Draft PWS -GBCAS and Cybersecurity cao.pdf

GB CLOUD ACCELERATION SERVICES (CAS) AND CYBERSECURITY

IN SUPPORT OF

BUSINESS ENTERPRISE SYSTEMS (BES)

CONTRACT # FA8771-25-R-0017

12 January, 2026

Performance Work Statement (PWS) for Indefinite Delivery, Indefinite Quantity (IDIQ) Contract:

Cloud and Cybersecurity Services for US Air Force Business Enterprise Systems

1.0 Introduction

1.1 The United States Air Force (USAF) Business Enterprise Systems Directorate requires comprehensive cloud and cybersecurity services to modernize, standardize, secure and enhance its information technology (IT) infrastructure, platforms, and mission applications. This Performance Work Statement (PWS) outlines the requirements for an IDIQ contract to provide four core service areas: Cloud Assessment, Cloud Migration, Cloud Continuous Development, and Cybersecurity.

2.0 Scope of Work

2.1 The Contractor shall support evolving BES Programs/Systems and an organizational structure that will change as the programs progress through their lifecycle phases. Support includes, but not limited to, the tasks/skills in following paragraphs. Note the software tools mentioned throughout this PWS are subject to change depending on BES implementation of new technologies.

2.1.1 The Contractor shall fulfill the following roles associated with day-to-day security operations and software development lifecycle as required by the four cybersecurity positions. Information System Security Officer (ISSO), Information System Security Manager (ISSM), Information Systems Security Engineer (ISSE) and Security Control Assessor’s Representative (SCAR), as outlined in AFI 17-101, Risk Management Framework (RMF) for Air Force Information Technology (IT).

2.1.2 The contractor shall identify any necessary Government Furnished Equipment (GFE), such as a Government laptop, if required. Necessary equipment may be provided as agreed upon by the Government and contractor. The contractor’s personnel shall not use Government resources in violation of any federal, State, Local statute, regulation, or policy.

2.1.3 The government will furnish the contractor with documentation, and other pertinent information, and other documentation or material required to perform the tasks in this contract. Information will be provided to the contractor to meet schedule and dates for contract tasks and activities. The Government will provide the contractor government guided access to systems and software required to complete contract tasks (including admin rights to tools). The Contractor shall identify and notify the Government of required data necessary for the proper performance of these tasks. The Contractor shall protect Government data and not disseminate it or store it in any unapproved manner/ form.

2.2 Cloud Assessment

2.2.1 Conduct comprehensive assessments of Business Enterprise Systems and Mission Partners applications to determine their suitability for cloud migration.

2.2.2 Analyze current mission application infrastructure, platforms, environments, software, applications, data, and security posture.

2.2.3 Identify and document system dependencies, interoperability requirements, and potential risks associated with cloud migration.

2.2.4 Develop a prioritized roadmap for cloud migration, including recommendations for mission application refactoring, cloud service models (IaaS, PaaS, SaaS), deployment models, and specific cloud providers.

2.2.5 Provide detailed cost-benefit analyses for different cloud migration scenarios.

2.3 Cloud Migration

2.3.1 Develop and execute detailed migration plans based on the chosen cloud strategy and the cloud assessment findings/reports.

2.3.2 Migrate applications and data to the chosen cloud environment, ensuring data integrity, security, and minimal disruption to USAF/mission application operations.

2.3.4 Configure and optimize cloud resources to meet the performance, availability, and scalability requirements of migrated applications.

2.3.5 Provide comprehensive documentation of the migrated environment, including architecture diagrams, configurations, and operational procedures.

2.4 Cloud Continuous Development

2.4.1 Implement Agile and DevSecOps practices and tools to enable continuous integration and continuous delivery (CI/CD) of applications in the cloud environment, preferably using available tools and services (such as - GBE DevSecOps Pipeline, GBQ BAT Agile product management tools, and/or GBO/BESPIN, etc.).

2.4.2 Design, develop, provide, and maintain cloud-native solutions (containers/Kubernetes-based, microservices, high availability/resilient, elasticity, etc.), leveraging cloud services to the maximum extent possible (not “recreating the wheel”), using Agile methodologies and modern development tools/processes (DevSecOps, platform engineering, automation, etc.).

2.4.3 Automate delivery, deployment, monitoring, and related (cloud infrastructure/platform) testing and processes to improve software quality and delivery speed.

2.4.4 Provide guidance and support to PEO BES personnel and mission partners on deliverables (new tech stack/baseline, processes, etc.).

2.5 Cybersecurity

2.5.1 The Contractor shall fulfill the following roles and complete the cybersecurity activities associated with day-to-day security operations and software development lifecycle as required by the four cybersecurity positions. Information System Security Officer (ISSO), Information System Security Manager (ISSM), Information Systems Security Engineer (ISSE) and Security Control Assessor’s Representative (SCAR), as outlined in AFI 17-101, Risk Management Framework (RMF) for Air Force Information Technology (IT).

2.5.2 Provide PMO Cybersecurity Services

2.5.2.1The Contractor shall provide the Program Management Office/Capability Delivery Team (PMO/CDT) cybersecurity support per DoDI 8500.01, Cybersecurity Contractor services include assessing and continuously monitoring cybersecurity risk ensuring that legacy and new capabilities adhere to enterprise standards defined by the Risk Management Framework (RMF), Cybersecurity Framework (CSF), National Institute of Standards and Technology (NIST) and the Authorizing Official’s (AO) Information System’s Continuous Monitoring (ISCM) strategy.

2.5.3 Provide RMF Control Family Guidance

2.5.3.1 The Contractor shall provide guidance on the following to include, but not limited to, access control; security awareness and training; audit and accountability; security assessment and authorization;

configuration management; contingency planning; identification and authentication; incident response;

maintenance; media protection; personnel security; physical and environmental protection; planning;

program management; risk assessment; system and services acquisition; system and communications protection; system and information integrity; software engineering and software tools as it relates to cybersecurity.

2.5.4 Apply National/Federal Cybersecurity Guidance Knowledge

2.5.4.1 The Contractor shall exercise knowledge and comprehension of Federal, Committee on National Security Systems (CNSS), RMF, CSF, NIST Publications, DoD, and AF cybersecurity policy, guidance, processes, and procedures to facilitate PMO/CDT/system compliance.

2.5.5 Maintain System-Level Cybersecurity Documentation and Data

2.5.5.1 The Contractor shall advise, develop, and update as needed, the system-level security Assessment & Authorization (A&A) documentation and Plans of Action and Milestones (POA&M) to obtain Authority to Operate (ATO)/Authority to Connect (ATC) within the AF specified timeline for achieving full accreditation for assigned systems. The A&A and POA&M documentation must adhere to the NIST, RMF, and CSF processes as defined in DoDI 8510.01, Risk Management Framework for DoD Systems, AFI 17-101, Risk Management Framework (RMF) for Air Force Information Technology (IT), DoD’s RMF Knowledge Service (KS) website, CNSSI 1253, Security Categorization And Control Selection For National Security Systems, AFI 17-130, Cybersecurity Program Management and the AO’s specific requirements for their authorization boundary.

2.5.5.2 The Contractor shall complete system-level risk assessments of all existing documentation to identify gaps in cybersecurity objectives and security compliance and update as necessary for compliance for all supported business enterprise systems.

2.5.6 Serve as Cybersecurity Technical Advisors/Consultants

2.5.6.1 The Contractor cybersecurity professionals shall serve as the system primary cybersecurity technical advisor/POC to the AO, Information System Owner (ISO), Security Control Assessor (SCA), and PMO/CDT to communicate RMF implementation IAW DoDI 8510.01 and AFI 17-101.

2.5.7 Personnel Cybersecurity Certification Compliance

2.5.7.1 Per DoDM 8140.03, Cyberspace Workforce Qualification and Management Program, DAFMAN 17-1305, Department of the Air Force Cyberspace Workforce Management Program and DFARS 252.239.7001, Information Assurance Contractor Training and Certification contracted support personnel must meet foundational qualification requirements upon commencement of cyberspace work. The foundational qualifications are stipulated in the Defense Cyber Workforce Framework (DCWF). IAW

DCWF, personnel shall obtain one of the certifications required for their assigned work role and proficiency level.

2.5.7.2 The Contractor shall provide the Government a signed formal statement acknowledging cybersecurity responsibilities prior to DCWF work role assignment.

2.5.7.3 The Contractor shall complete a minimum of 20 hours continuous professional development per year (or vendor certification maintenance minimums, whichever is greater) to sustain the required foundational qualification associated with the assigned DCWF work role.

2.5.8 Maintain System Security and Privacy Posture

2.5.8.1 The Contractor shall maintain the system security and privacy posture by working in close collaboration with the system integrator, CDT, and other stakeholders to protect information and information systems from unauthorized system activity and behavior to provide confidentiality, integrity, and availability IAW NIST SP 800-37, Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy.

2.5.9 Participate in Program Project Meetings

2.5.9.1 The Contractor shall communicate security impacts and requirements in daily software development meetings, release and sprint planning sessions (e.g., Agile ceremonies, backlog refinement, POA&M prioritization planning, demonstrations, retrospectives), and other meetings as the cybersecurity stakeholder.

2.5.9.2 The Contractor shall participate in network and systems requirements and design review/consideration sessions to ensure implementation of appropriate systems security controls and policies are addressed and updated.

2.5.10 Adhere to Program Office Agile, Development, Operations Processes

2.5.10.1 The Contractor shall adhere to the system-unique PMO/CDT agile manifesto/strategy and development/operations processes.

2.5.11 Identity and Access Management (IAM)

2.5.11.1 The Contractor shall provide guidance to the PMO/CDT to design and enforce robust IAM policies, ensuring proper execution of Role-Based Access Controls (RBAC) and Privileged Access Management (PAM) specific to where the systems are hosted.

2.5.12 Manage, Monitor, and Remediate Vulnerabilities

2.5.12.1 The Contractor shall manage vulnerabilities in accordance with Technical Order (TO) 00-33A- 1109, Vulnerability Management. Cyber Task Orders originate from United States Cyber Command (USCYBERCOM) and the contractor can monitor them via the USCYBERCOM and Air Force Secure Internet Protocol Router Network (SIPRNet) sites for vulnerability knowledge dissemination. This task/requirement includes monitoring newly reported vulnerabilities, coordinating remediation actions and reporting the status on vulnerabilities identified through the Vulnerability Disclosure Program and Palo Alto XPANSE.

2.5.13 Cybersecurity Configuration Requirement and Design Management

2.5.13.1 The Contractor shall identify mandated Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STIGs), Information Assurance Vulnerability Alerts (IAVA), Notice to Airmen (NOTAM), Time Compliance Network Orders (TCNO), Common Vulnerabilities and Exposures (CVE), Assured Compliance Assessment

2.5.13.2 Solutions (ACAS), Security Readiness Reviews (SRR), Cyber Task Orders (CTOs), and Maintenance Task Orders (MTOs) applicable to the system/program technical baseline and assist with defining remediation and testing requirements.

2.5.14 Cybersecurity Configuration Analysis and Validation

2.5.14.1 The Contractor shall define, execute and report execution results of automated and manual cybersecurity testing preferably using government provided tools, (Opentext, Unified Functional Test/Opentext Functional Test (UFT/OFT), Zephyr Scale, Selenium, ACAS, STIG/SCAP, Security Center and other Cloud provider tools) as required by the PMO/CDT agile sprint velocity.

2.5.14.2 The Contractor shall analyze and validate the results of developer adjudications using automated security vulnerability and compliance testing tools (e.g. Fortify, Checkmarx, SonarQube, and AppScan).

2.5.14.3 The Contractor shall review and analyze penetration testing results, identify root causes of findings, and recommend remediation strategies.

2.5.14.4 Additionally, the Contractor shall update relevant documentation to include but not limited to the System Security Plan (SSP), POA&Ms, and any additional relevant documentation, to reflect test findings and corrective actions, ensuring all identified vulnerabilities are addressed in compliance with DoD and organizational timelines.

2.5.15 Cybersecurity Configuration Continuous Monitoring

2.5.15.1 The Contractor shall oversee continuous monitoring of network, systems and information security in accordance with organizational and system-level information security continuous monitoring (ISCM) strategies, to include ongoing security control assessments and remediation actions, analysis of security impact based on proposed or actual changes to the system or environment, updates to required cybersecurity documentation to include the Security Plan and POA&M, and reporting of system security status to the AO and other appropriate officials.

2.5.15.2 The Contractor shall conduct information security continuous monitoring (ISCM) by maintaining ongoing awareness of information security, vulnerabilities, and threats to support organizational risk management decisions IAW approved ISCM strategy.

2.5.16. Data Remanence Security

2.5.16.1 The Contractor shall oversee data remanence security in accordance with AFMAN 17-1301, Computer Security (COMPUSEC), Chapter 5, Remanence Security.

2.5.17 Cybersecurity Status Briefing Support

2.5.17.1 The Contractor shall plan and prepare documents and facilitate briefings for required cybersecurity meetings with the PMs, Engineers, Authorization Official (AO) / Authorization Official Designated Representative (AODR), Security Control Assessor (SCA) / Security Control Assessor Representative (SCAR) and peers.

2.5.18 Maintain Data in DoD Requirement and Deficiency Tracking Systems

2.5.18.1 The Contractor shall be competent in utilizing DoD tracking systems (e.g. Jira, Opentext ALM/Octane, Gitlab, and eMASS) to manage cybersecurity deficiencies, vulnerabilities, and change requests for each program/system supported.

2.5.18.2 The Contractor shall provide the PM/CDM cybersecurity details for entry into the Information Technology Investment Portfolio System (ITIPS).

2.5.18.3 The Contractor shall register system connection information in the Systems/Networks Approval Process (SNAP) database and/or the Global Information Grid (GIG) Interconnection Approval Process (GIAP) database as applicable.

2.5.19 Cybersecurity Inspection Readiness

2.5.19.1 The Contractor shall review program/system-specific cybersecurity scan results to assess current inspection readiness (e.g., Self-Assessments, Inspector General Inspections, and Command Cyber Readiness Inspections) and assist the PMO/CDT in providing remediation recommendations by the dates outlined in the inspection schedule.

2.5.20 Cybersecurity Strategy Development and Implementation

2.5.20.1 The Contractor shall support development and implementation of a cybersecurity strategy for IT IAW AFMAN 17-1402, Air Force Clinger-Cohen Act (CCA) Compliance guide, and AFI 63- 101_20-101, Integrated Life Cycle Management.

2.5.21 Cybersecurity Policy, Process and Procedure Maintenance

2.5.21.1 The Contractor shall provide recommendations for updates to policies and procedures to ensure information systems’ reliability and accessibility and to prevent and defend against unauthorized access to systems, networks, and data protection.

2.5.21.2 The Contractor shall develop and implement consistent cybersecurity processes and procedures to ensure uniform compliance with RMF and NIST frameworks to streamline workflows, enhance collaboration, reduce errors, and minimize redundancies across PMO/CDT cybersecurity teams supported by this contract.

2.5.22 Incident Response Program Management

2.5.22.1 The Contractor shall document, exercise and manage the system/program IT incident response capability is in accordance with AFI 17-203, Cyber Incident Handling.

2.5.23 Financial Improvement and Audit Readiness (FIAR) Support

2.5.23.1 The Contractor shall support the PMO/CDT with Financial Improvement and Audit Readiness (FIAR) efforts to include assessing and guiding the quality and completeness of its DoD and AF policies and controls and as it aligns with A&A activities.

2.5.24 Conduct PMO/CDT Security Awareness Training

2.5.24.1 The Contractor shall provide tailored cybersecurity training to PMO/CDT members to enhance their ability to implement and maintain secure systems in compliance with DoD policies and standards.

2.5.25 Containerized Application Security

2.5.25.1 The Contractor shall assess and provide guidance to secure containerized applications (e.g., Docker, Kubernetes) within the cloud environment IAW DISA container STIGs and Center for Internet Security (CIS) Benchmarks.

2.5.26 Advanced Logging Management

2.5.26.1 The Contractor shall oversee the implementation and management of advanced logging mechanisms like Amazon Web Services (AWS) CloudTrail, Azure Monitor, and Google Cloud Operations Suite and Oracle Cloud Infrastructure (OCI)for audit and forensic analysis as applicable to the

PMO/CDT.

2.5.27 Cloud Security Tooling Implementation

2.5.27.1 The Contractor shall provide expertise on the interoperability and implementation of cloud security tools available in Cloud One, including AWS GovCloud services (e.g., AWS Config, CloudTrail, GuardDuty, Inspector, and Security Hub), Azure Government tools (e.g., Azure Security Center, Azure Policy, and Sentinel), and DISA-approved vulnerability management solutions such as Tenable.io for GovCloud for any Cloud hosted applications.

2.5.28 Cloud Service Provider (CSP) Security Evaluation

2.5.28.1 The Contractor shall assess and advise on the implementation of cloud security across multiple Cloud Service Providers (CSPs) operating within GovCloud environments, ensuring compliance with DoD policies, including the DoD Cloud Computing Security Requirements Guide (CC SRG), RMF, and NIST standards. Responsibilities include evaluating cloud service models in these environments (e.g., IaaS, PaaS, SaaS) to identify vulnerabilities, ensuring the application of Zero Trust Architecture principles, and integrating appropriate security controls such as IAM, data encryption, network segmentation, and container security.

2.5.29 Cybersecurity Role Descriptions

25.2.29.1 Information System Security Manager (ISSM). As the ISSM, the contractor shall

2.5.29.1.2 Be the primary cybersecurity technical advisor to the AO, PM, and ISO.

2.5.29.1.3 Ensure the integration of cybersecurity throughout the lifecycle of the IT, on behalf of the AO and in accordance with DoDI 8510.01.

2.5.29.1.4 Contractor personnel in this role shall complete and maintain the cybersecurity certifications required by DAFMAN 17-1305. acquire and maintain a personnel certification associated with the DCWF Information Systems Security Manager work role ID 722 at an advanced proficiency level as outlined in the DCWF, DoDI 8510.01, DAFMAN 17-1305 and AFI 17-101 for assigned systems/applications.

2.5.29.1.5 Be U.S. citizens.

2.5.29.1.6 Ensure all AF IT cybersecurity-related documentation is current and accessible to properly authorized individuals.

2.5.29.1.7 Support the PM or ISO in maintaining current “Authorization to Operate”, and “Approval to Connect” (if required), and in implementing corrective actions identified in the plan of action and milestones. Coordinates, with the PM and AO staff on development of an ISCM strategy and monitor any proposed or actual changes to the system and its environment.

2.5.29.1.8 Continuously monitors the IT and environment for security-relevant events, assesses proposed configuration changes for potential impact to the cybersecurity posture, and assesses the quality of security controls implementation against performance indicators.

2.5.29.1.9 Ensures cybersecurity-related events or configuration changes that impact AF IT authorization or adversely impact the security posture are formally reported to the AO and other affected parties, such as IOs and stewards and AOs of interconnected IT.

2.5.29.1.10 Ensures all ISSOs and privileged users receive necessary technical training and obtain cybersecurity certification IAW AFMAN 17-1301, DAFMAN 17-1305 and maintain proper clearances IAW DoDI 8500.01.

2.5.29.1.11 Ensures the AF IT is acquired, documented, operated, used, maintained, and disposed of properly and IAW DoDI 5000.02, Operation of the Adaptive Acquisition Framework and DoDI 8510.01.

2.5.29.1.12 The ISSM is required to acquire and maintain a personnel certification associated with the DCWF Information Systems Security Manager work role ID 722 at an advanced proficiency level as outlined in the DCWF, DoDI 8510.01, DAFMAN 17-1305 and AFI 17-101 for assigned systems/applications.

2.5.29.2 Information System Security Officer (ISSO)

2.5.29.2.1 The ISSO is responsible for ensuring the appropriate operational security posture is maintained for the assigned IT. This includes the following activities related to maintaining situational awareness and initiating actions to improve or restore cybersecurity posture. Implements and enforce all AF cybersecurity policies, procedures, and countermeasures. Completes and maintains required cybersecurity certification IAW DAFMAN 17-1305. Individuals in this position must be U.S. citizens. Ensures all users have the requisite security clearances and need- to-know, complete annual cybersecurity training, and are aware of their responsibilities before being granted access to the IT according to AFMAN 17-1301.

Maintains all authorized user access control documentation IAW the applicable AF Records Information Management System. Ensures software, hardware, and firmware comply with appropriate security configuration guidelines (e.g., security technical implementation guides /security requirement guides).

Ensure proper configuration management procedures are followed prior to implementation and contingent upon necessary approval. Coordinate changes or modifications with the system-level ISSM, SCA, and/or the Wing Cybersecurity office. Initiate protective or corrective measures, in coordination with the ISSM, when a security incident or vulnerability is discovered. Reports security incidents or vulnerabilities to the system-level ISSM and wing cybersecurity office according to AFI 17-203. Initiates exceptions, deviations, or waivers to cybersecurity requirements.

2.5.29.2.2 The ISSO is required to acquire and maintain a personnel certification associated with the DCWF Information Systems Security Manager work role ID 722 at an intermediate proficiency level as outlined in the DCWF, DoDI 8510.01, DAFMAN 17-1305 and AFI 17-101 for assigned systems/applications.

2.5.30 Information Systems Security Engineer (ISSE)

2.5.30.1 The ISSE is responsible for employing best practices when implementing security controls, including software engineering methodologies, system/security engineering principles, secure design, secure architecture, and secure coding techniques. Coordinates their security-related activities with the information security architect, ISSO, ISO, and common control provider.

2.5.30.2 The ISSE is required to acquire and maintain a personnel certification associated with the DCWF Information Systems Security Developer work role ID 631 at an advanced proficiency level as outlined in the DCWF, DoDI 8510.01, DAFMAN 17-1305 and AFI 17-101 for assigned systems/applications.

2.5.31 Security Control Assessor Representative (SCAR)

2.5.31.1 The SCAR is responsible for executing the following activities in support of the SCA. Provide risk assessments IAW NIST Special Publication 800-30 for authorization decisions and configuration changes. Participate in technical interchanges, security impact assessments and security assessment meetings with CDMs, ISSOs/ISSMs and the Authorizing Official’s Designated Representative (AODR). Develop Security Assessment Report to document security vulnerabilities, mitigations and overall risk determination. Review system Plan of Actions and Milestones (POA&M) entries. Review eMASS security testing and artifacts in eMASS to perform risk assessments. Validate eMASS controls or returns to submitter for re-testing. Perform automated and manual security testing. Support technical assessments of IT systems to include web applications, application servers, web servers, access control, and databases.

2.5.31.2 The SCAR is required to acquire and maintain a personnel certification associated with the DCWF Security Control Assessor work role ID 612 at an advanced proficiency level as outlined in the DCWF, DoDI 8510.01, DAFMAN 17-1305 and AFI 17-101 for the assigned authorization boundary.

2.5.32 IT Project Manager

2.5.32.1 The IT Project Manager is responsible for planning, directing, controlling, organizing, and coordinating the work activity of the cybersecurity personnel involved in all aspects of this contract;

implementing a quality assurance program to ensure services and products conform to applicable standards; formulating statements of management and technical problems; evaluating proposed computer systems to determine technical feasibility, implementation costs, operation costs, and functional adequacy. Briefs senior management on project milestones, baselines, and costs. Works within the Agile Software Development Life Cycle (SDLC) framework to include managing work activity according to the PMO/CDT Agile release velocity, participating in daily scrums, conducting sprint planning sessions, conducting sprint retrospective sessions, and utilizing sprint tracking software to communicate work activity to stakeholders.

2.5.32.2 The IT Project Manager is required to possess the core Knowledge, Skills, Ability and Tasks (KSATs) defined in DCWF work role ID 802 at a basic proficiency level.

2.5.33 Cybersecurity Certification Compliance Reporting

2.5.33.1 The Contractor shall ensure the personnel possess current and valid certifications as specified in paragraph 3.1.6 and 3.2. In the Monthly Status Report (MSR) (CDRL A004), the contractor shall document for each contractor personnel, a list of their certifications, including date obtained and expiration date. Personnel who are not currently certified IAW DoDM 8140.03 will meet their certification requirements within 30 days of the start of this task order’s initial period of performance.

3.0 Service Delivery Summary

3.1 The Contractor shall provide the following deliverables, as specified in individual task orders:

3.1.1 Cloud assessment reports

3.1.2 Cloud migration plans and other related documentation

3.1.3 Cloud continuous development code, documented practices/processes, and documentation

3.1.4 Cybersecurity policies, procedures, and reports

3.1.5 Training materials and documentation

4.0 Period of Performance

4.1 The base period of performance for this IDIQ contract shall be one (1) year, with two (2) one-year option periods.

5.0 Place of Performance

5.1 The Contractor shall perform the services required by this contract at remote and/or approved government locations.

6.0 Government Furnished Information (GFI)

6.1 The Government will provide the Contractor with access to relevant systems, documentation, and personnel as required to perform the services outlined in this PWS.

7.0 Security Requirements

7.1 All work performed under this contract is subject to applicable USAF and DoD security regulations.

The Contractor shall possess and maintain the appropriate security clearances for all personnel working on this contract.

8.0 Evaluation Criteria

8.1 Award of task orders under this IDIQ contract will be based on a best-value determination, considering factors such as:

8.1.1 Technical expertise and experience in cloud computing, cybersecurity, and software development

8.1.2 Understanding of USAF business requirements and IT environment

8.1.3 Past performance on similar projects

8.1.4 Proposed cost and schedule

9. Service Delivery Summary

9.1 The Contractor shall provide support for evolving Business Enterprise Systems (BES) programs, systems, and organizational structures, which may change as programs progress through their respective lifecycle phases. This support shall encompass, but is not limited to, the tasks and skills described in this Performance Work Statement (PWS). The Contractor acknowledges that software tools referenced herein are subject to change based on the BES's adoption of new technologies.

9.2 The Contractor shall perform responsibilities associated with daily cybersecurity operations and the software development lifecycle, in alignment with the following cybersecurity roles as defined in Air Force Instruction (AFI) 17-101, Risk Management Framework (RMF) for Air Force Information Technology (IT):

9.2.2 Information System Security Officer (ISSO)

9.2.3 Information System Security Manager (ISSM)

9.2.3 Information Systems Security Engineer (ISSE)

9.2.4 Security Control Assessor’s Representative (SCAR)

9.3 The Contractor shall identify any necessary Government Furnished Equipment (GFE), such as a government-issued laptop, required to perform contract tasks. GFE may be provided based on mutual agreement between the Government and the Contractor. Contractor personnel shall not utilize Government resources in any manner that violates federal, state, or local statutes, regulations, or policies.

9.4 The Government shall furnish the Contractor with applicable documentation, system access (including administrative privileges when necessary), and any other pertinent materials required to fulfill the contract tasks. The Contractor shall proactively identify and notify the Government of any additional data or resources required for effective task execution. The Contractor is responsible for ensuring the protection of all Government-provided data and is strictly prohibited from disseminating or storing such data in any unauthorized form or location.

This PWS provides a general framework for the IDIQ contract. Specific requirements, deliverables, and timelines for individual task orders will be defined in separate task order documents.