COA for each vulnerability completed on Time

Complete and accurate reports 90% of the time

COR Oversight via final document review

If Contractor meets or exceeds the performance threshold, it will:

(i) contribute to a positive Schedule rating in CPARS.

1.2 Respond to RFIs

and Taskers within the time allocated

Provide complete and accurate response to RFI/task related to 4 phases of MA Constructs within the time allocated 90% of the time

COR Oversight If Contractor meets or exceeds the performance threshold, it will:

(i) contribute to a positive Schedule rating in CPARS.

1.4.1 The Contractor

shall keep current all required certifications to perform the duties/roles of the appropriate LCAT.

At all times, the Contractor shall ensure its on-site personnel maintain and keep current all certifications.

Review during PMR or in Progress Reports.

If Contractor meets or exceeds the performance threshold, it will:

(i) contribute to a positive Schedule rating in CPARS.

1.4.3 Provide sufficient

personnel to perform all tasks specified in Section 4 without interruption.

Replace any departing personnel within 45 days.

Onsite surveillance.

1.4.3 Personnel vacancies No vacancies

greater than 2 weeks

Key personnel

PM

Technical writer

4. Security No violation of security

2.2 DELIVERABLES DD 1423, CONTRACT DATA REQUIREMENTS LIST

Paragraph Number

Item PWS Para Due Date

A001 Monthly Status Report 1.1-1.3 1st of each month

A002 Monthly expenditure Report

4.3

A003 Personnel list for security

4.5 Within 2 days of contract change

Page 10 of

A004 A005

A006

A007

A008

A009

A010

A011

III. GOVERNMENT FURNISHED PROPERTY OR EQUIPMENT (GFP/GFE)

Government furnished property will NOT be provided. However, contractor personnel performing work under this contract on-site will be provided with a government workspace, a laptop, computer peripheries, Common Access Cards (CACs), AF e-mail accounts, access to government file servers while off-site, and office supplies.

Contractor personnel shall not use government equipment for personal use. Government equipment may only be used by the contractor for the execution of the tasks specified in this contract.

The Contractor shall submit requests for replacement of Government-furnished equipment to the COR for processing. Such requests must specify the reason for the replacement request within 15 days of known requirement. Lost or stolen GFE shall be verbally reported immediately, and followed up in writing, within 24 hours of incident to the COR.

The Contractor shall submit a Master Government Property List (MGPL) and the contract clauses.

Any accommodations not identified in this section are the responsibility of the contractor for their

Page 11 of personnel.

IV. GENERAL INFORMATION

4.1 PERFORMANCE SCHEDULE

MAA Teams will be responsible for conducting AF MAA at TDY locations IAW the JS Integrated Assessment Schedule and CARM Branch Chief assignments. MAA Reports will be required within 90 days of completing the MAA.

Support Staff is required to report Monday – Friday except Weekends and Holidays. Business Hours are from 0700-1700.

4.2 PERFORMANCE LOCATION

Mission Assurance Assessment Team Members will work at contractor facility and perform assessments in a TDY status.

Support staff will work at AF/A3OB, 1480 Air Force Pentagon, Alexandria VA 20330 or other Pentagon designated space unless TDY.

4.3 TRAVEL

The Contractor shall travel both CONUS and OCONUS. The Contractor shall provide on-site support and contractor personnel shall travel in support of AF/A3OB MA Division in execution of the requirements of this PWS. When traveling to locations designated by the Department of State as a danger pay post, the Contractor shall allocate the cost of the danger pay, consistent with the allowances provided by the Department of State, to the Travel CLIN on this contract.

The Contractor shall submit an estimated travel budget once a year, itemizing all estimated travel costs.

The Contractor shall obtain approval for the estimated budget from the COR on an annual basis in writing. However, if the estimate for any particular trip or traveler deviates more than 25% from the annual estimated cost, the Contractor shall submit a new estimated cost to the COR for approval 30 days prior to travel. All travel must be compliant with the Federal Travel Regulations (FTR), unless otherwise specified by the COR. .

Within 30 days of completing the trip, the Contractor shall submit a reflecting the actual costs incurred. The Contractor shall at all times use reasonable efforts to pursue the most economical travel arrangements and minimize the cost of travel.

The Contractor shall coordinate closely with the COR to arrange travel overseas, specifically when contractor personnel are to fall under a Status of Forces Agreement (SOFA) or other host nation agreements and/or when Synchronized Pre-deployment & Operational Tracker (SPOT) requirements are triggered. The Contractor shall comply with all requirements of the SPOT clauses included in the contract in a timely manner.

The contractor employees shall comply with all DOD mandatory travel reporting policies.

Page 12 of

4.3 SECURITY

The contractor shall possess a DOD TOP SECRET clearance with an SCI caveat Facility Clearance and employees working on this program must be U.S. citizens and will require a DOD TOP SECRET clearance with an SCI caveat granted by the Defense Security Service (DSS) to provide the required support. Clearances must be in place prior to contract award. A Visit Authorization Letter (VAL) must be provided for each contractor employee working on this contract who will require access to any AF site. The VALs for collateral security clearance shall be typewritten, contain the information specified in paragraphs 6-103, 6-104 and 6-105 of the National Industrial Security Program Operating Manual (NISPOM), and be submitted to the AF/A3OB Security Manager who will process the request with AF/A3. The term of the VAL shall be for the term of the contract. The Contractor shall provide proof of U.S. citizenship for all contracted employees prior to entering the DTRC. The contractor shall comply with all terms of the DD 254, and the NISPOM, DoD 5220.22-M, NATIONAL INDUSTRIAL SECURITY PROGRAM, and any revisions to that manual. The contractor shall provide all forms and information, apply for clearances and shall be responsible for any expense incurred in obtaining TOP SECRET/SCI security clearances for the contractor employees.

The contractor will produce some SECRET and/or TOP SECRET documents. The contractor shall comply with all DoD requirements for marking, handling, storing and transporting classified documents, working papers, notes, media, etc. (herein referred to as documents) while in the possession of the contractor. This includes any document the contractor may generate in performance of this contract.

The contractor shall demonstrate sound and proven Operations Security practices, ensuring unclassified/sensitive information will be properly protected at all times, and abide by all AF Operations Security (OPSEC) policies.

The contractor shall adhere to all facility access control policies and procedures. Contractor personnel shall wear security identification badges at all times while in government facilities, as access cards and Identification Cards (IDs) are presented upon request at all entry control points. Lost or stolen IDs or badges shall be verbally reported immediately, and followed up in writing, within 24 hours of incident to the A3OB Contracting Officer Representative.

The contractor must be responsible for safeguarding all Government property provided for contractor use. At the end of each work period, all Government property, equipment and materials must be secured.

V. APPLICABLE DOCUMENTS

DoDD 3020.40, Mission Assurance DoDI 3020.45, Mission Assurance Construct DoDI 2000.16, DoD Antiterrorism Standards DoDI 6055.17, DoD Installation Emergency Management Program DoDI 2000.12, DoD Antiterrorism Program DoDI 3020.39, Mission Assurance for DIE DoDI 3020.45, Mission Assurance Construct CJCSI 3209.01A Mission Assurance Construct Implementation

Page 13 of

AFM 10-24, Mission Assurance AFI 10-2402, Critical Asset Risk Management Program 2023 DOD Mission Assurance Assessment Benchmarks

V. APPLICABLE DOCUMENTS