DRAFT PWS ADIS CIDS 8 April 2025.pdf

AFLCMC/HIS WPAFB, OH 45433-5006

PERFORMANCE WORK STATEMENT (PWS)

By Multi-Functional CDT

For

Acquisition Due-In System (ADIS) and

Contracting Information Database System (CIDS)

CONTRACT NUMBER: TBD

SOLICITATION NUMBER: TBD

25 Feb 2025

Version 1

1.0 PURPOSE AND BACKGROUND

1.1 The Acquisition Due-In System (ADIS)(J041) program

1.2 The Contracting Information Database System (CIDS)(J018R) program

2.0 SCOPE

2.1 Program Office

2.2 Support

2.3 Personnel

2.4 Privacy Act

3.0 CAPABILITIES/DESCRIPTION OF SERVICES

3.1 ADIS (J041) Capability Support

3.2 CIDS (J018R) Capability Support

3.3 Helpdesk/Production Support (ADIS and CIDS)

3.4 Continuous Capability Delivery (ADIS and CIDS)

3.5 System Migration/Subsumption (ADIS and CIDS)

3.6 Security and Cybersecurity Support (ADIS and CIDS):

3.7 DoD Internet Protocol version 6 (IPv6) Requirements

4.0 PROGRAMMATIC REQUIREMENTS:

4.1 Technical Reports

4.2 Application of Government Processes and Tools

4.3 Post Award Conference

4.4 Inbound Transition Planning

4.5 Outbound Transition Planning

4.6 Outbound Transition Support (Option CLIN XXX)

5.0 CONTRACTUAL REQUIREMENTS:

5.1 Government Furnished Information (GFI):

5.2 Place of Performance:

5.3 Normal Hours of Operation:

5.4 Government-Furnished Property:

5.5 Non-Personal Services:

5.6 Other Direct Costs:

5.7 Contractor Identification:

5.8 Performance Reporting:

5.9 Documentation and Data Management:

5.10 Records, Files, and Documents:

5.11 Data Deliverables:

5.12 Defense Contractor Manpower Reporting:

5.13 Security:

5.14 Personnel Cybersecurity:

5.15 Personnel Investigation, Clearances, Computer, and Network Access

5.16 Confirming Compliance with Cybersecurity Workforce Requirements:

5.17 Annual Requirement for Cyber Awareness and Force Protection Training:

5.18 Transmission of Classified Material:

5.19 System and Network Authorization Access Requests:

5.20 Common Access Card (CAC):

5.21 In/Out Processing:

5.22 Organizational Conflict of Interest (OCI)

5.23 Travel:

5.24 Training

5.25 Continuation of Essential Contractor Services

5.26 Combatting Trafficking in Persons (CTIP):

5.27 Workspace at WPAFB, OH:

6.0 CHANGE PROPOSALS

6.1 Engineering Change Proposal (ECP)

6.2 Contract Change Proposal (CCP):

7.0 SERVICES DELIVERY SUMMARY

8.0 ENVIRONMENTAL, HEALTH, AND SAFETY

8.1 Safety and Health Requirements

8.2 Voluntary Protection Program (VPP)

APPENDIX A: APPLICABLE STANDARDS AND REFERENCES

APPENDIX B: ACRONYM LIST

REVISION HISTORY

CHANGE SECTION/PARAGRAPH DATE MADE BY

Version 1 Draft 25 Feb 2025 PMO, FMO

ADIS and CIDS Support

CONTRACT PERFORMANCE WORK STATEMENT (PWS)

1.0 PURPOSE AND BACKGROUND

1.1 The Acquisition Due-In System (ADIS)(J041) program provides a single repository of information for items centrally procured at the Air Logistics Complexes (ALCs). ADIS maintains and processes data for contracting and requirements activities from Purchase Request (PR) initiation (pre-Award) through the contract lifecycle to contract closeout (post- Award). Additionally, ADIS maintains historical data on stock numbered items. ADIS uses Continuous Capability Delivery (CCD) to execute sustainment. The Air Force Life Cycle Management Center (AFLCMC) Business and Enterprise Systems (BES) Directorate, Enterprise Logistics Readiness Portfolio (HI4) Supply (HIS), Logistics, Purchasing and Contracting Product Line (LPC) maintains ADIS in a fully-operational state and does as-needed patch releases to correct any deficiencies discovered in the current code base and to keep the application compliant with current statutory and regulatory guidelines. ADIS is a financial feeder system making it subject to an annual Financial Improvement and Audit Readiness (FIAR) review by an Independent Private Auditor (IPA). The application is hosted at Defense Information Systems Agency (DISA) Defense Enterprise Core Computing (DECC) Ogden, UT on an International Business Machine Multiple Virtual Storage (IBM MVS) mainframe platform.

1.2 The Contracting Information Database System (CIDS)(J018R) program provides the ALCs with an on-line Ad Hoc query solution utilizing a desktop client application and an Oracle relational database management system server. CIDS provides clients with the data necessary to improve the Air Force Materiel Command (AFMC) acquisition process and expedite PR processing. CIDS provides capabilities for the Item Managers to view the National Item Identification Number (NIIN) Item History record and provides Buyers and Item Managers a view into the central contracting processes by providing an automated method of reviewing contract data derived from ADIS and contract related data from Mechanization of Contract Administration Services (MOCAS) (Closeout), Wide Area Work Flow (WAWF) (Shipment/Acceptance) and D035A(Receipts). CIDS uses CCD to execute sustainment. CIDS uses the Agile software development approach to develop and maintain interfaces with interface partners and to keep the application compliant with current statutory and regulatory guidelines. CIDS is a financial feeder system making it subject to an annual FIAR review by an IPA. The client application is installed on desktops at the ALCs and connects via SQLNet to an Oracle database hosted on a MS Windows server located at Wright-Patterson Air Force Base (WPAFB), OH.

2.0 SCOPE

2.1 Program Office. The Program Office for ADIS and CIDS is located at WPAFB, OH and is responsible for the daily operations and maintenance of the logistics business systems associated with the Air Force (AF) acquisition process. The scope of services for this contract is to provide program operations support for the ADIS and CIDS programs.

2.2 Support. Support includes, but is not limited to, software development and maintenance, Helpdesk/Production support, Compliance for FIAR/FFMIA/etc., Technical liaison support for Headquarters (HQ) AFMC/A4N, Air Force Sustainment Center (AFSC)/LGPS, and HQ AFMC/PK (i.e., Portfolio Managers, Customers), architectural documentation development including interfaces, Security Technical Implementation Guidance (STIG) documentation necessary to achieve an Authority to Operate (ATO), subsumption/decommission, and audits.

2.3 Personnel. The Contractor shall furnish personnel and related services required to meet the PWS objectives as described in the requirement description section of this PWS.

2.4 Privacy Act. Work on this project may require personnel to have access to Privacy Act Information. As required, Contractor personnel shall adhere to the Privacy Act, U.S. Code, Title 5, Part 1, Chapter 5, Subchapter II, Section 552a and applicable agency rules and regulations.

2.5 Data Rights

Unlimited rights in technical data, computer software and computer software documentation are required for this effort.

3.0 CAPABILITIES/DESCRIPTION OF SERVICES

3.1 ADIS (J041) Capability Support

A. The Contractor shall provide personnel with knowledge and capabilities in Common Business-Oriented Language (COBOL), COBOL Language Extender (COBOL LE), International Business Machine Multiple Virtual Storage Job Control Language (IBM MVS JCL), International Digital Electronic Access Library (IDEAL), and other tools, e.g. DISA Multi-host Internet Access Portal (MIAP) and Reflection ZFE for 3270 terminal emulation within a Hypertext Markup Language (HTML)-5 capable browser, associated with the mainframe environment located at the DISA DECC in Ogden, UT.

B. The Contractor shall provide personnel with knowledge and experience in system programming/monitoring in the following areas:

1. Write application operating and installation instructions to coordinate with DISA personnel (Contract Data Requirements List (CDRL) A011)

2. Provide meeting agendas, record and track project team meeting minutes for monthly and ad hoc meetings (CDRL A004)

3. Create test cases, test results, and test reports and summaries (CDRL A010, A012)

4. Maintain applicable product design documentation (see technical library), to include but not be limited to interface diagrams, architectural views, etc.

5. Create and update Interface Control Documents (ICD) into the Corporate Data Repository System (CDRS)

6. Provide File Transfer Protocol (FTP) and Secure File Transfer Protocol (SFTP) transmission support

7. Ensure STIG compliance is achieved by applying all approved STIGs to the applications as they are issued

8. Prepare Software Installation Plan (CDRL A011)

9. Technical support for the maintenance and modification of ADIS and its related software modules, including but not limited to, systems analysis, design, programming, testing, deployment, on-going customer support and documentation for Change Requests (CR) and Deficiency Reports (DR) in the Information System Management Tool (ISMT) (approximately three per year) defined required software changes. This includes the modification/addition of code as required to maintain and update the ADIS system, as well as the creation and updating of sprint and release documentation.

3.2 CIDS (J018R) Capability Support

A. The Contractor shall provide personnel with knowledge and experience in PowerBuilder 2017 or higher, Oracle 19c database environment or higher, Extensible Markup Language (XML), Microsoft (MS) Windows operating systems (OS) and office products, as well as standard transfer protocols e.g. IBM MQ Series, FTP, and

SFTP.

B. The Contractor shall maintain and operate CIDS application and database servers and software to comply with current Information Technology (IT) policies/directives.

C. The Contractor shall provide personnel with knowledge and experience in technical support for the maintenance and modification of CIDS and its related software modules, including but not limited to, systems analysis, design, programming, testing, deployment, on-going customer support and documentation for CRs and DRs in ISMT (historically 38 per year) defined required software changes to support a minimum of four releases annually. The Contractor shall provide personnel with administrative and project management knowledge and experience in the following areas:

1. Creating Sprint Plans (CDRL A004)

2. The contractor shall utilize an Agile development methodology in concert with the Government. The contractor shall work with the government in a team-based Agile environment. The contactor shall create and maintain the system architecture, requirements backlog, and roadmaps that will be the basis for the contractor’s work.

3. The contractor shall support the government in the development and estimate of user stories, a release plan, systems engineering products, and acceptance criteria.

4. Program planning, forecasting, and describing in detail the sprint plan

5. Providing technical briefings/reports, CDRLs, demonstrations, and attending meetings as required

6. Managing the Contractor workforce and assigning tasks

7. Providing meeting agendas, recording and tracking project team meeting minutes for weekly and ad hoc meetings (CDRL A004)

8. Participating in programmatic meetings and reviews to ensure compliance with all standards referenced in Appendix A

9. Preparing a Monthly Status Report (MSR) to include all project management activities to maintain control and provide the Government visibility into Contractor program activities and progress. (CDRL A001)

10. Monitoring and maintaining the requirements for software licenses. Download updates when available, and purchase new licenses as required through Other Direct Costs (ODC).

D. The Contractor shall provide personnel with system administration knowledge and experience in the following areas. The personnel fulfilling these requirements shall have a SECRET Clearance:

1. Ensuring STIG compliance is achieved by validating that all approved STIGs have been applied to the servers as they are issued.

2. Remediating all Category (CAT) I, II, and III vulnerabilities within compliance timelines directed by Information Assurance Vulnerability Alerts/Bulletins (IAVA/B). Provide input to the Plan of Actions and Milestones (POA&M) as required to bring the affected system into compliance.

3. Maintaining MS Windows servers, to include rebooting, in the Production, Development, and Test environments.

4. Ensuring implementation of OS software patches and updates performed by the 88th Communications Squadron (CS).

5. Reviewing server event logs for anomalies. Report any anomalies and corrective actions to the Government Capability Delivery Manager (CDM) for approval to implement. (CDRL A003)

6. Planning and organizing the architecture of the Test and Development environment located in the Capabilities Integration Environment (CIE) at Gunter Air Force Base (AFB), AL.

a. Within the CIE:

1) Install and configure all server and workstation software

2) Create all scheduled tasks

3) Configure all groups and permissions for the users

7. Monitoring daily database load and interface applications for successful completion

E. The Contractor shall provide personnel with application development knowledge and experience in the following areas:

1. Maintaining applicable product design documentation (see technical library), to include but not be limited to interface diagrams, architectural views, help files, etc. (CDRL A005)

2. Creating and updating ICDs into the CDRS

3. Creating and updating sprint and release documentation

4. Creating HASH file for validating entire CIDS Client Application installation file has been fully downloaded and instructions to users on how to use the HASH file.

5. Preparing Software Installation Plans for each release (CDRL A011)

6. Creating test cases, test results, and test reports (CDRL A010, A012)

7. Ensuring STIG compliance is achieved by applying all approved STIGs to the applications as they are issued

8. Modifying/adding code as required to maintain and update CIDS

F. The Contractor shall provide personnel with Oracle Database Administration knowledge and experience in the following areas:

1. Supporting at least nine Oracle database instances including daily backups and availability

2. Supporting patching for each database instance at least quarterly

3. Ensuring STIG compliance is achieved by applying all approved STIGs to the databases as they are issued

4. Troubleshooting Oracle issues and providing solutions to the Government Capability Delivery Manager for approval to execute

5. Conducting database refreshes as required

3.3 Helpdesk/Production Support (ADIS and CIDS)

A. The Contractor shall provide Helpdesk/Production Level II and III to support ADIS and CIDS user questions and requests. The Contractor shall record and track all DRs and trouble tickets in the ADIS and CIDS SharePoint Help Desk sites. The Contractor shall maintain the SharePoint Help Desk site.

1. The level definitions follow:

a. Level I – Basic application support (i.e., password reset) Performed by ALC site managers or DISA

b. Level II – More complex application support (i.e., Functional and Capability Delivery Team (CDT) collaboration for support)

c. Level III – Usually subject matter experts (SME) involving changes to application software

B. The Contractor shall provide Helpdesk/Production Level II and III support during normal duty hours and off-hours. Tickets shall be logged in the CIDS or ADIS SharePoint Help Desk tool within one hour of the Contractor being notified, and analysis initiated within four business hours of notification. Some Level II and III support may need to be coordinated with infrastructure providers (88th CS, DISA, CIE). Help Desk metrics shall be reported with requirements presented in accordance with (IAW) Government direction. Help Desk activities include, but are not limited to:

1. Correctly identifying problems and achieving resolution

2. Performing metrics collection and reporting

3. Providing ticket resolution descriptions, as required, to other agencies

4. Participation in resolution meetings

5. Receive/field trouble tickets from customers/users

6. Installation assistance, standard system configuration

7. General trouble-shooting of common system errors

8. System checks to ensure system is active and functioning

9. Checking/verifying running standard reports

10. Research code/procedures/script errors

11. Examine database connection issues

12. Research user connectivity issues

13. Resolve data integrity errors

14. Troubleshoot SFTP and FTP errors

15. Address firewall issues

16. Support application software loads

17. User Account Permission Issues

18. Monitor, update, and track all trouble tickets (including those submitted to external organizations, i.e., DISA, 88th CS, etc.) with status and resolution information in the SharePoint Help Desk (approximate number of trouble tickets per year for ADIS is 12 and for CIDS is 32).

3.4 Continuous Capability Delivery (ADIS and CIDS).

A. The Contractor shall maintain the integrity of the data contained in ADIS and CIDS software within the Government-owned and operated computing facility.

B. The Contractor shall notify the appropriate Government representative of scheduled outages at least five business days prior to the outage. Unscheduled outages shall be reported to the Government within one business hour of the outage. Additionally, the Contractor shall log such unscheduled outages IAW Helpdesk/Production Support requirements located in this document.

C. The Contractor shall work directly with Government organizations to resolve all technical and network connection issues, security scans, cybersecurity (formerly known as Information Assurance (IA)) controls affecting ADIS and CIDS operations, and perform contingency testing. The Contractor shall escalate issues to the ADIS and/or CIDS CDM.

D. The Contractor shall maintain existing systems and environments IAW the United States Air Force (USAF) Acquisition Process Model (APM) https://www.afacpo.com/apm/ (replacing the BES Process Directory (BPD) which sunset 1 Mar 2020), and sustain applications, databases, and interfaces in compliance with applicable AF/Department of Defense (DoD) standards including but not limited to those referenced in Appendix A.

E. The Contractor shall provide patch management support for multiple software versions, providing technical assistance and maintenance, for reporting deficiencies in software.

F. The Contractor shall perform Configuration Management (CM) activities which shall include, but not be limited to, management and planning of the CM process, software configuration identification, software configuration control, software configuration status accounting, software configuration auditing, software release management and delivery, change control, appropriate signatures, and proper filing. (CDRL A007)

G. The Contractor shall analyze requirements and prepare reports, Rough Orders of Magnitude (ROM) and/or solutions on findings as applicable. (CDRL A003)

H. The Contractor shall attend Integrated Product Team (IPT) workgroup meetings and/or Agile ceremonies.

I. The Contractor shall serve as a technical liaison for AFLCMC/HIS with various offices, including but not limited to, AFSC/LGPS, HQ AFMC/A4N, AFMC/PK, DISA and other program offices and entities in the Federal, Civilian, and DoD sectors to ensure that AFLCMC/HIS incorporates AF business rules into overall system architecture.

https://www.afacpo.com/apm/

3.5 System Migration/Subsumption (ADIS and CIDS): The Contractor shall assist in completing the migration and modernization efforts from legacy ADIS and CIDS to AFMC/A4N’s Enterprise Supply Chain Analysis Planning and Execution Operational Data Store (ESCAPE ODS) platform.

A. Review of in-bound and out-bound ICDs, Date Element Mnemonics, rectifying note field data that is actually live data, record layouts, etc. to complete a comprehensive data model and mapping.

B. Assist with Business Process Re-engineering (BPR) or transformational business process efforts as required.

C. Provide any known documentation on functionality and capability in ADIS and

CIDS.

D. Assist with developing documentation of ADIS and CIDS functionality and capability to enable migration to the cloud.

E. Provide current calculations, transformations, or edits performed by ADIS and CIDS.

F. Provide current database structure, schema, and data mappings to landing, processing, or load tables.

G. Provide current ADIS and CIDS code.

H. Provide all cybersecurity documentation related to the current ATO, including system security plan and all artifacts related to individual controls.

I. Provide other related information as deemed necessary by the AF to migrate ADIS and CIDS.

3.6 Security and Cybersecurity Support (ADIS and CIDS): The Contractor shall provide security and cybersecurity support for the legacy ADIS and CIDS.

A. The Contractor shall provide support toward completing Risk Management Framework (RMF) requirements, including, but not limited to, maintaining hardware and software inventories and recording updates, maintaining current configuration/architecture diagrams, employing security tests on a regular basis, employing actions designed to correct deficiencies and reduce or eliminate vulnerabilities in the system, employ security controls on an ongoing basis and demonstrate the security posture of the system is continuously acceptable.

B. The Contractor shall provide support toward ensuring the success of the program’s Cybersecurity package to include, but not be limited to, review of the Information Security Continuous Monitoring Plan (ISCMP), Configuration Management Plan (CMP), System Security Plan, Incident Response Plan, and Contingency Plan, implementing STIG checklists, reviewing various documents such as Ports, Protocols & Services (PPS) worksheets, configuration guides, regulations, instructions and manuals.

C. The Contractor shall provide any other support required for completion and approval of Authority to Connect (ATC) or ATO packages and all efforts for completion of documents required for successful RMF as it pertains to ADIS and CIDS.

D. Agent of the Certifying Authority (ACA) Support Services- Not applicable

3.7 DoD Internet Protocol version 6 (IPv6) Requirements: All Products must be IPv6 capable. Some examples of IPv6 mandated products from the DoD IPv6 Standards Profile are listed below:

A. Host/Workstations: A desktop or other end-user computer or workstations running a general purpose OS such as UNIX, Linux, Windows, or a proprietary OS that is capable of supporting multiple applications.

B. Network Appliance or Simple Server: Simple end nodes such as cameras, sensors, automation controllers, networked phones or adapters such as Circuit-to-Packet (CTP) devices, typically with an embedded OS and specialized software for limited applications. A Network Appliance is typically managed by an end-user, but may support more than one concurrent user remotely via a Web browser interface. A Simple Server supports a small number of concurrent clients via a web browser interface or other protocol with a client application. Examples of simple servers are stand-alone network print servers, storage servers, Session Initiation Protocol (SIP) 11 servers, a “web camera” appliance that serves pictures via an embedded web server, and a network time server appliance that solely functions to serve Network Time Protocol (NTP) requests. Advanced Server-End Nodes with one or more server-side applications (for example Dynamic Host Configuration Protocol (DHCPv6), Domain Name Server (DNS), NTP, E-mail, FTP, Hypertext Transfer Protocol (HTTP), web server, storage server or database) to support clients in the network

C. Intermediate Nodes: Routers, Switches, IA or IA enabled devices

D. IPv6 Capable Software: A product that implements functions available via an IPv6 interface to end-users, network needs or other software, when installed on an appropriate hardware platform.

4.0 PROGRAMMATIC REQUIREMENTS:

4.1 Technical Reports: The Contractor shall prepare technical reports for the consumption, performance, and monitoring of products and services related to the ADIS and CIDS operational environments as well as system migration. The Contractor shall also prepare reports related to the development of code if an equivalent product is not produced as part of an agile methodology. This shall include, but not be limited to, the following:

A. ROM (A003)

B. Sprint Plan (CDRL A004) C. Software Development Plan (CDRL A013) D. Vulnerability Scan Compliance (VSC) Report Response (CDRL A008) E. Software Test Report (STR) (CDRL A010) F. Computer Software Product (Source Code, etc.) (CDRL A013) G. Incident reports (A003) H. Version Description Documents (VDD) (A003) I. Change Control Documents (CCD) (A003) J. Software Test Description (STD) and related Test Cases (CDRL A012) K. Requirements Traceability Matrix (RTM) (A003)

4.2 Application of Government Processes and Tools: The Contractor shall adhere to the Government’s operational policies, processes and procedures to complete the requirements identified in this PWS. Currently, these policies, processes, and procedures are included in the USAF APM (replacing the BPD which sunset 1 Mar 2020).

4.3 Post Award Conference: The Contractor agrees to attend a post award conference at a location agreed upon by the CDT and Contractor convened by the contracting activity or contract administration office IAW Federal Acquisition Regulation (FAR) Subpart 42.5.

Appropriate action shall be taken to resolve outstanding issues. The conference will be scheduled no later than 30 calendar days after start of Period of Performance (PoP). As a minimum, the post-award conference attendees shall be the CDT Capability Delivery Manager, CO and key support team members from both the Government and Contractor.

The topics at the Post Award conference shall include, at a minimum, a project overview, the team organization, schedule, technical approach and process, requirements management, risk management, communications, resource planning, and metrics. Project Planning (CDRL A004)

4.4 Inbound Transition Planning: The Contractor shall deliver an Inbound Transition Plan at contract award or as required. Delivery shall consist of one electronic copy. The Contractor shall present a methodology detailing how transition will occur from the current Contractor to the new Contractor at the beginning of this contract to prevent both loss of support or additional cost. The Contractor shall execute their transition plan to become fully operational at the start of the PoP. The transition plan shall include, but not be limited to, providing for the orderly startup of server administration, oracle database administration, Helpdesk/Production support, training, sustainment and transfer of all items related to the maintenance of ADIS and CIDS. Software Transition Plan (STrP) (CDRL A009)

4.5 Outbound Transition Planning: The Contractor shall deliver an Outbound Transition Plan upon Contracting Officer (CO) request. Delivery shall consists of one electronic copy.

The Contractor shall conduct an outbound transition period of up to 60 calendar days to ensure a smooth transition in the change of work effort to any new Contractor. The

Contractor shall cooperate to the extent required to permit an orderly change over to any Contractor. The Contractor shall execute their Transition Plan which shall include contract exit procedures. Software Transition Plan (STrP) (CDRL A009)

4.6 Outbound Transition Support: The Contractor shall execute the Transition Plan to affect successful project transition for ADIS and CIDS upon CO request. During the outbound transition period at contract expiration, the Contractor shall perform a joint inventory of Government Furnished Information (GFI) with the Government.

5.0 CONTRACTUAL REQUIREMENTS:

5.1 Government Furnished Information (GFI): The Government will provide access to all necessary information required for this effort. All GFI is provided explicitly for providing the services of this contract and shall not be considered transferred to the Contractor at any time.

All GFI shall be returned to the Government upon completion or termination of this contract.

5.2 Place of Performance: During normal operations the Contractor shall perform all work in Government facilities located at WPAFB, OH.

5.3 Normal Hours of Operation: The Contractor shall provide coverage for the services required under this contract within the hours of 0600 – 1800 Eastern Standard Time (EST) Monday through Friday, except federal holidays. In excess of the standard 40 hour week shall not be allowed without written approval from the CO if necessary.

A. In the course of business, situations may arise where Government facilities may not be available for performance of the requirements (i.e., base closure due to weather, Force Protection conditions, etc.). In the event of these situations, the Contractor is still required to provide services at an alternate duty location.

B. There may also be occasions when support Contractors are invited to participate in morale and recreational activities (i.e. holiday parties, golf outings, sports days and other various social events). Contractor employees shall not be directed to attend such events by the Government. Participation in such events is not billable to the contract.

C. Recognized Federal Holidays. The Government will not be billed overtime or additional cost for holidays, except when services are required by the Government and are actually performed on a holiday. The following days are Government holidays:

New Year’s Day Martin Luther King Day President’s Day Memorial Day Independence Day Labor Day Columbus Day

Veteran’s Day Thanksgiving Day Christmas Day

If the holiday falls on a Saturday, it is observed on a Friday. If the holiday falls on a Sunday, it is observed on Monday.

In addition to the days designated as holidays, the Government observes the following days:

Any other day designated by Federal Statute Any other day designated by Executive Order Any other day designated by the President’s proclamation

5.4 Government-Furnished Property: Government-Furnished Property is not applicable for this effort.

5.5 Non-Personal Services: The Government will neither supervise Contractor employees nor control the method by which the Contractor performs the required tasks. Under no circumstances will the Government assign tasks to, or prepare work schedules for, individual Contractor employees. It shall be the responsibility of the Contractor to manage its employees and to guard against any actions that are of the nature of personal services, or give the perception of personal services. If the Contractor feels that any actions constitute, or are perceived to constitute personal services, it shall be the Contractor’s responsibility to notify the Government CO immediately. These services shall not be used to perform the work of a policy/decision making or management nature, i.e., inherently Governmental functions. All decisions relative to programs supported by the Contractor will be the sole responsibility of the Government.

5.6 Other Direct Costs: The Contractor shall identify ODCs and miscellaneous items as specified in the contract. The CO must approve any ODCs in writing prior to costs being incurred. In situations where the purchase of new commercial off-the-shelf (COTS) software is needed to satisfy the requirements, the Contractor shall use available existing enterprise licenses. If enterprise licenses are unavailable, then products will be obtained via the DoD Enterprise Software Initiative (ESI) Blanket Purchase Agreements (BPAs). The use of the General Service Administration’s Blanket Purchase Agreements is mandated IAW AF Manual (AFMAN) 17-1203. The updated listing of COTS software available from DoD ESI sources can be viewed at: https://www.esi.mil/. The Contractor shall report ODC purchase status in the Other Direct Costs Report (CDRL A002). No profit or fee will be added, however Defense Contract Audit Agency (DCAA) approved burden rates are authorized.

The Contractor shall ensure that software licenses and equipment fielded on DoD networks are listed on the Department of Defense Information Network Approved/Evaluated Products List (DoDIN A/EPL) and/or the Air Force Approved/Evaluated Products List (AF A/EPL).

The DoDIN and AF A/EPL must be consulted prior to purchasing a system or product. If no listed product meets the organization's needs, the organization may sponsor a product for testing that does meet their needs.

A. ODCs must be allowable in the General Services Administration Federal Supply

Schedule, or

B. ODCs must be added by specific CO reference, and the CO must approve the ODCs prior to the Contractor’s purchase in writing. In addition, at the time of requesting approval, the Contractor shall provide current quotes from three (3) vendors or other proof of cost reasonableness as well as brand name justification, if a brand name justification is applicable.

5.7 Contractor Identification: All Contractor/Subcontractor personnel shall be required to wear AF-approved or provided picture identification badges so as to distinguish themselves from Government employees. When conversing with Government personnel during business meetings, over the telephone or via electronic mail, Contractor/Subcontractor personnel shall identify themselves as such to avoid situations arising where sensitive topics might be better discussed solely between Government employees. Contractors/Subcontractors shall identify themselves on any attendance sheet or any coordination documents they may review.

Electronic mail signature blocks shall identify their company affiliation. Where practicable, Contractor/Subcontractors occupying collocated space with their Government program customer should identify their work space area with their name and company affiliation.

5.8 Performance Reporting: The Contractor’s performance will be monitored by the Government throughout the contract’s period of performance. Paragraph 7 of this PWS include a Services Delivery Summary. It will also be reported annually in the Contractor Performance Assessment Reporting System (CPARS).

5.9 Documentation and Data Management: The Contractor shall maintain and administer an integrated data management system for collection, control, publishing, and delivery of all program documents. The data management system shall include, but not be limited to, the following types of documents: CDRLs, white papers, status reports, contract letters, and contract proposals. The Contractor shall provide the Government with electronic access to this data, including access to printable reports. All products resulting from this contract shall be the property of the Government.

5.10 Records, Files, and Documents: All physical records, files, documents, and work papers, provided and/or generated by the Government and/or generated for the Government in performance of this PWS, maintained by the Contractor which are to be transferred or released to the Government or successor Contractor, shall become and remain Government property and shall be maintained and disposed of IAW AFMAN 33-363, Management of Records; AFI 33-364, Records Disposition – Procedures and Responsibilities; the FAR, and/or the Defense Federal Acquisition Regulation Supplement (DFARS), as applicable.

Nothing in this section alters the rights of the Government or the Contractor with respect to patents, data rights, copyrights, or any other intellectual property or proprietary information as set forth in any other part of this PWS.

5.11 Data Deliverables: The Government requires all deliverables that include Scientific and Technical Information (STINFO), as determined by the Government, be properly marked IAW DoD Directive 5230.24 and AFI 61-204 prior to initial coordination or final delivery.

Failure to mark deliverables as instructed by the Government will result in non-compliance and non-acceptance of the deliverable. The Contractor shall include the proper markings on any deliverable deemed STINFO regardless of media type, stage of completeness, or method of distribution. Therefore, even draft documents containing STINFO and STINFO sent via e-mail require correct markings.

A. Assist in USAF APM (replacing the BPD which sunset 1 Mar 2020) document preparation and updates to include but not be limited to:

1. Business Impact Analysis (BIA)

2. Business Continuity Plan (BCP)

3. CMP

4. Integrated Test Plan (ITP)

5. Risk Management Plan

6. Requirements Management Plan (RMP)

5.12 Defense Contractor Manpower Reporting: In accordance with 10 U.S.C. 2330a, the Department of Defense requires contractors to provide service data using Service Contract Reporting located in the System for Award Management, (www.sam.gov) site (replacing the Enterprise Contractor Manpower Reporting Application (eCMRA) as of FY 2020). All Acquisition Service Portfolios in excess of $3,000,000.00, in total purchases are required to report data in the Service Contract Reporting system for the following Services: Logistics Management Services, Equipment Related Services, Knowledge-based Services, Electronics and Communication Services (includes IT, Telecom Services, Equipment Maintenance/Leases PSCs).

5.13 Security: Individuals performing work under this contract shall comply with applicable program security requirements as stated in the contract. Contractors shall obtain adequate security clearances prior to performing services under the contract. The Contract Security Classification Specification (DD Form 254) describes the security requirements for the contract. A DD Form 254 is not required for these programs. All Contractors located on military installations shall also comply with Operations Security (OPSEC) requirements as set forth in DoD Directive 5205.02, DoD Operations Security Program and AFI 10-701, Operations Security. IAW Homeland Security Presidential Directive-12 Policy for a Common Identification Standard for Federal Employees and Contractors and AFMAN 17- 1301 Computer Security, DoD military, civilian, consultants, and Contractor personnel using unclassified automated information systems, including e-mail, shall have, at a minimum, a favorable Tier 1 (T1) background investigation (formerly called National Agency Check plus http://www.sam.gov/

Written Inquiries (NACI)). Personnel who require access to classified information, applications, or systems shall have, at the minimum, a security clearance equal to the classification of the information, application, or system being accessed. The types of Personnel Security Investigations (PSI) required for the Contractor vary in scope of investigative effort depending upon requirements of the Government and the work the Contractor will perform.

Contractors shall provide a listing of personnel who require a Common Access Card (CAC) to the Contracting Office (CO) and Trusted Associate (also called the Trusted Associate Sponsorship System (TASS) Trusted Agent (TA) or simply the TA). The Contractor shall submit on company letterhead the names, Cybersecurity position(s) the employee will fill, the date and appropriate certification for the Cybersecurity position, CDRL A015, Contractor’s Personnel Roster. Reference paragraph 5.14 Personnel Cybersecurity, subparagraph H. pertaining to AFMAN17-1303 for additional required information. The Government TA will verify each individual’s clearance prior to sponsoring the individual for a CAC.

In cases where access to systems such as e-mail is a requirement of the Government, application/cost for the PSI shall be the responsibility of the Government. These PSIs are the Tier 1 (T1), Tier 3-for-Information Technology II (T3-for-IT2), and Tier 5-for-Information Technology I (T5-for-IT1) investigations. In cases where access to classified systems or information is a condition of the contract, application/cost for the appropriate PSI shall be the responsibility of the Contractor. These PSIs are the Tier 3 and Tier 5 investigations. In such instances, the Contractor shall diligently pursue obtaining the appropriate security clearance eligibility for its employees prior to assigning them to work the contract. Uncleared contractors shall not be assigned to work under contract (i.e., bill the government) if their position requires a security clearance. Acquisition planning must consider Antiterrorism (AT) measures when the effort to be contracted could affect the security of operating forces (particularly in-transit forces), information systems and communications systems IAW DoD Instruction 2000.16, Antiterrorism (AT) Standards. Contractor employees shall be United States citizens. Foreign Contractor personnel are not permitted to participate at either the prime or Subcontractor level.

5.14 Personnel Cybersecurity: The Contractor shall comply with AFMAN 17-1303, Cybersecurity Workforce Improvement Program, 23 July 2018, which includes compliance with the DFARS 252.239.7001, Information Assurance Contractor Training and Certification, and all cybersecurity requirements stipulated herein.

A. The Contractor shall ensure that personnel accessing information systems have the proper and current cybersecurity certification to perform cybersecurity functions IAW DoD 8570.01-M, Information Assurance Workforce Improvement Program. The Contractor shall meet the applicable cybersecurity certification requirements, including (1) DoD-approved IA workforce certifications appropriate for each category and level as listed in the current version of DoD 8570.01-M; and

(2) Appropriate OS certification for IA technical positions as required by DoD 8570.01-M.

B. Upon request by the Government, the Contractor shall provide documentation supporting the IA certification status of personnel performing cybersecurity functions.

Contractor personnel who do not have proper and current certifications shall be denied access to DoD information systems for the purpose of performing cybersecurity functions.

C. These requirements shall apply to all Contractor personnel performing one or more cybersecurity functions identified, managed, and tracked as part of the DoD Cybersecurity Workforce, IAW DoD 8570.01-M, Paragraph C1.4.4.7, regardless of contract labor category, duty title, or full-time/part-time/additional duty status.

Examples include, but are not limited to, System Administrators, System Developers, Programmers, and System Engineers. Contract personnel serving as privileged users shall comply with AFMAN 16-1405, which includes the following requirements:

1. Shall meet all requirements of authorized users

2. Shall apply for Information System access as an IT Level I (Privileged) or IT

Level II (Limited Privileged) user on the DD Form 2875. In this context, IT Level is synonymous with Automated Data Processing (ADP) Level and Automated Information System (AIS) Level. Notably, an IT Level II’s work must be technically reviewed by an IT Level I.

3. Shall possess appropriate and current personnel security background investigation commensurate with required Information Technology Level certification. Per AFMAN 16-1405, IT Level I requires a favorably concluded Tier 5 background investigation, and IT Level II requires a favorably concluded Tier 3 background investigation.Shall complete a Privileged Access Agreement according to DoD 8570.01-M.

4. Shall only access data, control information, software, hardware, and firmware that they are authorized access and still have a requirement for “need to know.”

5. Shall maintain separation of duties and least privilege, users maintain separate accounts, a user account for day-to-day or “non-privileged” functions, and a privileged account for administrative functions

6. Shall not share privileged user accounts between users

D. The Contractor shall also meet the following, additional requirements specified in AFMAN 17-1303: The Contractor shall have the appropriate DoD-approved cybersecurity baseline certification(s) prior to supporting any Cybersecurity functions. The Contractor shall be certified at Level I, II, or III for each applicable IA workforce improvement program labor category for all personnel performing cybersecurity functions:

1. System Administrators, and those performing system administrator function:

Information Assurance Technician (IAT) Level I, II, or III

2. Software Developers, and those performing software development functions:

Information Assurance Security Architect and Engineer (IASAE) Level II

E. See AFMAN 17-1303, Section 3.2, Cybersecurity Workforce, for further guidance in identifying the appropriate levels for personnel performing cybersecurity functions.

F. See the AFMAN 17-1303, Attachment 2, AF Cybersecurity Workforce Position Certification Determination Guide, for further guidance on certification requirements.

DoD Approved Cybersecurity Workforce Improvement Program Baseline Certifications are provided at https://cyber.mil/cwmp/dod-approved-8570-baseline-certifications/

G. All Contractor personnel shall complete/sign a formal statement of assigned Cybersecurity responsibilities per AFMAN 17-1303, section 2.16.8.4. A suggested format can be found in AFMAN 17-1303, Attachment 6.

H. In accordance with AFMAN17-1303, AF Cybersecurity Position Certification Determination Guide, the Contractor shall:

1. Attain appropriate cybersecurity certification(s) applicable for assigned cybersecurity workforce position prior to the first day of work on this task order IAW DoD 8570.01-M, Paragraph C2.3.9.

2. Maintain in good-standing cybersecurity baseline certification(s) IAW DoD 8570.01-M, Paragraph C2.3.7.

3. Maintain the highest-level cybersecurity baseline certification attained for category or specialty as required by position within this PWS.

4. Become qualified in cybersecurity position as defined in AFMAN 17-1303 Chapter 4 WORKFORCE QUALIFICATIONS.

5. Sign a formal statement of assigned cybersecurity responsibilities IAW DoD 8570.01-M, Paragraphs C3.2.4.4, C4.2.3.6, and C10.2.3.6.

6. Sign the Privileged Access Agreement if privileged access is required, for each IS/PIT system necessary to perform assigned duties IAW DoD 8570.01-M, Paragraph C2.1.4.

7. Authorize the release of cybersecurity baseline certification or a new certification release, whenever a certification is issued or renewed, to DoD/DMDC IAW DoD 8570.01-M, Paragraphs C2.3.12. The authorization release can be found:

https://dmdc.osd.mil/appj/dwc/index.jsp.

8. Not be reimbursed for certification costs or maintenance fees.

9. Not be eligible for cybersecurity baseline certification waivers IAW DoD 8570.01-M, Paragraphs C2.3.9.

10. Report their workforce certifications on CDRL A015, Contractor’s Personnel Roster.

If a position is performing functions spanning across one or more levels within a category/specialty, then the position certification requirements must be those of the highest level function(s) IAW DoD 8570.01-M, Paragraph C2.2.5.

5.15 Personnel Investigation, Clearances, Computer, and Network Access:

A. Information Technology (IT) Level I, II, and III positions are defined below.

Performance of these types of duties require a favorably completed Personnel Security Investigation also known as a trustworthiness determination; they do not result in clearance eligibility. The investigations are submitted through the Government Security Manager.

1. Critical-Sensitive Positions, Information Technology (IT) Level I positions. Those positions in which the incumbent is responsible for the planning, direction, and implementation of a computer security program; major responsibility for the direction, planning and design of a computer system, including the hardware and software; or, can access a system during the operation or maintenance in such a way, and with a relatively high risk for causing grave damage, or realize a significant personal gain. Criteria for assigning IT Level I:

a) Responsible for the development and administration of Agency computer security programs, and also including direction and control of risk analysis and/or threat assessment.

b) Significant involvement in life-critical or mission-critical systems.

c) Responsible for the preparation or approval of data for input into a system, which does not necessarily involve personal access to the system, but with relatively high risk for effecting grave damage or https://dmdc.osd.mil/appj/dwc/index.jsp realizing significant personal gain.

d) Relatively high risk assignments associated with or directly involving the accounting, disbursement, or authorization for disbursement from systems of (1) dollar amounts of $10 million per year or greater, or (2) lesser amounts if the activities of the individual are not subject to technical review by higher authority in the IT Level I category to insure the integrity of the system.

e) Positions involving major responsibility for the direction, planning, design, testing, maintenance, operation, monitoring, and/or management of systems hardware and software.

f) Other positions as designated by the Agency head that involve relatively high risk for effecting grave damage or realizing significant personal gain.

2. Noncritical-Sensitive Positions, Information Technology (IT) Level II positions.

Those positions in which the incumbent is responsible for the-direction, planning, design, operation, or maintenance of a computer system, and whose work is technically reviewed by a higher authority of the IT Level I category to insure the integrity of the system. Criteria for assigning IT Level II:

a) Responsible for systems design, operation, testing, maintenance, and/or monitoring that is carried out under technical review of higher authority in the IT Level I category, includes, but is not limited to:

1) access to and/or processing of proprietary data, information requiring protection under the Privacy Act of 1974, and Government-developed privileged information involving the award of contracts;

2) accounting, disbursement, or authorization for disbursement from systems of dollar amounts less than $10 million per year.

Other positions are designated by the Agency head that involve a degree of access to a system that creates a significant potential for damage or personal gain less than that in IT Level I positions.

3. Nonsensitive Positions, Information Technology (IT) Level III.