DRAFT_BASIC Data Ops SOO_2025.03.17.pdf

PERFORMANCE WORK STATEMENT (PWS)

FOR

Air Force Technical Application Center

Data Operations

AFTAC/SDA

4 March 2025

1297539279C Draft

Revision Number Date Revision Description Revision 0

1 DESCRIPTION OF SERVICES

1.1 INTRODUCTION

1.2 BACKGROUND

1.3 SCOPE

1.4 PERIOD OF PERFORMANCE

2 SPECIFIC TASKS

3 SERVICES SUMMARY (SS)

4 GOVERNMENT FURNISHED PROPERTY AND SERVICES

4.1 SERVICES

4.2 FACILITIES

4.3 UTILITIES

4.4 EQUIPMENT

4.5 MATERIALS

APPENDIX A – ACRONYMS AND ABBREVIATIONS LIST

APPENDIX B - ESTIMATED WORKLOAD DATA

APPENDIX C - APPLICABLE PUBLICATIONS & INSTRUCTIONS……………………….30

APPENDIX G – AFTAC SOFTWARE DEVELOPMENT STRATEGY DOCUMENT (SDSD)

DESCRIPTION OF SERVICES.

1.1 Introduction.

1.1.1 This is a non-personal services contract. The Government will neither supervise contractor employees nor control the method by which the contractor performs the required tasks. The contractor shall manage its employees and guard against any actions that are of the nature of personal services or give the perception of personal services. The contractor shall notify the Contracting Officer (CO) immediately if they perceive any actions constitute personal services.

These services shall not be used to perform any Inherently Governmental Functions.

1.2 Background.

1.2.1 The Air Force Technical Applications Center (AFTAC) currently has a On-Prem Cross Domain Solution (CDS) to move, transform, validate, and quality assure data, that is being maintained under a separate contract. This On-Prem CDS currently moves data from inside and outside of AFTAC through a CDS process to individual security enclaves following published National Institute of Standards and Technology (NIST), Department of Defense (DoD), Air Force guidance and other relevant regulations. AFTAC is looking to move this On-Prem CDS to a cloud CDS environment in whole or in part depending on data type and process. The current on-premise cross-domain solution is nearing the end of its life cycle and requires modernization to improve security, scalability, and efficiency. The transition to a cloud-based cross-domain solution will enable greater flexibility, cost savings, and enhanced collaboration.

1.2.2 The current AFTAC cross domain capability operates at the AFTAC headquarters located at Patrick Space Force Base (PSFB) FL and Alternate facility located at Millington TN, with developmental cross domain flows across cloud diodes. The focus of this effort is to ensure cross domain data to the SECRET and TOP SECRET domains for all AFTAC mission data, and software artifacts. Data origins may include a variety of sources (i.e. commercial cloud, GovCloud, FTP Servers, Commercial data providers, standard message formats, file stores, etc.) and acquisition may be in either pull or push modes. Data targets will also include a variety of destinations depending on mission needs.

1.3 Scope.

1.3.1 The scope of this contract is the research and development of a cross-domain cloud system that will include the operation and maintenance of the enterprise data operations requirements for both the cloud and on-premise environments. The current on-premise cross domain systems must be maintained until all mission data flows are engineered for a cloud environment and an active operational Authority to Operate is acquired for the cloud environments. Once mission data, mission support system patches, and software artifacts can be delivered operationally from the cloud environment and pass the Test and Evaluation (T&E) phase, the on-premises hardware may be decommissioned.

1.3.2 The non-personal services to be performed under this contract are related to maintaining and sustaining as well as improving overall system performance in support of data operations and the cross-domain system.

1..3.3 The technical, systems engineering, program management, logistical services, research and development, and operations and maintenance will be executed on an individual task order basis. Services shall include, but not be limited to:

1.3.3.1 Configuration Items (CIs)

1.3.3.2 Operational and Alternate system maintenance;

1.3.3.3 Sustainment/Development system maintenance;

1.3.3.4 Data services, including;

1.3.3.4.1 Movement of data through cloud environment:

1.3.3.4.2 Movement of data through on premise environment

1.3.3.4.3 Monitoring data acquisition statistics and addressing discrepancies;

1.3.3.4.4 Maintaining the data distribution software;

1.3.3.4.5 Maintaining the external web-portals and their products;

1.3.3.4.6 Managing data requests;

1.3.3.4.7 Integrating COTS data acquisition software; and

1.3.3.4.8 Performing maintenance on configuration files

1.3.3.5 24/7 operational system support;

1.3.3.6 Change Request (CR) resolution;

1.3.3.7 CR integration, documentation, test, and promotion;

1.3.3.8 Third Party Support

1.3.3.9 Research and Development

1.3.3.10 Security

1.4 Period of Performance

1.4.1 Period of Performance: 1 Nov 2025 – 31 Oct 2031. A 60-day transition period is anticipated to ensure the smooth transfer of current operations to the new contract.

1.4.1.1 Task orders for the scope of work identified in this PWS will be issued on an as-needed-basis. The PoPs for each task order will not exceed the performance period allowed for the applicable appropriations but may exceed the six-year ordering period plus a ninety (90) day phase-out period. This does not include any extension(s) of performance under FAR 52.217-8.

2 SPECIFIC TASKS

2.1 Research and Development (R&D)

2.1.1 The Contractor shall work closely with the Government to develop and conduct a thorough analysis of the current on-premise cross-domain solution, research, evaluate and implement cloud-based cross-domain solutions. The Contractor shall produce estimates for developing and implementing the individual cloud transition plans. Upon completion, the Contractor shall provide technical reports covering activities performed through the analysis, research and development. (A013, Tech Report)

2.2 Operations and Maintenance (O&M)

2.2.1 The Contractor shall provide data services support which includes monitoring data acquisition statistics and addressing discrepancies; maintaining the data distribution software;

maintaining the web-portals and their products; managing data requests; integrating Commercial of the Shelf (COTS) & Government of the Shelf (GOTS) data acquisition software; and performing maintenance on configuration files as the field system evolves, to include technical support, lifecycle management and system administration, to maintain and sustain the cross-domain data transfer subsystems. "Data services" primarily refers to the input and output of data and products.

2.3 Technical Specifications Applicable to all TOs

2.3.1 The contractor shall accomplish daily monitoring of the data flow processes used to transfer data to and through the cross-domain transfer systems to include status/error notification to functional data owner processes.

2.3.2 The contractor shall support troubleshooting, configuration, documentation, and testing of the data flow processes used to transfer data to and through the cross-domain transfer systems.

2.3.3 The contractor shall support the architecture and lifecycle management of the cross-domain transfer systems.

2.3.4 The contractor shall provide data custodian and management services to ensure and enforce AFTAC and Air Force data transfer and data management policies and procedures are adhered to for all data flow through the cross-domain transfer subsystems.

2.3.5 The contractor shall maintain development and operational cross domain data flows for mission data types, mission support system patches, and software artifacts. Conversion between data types (e.g. to XML) for the purposes of facilitating data transfer across domains may be required. Where needed to fulfill the cross-domain transfer, the contractor shall be responsible for the conversion to and from approved data types.

2.3.6 Data services, including the following.

2.3.6.1 Monitoring data acquisition statistics and addressing discrepancies;

2.3.6.2 Maintaining the data distribution software;

2.3.6.3 Maintaining the external web-portals and their products;

2.3.6.4 Managing data requests; data request verification, complete verification within one (1) week of request approval

2.3.6.5 Integrating COTS & GOTS data acquisition transforming and processing software

2.3.6.6 Performing maintenance on configuration files

2.3.7 The contractor shall ensure that missions meet their data goals, data must be transferred to the appropriate classification level within certain timing requirements, depending on the data type. To accomplish this, the contractor may combine or break up individual files and set priorities on the file types. Redundancy and replication requirements will depend on mission needs per data type.

2.3.8 The contractor is responsible for data acquisition, transformation and the patching of the following data acquisition applications, processing applications and configuration management of non-person entities (NPEs), virtual hardware, cloud formation files, and software required to operate the cloud cross domain solution. Operational on-premise hardware will be maintained through a separate AFTAC maintenance support contract.

2.3.9 The contractor is responsible for providing 24x7 on call support to ensure 99% operational availability rate.

2.3.10 The Contractor shall provide 24 hours-a-day, 7 days-a-week on-call support. This support includes hardware and software maintenance support and system administration support.

2.3.10.1 Support shall also be in response to system outages and in response to mission transfers, both actual and exercises.

2.3.10.2 Incident reports shall be filed for all 24/7 support items. Some incidents can be handled over the phone; however, on-site support is required if telephone support is not able to resolve the issue.

2.3.10.3 Contractor shall acknowledge all notifications within 15 minutes either via phone call or in person.

2.3.10.3.1 If an incident cannot be handled over the phone, Contractor shall be on-site within 60 minutes from the time of initial notification. All 24/7 system support incidents shall be worked continuously until resolved in coordination with customer.

2.3.11 Change Management

The Contractor shall accept change requests (CRs) and process them in accordance with the Systems Engineering Plan (SEP) and Software Development Plan (SDP). A CR is defined as any change to the operational baseline that has been approved by the Government. CRs may involve determining optimal parameter settings. (A004, SEP; A007, SDP)

The Contractor shall:

a) Review and analyze the requirements associated with the CRs,

b) Implement new and modified software in response to the CRs, moving each CR through a well-defined progression of states managed by a CMB as defined in the data process flow (e.g., submitted, assigned, opened, peer reviewed, verified, validated, or rejected).

c) Resolve Urgent CRs within 72 hours.

2.3.11.1 The contractor participates as a member of the applicable Change Management Board (CMB) to ensure mission data flow will continue to meet the operational availability requirements.

2.3.12 Integration of 3rd party efforts: The Department of Energy (DoE) and National Labs, as well as various government contractors and agencies are involved in numerous cross domain efforts. It will be the contractor's responsibility to team with these AFTAC partners to ensure cross domain data transfer for all AFTAC mission data types, mission support system patches, and software artifacts.

2.3.13 The Contractor shall provide updates for the Information System Accreditation Documentation in the form of a System Security Authorization Agreement as defined by the Department of Defense Information Technology Security Certification and Accreditation Process and AFSSI 5024 Volumes I, II, and III (Ref. Appendix C). The updates include:

a. Engineering drawings: updates and changes provided to the Government prior to the changes occurring to support system accreditation.

b. System software (COTS, GOTS, and developed) configuration documentation; updates and changes provided to the Government prior to the changes occurring to support system accreditation

c. Interface control information: updates and changes provided to the Government prior to the changes occurring to support system accreditation.

2.3.13.1 The Contractor will be provided access to prior security accreditation efforts and documentation undertaken by the Government. The Contractor shall implement security requirements based upon the current operational mode of the system and the requirements given by the appropriate Designated Approving Authority (DAA) for the system.

2.3.13.2 The contractor shall be responsible for attaining and maintaining an Authority to Operate (ATO) for both on-premise and cloud environments at each classification level of the cross-domain solution in accordance with (IAW) the Risk Management Framework (RMF).

Documentation must be maintained in XACTA (an IT and Cyber Risk Management Platform). In addition to RMF required products, data flow diagrams shall be maintained.

2.3.13.3 The contractor is responsible for adding metadata to the data products in accordance with Zero Trust directives (Ref. Appendix C). The data files must be validated using a variety of tools including but not limited to virus scan, format or content checks, and checksum validation (Ref AWS Data Verification Guide (DVG).

2.3.13.4 The contractor will work in coordination with the organization’s Cybersecurity office and Chief Information Security Officer (CISO) on the establishment, implementation, documentation and monitoring of the supported system’s authorization and related documentation requirements in order to achieve, monitor and maintain the system’s Authority to Operate (ATO) and software Certificate to Field (CTF) IAW RMF, AFTAC and US Air Force processes requirements.

2.3.14 The Contractor shall maintain and document all CIs, both Hardware Configuration Items (HWCIs) and Computer Software Configuration Items (CSCIs). The Contractor shall capture CI identification information for the System/Subsystem Design Description (SSDD), Database Design Description (DBDD) and Interface Control Document (ICD) Software Version Description (SVD) to be included in the Data Management Plan (DMP). Updates to the SSDD, DBDD, SVD, and ICD shall be submitted to the Government in accordance with document change procedures. (A009)

2.3.15 Equipment Control Officer (ECO)

The Contractor shall perform ECO duties for the system in accordance with Air Force Manual 17-1203, Information Technology (IT) Asset Management (ITAM), 19 March 2014 Incorporating Change 2, 7 March 2017. (Ref Appendix C)

2.3.16 Supportability

2.3.16.1 Technical Instruction Manuals

The Contractor shall provide updates to the existing Technical Instruction (TI) manuals to support organizational maintenance and operation of cross domain solutions at both headquarters and the alternate site, as well as cloud environments. Updates to TIs shall be submitted to the Government in accordance with document change procedures contained in the CMB Process Guide.

2.3.16.2 Program Management

The Contractor shall promote full and open communication between AFTAC personnel and personnel from the Contractor and associate Contractors. The Contractor shall perform management tasks to plan, organize, control, integrate, and execute contractual requirements.

(B002, MSR)

2.3.16.3 Program Management Reviews (PMRs)

The Contractor shall conduct formal PMRs every six (6) months. In these reviews, the Contractor shall identify on-going tasks with associated schedules and expenditures to date, planned actions, staffing information and any difficulties encountered in performing work. The Contractor shall provide a draft agenda and draft presentation materials to the Government no later than three business days prior to each PMR. (B001, Conf Min)

2.3.16.4 Status Reporting

The Contractor shall prepare and deliver monthly program status reports (MSR). The status report shall include a description of all work efforts performed during the month for all PWS tasks. The MSR shall include a status of all data deliverables for the reporting period. (B002, MSR)

2.3.16.5 Risk Management

The Contractor shall develop and implement a Risk Management Plan (RMP). The Contractor shall identify, evaluate, and assess program risk and report this information, along with risk mitigation strategies and results, at PMRs and in MSRs. (B008, RMP)

2.3.16.6 Data Management

The Contractor shall implement and maintain a data delivery and tracking system as documented in a Contractor Data Management Plan (DMP) and IAW paragraph 2.3.14. The Contractor shall conduct internal data reviews to ensure all deliverable data conforms to Government Contracts Deliverable Requirements List (CDRL) requirements. The Contractor shall make all technical data available for review by the Government Contracting Officer’s Representative (COR). The Contractor shall prepare data for delivery to the Government. The Contractor shall supply technical documentation to the Government identified with (at a minimum) title, document number, revision, and date. The Government will have unlimited rights to use, duplicate or disclose all deliverable data, in whole or in part. (A003, DAL)

2.3.16.7 Records Management

Records management oversight of a Contractor’s records is necessary to ensure Air Force records keeping requirements are met. All records created as a result of processes prescribed in the PWS shall be maintained in accordance with AFMAN 33-363, Management of Records, AFI 33-364, Records Disposition-Procedures and Responsibilities, the Air Force Electronic Records Management Solution, AFTAC’s supplements to each of the fore mentioned publications, and are disposed of in accordance with the Air Force Records Disposition Schedule. At the conclusion/termination of this effort, all records shall be returned to the Air Force Office of Primary Responsibility (OPR) for proper disposition. Contractors who create and receive official records on behalf of the Air Force and are performing records management support are referred to as records professionals. Contractor records professionals shall be appointed in writing to the AFTAC Records Manager and shall meet the training and performance requirements identified in AFI 33-322 (Ref. Appendix C), Records Management Program and applicable AFTAC supplement. Contact the AFTAC Records Manager for specific guidance and procedures.

2.3.16.8 Quality

The Contractor shall perform quality reviews as defined in the Contractor’s Quality Management Plan (QMP) before code is pushed to an operational system. The Contractor shall ensure that the persons conducting quality control evaluations are not the persons who developed the product, performed the activity, or are responsible for the product or activity. This does not preclude such persons from taking part in these evaluations. The Contractor shall ensure that the persons responsible for ensuring compliance with the contract shall have the resources, responsibility, authority, and organizational freedom to permit objective quality evaluations and to initiate and verify corrective actions. (B010, QMP)

2.3.16.9 Proprietary and Licensed Items

The Contractor shall identify to the Government, prior to incorporation, any software or hardware without unlimited rights. The Contractor shall not use or deliver any proprietary computer hardware or software for the integration, operation, or maintenance of the cross-domain system without prior written Government PM or COR approval. The Contractor shall obtain and furnish to the Government copyright releases for all COTS products and provide copyright releases for all software and documentation generated by the Contractor because of this contract. The Contractor shall not incur any license fees, agreements, or other limitations on the use of proprietary resources without prior Government PM or COR approval. The Contractor shall identify proprietary and licensing material at PM reviews. (B001, Conf Min; A003, DAL)

2.3.16.10 Data Accession List (DAL)

The Contractor shall supply additional data in Contractor format as a DAL item. (A003, DAL)

2.3.17 Program Support

2.3.17.1 Transition

2.3.17.1.1 Phase-In (Transition from Incumbent)

2.3.17.1.2 Responsibilities

This Phase-In period shall not to exceed 90 days from start of performance, to allow the incoming Contractor to attain system competence. The Phase-In period shall be utilized by the incoming Contractor to hire, train and familiarize personnel with the Cross-Domain system.

During the Phase-In period the incoming Contractor shall receive orientation training from the incumbent Contractor for up to twenty (20) employees, shall perform accountability of the Government inventory, and shall transfer assignment of Government assets, i.e. computers, software, access codes/passwords, from the incumbent to the incoming Contractor. All personnel shall be hired, trained, and in place by completion of this Phase-In period. The incoming Contractor shall provide updated versions of the SEP, SDP, QCP and CMP for Government review during the Phase-In period.

2.3.17.1.3 Transition Meeting

An on-site transition meeting shall be conducted not later than 14 days after notification of contract award to discuss the incoming Contractor's Phase-in Transition Plan and the respective responsibilities of all parties. (B001, Conf Min)

2.3.17.1.4 Pre-Contract Start Date Meeting

A Pre-Contract Start Date meeting shall be conducted ten (10) days before the actual performance start date and shall include the discussions on the Contractor's readiness and capability to assume full responsibility. (B001, Conf Min)

2.2.17.1.5 Phase-Out (Transition to Successor)

If the Contractor performing under this contract award is the unsuccessful offeror in a subsequent contract for these services, or if this contract is terminated for any reason, the Contractor shall (before the expiration of this contract) provide all reasonable support to the Government and the successor Contractor to ensure an orderly transition and minimize any impact on operational readiness. This Phase-Out period shall not exceed 90 days but shall be no less than 30 days, unless otherwise specified by the Government. The Contractor shall provide the successor Contractor access to the site and to all technical documentation and publications on a non-interference basis during the phase-out period. The successor Contractor shall also be permitted to observe the Contractor performing the support services and equipment operations on a non-interference basis during the phase-out period. The incumbent Contractor shall retain full responsibility for all services and equipment in accordance with the PWS until completion of the phase-out period.

2.3.18 Personnel

The Contractor shall have the ability to obtain and maintain TOP SECRET-SCI security clearances for all Contractor personnel. All personnel shall be required to work in the AFTAC facility Building 10989, Patrick AFB, FL. US Citizenship is required for all personnel supporting the contract. Personnel identified as key personnel under Appendix E – Contractor Support Staff Descriptions shall have and maintain a TOP SECRET-SCI security clearance. The primary location for technical work is the AFTAC facility located in Building 10989, Patrick

SFB, FL.

2.3.18.1 Program Management

A Program Manager and alternate(s) shall be designated by the Contractor, in writing, to the Procurement Contracting Officer (PCO) and shall be responsible for contract performance and

1297539279C Cross-Out ensuring proper communication between Contractor and Government. The Program Manager shall be an employee of the Prime Contractor.

2.3.18.2 Contractor Program Support Staff

The Contractor shall provide and manage a program staff that provides the required skill sets, expertise and qualifications appropriate to the mission and scope of work. Multiple persons and their experience may be combined to provide a program staff area of expertise. All Contractor personnel shall have and maintain a TOP SECRET-SCI security clearance.

IAW AFM 33-285 and DoD 8570.01-M, program staff shall possess a DoD approved cybersecurity baseline certification commensurate to category and level of the assigned position.

The DoD approved listing can be found at this link:

http://iase.disa.mil/iawip/Pages/iabaseline.aspx. The DoD approved certification must cover knowledge areas in the secure software development life cycle (e.g. secure software requirements and design, secure coding techniques, and secure software deployment strategies) (T-1).

2.3.18.3 Appearance and Conduct

The Contractor shall be responsible for the supervision and conduct of employees. Contractor personnel shall always conduct themselves in a proper and efficient manner and wear the type of clothing worn by their counterparts in business and industry. A Government-furnished security badge shall be displayed and worn at all times.

2.3.19 Performance of Services During Crisis Declared by the National Command Authority or Overseas Combatant Commander

Contractor shall remain at fully operational status during any crisis declared by the National Command Authority or Overseas Combatant Commander according to DoDI 1100.22. The Contractor shall develop contingency plans for use during declared crises or natural disasters. In the contingency plans, the Contractor shall identify employees with military mobilization recall commitments and document procedures for replacing those employees in the event of mobilization. (A004, SEP)

3 SERVICES SUMMARY (SS).

The contract service requirements are summarized in performance objectives that relate directly to mission essential items. The performance threshold briefly describes the minimally acceptable levels of service required for each requirement. The Services Summary (SS) provides information on contract requirements and the expected level of contractor performance to be successful. These thresholds are critical to mission success. Procedures as set forth in the applicable Inspection clause in the contract will be used to remedy all deficiencies. The Government retains the right to inspect any item included in the contract.

Performance Objective PWS PARA Performance Threshold

SS # 1.

Timely response to call for 24/7 on-call support responding to call within 15 minutes

2.3.10.3 Quarterly: 90% of the time within 15

minutes. The remaining 10% within 30 minutes.

SS # 2.

Resolution of 24/7 on-call support problems within 60 minutes of initial notification

2.3.10.3.1 Quarterly: 95% of the time, issue is

resolved via phone or contractor is on site working the problem within 60 minutes. The remaining 5% within 90 minutes.

SS # 3.

Timely response to Urgent CRs resolving within 72 hours of approval notification

2.3.11 Quarterly: 100% of the time, unless

otherwise authorized by the COR.

SS # 4.

Timely data request verification, complete verification within one

(1) week of request approval

2.3.6.4 Quarterly. 50% of the time. The

remaining 50%, complete verification with two (2) weeks of promotion of the

CR.

Performance Objective PWS PARA Performance Threshold

SS # 5.

Timely submission of all Data Deliverables in accordance with PWS and CDRL schedule.

2.3.16.4; Quarterly. 95% of the time. The remaining 5% submitted no more than five (5) business days after established due date.

SS # 6.

All final Data Deliverables are delivered on time and require no administrative or technical clarifications or corrections.

2.13.16.5;

2.3.16.9;

2.3.16.10;

5.12

Quarterly. 95% of the time. The remaining 5% delivered, clarified or corrected, within 5 business days of due date.

4 GOVERNMENT FURNISHED PROPERTY AND SERVICES.

4.1 Services.

The Government will provide the necessary services for the contractor staff to provide the services outlined in this contract to include help desk support, IT security, trash, janitorial, and other services that are provided to Government personnel in AFTAC.

4.2 Facilities.

The Government will provide the necessary workspace for the contractor staff to provide the services outlined in this contract to include desk space, telephones, computers, and other items necessary to maintain an office environment, if the services provided are on-site (AFTAC headquarters). If the services are being performed at the contractor facility, no facilities will be provided.

4.3 Utilities.

The Government will provide the necessary utilities for the contractor staff to provide the services outlined in this contract to include electricity, heating, cooling, and water, if the services provided are on-site (AFTAC headquarters). If the services are being performed at the contractor facility, no utilities will be provided.

4.4 Equipment.

The Government will provide access to and use of Government equipment sufficient to carry out contractual functions. The Contractor shall monitor all assigned equipment in accordance with the terms of the contract and report any changes or updates to the Government Equipment Custodian. (B006, Status of GFE Report)

4.5 Materials.

The Government will provide access to and use of Government material sufficient to carry out contractual functions. The Government will provide Government Furnished Material as outlined in individual task orders.

5 GENERAL INFORMATION.

5.1 Contractor Identification in the Government Workplace.

When conversing with Government personnel during business meetings, over the telephone or via electronic mail, the contractor shall identify themselves as such to avoid situations arising where sensitive topics might be better discussed solely between Government employees. The contractor shall identify themselves on any attendance sheet or any coordination documents they may review. Electronic mail signature blocks shall identify their company affiliation.

5.2 Industrial Security.

DD Form 254. Overarching security requirements and contractor access to classified information will be as specified in the DD Form 254, Department of Defense Security Classification attached to the contract. The contractor shall have a final U.S. Government issued TOP SECRET-SCI security clearance and be DCID 6/4 eligible with a current SSBI.

5.3 Physical Security.

The contractor shall safeguard all Government property provided for contractor use. At the close of each work period, Government facilities, property, and materials shall be secured.

5.3.1 Key Control. The contractor shall establish and implement methods of ensuring that all keys and key cards issued to the contractor by the Government are not lost or misplaced and are not used by unauthorized persons.

5.3.1.1 The contractor shall immediately report the occurrences of a lost or duplicate key to the

COR.

5.3.1.2 In the event keys, other than master keys, are lost or duplicated, the total cost of rekeying or the replacement of the lock or locks shall be deducted from the monthly payment due the contractor. In the event a master key is lost or duplicated, all locks and keys for that system will be replaced by the Government and the total cost shall be deducted from the monthly payment due the contractor.

5.3.1.3 The contractor shall prohibit the use of keys issued by the Government by any persons other than the contractor’s employees. The contractor shall prohibit the opening of locked areas by contractor employees to permit entrance of persons other than contractor’s employees engaged in the performance of assigned work in those areas, or personnel authorized entrance by the COR.

5.3.2 Combinations and Codes. The contractor shall establish and implement methods of ensuring that all combinations and codes are not revealed to unauthorized persons. The contractor shall ensure that lock combinations are changed when personnel having access to the combinations no longer have a need to know such combinations.

5.3.2.1 Access lock combinations are “Controlled Unclassified Information” and shall be protected from unauthorized personnel.

5.3.2.2 Combinations to security containers, secure rooms, or vaults are classified information and shall properly safeguarded. Only the contractor employees with proper security clearance and need-to-know will be given combinations to security containers, secure rooms, or vaults.

5.3.2.3 Security alarm access codes are “Controlled Unclassified Information” and shall be protected from unauthorized personnel. Security alarm access codes will be given to contractor employees who require entry into areas with security alarms. The contractor shall properly safeguard alarm access codes to prevent unauthorized disclosure.

5.4 Privacy Act.

Work on this contract requires the contractor to have access to Privacy Information. The contractor shall adhere to the Privacy Act, Title 5 of the US Code, Section 552a and applicable Agency rules and regulations.

5.5 Location(s) of Work.

The work to be performed under this contract shall be performed at AFTAC HQ (Address Below). This requirement shall be defined at in individual task orders and via the DD254.

AFTAC HQ

Building 10989

1020 South Patrick Drive

Patrick AFB, FL 32925

5.6 Hours of Operation.

5.6.1 Normal Hours of Operation.

5.6.1.1 The contractor shall perform the services required under this contract during the following hours: Monday - Friday, 0600-1800 EST, except federal holidays. The contractor shall have the flexibility to manage their workforce within the hours of 0600-1800 Monday – Friday in order to provide the services specified in the PWS and in individual task orders.

5.6.2 24/7 Hours of Operation

5.6.2.1 For activities under PWS Paragraph 1.3, Scope, the contractor shall perform the on-call support 24 hours daily including federal holidays. The contractor shall manage their workforce in order to provide the on-call support outside of the hours specified in the PWS and in individual task orders.

5.6.3 Recognized Holidays.

The contractor is not required to provide service except as under PWS Paragraph 2.3.9- 2.3.10.3.1, 24/7 System Support, on the following federal holidays:

New Year’s Day Labor Day

Dr. Martin Luther King’s Birthday Columbus Day

Presidents’ Day Veterans Day

Memorial Day Thanksgiving Day

Independence Day Christmas Day

Juneteenth Day

5.6.3.1 If the holiday falls on Saturday, it is observed on Friday. If the holiday falls on a Sunday, it is observed on Monday.

5.6.3.2 The contractor shall not report for duty and shall not be reimbursed by the Government when the Government facility is closed due to a Federal holiday, local or national emergencies, administrative closings, or similar Government directed facility closings except as specified under PWS Paragraph 2.3.9 – 2.3.10.3.1, 24/7 System Support, and PWS Paragraph 2.3.19, Performance of Services During Crisis Declared by the National Command Authority or Overseas Combatant Commander.

5.7 Conservation of Utilities.

5.7.1 The contractor shall operate under conditions which prevent the waste of utilities which include the following:

5.7.1.2 Lights shall be used only in areas where and when work is being performed.

5.7.1.3 Mechanical equipment controls for heating, ventilation, and air conditioning systems shall not be adjusted by the contractor unless authorized.

5.7.1.4 Water faucets or valves shall be turned off after the required use has been accomplished.

5.7.1.5 Government telephones shall be used only for official Government business.

5.8 Records.

The contractor shall create, maintain and dispose of only those Government required records that are specifically cited in this PWS Paragraph 2.3.16.7, Records Management. If requested by the Government, the contractor shall provide the original record, or a reproducible copy of any such record within five (5) workdays of receipt of the request.

5.9 Contractor Manpower Reporting.

The Below information is for informational purposes only and shall not be initiated by the contractor without written directions from the Contracting Officer:

5.9.1 Overview. In accordance with Section 8108 of the National Defense Appropriations Act of Fiscal Year 2011 the contractor shall report, annually, for performing services on Department of Defense installations in support of this contract, all required prime contract and subcontract data, or require any subcontractors to report separately using the Enterprise-wide Contractor Manpower Reporting Application (eCRMA) located at http://www.ecmra.mil. There are four separate eCMRA tools: Army, Air Force, Navy and All Other Defense Components. The appropriate eCMRA reporting tool to use is determined by the requiring activity being supported (e.g., if DISA awards a contract for an Air Force requiring activity, the contractor shall load the required reporting data in the “Department of Air Force CMRA” tool). The contractor shall report ALL contractor direct labor hours and direct labor dollars (including subcontractor labor hours) required for performance of services provided under this contract. The contractor is only responsible for entering the Order, Contact, and Location Data. The contractor may view user manuals and frequently asked questions (FAQs) at https://cmra.army.mil/Help/help.html.

5.9.1.2 Initial Contract/Order Creation. The contractor shall enter initial data (Order and Contact Data only) into the appropriate eCMRA tool to establish the basic contract record no later than 30 calendar days after receipt of contract award. The contractor shall notify the COR and the CO when the basic contract record has been established in the appropriate eCMRA tool.

5.9.1.3 Annual Reporting. Reporting inputs will be for the direct labor executed during the period of performance (PoP) for each Government fiscal year (FY), which runs 1 October through 30 September. While inputs may be reported any time during the FY, all data shall be reported no later than 31 October of each calendar year. The contractor shall provide reporting inputs for the final PoP of this contract no later than 30 calendar days after contract expiration.

The contractor may direct technical questions about the eCMRA tool to the CMRA help desk at dodcmra@pentagon.af.mil.

5.9.1.4 Uses and Safeguarding of Information. Information from the secure website is considered to be proprietary in nature when the contract number and contractor identity are associated with the direct labor hours and direct labor dollars. At no time will any data be released to the public with the contractor’s name and contract number associated with the data.

5.10 Environmental Controls.

5.10.1 Compliance with Laws and Regulations. The contractor shall be knowledgeable of and comply with all applicable Interstate, Federal, State, and Local laws, regulations, and requirements regarding environmental protection. In the event environmental laws or regulations change during the term of this contract, the contractor shall comply as such laws come into effect. If there is an increase or decrease in cost as a result of the change, the contractor shall inform the CO pursuant to notice requirements and negotiate a modification to the contract.

5.10.1.2 Notification of Environmental Spills. If the contractor spills or releases any substance contained in 40 CFR 302 into the environment, the contractor shall immediately report the incident to the COR. The liability for the spill or release of such substance’s rests solely with the contractor.

5.11 Safety Requirements (If Applicable).

In performing work under this contract, the contractor shall:

5.11.1 Conform to the safety requirements contained in the contract for all activities related to the accomplishment of the work.

5.11.1.2 Take such additional immediate precautions as the CO may reasonably require for safety and mishap prevention purposes.

5.11.1.3 Record and report promptly (within one hour) to the CO or COR, all available facts relating to each instance of damage to Government property or injury to either contractor or Government personnel.

5.11.1.4 In the event of an accident/mishap, take reasonable and prudent action to establish control of the accident/mishap scene, prevent further damage to persons or property, and preserve evidence until released by the accident/mishap investigative authority through the CO.

If the Government elects to conduct an investigation of the accident/mishap, the contractor shall cooperate fully and support Government personnel conducting the investigation.

5.12 Contractor Personnel Training.

Contractors shall complete and shall participate in the government’s in-house and web-based security training. The Contractor shall attend training provided by the Government to support program activities. The Contractor shall include all Government-directed training activities in the MSR. Any additional specific training shall be specified in individual task orders. (B001, MSR; A003, DAL)

5.13 Special Training, Certifications and Qualifications.

5.13.1 Contractor personnel requiring access to a DoD Information System shall receive initial IA awareness training as a condition of access and thereafter shall complete annual IA refresher awareness, as required by DoD Directive 8140.3, "Information Assurance Workforce Improvement Program."

5.13.1.2 DoD 8140.3 Registration.

5.13.1.2.1 The contractor shall register all DoD 8140.3 certifications into the FAQs (DWCA) using the following web address:

https://public.cyber.mil/wf-element-sub/cybersecurity/

5.13.1.2.2 DWCA is the authoritative database of DoD Military, Civilian and Contractor personnel who hold active 8140 certifications used by the DoD CIO office to validate, monitor and report on the certification status of certified IA workforce members.

5.14 Periodic Progress Meetings.

The CO, COR, and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor's performance. At these meetings the CO will apprise the contractor of how the Government views the contractor's performance and the contractor shall apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. The contractor shall provide minutes of these meetings to the Government. (A001, Conf Min)

5.15 Contractor Travel and Other Direct Costs (ODC).

Travel, subsistence, and associated labor charges for travel time are authorized for travel beyond a 50-mile radius of the primary work site whenever a task assignment requires work to be accomplished at a temporary alternate work site. No travel or subsistence shall be charged for work performed within a 50-mile radius of the primary work site. Travel performed for personal convenience and daily travel to and from work at the primary work site shall not be a direct charge to this contract. The Contractor's travel and per diem costs shall not exceed the allowable costs set forth in the Joint Travel Regulations (JTR). Car rental for Temporary Duty (TDY) terms will be limited to a rate of one car for every four (4) persons on TDY at one site. All travel requirements (including destination, purpose, plans, agenda, itinerary, number and names of personnel, and dates) shall be pre-approved by the COR. The Contractor shall obtain concurrence of the COR prior to expending funds for ODCs. Contractor shall submit a trip report upon completion of travel. Costs for travel shall be billed on a strictly cost reimbursable basis IAW, the regulatory implementation of Public Law 99-234, Federal Acquisition Regulation (FAR) subpart 31.205-46 entitled Travel Costs and the limitation of funds specified in this contract. (A005, Trip Report)

5.16 Associate Contractor Agreements

Associate Contractor Agreements (ACA) are agreements between contractors working on government contracts or projects that specify requirements for them to share information, data, technical knowledge, expertise, or resources. Prime contractor to subcontractor relationships do not constitute ACAs and are not subject to this section s requirements.

ACAs may be needed when contractors working on separate Government contracts or task orders must cooperate, share resources or otherwise jointly participate in working on contracts or projects. The contractor should tailor each ACA to the requirements of the individual contracting situation and may consult with the contracting officer as required.

5.16.1 The Contractor shall enter into Associate Contractor Agreements (ACA) for any portion of the contract or an individual task order requiring joint participation in the accomplishment of the Government’s requirement. The agreements shall include the basis for sharing information, data, technical knowledge, expertise, and/or resources essential to the integration of the Cross

Domain System, which shall ensure the greatest degree of cooperation for the development of the program to meet the terms of the contract.

5.16.1.1 ACAs shall include the following general information:

5.16.1.2 Identify the associate contractors and their relationships.

5.16.1.3 Identify the program involved and the relevant Government contracts of the associate contractors.

5.16.1.4 Describe the associate contractor interfaces by general subject matter.

5.16.1.5 Specify the categories of information to be exchanged or support to be provided.

5.16.1.6 Include the expiration date (or event) of the ACA.

5.16.1.7 Identify potential conflicts between relevant Government contracts and the ACA;

include agreements on protection of proprietary data and restrictions on employees.

5.16.2 A copy of such agreement shall be provided to the Contracting Officer for review before execution of the document by the cooperating contractors.

5.16.3 Nothing in the foregoing shall affect compliance with the requirements of any Organizational Conflict of Interest clause.

5.16.4 The Contractor is not relieved of any contract requirements or entitled to any adjustments to the contract terms because of a failure to resolve a disagreement with an associate contractor.

5.16.5 Liability for the improper disclosure of any proprietary data contained in or referenced by any agreement shall rest with the parties to the agreement, and not the Government.

5.16.6 All costs associated with the agreements are included in the negotiated cost of individual task orders under this contract. Agreements may be amended as required by the Government during the performance of this contract or an individual task order.

5.17 Deliverables

Reports and other data required in contract PWS shall be submitted IAW the Contract Data Requirements List (CDRL) in Exhibit A of the master contract with the following exceptions:

(1) CDRLs A004, A007, B008, and B010 shall not need an “Initial submittal shall be provided 90 days after contract performance starts” and

(2) all CDRLs softcopy submission shall be via AFTAC NIPRNET unless submission contains classified information.

CDRL

DID

Number Data Item Description PWS Para. Delivery Schedule

B001 DI-ADMN-

81250A Conference Minutes

2.3.16.3, 2.3.16.9, 2.3.17.1.3, 2.3.17.1.4, 5.14

Action items due 1 work day after meeting.

Minutes due 7 calendar days after meeting.

B002 DI-MGMT-

80368A Monthly Status Report (MSR) 2.3.16.2, 2.3.16.4

Monthly; due 15 calendar days following the end of each month.

A003 DI-MGMT-

81453A Data Accession List (DAL)

2.3.16.5, 2.3.16.9, 2.3.16.10, 5.12

DAL due monthly; 15 calendar days following the end of each month.

All other data deliverables under this CDRL AS

REQUIRED.

A004 DI-SESS-

81785A

Systems Engineering Plan

(SEP)

2.3.11, 2.3.19

Initial submittal shall be provided 90 days after contract performance starts.

Yearly updates shall be provided by end of first quarter.

A005 DI-MISC-

80508B

Technical Report – Study/Services—Trip Report 5.15

Trip Reports shall be submitted within 7 calendar days of completion of travel.

B006 DI-MGMT-

80269/T

Status of Government Furnished Equipment (GFE) Report

4.4

Initial submittal shall be provided 90 days after contract performance starts.

Yearly updates shall be provided by end of first quarter.

CDRL

DID

Number Data Item Description PWS Para. Delivery Schedule

A007 DI-IPSC-

81427B

Software Development Plan

(SDP) 2.3.11

Initial submittal shall be provided 90 days after contract performance starts.

Yearly updates shall be provided by end of third quarter.

B008 DI-MGMT-

81808 Risk management Plan (RMP) 2.3.16.5

Initial submittal shall be provided 90 days after contract performance starts.

Yearly updates shall be provided by end of second quarter

A009 DI-IPSC-

81442A

Software Version Description

(SVD) 2.3.14

Yearly updates shall be provided by end of second quarter

B010 DI-QCIC-

81722

Quality Management Plan

(QMP) 2.3.16.8

Initial submittal shall be provided 90 days after contract performance starts.

Yearly updates shall be provided by end of first quarter

APPENDIX A – ACRONYMS AND ABBREVIATIONS LIST

Acronym/Abbreviation Definition AF Air Force AFB Air Force Base AFTAC Air Force Technical Applications Center ALT Alternate Operations Subsystem CAGE Commercial and Government Entity CDRL Contract Deliverable or Data Requirements List CFR Code Federal Regulation CI Configuration Item CM Configuration Management CMB Change Management Board CMP Configuration Management Plan CO Contracting Officer CONOPS Concept of Operations Defense Workforce Certification Application COR Contracting Officer’s Representative COTS Commercial Off-the-Shelf CR Change Request CSCI Computer Software Configuration Item CSD Contract Start Date DAA Designated Approving Authority DAL Data Accession List DBA Database Administration DBDD Database Design Description DCN Document Change Notice DMP Data Management Plan DoD Department of Defense DWCA Defense Workforce Certification Application eCRMA Enterprise-wide Contractor Manpower Reporting Application FAQs Frequently Asked Questions FAR Federal Acquisition Regulation FSP Forward Supply Point FY Fiscal Year GAFB Goodfellow Air Force Base GFP Government Furnished Property GMS Geophysical Monitoring System GOTS Government Off-the-Shelf HWCI Hardware Configuration Item IA Information Assurance IAW In accordance with ICD Interface Control Document IDC International…