F35 Program Security PWS.docx

F-35 JOINT PROGRAM OFFICE

DIRECTORATE OF ENTERPRISE SERVICES ACQUISITION

SECURITY SUPPORT SERVICES

PERFORMANCE WORK STATEMENT

1. INTRODUCTION.

The F-35 Lightning II Joint Program Office (JPO) leads the life-cycle program management of the F-35A, F-35B, and F-35C: the fifth-generation joint strike fighter air system of choice for the U.S. Air Force, U.S. Navy, U.S. Marine Corps (the US Services), Cooperative Program Partners (CPP), and foreign military sales (FMS) customers. The mandate of the JPO is to deliver a capable, available, and affordable air system to the warfighter - outpacing key competitors to win tomorrow's high-end fight as we develop, deliver, and sustain war-winning fifth-generation capabilities at high-end fourth-generation costs.

· The JPO ensures that the F-35 is lethal, scalable, adaptable, and capable of competing and keeping the warfighter one step ahead of aggressors.

· The JPO ensures that the F-35 is operative, and parts are available when needed. The long-term goal is an environment of comprehensive sustainment excellence that includes initiatives to keep parts on wing longer, maintain appropriate spares, and enhance repair capability and velocity.

· The JPO ensures that the F-35 is affordable for the U.S. services, international partners, and customers through cost reduction across the acquisition life cycle.

1.1. Scope.

The JPO, which is comprised of the US Services, CPP, and FMS customers, requires knowledge-based security services in support of F-35 acquisition and sustainment activities. The F-35 JPO Security Directorate (herein referred to as F-35 JPO Security) has the critical mission of providing full spectrum multi-disciplined security support to protect F-35 technology and information across its enterprise and throughout the acquisition and sustainment lifecycle. F-35 JPO Security efforts include providing advice and services regarding programmatic security measures that deny unauthorized access to F-35 facilities, equipment, and resources, and protect personnel, information, and property from damage and/or loss of technology.

Security support services encompass the management and control of controlled unclassified information (CUI), collateral/general service (GENSER) information, Special Access Program (SAP) information, North Atlantic Treaty Organization (NATO) information, Critical Nuclear Weapons Design Information (CNWDI), Restricted Data (RD) and Formal Restricted Data (FRD), and Sensitive Compartmented Information (SCI) across multiple security disciplines. Security support disciplines consist of, but are not limited to, General Security (GENSEC), Industrial Security (INDUSEC), Information Security (INFOSEC), Personnel Security (PERSEC), and Physical Security (PHYSEC). This contract will be used as a means of providing security services to the JPO globally.

2. APPLICABLE LAWS, REGULATIONS, AND POLICY.

2.1. Laws

· Title 10, Section 119, Special Access Programs, Congressional Oversight

· Intelligence Reform and Terrorism Prevention Act of 2004, Public Law 108-458

· Intelligence Reform and Terrorist Prevention Act of 2004, H.R. 108-796

· Intelligence Authorization Act for FY 2005, H.R. 4548

· U.S.A. Patriot Act of 2001, Public Law 107-56

2.2. Code of Federal Regulations

· 32 CFR Parts 2001 and 2003, Classified National Security Information; Final Rule

· 32 CFR Part 117 National Industrial Security Program Operating Manual (NISPOM) Rule

· 22 C.F. R. Parts 120-130, “International Traffic in Arms Regulations (ITAR).”

· DoD 5200.08-R, Physical Security Program

2.3. Policy – DoD Directive

· DoDD 2000.12, DoD Antiterrorism (AT) Program

· DoDD 3020.26, DoD Continuity Policy

· DoDD 3020.40, Mission Assurance

· DoDD 5000.59, DoD Modeling and Simulation Management

· DoDD 5200.02, Defense Industrial Personnel Security Clearance Review Program

· DoDD 5205.02E, DoD Operations Security (OPSEC) Program

· DoDD 5205.07, DOD Special Access Program Policy

· DoDD 5210.42, Nuclear Weapons Personnel Reliability Program

· DoDD 5230.11, Disclosure of Classified Military Information to Foreign Governments and International Organizations

· DoDD 5230.25, Withholding of Unclassified Technical Data from Public Disclosure

· DoDD 5240.6, Counterintelligence (CI) Awareness, Briefing, and Reporting Programs

2.4. Policy – DoD Instruction

· DoDI 1000.13, Identification Cards for Members of the Uniformed Services, Their Dependents, and Other Eligible Individuals

· DoDI 3200.12, DoD Scientific and Technical Information Program (STIP)

· DoDI 4120.24, Defense Standardization Program

· DoDI 5000.02, Operation of the Adaptive Acquisition Framework

· DoDI 5000.83, Technology and Program Protection to Maintain Technological Advantage

· DoDI 5000.85, Major Capability Acquisition

· DoDI 5000.88, Engineering of Defense Systems

· DoDI 5000.89 Test and Evaluation

· DoDI 5000.91, Product Support Management for the Adaptive Acquisition Framework

· DoDI 5000.97, Digital Engineering

· DoDI 5200.02, DOD Personnel Security Program (PSP)

· DoDI 5200.08, Security of Installations and Resources and the DOD Physical Security Review Board (PSRB)

· DoDI 5200.39, “Critical Program Information Identification and Protection within Research, Development, Test, and Evaluation.”

· DoDI 5200.46, "DOD Investigative and Adjudicative Guidance for Issuing the Common Access Card (CAC)"

· DoDI 5200.48, Controlled Unclassified Information (CUI)

· DoDI 5205.11, Management, Administration, and Oversight of DoD Special Access Programs

· DODI 5210.02 Access to and dissemination of RD and FRD

· DoDI 5210.45, "Personnel Security Policies and Procedures for Sensitive Cryptologic Information in the National Security Agency/Central Security Service"

· DoDI 5220.31, National Industrial Security Program

· DoDI 5240.26, Countering Espionage, International Terrorism, and the Counterintelligence (CI) Insider Threat

· DoDI 5230.24, Distribution Statements on DoD Technical Information

· DoDI 5230.27, Presentation of DoD-Related Scientific and Technical Papers At Meetings

· DoDI 8510.01, Risk Management Framework (RMF) for DoD Information Technology (IT)

· DoDI 8500.01, Cyber Security

· DoDI 8580.1, Information Assurance (IA) in the Defense Acquisition System

· DoDI 8582.01, Security of Unclassified DoD Information on Non-DoD Information Systems

2.5. Policy – DoD Manual

· DoDM 1000.13, Volume (V)1-2 DoD Identification (ID) Cards

· DoDM 3200.14, V1-2 Principles and Operational Parameters of the DoD Scientific and Technical Information Program (STIP)

· DoDM 5200.01, V1-3 Information Security Program

· DoDM 5200.08, V3 Physical Security Program

· DoDM 5205.02, “DoD Operations Security (OPSEC) Program Manual”

· DoDM 5220.32 V1-2, National Industrial Security Program

· DoDM 5205.07, V1-4 DoD Special Access Program (SAP) Security Manual

· DoDM 5105.21 V1-3, Sensitive Compartmented Information (SCI) Administrative Security Manual

· DoDM 5200.02 Procedures for the DOD Personnel Security Program (PSP)

· DoDM 5200.45, Instructions for Developing Security Classification Guides

· DoD Manual S-5230.28, "(U) International Transfer Guidance (ITG) for Low Observable (LO) and Counter Low Observable (CLO) Technologies and Systems.”

2.6. Policy – Miscellaneous

· Air Force Instruction 31-101, Air Force Integrated Defense

· AFI 10-701 OPERATIONS SECURITY (OPSEC)

· DAFMAN 16-201 Foreign Disclosure and Technology Transfer Program

· Secretary of the Navy Instruction (SECNAVINST) 5510.30A, Department of Navy Personnel Security Program

· SECNAV Manual 5510.30, Personnel Security Program

· SECNAV Instruction 5510.30B, Personnel Security Program

· SECNAVINST 5510.36, Department of Navy Information Security Program

· United States Security Authority for NATO (USSAN) Instruction 1-07

· Joint Special Access Program Implementation Guide (JSIG)

· Chairman of the Joint Chiefs of Staff Instruction (CJCSI) 6211.02D, Defense Information System Network (DISN): Policy, Responsibilities, and Processes

· TS-82 Position Classification Standard for Security Administration Series, GS-0080, OPM, December 1987

· USD(I) Memorandum, "Adherence to Federal Laws Prohibiting Marijuana Use"

· USD(I) Memorandum, "Notifications Required Upon the Receipt or Development of Unresolved Criminal Conduct"

· USD(I) Memorandum, "Reciprocal Recognition of Existing Personnel Security Clearances"

· Security Executive Agent Directive (SEAD) 2, Use of polygraph in support of personnel security determinations for initial or continued eligibility for access to classified information or eligibility to hold a sensitive position

· SEAD 3, Reporting Requirements

· SEAD 4, National Adjudicative Guidelines

· SEAD 5, Collection, use, and retention of publicly available social media information in personnel security background investigations and adjudications

· SEAD 6, Continuous Evaluation

· SEAD 7, Reciprocity of Background Investigations and National Security Adjudications

· SEAD 8, Temporary Eligibility

· SEAD 9, Whistleblower Protection

· Security Executive Agent Clarifying Guidance Concerning Marijuana for Agencies Conducting Adjudications of Persons Proposed for Eligibility for Access to Classified Information or Eligibility to Hold a Sensitive Position

· Intelligence Community Directive (ICD) 704, "Personnel Security Standards and Procedures Governing Eligibility for Access to Sensitive Compartmented Information"

· ICD 705, Sensitive Compartmented Information Facilities

· ICD 705, Technical Specifications Version 1.5.1

· ICD 709, "Reciprocity for IC Employee Mobility"

· Intelligence Community Policy Guidance (ICPG) 704.4, "Reciprocity of Personnel Security Clearance and Access Determinations"

· Intelligence Community Standard (ICS) 731-01, Supply Chain Criticality Assessment

· ICS 731-02, Supply Chain Threat Assessments

· ICS 731-03, Supply Chain Information Sharing

· ICS 731-04, Supply Chain Vulnerability Assessments

· ICS 731-05, Supply Chain Risk Assessments

· ICS 705-1, Physical and Technical Security Standards for Sensitive Compartmented Information Facilities, 17 September 2010

· ICS 705-02, Standards for the Accreditation and Reciprocal Use of Sensitive Compartmented Information Facilities, 22 December 2016

· ICS 706-01, Domestic Facility Security Risk Assessments Standards, 18 June 2019

· ICS 706-02, Protecting Mission Critical-Facility Related Control Systems (MC-FRCS) in Mission Critical Facilities (MCF), 23 December 2019

· ICS 731-02, Supply Chain Threat Revisions, 25 September 2019

· Institute of Electrical and Electronics Engineers (IEEE) 299 Standard Method for Measuring the Effectiveness of Electromagnetic Shielding Enclosures

2.7. F-35 Joint Program Office Policies, Procedures, and other Documents

· F-35 Site and Ship Activation Management Plan (SSAMP)

· F-35 Facilities Requirement Document (FRD)

· F-35 Facilities Protection Document (FPD)

· F-35 JPO Compliance-Assessments-Program CONOPs (U) 14 Mar 2022

· F-35 JPO Collateral-Oversight-Program CONOPs (U) 18 May 2023

3. TASKS/PERFORMANCE REQUIREMENTS.

The Contractor shall provide all personnel, materials, services and project supervision, as required in connection with this Performance Work Statement (PWS).

3.1. Overarching Support Requirements.

The Contractor shall provide competent and trained security professionals who meet the standards for executing security duties in accordance with Section 2 of this PWS and the standards described herein. The Contractor shall furnish technically trained personnel to provide routine and emergency security support services for the JPO. The Contractor shall perform to the standards required in this contract and will be expected to work closely with F-35 JPO Security government representatives throughout the duration of the contract.

The Contractor shall provide multidiscipline security support to the JPO across all classification levels (CUI, Collateral, NATO, CNWDI, RD/FRD, SAP, and SCI) in support of all elements of the JPO (i.e., the US Services, CPP, and FMS customers). Security support disciplines consist of, but are not limited to, General Security (GENSEC), Industrial Security (INDUSEC), Information Security (INFOSEC), Personnel Security (PERSEC), and Physical Security (PHYSEC). Security support performance shall be in accordance with the regulations, policies, and standards annotated in Section 2. Unless otherwise specified, the Contractor should note all tasks may pertain to US Services, CPP, and FMS customers; CPP and FMS support may include a requirement for in-country support.

· Specialized knowledge and experience in security management within the DoD or similar organizations is required.

· The Contractor shall have a working knowledge and experience in executing a multidisciplined security program.

· The Contractor shall provide recommendations and innovative solutions, and possess a high degree of independent thinking, initiative, requiring minimal supervision.

· The Contractor shall provide recommendations, and assistance to program personnel and sensitive activities concerning security matters.

· The Contractor shall perform risk management and risk analysis to evaluate security threats and vulnerabilities for each security discipline and provide the F-35 JPO Security Director, or designate, with options and resource requirements to implement mitigations.

· The Contractor shall analyze security related processes, procedures, and policies and notify F-35 JPO Security of any issues and recommend corrective actions.

· The Contractor shall possess skills and demonstrate the ability to communicate and interact, in writing and orally, with colleagues, counterparts, senior officials in various US and foreign government military/civilian agencies, and representatives of diverse cultures with tact and diplomacy on all occasions.

· The Contractor shall possess knowledge of US International/Foreign Affairs objectives, Arms Export Control Act (AECA), and Foreign Military Sales (FMS) processes, and/or understanding of international relations policy objectives within Security Assistance.

· The Contractor shall possess the ability to address complex security challenges with an understanding of cultural and socio-political dynamics while strengthening relationships that promote mutual interests.

3.2. General Security Support.

GENSEC covers security topics and issues which may or may not be addressed in other security disciplines and content areas.

3.2.1. Administrative Security Support:

3.2.1.1. Author, Maintain, and update security related documentation, reports, and publications which include, but are not limited to, Security Operations Manuals (SOM), Standard Operating Procedures (SOP), Security Classification Guides (SCG), Access Management Control Plans (AMCP), Project Security Instructions (PSI), Site & Ship Activation Management Plan (SSAMP), Continuity of Operations Plans (COOP), Occupant Emergency Plans (OEP), Program Protection Plans, and Emergency Action Plans (EAP). Each document and/or publication shall be updated at minimum intervals as directed by the government.

3.2.1.2. Maintain and update US Government security related websites, databases, and systems of record (e.g. Joint Access Database Environment (JADE), Defense Information System for Security (DISS), local databases, SharePoint, central archive, etc.).

3.2.1.3. The Contractor shall assist with the scheduling (including the reservation of conference/meeting rooms) and execution of security related meetings, conferences, and other events/activities (such as working groups). Execution of these activities include recording notes and any security specific tasks or responsibilities identified.

3.2.1.4. The Contractor shall perform task management and develop a method to track all priorities identified by the government, tasks, reports, and other security related actions.

3.2.2. Security Compliance and Assessments Support:

3.2.2.1. The Contractor shall provide security assessments (to include Staff Assistance Visits (SAV)) and protection guidance.

3.2.2.2. The Contractor shall conduct in-depth analysis of JPO equities for risks and vulnerabilities (potential exploits and security gaps) to ensure security methodologies execute applicable coverage to mitigate risks and vulnerabilities.

3.2.2.3. The Contractor shall assist with the development and execution of Corrective Action Plans (CAP), Plans of Actions and Milestones (POA&M), and other documentation to support Security Program compliance with the appropriate regulations, policies, and procedures (see Section 2).

3.2.3. Security Education and Training Awareness (SETA) Support:

3.2.3.1. The Contractor shall develop and execute an in-person, virtual, and static display SETA program, to include monthly topics or focus areas, in accordance with Section 2.

3.2.3.2. The contractor shall develop, publish, and maintain security related posters and announcements on an established periodic basis and as directed by the F-35 JPO Security Director (or designee), to include maintaining Bulletin Boards.

3.2.3.3. The Contractor shall ensure security incident trends are identified and training mitigations are incorporated into the security program.

3.2.3.4. All developed training programs shall include a syllabus, curriculum, certificate of completion (or other approved documentation), and a method to efficiently track completion.

3.2.3.5. The contractor shall ensure all required security related initial and annual training is conducted on time and appropriately documented with both the JPO and the trainee’s home station (US Service Security Office, Facility Security Officer, or Country Security Manager).

3.2.4. Operations Security (OPSEC) Support:

3.2.4.1. The contractor shall assist with the identification of, and implementation of protection measures for, Critical Program Information (CPI), Mission Critical Components (MCC), and Mission Critical Functions (MCF).

3.2.4.2. The Contractor shall develop and implement an approved OPSEC Plan to protect JPO CPI, MCC, and MCF across the enterprise.

3.2.5. Anti-Terrorism/Force Protection (AT/FP) Support:

3.2.5.1. The Contractor shall implement Resource Protection, Force Protection and Anti-Terrorism programs in accordance with DoD, NORTHCOM, PFPA, USAF, AFMC, AFLCMC policy/instructions.

3.2.6. Counter Insider Threat Support:

3.2.6.1. The contractor shall develop a Counter Insider Threat Program to deter, detect, and mitigate actions by insiders who represent a threat to national security.

3.2.6.2. The contractor shall provide Insider Threat Detection Analysis.

3.2.6.3. The contractor shall perform Security Incident Management actions.

3.2.6.4. The contractor shall support Active Shooter Awareness and Prevention activities.

3.2.6.5. The contractor shall coordinate with and support JPO Cybersecurity personnel regarding Counter Insider Threat activities.

3.2.7. Program Protection (P2) Security Support:

3.2.7.1. The contractor shall provide P2 security support throughout the acquisition and sustainment lifecycles for CPI, MCC, and MCF.

3.2.7.2. The contractor shall perform research relating to known threats and threat vectors.

3.2.7.3. The contractor shall conduct all Supply Chain Risk Management (SCRM) functions to protect the F-35 supply chain.

3.2.7.4. The contractor shall assist with tasks related to the Observables, Identification, and Containment (OI&C) Working Group

3.2.7.5. The contractor shall support aircraft mishap events:

3.2.7.5.1. Onsite coordination and execution of security protocols to protect critical technology.

3.2.7.5.2. Mishap support requires in depth knowledge and understanding of CPI, MCC, and MCF.

3.2.7.5.3. Mishap support requires the ability to travel globally on short notice for extended periods of time.

3.2.7.5.4. Mishap support requires the capability to lift 50 pounds of equipment and/or aircraft parts.

3.2.7.6. The contractor shall support SCRM initiatives and develop, through collaboration with logistics managers, critical component identification and analysis, requirements for supplier reviews, and recommend alternative cost-effective security countermeasures that meet security objectives within the capability or system design.

3.2.8. Export Compliance Support:

3.2.8.1. The contractor shall assist the Government in facilitating export related policy activities including the preparation and coordination of presentations for committee review, interacting with applicable interagency partners for export licenses, and interpreting/maintaining export-related documentation.

3.2.8.2. Coordinate across the JPO enterprise and other Government agencies to ensure a National Disclosure Policy (NDP) compliant air system is certified for export to international partners.

3.2.8.3. Review and provide recommendations on F-35 export licenses to ensure international participation remains within U.S. Government policy guidelines.

3.2.9. Low Observable/Counter Low Observable Policy (LO/CLO) Support:

3.2.9.1. The Contractor shall assist the Government with executing F-35 5th Gen, Aircraft LO/CLO policy activities.

3.2.9.2. The Contractor shall assist with planning for 5th generation coalition fighter interoperability and operations.

3.2.9.3. The Contractor shall coordinate F-35 integration and tactics issues with the U.S. Airforce, U.S. Navy, and U.S. Marine Corp counterparts to ensure consistent DoD guidance between the services.

3.2.9.4. The Contractor shall with the assessment of a Capability Development Document (CDD) compliant air system within NDP guidelines.

3.2.9.5. The Contractor shall coordinate across the JPO enterprise and with other Government agencies to ensure an NDP- compliant air system is certified for export to international partners.

3.3. Industrial Security (INDUSEC) Support.

INDUSEC covers protection of classified information, controlled unclassified information (CUI), ITAR, and proprietary information developed by or entrusted to U.S. industry operating under the National Industrial Security Program (NISP).

3.3.1. DoD Industrial Security Requirements Compliance Support:

3.3.1.1. The Contractor shall ensure security requirements and other security documentation (such as DD Forms 254s) in support of the JPO classified contracts are appropriately identified and implemented in accordance with organizational requirements.

3.3.1.2. The Contractor shall assist with ensuring CPI, MCC, and MCF are protected at industry locations.

3.4. Information Security (INFOSEC) Support.

INFOSEC covers the policies, procedures, and requirements to protect classified and controlled unclassified information (CUI) that, if disclosed, could cause damage to national security.

3.4.1. General INFOSEC Support:

3.4.1.1. The Contractor shall perform end of day security checks.

3.4.1.2. The Contractor shall retrieve, send, receive, and distribute mail from designated sites.

3.4.1.3. The Contractor shall review, receive, and transmit media via internal and external networks.

3.4.1.4. The Contractor shall maintain databases that reflect receipt, storage, inventory, and disposition of classified information to include data entry, personnel, updates, and generation of reports.

3.4.1.5. The Contractor shall conduct audits of Government classified holdings to ensure proper accountability.

3.4.1.6. The Contractor shall develop, plan, manage, and implement security policies as authorized by F-35 JPO Security.

3.4.1.7. The Contractor shall assist with the establishment, maintenance, and daily oversight of classified spaces (e.g., SAPFS, SCIFs, etc.).

3.4.1.8. The Contractor shall conduct entry/exit searches as required per established guidance.

3.4.1.9. The Contractor shall ensure all secure areas/facilities are open by 0600 and closed by 1800.

3.4.2. Classification Management Support:

3.4.2.1. The Contractor shall assist with the resolution of classification challenges.

3.4.2.2. The Contractor shall ensure repositories of Original Classification Authority activities (e.g., classification decisions/determinations, SCGs, etc.) are created and maintained. These repositories shall be made available to the greatest extent possible to the users of classified F-35 information.

3.4.3. Classified Document Control Support:

3.4.3.1. The Contractor shall perform inspection, inventory, logging, storage, documentation, transmittal, and internal distribution of classified information received.

3.4.3.2. The Contractor shall evaluate classified data submittals for compliance with the appropriate Security Classification/Declassification Guide (SC/DG).

3.4.3.3. Manage the courier program to include issuance of cards and conducting appropriate training and maintain positive inventory, reporting bi-annually the status.

3.4.3.4. The Contractor shall prepare and present courier briefing and issue courier identification.

3.4.4. Foreign Disclosure Support:

3.4.4.1. The contractor shall review, document, and assist with the release of information to non-US entities and to the public.

3.4.4.2. The contractor shall provide technical and analytical support for the release of information to non-US entities.

3.4.4.3. The contractor shall assist the Government with the interpretation and execution of disclosure and export policies.

3.4.5. Special Access Programs (SAP) Support:

3.4.5.1. The contractor shall provide SAP Billet management support including, but not limited to, assisting with the maintenance of SAP Billet Plans and associated documentation.

3.4.5.2. The Contractor shall develop and deliver GSSO training for US and international security professionals.

3.4.5.3. The Contractor shall assist, and serve as an alternate to, the Top Secret Control Officer.

3.5. Personnel Security (PERSEC) Support

PERSEC covers the standards, criteria, and guidelines upon which security eligibility determinations are based.

3.5.1.1. The Contractor shall maintain personnel security files as required.

3.5.1.2. The Contractor shall assist with updating personnel security clearance and access databases.

3.5.1.3. The contractor shall provide Program Access Request (PAR) Management Support

· Support to all PARs regarding international members shall occur at the F-35 JPO Headquarters in Crystal City, VA.

3.5.1.4. The contractor shall provide Personnel Clearance (PCL) Management Support

3.5.1.5. The contractor shall ensure security clearances for onsite Government and DoD contractor personnel are current, based on position sensitivity/access level, when compared to the DoD system of record.

3.6. Physical Security (PHYSEC) Support.

PHYSEC covers active and passive measures, designed to prevent the unauthorized access to personnel, equipment, installations, materials, and information; and to safeguard them against espionage, sabotage, terrorism, damage, and criminal activity.

3.6.1. Visitor Control Support:

3.6.1.1. The Contractor shall maintain databases of classified visits, clearance levels, and accesses.

3.6.1.2. The Contractor shall receive, transmit, and file visit request for assigned personnel and visitors for US CONUS and OCONUS facilities as well as international facilities.

3.6.1.3. The Contractor shall verify security clearance and program access to issue and account for visitor and permanent personnel badges.

3.6.1.4. The Contractor shall sign in and maintain visitor access utilizing secure electronic capabilities.

3.6.1.5. The Contractor shall escort un-cleared personnel in JPO spaces.

3.6.1.6. The Contractor shall process CAC applications and DD 2249s for Pentagon and JPO facilities access.

3.6.1.7. The Contractor shall process all required JPO In-processing documents and forms.

3.6.1.8. The contractor shall process all Foreign Visit System (FVS) activities and monitor international visits through any and all systems as directed by the Government.

3.6.2. Secure Facility Construction Support:

3.6.2.1. The Contractor shall advise and assist the government with providing Guidance and Documentation to Facilitate DoD/ICD Compliance.

3.6.2.2. The Contractor shall advise and assist the Government in maintaining all standards required by ICD 503, for Protection of the Information Systems and ICD 705, Physical Security Standards for Secure Rooms up to Special Access and/or SCI Facilities.

3.6.2.3. The Contractor shall advise on construction requirements, prepare fixed facility checklists, and prepare accreditation requests for Government processing.

3.6.2.4. The Contractor shall monitor requirements, processes requests for updates, and ensures accreditations/approvals remain current.

3.6.2.5. The Contractor shall assist with measures necessary for maintenance and testing of facility alarms and facility accreditation.

3.6.2.6. The Contractor shall assist in obtaining and maintaining facility accreditation under direction of the Special Security Officer (SSO), Program Security Officer (PSO), site security manager, and/or other designated US Government personnel.

3.6.2.7. The Contractor shall assist in the development of construction security plans, standard operating procedures, fixed facility checklists, requests for approvals and documentation required for SCI/SAP facility operations per established DoD and IC guidance.

3.6.2.8. The Contractor shall assist with developing facility security status reports.

3.6.2.9. The Contractor shall support all JPO SSAMP activities. Support includes, but is not limited to, physical attendance globally (at the direction of the government) and the drafting of memorandums recommending approval or disapproval of security construction documentation at the required intervals and as directed by the government.

4. GENERAL INFORMATION.

4.1. Period of Performance.

The period of performance (PoP) consists of a 12-month base period with four (4) 12-month option periods.

4.2. Place of Performance.

Government site(s) include 200 12th Street South, 201 12th Street South, 2521 South Clark Street, and 1550 Crystal Drive, in Arlington, Virginia (VA). Other operating locations include:

· Naval Air Warfare Center/Aircraft Division (NAWC/AD), Patuxent River, MD

· All Lockheed Martin Aeronautics Company F-35 locations in Fort Worth, TX

· Wright Patterson Air Force Base, OH

· 9595 Springboro Pike, Miamisburg, OH 45342

· Lexus Nexus Building, Dayton, OH

· EUCOM – Ramstein, Germany

· Eglin AFB, FL

· Edwards AFB, CA

· Naval Air Warfare Center/Weapons Division (NAWC/WD) China Lake, CA

· NAWC/WD, Pt. Mugu, CA

· Other US government and foreign government sites for temporary duty assignments

4.3. Hours of Operations.

The Contractor shall provide support services as captured in the performance work statement. Current duty hours are 8 hours between 0600 and 1800, Monday through Friday. The Contractor shall provide the Technical Point of Contact (TPOC) a current schedule for its entire staff assigned to the contract, including planned leave. The Contractor shall assign alternates to cover assignments of any of its staff that are absent sufficient to ensure that the services are not disrupted.

Work outside of the hours specified above will not normally be required. However, due to unforeseen circumstances, the COR may request unusual and lengthy after-hour, weekend, or holiday on-site support for services covered in this scope of work.

4.4. Telework.

All contractor personnel will provide on-site support at the Government sites listed above for approximately 100% of the time. There will be a representative for the contract in each supported office 100% of the time unless approved by the Contracting Officer (CO) or Contracting Officer's Representative (COR) and with concurrence from the Security leadership in writing such as when needed due to operational contingencies or otherwise determined to be in the best interests of the government. It is impermissible that there be any additional cost to the government for approved telework above the costs specified in this contract. In the event telework is utilized, the Contractor remains responsible for performance and compliance with any applicable cost accounting standards and contract cost principles/procedures. Remote work is not authorized.

4.5. Installation Closure.

When Federal employees are officially excused from work due to a holiday or a special event, severe weather, a security threat, or any other Government facility related problem that prevents Federal personnel from working at the Government facility, Contractor personnel assigned to work at that facility performing non-mission essential work in support of such Federal employees shall follow their parent company’s policies.

4.6. Non-Personal Services.

The services and performance required under this contract are determined to be not inherently governmental. The Contractor shall not perform or give the appearance of performing inherently governmental functions as described in Federal Acquisition Regulation (FAR) Part 2 and Subpart 7.5, and all applicable DoD policy. The Government shall neither supervise contractor employees nor control the method by which the Contractor performs the required tasks. All contract personnel shall identify themselves as contracted support personnel in all forms of communication with all entities with whom the JPO has business dealings. It shall be the responsibility of the Contractor to manage its employees and to guard against any actions that are of the nature of personal services or give the perception of personal services. If the Contractor believes that any actions constitute, or are perceived to constitute personal services, it shall be the contractor's responsibility to notify the CO immediately.

4.7. Business Relations.

The Contractor shall successfully integrate and coordinate all activity needed to execute the requirements specified herein. The Contractor shall manage the timeliness, completeness, and quality of the contract deliverables. The Contractor shall provide corrective action plans, proposal submittals, timely identification of issues, and effective management of all contractor personnel (including subcontractors). The Contractor shall seek to ensure customer satisfaction and professional and ethical behavior of all contract personnel.

4.8. Program Management.

The contractor shall provide contract management support under this contract. This includes the management, supervision and oversight of all activities performed by contractor personnel, including subcontractors, to ensure all F-35 JPO Security Directorate services satisfy the requirements identified in the Performance Work Statement (PWS). The Contractor shall maintain all management, supervision, manpower, training, screening, equipment, supplies, licenses, permits, certificates, insurance, pre-employment screenings, reports, files and any other resources necessary to accomplish the services as described herein. The contractor shall identify a Program Manager (PM) by name, who shall serve as the primary interface and point of contact (POC) with the Government program authorities and representatives on technical program/project issues. The contractor PM shall provide management, direction, administration, quality assurance, and leadership within the contractor’s team to their personnel for the execution of this contract in support of the F-35 JPO. The contractor shall facilitate communications between the Government and the contractor’s team along with all activities necessary to ensure the accomplishment of timely and effective support, performed in accordance with the requirements contained in this PWS.

The contractor shall use industry best practices and proven methodologies that assure that all contract activities are identified, documented, and tracked so that the contract shall continuously be evaluated and monitored for timely and quality service by the contractor. The contractor shall notify the COR, CO, and F-35 JPO TPOC in writing of any technical, financial, personnel, or general managerial problems encountered throughout the PoP.

4.9. Contract Management.

The Contractor shall establish clear organizational lines of authority and responsibility to ensure effective management of the resources assigned to this requirement. The Contractor must maintain continuity between the support operations and the Contractor's corporate offices.

The Contractor shall establish processes and assign appropriate resources to effectively administer this contract. The Contractor shall respond to Government requests for contractual actions in a timely fashion. The Contractor shall have a single point of contact between the Government and Contract personnel assigned to support this PWS. The Contractor shall assign work effort and shall maintain proper and accurate time keeping records of personnel assigned to work on this requirement including non-disclosure agreements.

4.10. Subcontract Management.

The Contractor shall be responsible for any subcontract management necessary to integrate work performed on this requirement and shall be responsible and accountable for subcontractor performance on this requirement. The prime Contractor shall manage work distribution to ensure there are no Organizational Conflict of Interest (OCI) considerations. Contractors may add subcontractors to their team after notification to the CO.

4.11. Contract Personnel and Continuity.

An integral part of successful performance under this contract is not only the production of quality products described in Section 3.0, but also the responsiveness of contract personnel in the day-to-day output of work products. While the end product or deliverable is vital to successful performance, day-to-day oversight also includes client interaction and responsiveness. Accordingly, the Contractor is required to proactively maintain assigned tasks, and be responsive to all entities with professional business dealings related to the assigned tasks.

4.12. Training.

The Contractor shall provide training, as necessary, for their personnel to ensure that personnel are trained on the common suite of Microsoft Office tools (e.g., Word, Excel, PowerPoint, Outlook, Teams and SharePoint) and other applicable programs. The Contractor shall also ensure that all its employees have been properly trained and are fully qualified to perform assigned tasks under this PWS. The Government will provide or coordinate training on any new Government-provided equipment or Government-directed training (e.g., Information Assurance). If such training requires travel on the part of contractor employees, local travel costs (e.g., Metro) shall be borne by the contract personnel.

4.12.1. General Security Support:

· All contractor personnel shall possess the Security Fundamentals Professional Certification (SFPC) or the Physical Security Certification (PSC) via Defense Counterintelligence and Security Agency’s (DCSA) Security Professional Education Development (SPēD) Certification Program.

· Personnel shall complete the Acquisitions and Contracting Basics in the NISP (IS123.16) via the Defense Counterintelligence and Security Agency’s (DCSA) Center for Development of Security Excellence (CDSE).

4.12.1.1. Security Compliance and Assessments Support:

· Personnel providing Compliance and Assessments Support shall possess the Industrial Security Oversight Credential (ISOC) via DCSA’s SPēD Certification Program.

· Personnel shall complete the NISP Self-Inspection (IS130.16) via CDSE.

· Personnel shall complete the Orientation to SAP Security Compliance Inspections (SA210.PR) via CDSE.

4.12.1.2. SETA Support:

· Personnel shall complete the Developing a Security Education and Training Program (GS104.16) via CDSE.

4.12.1.3. OPSEC Support:

· Personnel shall complete the Introduction to Risk Management (GS150.06) via CDSE.

· Personnel shall complete the Risk Management for DoD Security Programs (GS102.16) via CDSE.

4.12.1.4. AT/FP Support:

· Personnel providing AT/FP Support shall possess the Antiterrorism Credential (ATC) via DCSA’s SPēD Certification Program.

· Personnel shall complete the Anti-Terrorism Officer Certified by Pentagon Force Protection Agency or the Antiterrorism Officer (ATO) Level II (GS109.16) via CDSE.

4.12.1.5. Counter Insider Threat Support:

· Personnel complete the Establishing an Insider Threat Program for Your Organization (INT122.16) via CDSE.

· Personnel shall complete the Developing a Multidisciplinary Insider Threat Capability (INT201.16) via CDSE.

4.12.1.6. P2 Security Support:

· Personnel providing P2 Support shall possess the Security Asset Protection Professional Certification (SAPPC) and the Security Program Integration Professional Certification (SPIPC) via DCSA’s SPēD Certification Program.

· Personnel shall complete the ACQ-160 course offered via Defense Acquisition University (DAU) or the Program Protection Planning Awareness course (DAU-ACQ160.16) via CDSE.

· Personnel shall complete the Industrial Security Basics (IS122.16) via CDSE.

· Personnel shall complete the Risk Management for DoD Security Programs (GS102.16) via CDSE.

· Personnel shall complete the Counterfeit Prevention Awareness (DAU-CLL062.16) via CDSE.

· Personnel shall complete the Preventing Counterfeit Electronic Parts from Entering the DoD Supply (DAU-CLL032.16) via CDSE.

· Personnel shall complete the DoD Supply Chain Fundamentals (DAU-LOG0370.16) via CDSE.

4.12.2. INDUSEC Support:

· Personnel shall possess the Industrial Security Oversight Credential (ISOC) via DCSA’s SPēD Certification Program.

· Personnel shall complete the Acquisitions and Contracting Basics in the NISP (IS123.16) via CDSE.

· Personnel shall complete the Security Support to International Programs in Cleared Defense Industry (IS181.16) via CDSE.

· Personnel shall complete the Preparing the DD Form 254 (IS128.16) via CDSE.

· Personnel shall complete the Contracting Officer’s Security Representative (COSR) training within six months of assignment on CDSE.

4.12.3. INFOSEC Support:

· Personnel shall complete the Introduction to Information Security (IF011.16) via CDSE.

· Personnel shall complete the Security Classification Guidance (IF101.16) via CDSE.

· Personnel shall complete the Unauthorized Disclosure of Classified Information and CUI (IF130.16) via CDSE.

· Personnel shall complete the Classified Storage Requirements (IF004.16) via CDSE.

4.12.3.1. Classification Management Support:

· Personnel shall complete the Derivative Classification (IF103.16) via CDSE.

4.12.3.2. Classified Document Control Support:

· Personnel shall complete the Disposal and Destruction of Classified Information (IF002.16) via CDSE.

· Personnel shall complete the Transmission and Transportation for DoD (IF107.16) via CDSE.

4.12.3.3. Foreign Disclosure Support:

· Personnel shall complete the Foreign Disclosure Training for DoD (GS160.16) via CDSE.

4.12.3.4. Special Access Programs (SAP) Support:

· Personnel providing SAP Support shall possess the Special Program Security Credential (SPSC) via DCSA’s SPēD Certification Program.

· Personnel shall complete the Introduction to Special Access Programs (SAP) Overview (SA001.16) via CDSE.

4.12.4. PERSEC Support:

· Personnel shall complete the Introduction to Personnel Security (PS113.16) via CDSE.

· Personnel shall complete the Adverse Information Reporting (PS007.16) via CDSE.

· Personnel shall complete the Special Access Program Personnel Security Official (SPO) Training (SA106.16) via CDSE.

4.12.5. PHYSEC Support:

· Personnel shall complete the Introduction to Physical Security (PY011.16) via CDSE.

· Personnel shall complete the DOD Locks Approved to Safeguard Classified and Sensitive Materials (PY001.16) via CDSE.

4.12.5.1. Visitor Control Support:

· Personnel shall complete the International Visit Requests (IS005.16) via CDSE.

4.12.5.2. Secure Facility Construction Support:

· Contractor(s) will have the CDSE Physical Security Certification (PSC) from CDSE within 6 months from assignment.

· Personnel shall complete the Physical Security Virtual Environment Assessment (PY108.06) via CDSE.

· Personnel shall complete the Physical Security Measures (PY103.16) via CDSE.

· Personnel shall complete the Physical Security Planning and Implementation (PY106.16) via CDSE.

· Personnel shall complete the Storage Containers and Facilities (PY105.16) via CDSE.

· Personnel shall complete the ICD 705 Physical Security Construction Requirements for SAP (SA501.16) via CDSE.

4.13. Public Release/Non-Disclosure Agreement (NDA).

The release of all information and material related to this contract is not authorized without the review and approval of the Government. All contractor personnel are required to sign an NDA. The NDA will be due to the CO with a courtesy copy to the COR at time of post award conference and immediately upon replacement of any personnel under this contract.

4.14. Public Disclosure.

The Contractor shall not disclose or provide to the public information about training events and attendees/students of training events or sessions. The Contractor shall use its own company identity for any training site or posting of the event(s), if required by the government task manager, the CO, or the COR. At no time during the performance on the contract will any information be released or posted to the public that identifies the DoD or any of the attendees by name and or their position(s); all this information will be confidential. Note that training provided under this contract will normally be subject to the conditions of this paragraph.

4.15. Copyrights.

All training materials and content shall include a fully paid-up, lifetime license for use by the U.S. Government at no additional cost. No external copyright material shall be included in course materials/content unless a paid-up, lifetime copyright license is presented to the Government.

4.16. Organizational Conflict of Interest.

Contractor and subcontractor personnel performing work under this contract may inadvertently or intentionally receive, have access to or participate in the development of proprietary or source selection information (e.g., cost or pricing information, budget information or analyses, specifications, or work statements, etc.) or perform evaluation services which may create a current or subsequent Organizational Conflict of Interests (OCI) as defined in FAR Subpart 9.5. The Contractor shall notify the CO immediately whenever it becomes aware that such access or participation may result in any actual or potential OCI and shall promptly submit a plan to the CO to avoid or mitigate any such OCI. The Contractor’s mitigation plan will be determined to be acceptable solely at the discretion of the CO and in the event the CO unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the CO may affect other remedies as he or she deems necessary, including prohibiting the Contractor from participation in subsequent contracted requirements which may be affected by the OCI.

4.17. Information Technology.

The Contractor shall not purchase any IT equipment in support of this contract. The Government will provide all necessary reference documents not generally available to the Contractor as required. Throughout the life of the contract, if any instruction or document is replaced or superseded, the replacement or superseding instruction or document shall be applicable to the requirements defined in this PWS.

4.18. Section 508 Compliance.

All Electronic and Information Technology (EIT) products and services proposed shall fully comply with Section 508 of the Rehabilitation Act of 1973, per the 1998 Amendments, 29 United States Code (U.S.C.) 794d, and 36 Code of Federal Regulations (CFR) 1194. The contractor shall identify all EIT products and services proposed, identify the technical standards applicable to all products and services proposed, and state the degree of compliance with the applicable standards. Additionally, the contractor must clearly indicate where the information pertaining to Section 508 compliance can be found (e.g., vendor’s website or other exact web page location). The contractor shall ensure that the list is easily accessible by typical users beginning at TOA and shall inform the COR and TPOC of the information location.

5. SECURITY REQUIREMENTS.

5.1. Citizenship Requirements.

Only U.S. citizens may perform under this contract. If the Contractor cannot find qualified U.S. citizens to perform the work, the Contractor shall submit a citizenship waiver request with justification to the Government Security Office and COR. The waiver request should include:

· The individual's name, date and place of birth, position title, and current citizenship.

· A statement that a qualified U.S. citizen cannot be hired in sufficient time to meet the contractual requirements.

· A statement of the unusual expertise possessed by the applicant.

· A statement that access will be limited to a specific government contract (specify contract number).

· A statement that the Contractor has obtained an export license for the information required to perform the contract.

5.2. Security Requirements DD-254.

Contract Security Classification Specification. The Contractor shall comply with security requirements specified in the DD-254 attached to this contract. Information or data that the Contractor accesses shall be handled at the appropriate classification level, unclassified information shall be handled as Controlled Unclassified Information (CUI) (or updated designation). Distribution is authorized to the Requiring Office’s Organization and supported Activity only.

5.3. Basic Personnel Clearance Requirements.

The Contractor shall conform to the provisions of 32 CFR Part 117 National Industrial Security Program Operating Manual (NISPOM) Rule and shall obtain and maintain security clearances for Contractor employees. The Contractor shall assure the proper investigations are conducted for Contractor personnel in accordance with Section 2 of this PWS. Contractor personnel shall have and maintain a SECRET clearance, to include interim clearances (NOTE: Personnel performing duties requiring SAP access must have a final SECRET clearance at a minimum), based on an SSBI or SSBI-PR completed within five (5) years (or be enrolled in Continuous Evaluation) at Time of Performance (TOP) or time of hiring unless otherwise captured at the task order level or as allowed as stated below.