Section C - Oracle Consolidated Project Final SOO 20250611v7.pdf

Statement of Objectives Final, 11 June 2025

STATEMENT OF OBJECTIVES (SOO)

FOR

Air Force Services Financial Management System (AFSFMS) Oracle Consolidated Project

AT

Air Force Services Center (AFSVC), Port San Antonio, TX

Statement of Objectives Final, 11 June 2025

Table of Contents

SECTION I

1.0 DESCRIPTION OF SERVICES

1.1. General

1.2. Background

1.3. Scope

SECTION II

2.0 PROBLEM STATEMENT

2.1. Objective(s)

2.2 Final Outcome

SECTION III

3.0 DELIVERABLES AND ACCEPTANCE CRITERIA

3.1. Deliverables

3.2. Acceptance Criteria

SECTION IV

4.0 TERMS OF THE CONTRACT, STAKEHOLDER (collaborating offices)

4.1. Timeline

4.2. Contractor Qualifications

4.3. Stakeholders (Collaborating Offices)

SECTION V

5.0. CONTRACT ADMINISTRATION

5.1. Reporting

5.2. Schedule

5.3. Resource Calendar

5.4. Meetings

5.5. Weekly Status Meetings

5.6. Documentation

SECTION VI

6.0 GENERAL INFORMATION

6.1. Contracting Officer’s Representative (COR) Responsibilities

6.2. Place of Performance

6.3. Government Furnished Equipment (GFE) & Personnel

6.4. Travel

Statement of Objectives Final, 11 June 2025

6.5. Identify Known or Possible Conflicts of Interest

6.6. Security and Training Requirements

6.7. Security Clearances

6.8. Privacy Act

6.9. Cyber Security

6.10. Cyber Security Work Force (CSWF)

6.11. Section 508: Data Stewardship and Governance

SECTION VII

7.0 APPENDIX

7.1. DEFINITIONS & ABBREVIATIONS

7.2. ACRONYMS

7.4. Sample Weekly Status Reports or as agreed upon by COR

7.5. Sample Contract Progress Report

7.6. NAFI Observed Holidays

Statement of Objectives Final, 11 June 2025

SECTION I

1.0 DESCRIPTION OF SERVICES

1.1. General. The Air Force Services Center (AFSVC), headquartered at Joint Base San Antonio-Lackland, Texas, delivers Services programs and activities to build and sustain ready and resilient Airmen, Guardians and families. AFSVC supports the bases, major commands and air staff by providing technical assistance, new initiatives, developing programs and procedures and managing central support functions. AFSVC ensures successful operation of essential food, fitness, childcare, lodging and recreation opportunities for military members and their families. The Center’s responsibilities include preparing responses to high-level inquiries, providing technical assistance to the field and developing new programs that support major command and installation activities. The Installations Systems Branch (VTEI) manages the Oracle E-Business Suite (EBS) Air Force Services Financial Management System (AFSFMS). AFSFMS supports a worldwide mission providing payroll, human resources, benefits, cash management and financial information to customers.

1.2. Background.

1.2.1. AFSVC needs to enrich their investment in EBS, and to future-proof and modernize AFSFMS by providing agile and responsive tooling, infrastructure, and platforms to accomplish the mission.

1.2.2. Volumetrics:

24x7 System Oracle E-Business Suite R12 (12.2.13) on Red Hat Enterprise Linux release 8.8

(Ootpa) & Red Hat Enterprise Linux Server release 7.9 (Maipo) Oracle Database 19c

Current Modules:

Fixed Assets Accounts Payables Purchasing Accounts Receivables Benefits Cash Management Treasury General Ledger Payroll

Total of 28,448 Users: 1,445 APF; 19,875 NAF; 7,128 Retirees-Beneficiaries 150+ OAS Reports 10,000+ Oracle 6i Base Reports (Monthly) Transactions processed in AFSFMS

11 million transactions per day 330 million transactions per month

Statement of Objectives Final, 11 June 2025

4 billion transactions per year 4TB of data for a database tier - executables + DB (Production) Six (6) instances in Sustainment Production Environments: PROD, DR Testing Environments: DEV, TEST, GOLD, TRAIN

1.3. Scope.

1.3.1. AFSVC seeks an EBS R12.2.X-certified contractor with deep expertise in Oracle EBS modules to replace legacy systems by seamlessly integrating new Oracle EBS modules with existing EBS modules and enhancing existing EBS modules. The contractor will provide configuration, implementation, and DBA support, focusing on Treasury Management, Cash Management, Project Management, iSupplier, Payables, Contract Life-Cycle Management (CLM), Procurement, and related modules to fully leverage and optimize the capabilities of the Oracle EBS platform.

SECTION II

2.0 PROBLEM STATEMENT

AFSVC needs to make significant investments to modernize and deliver the rock-solid Oracle E- Business Suite necessary to meet the demands of AFSVC. The purpose of this SOO, utilizing industry best practices, is to:

Review, analyze and implement the current legal entity set-up and determine the best legal entity mapping following R12 recommended functionality.

Reconfigure the current LOA set-up to ensure full functionality of each segment within the Oracle LOA are properly formatted to ensure the modules and the entire system functions correctly.

Configure, integrate and implement Oracle’s Project Management.

Configure, integrate, and implement full functionality of the Cash Management and

Treasury Management modules into the current AFSFMS for the Financial Management & Comptroller Directorate replacing the current legacy Cash Management and Investment Program (CMIP) (AFSVC/VF 525).

Configure, integrate and implement Contracting LifeCycle Management (CLM), Procurement and, iSupplier (or other system as recommended by contractor) replacing the current customized legacy Internet Based Purchasing System (IBPS).

The Contractor shall provide all services, travel, and project supervision, as required in connection with this Statement of Objective (SOO).

2.1. Objective(s).

2.1.1. AFSVC requires an analysis of existing processes, source document submission and data exchanges; and a recommendation on implementation and sequencing of all objectives.

2.1.2. Review, analyze and implement the current Ledger set-up and determine the best mapping and recommended functionality.

Statement of Objectives Final, 11 June 2025

2.1.3. Reconfigure the AFSVC current line of accounting (LOA) to allow the full capability of the inter/intra accounting segments.

2.1.4.Configure, integrate and implement Oracle’s Projects Management and configure, integrate, and implement full functionality of Oracle’s, Cash Management, and Treasury Management.

2.1.5. Transition all AFSVC/VF 525 legacy cash management and accounting system, transactions and all reports. Configure and code to transition into the AFSFMS.

2.1.6. Migrate all legacy accounting data from AFSVC/VF 525 database into AFSFMS.

2.1.7.Configure, integrate and implement Contracting LifeCycle Management (CLM), Procurement and iSupplier (or other system as recommended by contractor).

2.1.8.Configure, integrate and implement the Procurement and Procurement Contracts module integrated with CLM. Migrate all active data from current contracting system database.

2.1.9. Prepare the environment for System Integration Testing (SIT)/ User Acceptance Testing (UAT) environments.

2.1.10. Complete retrofitting, break/fix troubleshooting, SIT/UAT, and update implementation plan with any defect resolution(s) and timings

2.1.11. Contractor conducts an initial Smoke test in SIT/UAT, and release instance to users for final acceptance testing.

2.2 Final Outcome.

2.2.1. At the end of the contract performance, AFSVC AFSFMS environments will have Objectives 2.1.2. thru 2.1.8 fully tested and operational in the Production environment.

2.2.2. Post support and sustainment in place for each module..

SECTION III

3.0 DELIVERABLES AND ACCEPTANCE CRITERIA

The Contractor shall provide deliverable(s) in a format mutually agreed upon by the Government and the Contractor. The following deliverables are not expected to change. Due Date intervals are not expected to change but actual dates may need to be revised depending on actual contract start date. The Contractor shall provide its list of deliverables based on its proposed technical solution. This section will be updated based on the proposed technical solution selected by the Government.

Contractor must have experience with replacing legacy systems with Oracle solutions, to include development, configuration, implementation, and DBA support.

3.1. Deliverables

3.1.1. Deliverable one (1): Analysis of existing processes, source document submission and data exchanges; and a recommendation on implementation and sequencing of all objectives stated above and all current module implementation within 90 days from the start of the contract.

Statement of Objectives Final, 11 June 2025

3.1.1.1. The contractor shall provide an analysis (matrix) of AFSVC’s current ERP (Oracle E-Business Suites). Analyze benefits received from the integration and provide maximum optimization. If something cannot be fully integrated, an analysis of why will be required. Estimated at 30 days from paragraph 3.1.1.

3.1.2. Deliverable two (2): A Project Plan and RASCI matrix will be created by the Contractor, with AFSVC input, to identify all the roles and responsibilities of each stakeholder on the project. Within 30 days after deliverable one (1).

3.1.3. Deliverable three (3): Create an implementation plan for entire project. Within 30 days after deliverable two (2).

3.1.4. Deliverable four (4): Analysis and implementation (merge) of the ledger set-up, determine ledger mapping and recommendation of functionality.

3.1.5. Deliverable five (5): Reconfigure the current LOA set-up to ensure full functionality of each segment within the Oracle LOA are properly formatted to ensure the modules and the entire system functions correctly. Correct the current LOA set-up to ensure full functionality and reconfigure current reports to align with the new LOA structure. Note: Central AF NAFIs are considered parent companies and AF installation NAFIs are considered subsidiaries to those parent companies.

3.1.6. Deliverable six (6): Analysis of current Oracle Treasury Management setup, then configure, integrate and implement full functionality of Oracle’s Treasury Management to include reporting and Cash Management functionality

3.1.7. Deliverable seven (7): Transition AFSVC/VF 525: configure, integrate, and implement an in-house banking feature to act as a custodian bank to AF NAFI subsidiaries. All transactional activity for each AF NAFI subsidiary account from accounts payable, payroll, deposits, cash transfers between AF NAFI subsidiaries, interest paid/received from custodian bank to AF NAFI subsidiaries, associated accounting entries, incoming and outgoing transactional activities, all transactions in the legacy AFSVC/VF 525, and all daily cash-in-bank activity to be captured for each AF NAFI subsidiary to include calculations. Varied daily reporting functionality required.

Banking feature of “custodian bank” held within general ledger transitioned from AFSVC/VF 525 to AFSFMS. Each AF NAFI subsidiary’s cash balance must be auditable and satisfy audit requirement for cash balancing/reconciliation to general ledger control account.

3.1.8. Deliverable eight (8): Analysis of current Oracle’s Cash Management setup, then configure, integrate and implement full functionality of Oracle’s Cash Management.

3.1.8.1. Analysis of existing capabilities of legacy cash management system and ensure capability, functionality, and internal controls are provided in new module(s).

Existing capabilities and functionalities may need to be gained in more than one module in new environment.

3.1.8.2. Determine and implement relevant configurations and interfaces to support integration with other modules and cash inflows/outflows i.e. accounts payable, Statement of Objectives Final, 11 June 2025 payroll, revenue processing, merchant processing, etc. and other internal payment processes (i.e., workers’ comp) along with associated accounting entries.

3.1.9. Deliverable nine (9):Configure, integrate and implement full functionality of Oracle’s Project Management.

3.1.9.1. Migrate/convert transactional and related data for existing projects from various sources and file types into Oracle’s Project Management.

3.1.9.2. Configure supporting sub-ledgers to each project general ledger control account. Sub-ledger must be auditable and satisfy audit requirement for balancing/reconciling general ledger project control accounts on balance sheet.

3.1.9.3. Configure RICE reporting requirements in addition to modifying seeded reports and produce new reports as directed by COR. (Add RICE Attachment)

3.1.10. Deliverable ten (10): Transition general ledger and financial statements currently residing on AFSVC/VF 525 to AFSFMS and configure, integrate necessary coding to capture all cash management related activity into AFSFMS general ledger/financial statements. This general ledger/financial statement holds custodian bank account referred to in 3.1.7. above.

3.1.11. Deliverable eleven (11): Migrate all legacy data from AFSVC/VF 525 database into AFSFMS.

3.1.12. Deliverable twelve (12):Configure, integrate and implement Oracle Contracting LifeCycle Management (CLM), Procurement and Procurement Contracts modules.

3.1.13. Deliverable thirteen (13):Configure, integrate and implement Oracle iSupplier or other system as recommended by contractor.

3.1.13.1. If different systems are recommended, Total System Cost, Implementation cost, Training costs, and Yearly Maintenance License Fees are needed.

3.1.14. Deliverable fourteen (14): Provide MD50/70/120 documentation for deliverables six (6) thru thirteen (13).

3.1.15. Deliverable fifteen (15): Provide train-the-trainer material and training for Oracle Cash Management, Oracle Treasury Management, Oracle Project Management, Oracle iSupplier, Oracle Contract Life Management, Oracle Procurement and Procurement Contracts modules.

3.1.16. Deliverable sixteen (16): Migrate all active data from current contracting system database.

3.1.17. Deliverable seventeen (17): Create an archiving plan for auditable data from IBPS and AFSVC VF 525 systems.

3.1.18. Deliverable eighteen (18): Post implementation support for all modules.

3.2. Acceptance Criteria.

3.2.1. All deliverables, technical services, and products must be functionally tested to ensure compatibility with the Air Force systems. They must be approved by the

Statement of Objectives Final, 11 June 2025

Contracting Officer’s Representative (COR) and designated representatives from AFSVC before acceptance and must be capable of obtaining a viable assessment and authorization.

3.2.1.1. Weekly/Monthly status reports/meetings to the government with the following information:

3.2.1.1.1. Contract funds expended during the reporting period (monthly).

3.2.1.1.2. Description of the activities of the past week/month.

3.2.1.1.3. Any issues or problems affecting project progress along with proposed resolution (weekly/monthly).

3.2.1.1.4. Schedule of activities planned for the next reporting period (weekly/monthly).

3.2.1.1.5. Acceptance criteria for metrics, trip reports, and technical presentation requirements are as specified in the Deliverables section.

3.2.1.1.6. Quarterly Total Quality Management (TQM) reports.

3.2.1.1.7. Documented recommendations, system configurations/set-up and guidance identified/discussed in meetings or collaborative sessions.

3.2.2. All data or work products generated in the support and development effort shall be property of AFSVC.

3.2.3. Acceptance or rejection of named deliverables will occur by the COR, within 14 business days after receipt.

SECTION IV

4.0 TERMS OF THE CONTRACT

4.1. The NAFI will award one (1) Indefinite Delivery, Indefinite Quantity (IDIQ). The contract shall be for a two (2) year base period, with five (5), one (1) year options, for a total potential performance period of seven (7) years.

4.2. Contractor Qualifications.

The Contractor shall provide the experience necessary to complete the task outlined in the SOO. The Contractor shall utilize established policies, standards, and sound management principles in the performance of the SOO requirements and deliverables.

4.2.1. Offerors should be members of the “Oracle Certified Partner Network” to qualify for bidding.

4.2.2. The Contractor’s personnel, at a minimum, shall have the following experience as required per module:

4.2.2.1. Must have Oracle Cloud development and Oracle APEX experience.

4.2.2.2. Must have Oracle E-Business Suite R12 experience.

4.2.2.3. Must have line of accounting (LOA) implementation experience.

Statement of Objectives Final, 11 June 2025

4.2.2.4. Must have Oracle EBS core financial accounting knowledge with a concentration in Projects Management, Cash Management, and Treasury Management modules experience to include financial accounting experience for transition of legacy financial statements and interrelated data functionality from legacy system to the modules within the AFSFMS

4.2.2.5. Must have Contracting LifeCycle Management (CLM), Procurement, iSupplier (or similar product), and Purchasing modules experience.

4.3. Stakeholders (Collaborating Offices).

4.3.1 Lead organization for this effort: AFSVC/VT

4.3.2 Collaborating organizations: AFSVC/CC, AFSVC/VI, AFSVC/VIS, AFSVC/VP, AFSVC/VPE, AFSVC/VF, AFSVC/VFT, AFSVC/VFA, AFSVC/VT, AFSVC/VTOI, AFSVC/VTEI, AFSVC/VMX, AFSVC/VBL and others as needed (i.e., impacted Major Commands/Field Commands).

4.3.3 Risks created by multiple stakeholders:

4.3.3.1 Decentralized management/oversight of AFSVC and AFSVC/VTEI portfolio

4.3.3.2 Multiple process owners or co-process owners (which could be conflicting);

lack of structure and business rules governing/guiding the recent re-assignment of roles/responsibilities

4.3.3.3 Multiple requirement owners/generators; no mechanism or process implemented to accurately capture, validate, and prioritize requirements across the Enterprise

SECTION V

5.0. CONTRACT ADMINISTRATION

5.1. Reporting.

5.1.1. The Contractor shall provide weekly status reports (See 7.4. Weekly Status Report) and/or other updates as needed to provide the Contracting Officer’s Representative (COR) with the current status of the tasks completed for the week. The status report must identify action and/or items completed by individual contract resources, planned task/activities, risks and status updates.

5.1.2. Provide a list of planned task/activities for the week in the status report.

Subsequent status reports shall include completed percentage of completion of the previous week’s planned task/activities and a new list of planned activities for the following week.

5.1.3. The Contractor shall provide a monthly contract progress report, with their monthly invoice, that shall be consistent with the submitted and COR approved weekly status reports. (See 8.5. Contract Progress Report)

5.2. Schedule.

Statement of Objectives Final, 11 June 2025

5.2.1. A detailed contract plan that shall outline major tasks such as discovery/ramp up time, and environment configuration, validation/review, development and required support activities. The Contractor shall deliver in accordance with (IAW) the approved schedule.

5.2.1.1. The Contractor shall provide, at the scheduled kick-off meeting, a detailed contract plan (i.e. Gantt Chart) outlining major tasks such as discovery/ramp up time, environment configuration, validation/review, development and required support activities.

5.2.1.2. The Contractor shall provide, thirty (30) days, after the kick-off meeting, a realistic detailed project plan outlining the tasks and subtasks for both the AF and the Contractor based on the deliverables and requirements listed in the SOO. Once the submitted plan/schedule is approved by the COR, the Contractor shall deliver IAW the approved schedule.

5.2.1.3. All forecasted or unexpected delays to the schedule must be reported to the COR within one (1) business day of discovery. The Contractor shall provide reason for delay and proposed resolutions to the COR no later than 1600 CST the same day.

5.2.1.4. If a delay occurs and is the result of Contractor error, the Contractor shall submit a revised schedule to the COR for review and approval within two workdays of recognition of delay.

5.3. Resource Calendar.

5.3.1. At a minimum of 21 business days in advance, the Contractor shall provide the COR, in writing, the projected days the Contractor’s resources will be unavailable. This information is necessary to help plan for critical support task/activities like patching, system upgrades but not limited to these activities. This will allow AFSVC to coordinate and plan for resource availability.

5.4. Meetings.

5.4.1. Kick-Off Meeting. A kick-off meeting will be held after contract award on a date and time agreeable by both parties. The meeting will be held at the Place of Performance. The Contractor shall designate a primary Point of Contact (POC) for the contract for the kick-off meeting.

5.5. Weekly Status Meetings.

5.5.1. The day and time of the weekly status meeting shall be determined by the COR and the Contractor after contract award. Meetings will be held virtually unless otherwise coordinated between COR & Contractor.

5.5.2. Recommendations identified or discussed in meetings or collaborative sessions shall be provided in writing within two (2) business days of initial recommendations.

Contractor shall provide any recommendations, alternate options, scenarios or configurations in writing in MS Word format or COR approved format.

5.6. Documentation. All recommendations, configurations, and guidance must be provided in writing in MS Word format or COR approved format.

Statement of Objectives Final, 11 June 2025

5.6.1. Provide guidance and instruction for existing documentation provided such as setup and configuration documents.

5.6.2. Provide guidance and instruction to develop system documentation provided such as setup and configuration documents.

SECTION VI

6.0 GENERAL INFORMATION

6.1. Contracting Officer’s Representative (COR) Responsibilities.

6.1.1. The Contracting Officer (CO) will designate an individual as the Contracting Officer’s Representative (COR).

6.1.2. The COR is responsible for monitoring the performance of work under this contract. In no event, shall any understanding, agreement, modification, change order, or other matter deviating from the terms of this contract be effective or binding upon the contracting customer unless formalized by proper contractual documents executed by the CO prior to the completion of the contract.

6.1.3. This designation shall remain in effect throughout the life of the contract, unless terminated sooner in writing by the CO or due to reassignment. Primary responsibilities of the COR may include, but are not limited to, the following:

6.1.3.1. The COR is responsible for performing post award administrative functions necessary to ensure performance of services required by this contract. If the COR believes performance by the Contractor has not met the level required by the contract, the problem shall be referred to the CO for resolution.

6.1.3.2. The COR shall maintain and approve the list of all products required to be delivered by the Contractor as well as when the product is delivered and its acceptability status, this includes the project schedule.

6.1.3.3. The COR will maintain a record of all contract deliverables and a copy of the email message or cover letter used to deliver the deliverables.

6.1.3.4. The COR will work with CO to ensure the following responsibilities are adhered to:

6.1.3.4.1. Verify that the Contractor performs the technical requirements of the contract in accordance with the terms, conditions, and specifications therein.

Specific emphasis shall be placed on the quality provisions, for both adherences to the contract provisions and to the Contractor's own quality control program.

6.1.3.4.2. Perform acceptance for the customer of services performed under this contract.

6.1.3.4.3. Communication will be the key to success of this effort. Maintain liaison and direct communications with the Contractor and the CO. Written communications with the Contractor and other documents pertaining to the contract shall be signed by the COR and a copy shall be furnished to the CO.

Statement of Objectives Final, 11 June 2025

6.3.4.4. Monitor the Contractor's performance, notify the Contractor of deficiencies observed and direct appropriate action to effect correction. Record and report to the CO incidents of faulty or non-conforming work, delays, or problems.

6.2. Place of Performance

3515 South General McMullen Bldg. 1, San Antonio, TX 78236-9854. Remote work is authorized for a majority of the contract, however in office work may be required as recommended by the COR & Contractor.

6.3. Government Furnished Equipment (GFE) & Personnel

6.3.1. AFSVC will provide all software currently approved by the Air Force to sustain the current AFSFMS environment and required on the PCs. The software will be installed on the GFE-owned PCs and will be operational at the start of this contract.

6.3.2. If the GFE malfunctions, the Contractor shall notify the COR immediately.

6.3.3. GFE Updates. Any updates or additional required software, security patches, or maintenance will be accomplished by AFSVC. If required, AFSVC will provide other GFE as resources permit during this timeframe.

6.3.4. AFSVC will provide GFE-owned PCs to do the required work and access to the applications.

6.4. Travel

Contractor shall include in their price for the assigned team to travel to San Antonio, TX for the kick-off meeting, to pick-up & turn-in Government Furnished Laptops (turn-in will include a Contract Closeout Meeting). All other travel must be mutually coordinated & reimbursed by AFSVC in accordance with the Federal Travel Regulations (FTR see Clause 29 of the SEC I – NAF Standard Clauses).

6.5. Identify Known or Possible Conflicts of Interest

Contractor will have access to the Department of Air Force execution data from financial systems, contracts, and pricing data at the CLIN level. Contractor shall identify any known or possible conflicts of interests to the COR.

6.6. Security and Training Requirements

Highest level: UNCLASSIFIED. The preponderance of work will be at the unclassified level.

6.6.1. Building Access. Unescorted access to the AFSVC/Building 1 is approved and shall be coordinated through the COR and AFSVC’s Security Manager. Any other locations shall be approved on a case-by-case basis.

6.6.2 Training. Cyber Awareness Challenge Training, Controlled Unclassified Information (CUI) Training (one-time) and Privileged User Cybersecurity Responsibilities (if server access required). All Government required training shall be provided at no cost by the Government.

Statement of Objectives Final, 11 June 2025

6.7. Security Clearances

6.7.1. The Contractor shall ensure that personnel requiring access to AFSVC information systems, or its data have the proper and current cybersecurity certifications as determined by AFSVC cybersecurity teams to perform cybersecurity functions in accordance with DoDM 8140.03, Cyberspace Workforce Qualification and Management Program located at https://dodcio.defense.gov/Portals/0/Documents/Library/DoDM-8140-03.pdf.

6.7.2. The Contractor shall meet the following contract/security clearance requirements, including:

6.7.2.1. The Contractor shall safeguard and comply with the rules and regulations issued under DoDM 5200.01 V1, DoD Information Security Program: Overview, Classification and Declassification, 24 Feb 12, DoDM 5200.02, DoD Personnel Security Program (PSP), 21 Mar 2014; AFMAN 16-1405, Air Force Personnel Security Program; AFM 33-152, User Responsibilities and Guidance For Information Systems; DoDI 8500.01 security, 14 Mar 2014; AFI 17-130, Air Force Cybersecurity Program Management; and DoDM 8140.03, Information Assurance Workforce Improvement Program requirements and respective updates to the listed rules and regulations. The Contractor shall follow the DoD Privacy Office guidelines for submittal of Information Assurance Technical (IAT) security clearances and ensure all personnel are designated as IAT-II, or IAT-III where duties meet the criteria of the position sensitivity designations as stated in the DoDM 8140.03.

6.7.2.2. Contractor personnel assigned to perform duties within IAT-II or IAT-III, and or requiring “Limited Privileged Access” such as system or database administration rights, to the application or network are subject to investigation to determine whether they are and will remain reliable, trustworthy, of good conduct and character, and loyal to the United States and whether granting or continuing national security eligibility is clearly consistent with the national interest (Ref. DoDI 5200.02, DoD Personnel Security Program (PSP), 21 Mar 2014; AFMAN 16-1405, Personnel Security Program, Para 3.1). Documentation for a Tier 1 or Tier 3 investigation must be submitted to the Unit Security Manager within 10 business days after award.

6.7.3. Tier 1 requests are initiated using the Standard Form (SF) 85. Tier 3 requests are initiated using the Standard Form (SF) 86 and are submitted to the installation Information Protection Office through the Unit Security Manager. The initiation of the Tier 1 or Tier 3 shall include the submission of all required information and verified through the Department of Defense (DoD) Defense Information System for Security (DISS) database. The Contractor shall comply with the rules and regulations under DMDC Trusted Associate Sponsor System Overview Guide, Version 5.7, Sept 2018, DODI 5200.46 Issuing the Common Access Card (CAC) and associated updates.

Individuals who are non-U.S. nationals in the United States or U.S. territory for 3 years or more must have a NACI or equivalent investigation initiated after employment authorization is appropriately verified. (2) Non-U.S. nationals who have been in the United States or U.S. territory for less than 3 years do not meet the investigative requirements for CAC issuance. All CAC holders must, at a minimum, have an open favorable public trust background investigation (BI) and Special Agency check (SAC) , Statement of Objectives Final, 11 June 2025 or a DoD determined equivalent investigation. The NAFI may grant a waiver to allow the Contractor to start work after submitting all required information and passes a successful background check.

6.7.4. All Contractor personnel requiring network access must be adjudicated with a Favorable determination in DISS.

6.7.5. The Contractor shall ensure all FISMA, NIST, Department of Defense (DoD), Air Force certification, accreditation/assessment and authorization, data protection and security standards are met and renewed on a continuing basis throughout the contract period.

6.7.6. Information Systems (IS)/Networks Physical Security. The Contractor shall employ physical security safeguards for IS/Networks and applications involved in processing or storage of U.S. customer data to prevent the unauthorized access, disclosure, modification, destruction, use, etc. at any time, and to otherwise protect the confidentiality and ensure use conforms with DoD regulations. In addition, the Contractor shall support a physical security audit performed by the U.S. customer of the Contractor's internal information management infrastructure that is used in development.

The Contractor shall correct any deficiencies identified by the customer of the Contractor's physical security posture. The Contractor shall be required to follow all requirements in applicable DoD Information Assurance directives and policies.

6.7.7. All Contractor personnel requiring system access must respond to the AFSVC Security Manager’s inquiries within three business days (excluding federal holidays), not to exceed 72 hours. If Contractor personnel do not respond to the AFSVC Security Manager’s inquires within three business days, their non-compliance on this matter provides grounds for termination.

6.8. Privacy Act

The Contractor shall safeguard and comply with the agency rules and regulations issued under Public Law 110-53 (42 U.S.C. § 2000ee-1) Section 803; Air Force Policy Directive (AFPD) 33-3, Information Management; Department of Defense Directive (DoDD) 5400.11, Department of Defense Privacy Program; Department of Defense Regulation (DoDR) 5400.11-R, Department of Defense Privacy Program; Department of Defense Instruction (DoDI) 5400.16, DoD Privacy Impact Assessment (PIA) Guidance; DoDI 1000.30, Reduction of Social Security Number (SSN) Use Within DoD; and DoDI 1000.29, and DoD Civil Liberties Program, Privacy Act of 1974, 5 U.S.C. § 552a, E-Government Act of 2002, 44 U.S.C. §3601, Safeguarding and Responding to Personally Identifiable Information (PII) breaches, Reduction of Social Security Number (SSN) and AFI 33-332, AF Privacy and Civil Liberties Program and associated updates to the agency rules and regulations. Penalties are applied for the misuse or unauthorized disclosure of PII. The Act (5 U.S.C. 552a) provides for civil remedies for injured parties, including actual damages, attorney fees, and litigation costs.

6.9. Cyber Security

6.9.1 The Contractor shall comply with Risk Management Framework requirements and cybersecurity policies and instructions outlined in Department of Defense Instructions

Statement of Objectives Final, 11 June 2025

(DODI): 1015.16, 5205.13, 8520.02, 8551.01, DAFI 34-101; 2019 National Defense Authorization Act Sections 881, 1631-1657; current versions of National Institutes of Standards and Technology (NIST) publications 800-53, 800-37, 800-161, 800-34, 800-60 Vol 1 and 2, 800-122, 800-171; 800-172, 800-128; 800-63A; current DOD CIO policies located at https://dodcio.defense.gov/Library/; and current version of PCI-DSS.

6.9.1.1 The Contractor shall comply with applicable Security Technical Implementation Guide (STIG) and Security Requirements Guides (SRG) under purview of the NAFI. Applicable Correlating Control Indicators (CCI) are available on the DoD Cyber Exchange (https://public.cyber.mil/stigs/cci/).

6.9.1.2. The Contractor shall provide pertinent administrative, technical documentation support, data, topologies, hardware, software, firmware listings and inventory to the NAFI for review and acceptance to support a successful identify management, cloud access/internet access point, cybersecurity service provider, and Payment Card Industry Data Security Standards (if applicable).

6.9.1.3. Pursuant to the Office of Management and Budget (OMB) Memorandum M-21-07, contractors shall ensure that information systems using internet protocol (IP) technologies will be IPv6-enabled before implementation and operational use.

6.9.2. The contractor shall provide cyber security for systems according to the DFARS clauses incorporated by reference below:

252.204-7009 Limitations on the Use or Disclosure of Third-Party Contractor Reported Cyber Incident Information.

252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting. (DEVIATION 2024-O0013)

252.204-7021 Cybersecurity Maturity Model Certification Requirements.

252.239-7001 Information Assurance Contractor Training and Certification.

252.239-7010 Cloud Computing Services.

6.9.3. Where applicable, the Contractor shall ensure all components in the contractor solution, any applications that process, store, and/or transmit credit card information/cardholder data are thoroughly assessed and meet the most current version of the Payment Card Industry Data Security Standards (PCI DSS). The solution must meet all PCI DSS compliance requirements identified by the Payment Card Industry Security Standards Council. The Contractor shall provide to the NAFI sufficient evidence of PCI DSS Compliance certification regarding the solution’s PCI DSS compliance status.

6.9.3.1. The PCI DSS assessment and compliance validation of the appropriate Self- Assessment Questionnaire (SAQ) control identified and must be completed by a certified Qualified Security Assessor (QSA) with sufficient expertise. Qualified Security Assessor (QSA) companies are organizations that have been qualified by the PCI Council to have their employees assess compliance to the most current version of PCI DSS standard. Qualified Security Assessors are employees of these organizations

Statement of Objectives Final, 11 June 2025 who have been certified by the Council to validate an entity's adherence to the most current version of PCI DSS.

6.9.3.2. If payment applications are used within the solution, the applications must be PCI certified applications as derived from the PCI Data Security Standard requirements and Security Assessment Procedures. Contractor shall comply with all PCI annual requirements.

6.10. Cyber Security Work Force (CSWF):

Information Systems (IS) Access and Cybersecurity Workforce (CSWF) Requirements:

6.10.1. Contractor associates requiring system access to a AFSFMS will be required to undergo a background investigation and obtain a favorable adjudication before being approved for access.

6.10.2. System Access Levels: Contractor access to a AFSFMS can be separated into two levels, Authorized Access (AA) or Privileged Access (PA). AA provides basic access to an IS and a user will be able to browse, send email, and perform basic computing functions as appropriate. A PA user will have the same capability as an AA user but will also be able to make configuration and other changes at system level. A PA user would be involved in system administration, network configuration, programming, etc.

NOTE: U.S. citizenship, or who is a national (a resident of American Samoa and Swain Island), are eligible to be approved for Privileged Access to AFSFMS Systems.

6.10.3. System Access Documentation: Whether they require AA or PA a contractor associate will be required to submit a DD Form 2875 and submit to a background investigation (BI) appropriate to the level of access (AA or PA) being requested. The associate will also be required to take DOD provided cybersecurity and privacy training as part of their system access request. Further details on the required system access documentation are as follows:

6.10.3.1. DD Form 2875, TASS Form, OF306 or any Form(s) succeeding its use.

Completed at the outset of a contract. A BI resulting in an adjudication of less than favorable will mean that the associate will not be approved for system access (either AA or PA) and an alternate associate will need to be provided by the contractor. Any alternate associate(s) will be required to also undergo a BI.

6.10.3.2. Cybersecurity Training. Known as the DOD Cyber Awareness Challenge, this approx. 1 hour training course is required to be taken before completing DD Form 2875 and is required to be completed annually while a contractor continues to have system access. Refer to training site: https://public.cyber.mil/training/cyber-awareness-challenge/

6.10.3.3. Privacy Training. Commonly referred to as PII (Personally Identifiable Information) training. This approx. 1 hour training course is also required to be taken at the outset of the contract and is also required to be completed annually while a contractor continues to have system access. Refer to the training site:

https://cyber.mil/training/identifying-and-safeguarding-personally-identifiable-information-pii/

Statement of Objectives Final, 11 June 2025

6.10.3.4. Privilege User Training for System Code access:

https://cyber.mil/training/privileged-user-cybersecurity-responsibilities

Note: For Cybersecurity Privacy Training and Privacy Training a copy of the initial training session’s certificate of completion must be submitted with the DD Form 2875.

Contractor employees will complete initial Cyber Security, Privacy and OPSEC training within five days of on-boarding for initial, and annual refresher training as dictated by the unit security manager.

6.10.4. Contractor Employee Prescreening

6.10.4.1. Contractor shall thoroughly vet each prospective employee who will require access to AFSFMS IS to include verifying citizenship; confirming education required; and screening for negative criminal history at all levels (federal, state, and local). Prescreening may be conducted as part of a pre-employment screening.

6.10.4.2. An individual’s conduct involving questionable judgment, lack of candor, dishonesty, or unwillingness to comply with rules and regulations can raise questions about his or her reliability or trustworthiness and may put people, property, or information systems at risk. An individual’s past criminal or dishonest conduct may put people, property, or information systems at risk.

6.10.4.3. Contractor Performance. A contractor’s noncompliance with any requirements, including denial of access will not relieve the Contractor from its obligation to fully perform under the Contract within the time frames specified in the Contract. Contractors shall plan ahead to ensure timely processing of their employees.

6.10.4.4. Contractor shall ensure its employees hold appropriate level of qualifications and certifications required for access to AFSFMS systems, adhering to DoD 8140.03 to include maintaining the appropriate certifications and providing evidence of such certifications when Contractor employees or subcontractors are accessing any information system hosted or being maintained under this contract. All personnel requiring access to AFSFMS information systems and applications supported under this contract are assumed to be operating at no less than an Information Assurance Technical Level II (IAT II) designation (unless otherwise designated in writing and with approval by AFSFMS) where applicable for a specific performance work statement ordered and executed under this contract.

6.10.4.5. Any employees or subcontractors of Contractor requiring access to information systems hosted or supported under this Contract shall be required to submit a System Access Authorization – DD Form 2875 to AFSFMS IS for review and approval. Approval from AFSFMS IS office must be granted in writing before access to these information systems is authorized. Forms must be submitted by Contractor in a timely manner to ensure access is available when needed.

6.10.4.6. Contractor Responsibility for Government-provided Identification.

Statement of Objectives Final, 11 June 2025

6.10.4.6.1. The Contractor shall: (a) account for all forms of Government-provided identification issued to Contractor employees in connection with performance under this Contract; and within one (1) business day of when a Contractor employee with access to a AFSFMS IS system is terminated, confiscate the DoD Common Access Card (CAC); (b) notify the Contracting Officer’s Representative (COR), Technical Point of Contact (TPOC), or Sponsor (notification shall include the individual’s name and termination date, and be sent by e-mail, secure fax or by letter via overnight delivery service);

and (c) Return confiscated DoD CACs to the COR, TPOC or Sponsor either by hand delivery or by secure traceable overnight delivery service.

6.10.4.6.2. The Contracting Officer may delay final payment under Contract if Contractor fails to comply with these requirements.

6.11. Section 508: Data Stewardship and Governance

6.11.1. All electronic and information technology (EIT) procured through this contract must meet the applicable accessibility standards at 36 CFR 1194. 36 CFR 1194 implements Section 508 of the Rehabilitation Act of 1973, as amended. Further information on section 508 is available via the internet at http://www.section508.gov

6.11.2. The NAFI will have unlimited rights to all technical data unless the Contractor takes specific actions and includes prescribed legends in the proposal, contract, and/or data products to limit or restrict such NAFI rights for particular identified items.

“Technical data” refers to recorded information and includes (but is not limited to) research and engineering data and drawings, specifications, standards, process sheets, manuals, technical reports and computer software documentation. It does not include computer software or financial, cost/pricing or other contract and grant administrative data but does include any developed intellectual property not specific to the data.

6.11.3. Data and information generated during this agreement is owned by the NAFI.

Data must be physically separated from the data of other users, on separate drives or computers, and appropriate firewalls be established to prevent other users from accessing NAFI data.

6.11.4. Should the NAFI elect to not execute option years or at the end of the contract period, whichever is sooner, data must at all times be promptly accessible until converted to the new system with no additional separation fee.

SECTION VII

7.0 APPENDIX

7.1. DEFINITIONS & ABBREVIATIONS

Contracting Officer (CO). The duly appointed Government agent authorized to award or administer contracts. The contracting officer is the only person authorized to contractually obligate the Government.

Contracting Officer’s Representative (COR). The COR is responsible for monitoring the performance of work under this contract. In no event, shall any understanding, agreement, Statement of Objectives Final, 11 June 2025 modification, change order, or other matter deviating from the terms of this contract be effective or binding upon the contracting customer unless formalized by proper contractual documents executed by the CO prior to the completion of the contract.

Statement of Objective (SOO). A formal contracting document used to describe the goals and objectives expected from soliciting Contractor work.

AFSFMS environments. AFSFMS has fourteen environments: (10) Oracle EBS Environments and four (4) Oracle APEX environments.

7.2. ACRONYMS

AFSFMS - Air Force Services Financial Management System AFSVC - Air Force Services Center APEX – Application Express ATO - Authorization to Operate BAN - Business Area Network CC – Commander ConOps – Continuity of Operations, see DR CO – Contracting Officer COR – Contracting Officer Representative DBCS - Oracle Database Cloud Service DISS - Defense Information System for Security (legacy JPAS) DNS - Domain Name Server DOD - Department of Defense DR - Disaster Recovery EBS - Oracle E-Business Suite FTE – Full Time Equivalents GAT - General Acceptance Testing GFE – Government Furnished Equipment NAFI - Nonappropriated Fund Instrumentality OAC – Oracle Analytics Cloud OAS - Oracle Analytics Server OBDS – Oracle Base Database Service (formerly known as DBCS) OCI – Oracle Cloud Infrastructure OC2 - Government Oracle Cloud Infrastructure ODA - Oracle Database Appliance POC - Point of Contact RASCI - Responsible, Accountable, Supporting, Consulted and Informed SI - System Integrator SIT - System Integration Testing UAT - User Acceptance Testing VF – Financial Management & Comptroller Directorate VFA – Analysis & Central Accounting Division VBL - Lodging VFT - Treasury Management Division

Statement of Objectives Final, 11 June 2025

VI- Installation Support Division VIS - Shared Services Center VM - Mission Operations Directorate VMX- Capital Improvement VP – NAF Procurement Directorate VPE - Contracting VT – Business Information Technology Systems Directorate VTEI - Installation Systems Branch

VTOI - IT Infrastructure Operations Branch 7.3.AFSFMS Change Management Process

Statement of Objectives

7.4. Sample Weekly Status Reports or as agreed upon by COR

Statement of Objectives

7.5. Sample Contract Progress Report

Statement of Objectives

7.6. NAFI Observed Holidays

Holiday

New Year’s Day

Birthday of Martin Luther King, Jr.

Washington’s Birthday

Memorial Day

Juneteenth National Independence Day

Independence Day

Labor Day

Columbus Day

Veterans Day

Thanksgiving Day

Christmas Day