JWICS_IT_Support_Services_PWS_8_May_2019.docx.pdf

2-May-19

Page | 1

Performance Work Statement (PWS) for

Joint Worldwide Intelligence

Communications Systems (JWICS)

Enterprise Information Technology (IT)

Support Services

1. REQUIRING AGENCY: National Air and Space Intelligence Center (NASIC), Operating

Location (OL), Cyber Communication Support Division (SCM) (NASIC-OL/SCM), Joint

Base Anacostia Bolling, DC 20032.

2. TITLE: NASIC-OL/SCM Air Force (AF) Joint Worldwide Intelligence Communications Systems

(JWICS) Enterprise Information Technology (IT) Support Services.

3. BACKGROUND: NASIC-OL/SCM provides IT services in a Top Secret/Sensitive

Compartmental Information (TS/SCI) environment supporting the Secretary of the Air Force

(SAF), Chief of Staff of the Air Force (CSAF), the Deputy Chief of Staff for Intelligence, Surveillance and Reconnaissance (HAF/A2) and various Department of Defense (DoD) agencies in and around the National Capital Region (NCR).

4. SCOPE: The objective of this performance-based contract is to provide IT support to

HAF/A2, NASIC-OL/SCM and other DoD agencies (see Appendix A for supported agencies) requiring AF JWICS network access to a TS/SCI environment by operating, maintaining, and implementing IT services and assets of the AF JWICS Enterprise network. The Contractor shall be dedicated to providing efficient, mission-effective IT capabilities by maintaining high quality services and customer support to meet the required services to include:

communications electronics maintenance, hardware maintenance (break-fix), node maintenance, IT logistics and asset management, and conference room and desktop video teleconferencing (VTC) support. See Appendix B for historical data over the last 12 months.

5. CONTRACTOR REQUIREMENTS

5.1. Task 1 – IT Hardware Maintenance/Technical Support Services

5.1.1. Perform all hardware maintenance duties and have the ability to operate the automated diagnostics system and to interpret diagnostic findings.

5.1.2. Perform remedial and preventative maintenance in accordance with (IAW) Original

Equipment Manufacturer (OEM) recommendations or as defined by the Contracting

Officer Representative (COR). OEM recommendations can be found in the equipment manual that is included with the equipment.

5.1.3. Track and execute warranties for asset maintenance.

Page | 2

5.1.4. Perform equipment installation and relocation as needed.

5.1.5. Identify required spare parts and maintain inventory of spares provided by the

Government for IT maintenance.

5.1.6. Fabricate, install, and remove cabling and cabling infrastructure for supported systems

IAW DoD and AF requirements.

5.1.7. Perform basic network administration and actions required to install or troubleshoot

Internet Protocol (IP) assets on a network (e.g. configure IPs, troubleshoot connectivity issues, etc.)

5.1.8. Provide system hardware maintenance and interconnectivity familiarization for active duty and civilian personnel following hardware upgrades, integrations, reconfigurations and layout drawings updates. Provide all technical drawings and training material created by the Contractor as part of this contract.

5.1.9. Perform site surveys for new installations or reconfigurations via projects and/or task assignments.

5.1.10. Attend internal unit required training sessions and meetings.

5.1.11. Create/update diagrams supporting Information Assurance (IA), Configuration

Management (CM), and Government documentation requirements.

5.1.12. Perform/maintain change control and associated documentation

5.1.13. Provide Tier II/III support to the NASIC-OL/SCM Client Service Center (CSC)/ AF

JWICS Enterprise Service Desk (ESD)/East CONUS-Enterprise Service Center (EC-

ESC).

5.2. Task 2 – Network Engineering & Integration Services

5.2.1. Manage internal JWICS node devices.

5.2.2. Coordinate problem resolution with JWICS network service providers.

5.2.3. Troubleshoot and remediate network failures for Transmission Control

Protocol/Internet Protocol (TCP/IP) based networks.

5.2.4. Attend technical exchange meetings, conferences, and provide information to support alignment with DoD Intelligence Information System (DoDIIS) IT standards and the

AF JWICS Enterprise architecture.

5.3. Task 3 – Video Teleconferencing Services

5.3.1. Perform site surveys for installation, upgrade, commissioning/decommissioning of

Video Teleconferencing (VTC) equipment within the NCR. See Appendix C for list of suite conferencing systems and locations.

5.3.2. Load, configure, maintain, test, troubleshoot and remediate VTC suites and desktop

VTCs (DVTCs). Coordinate with the Defense Intelligence Agency (DIA) call manager and the end-user for access, installation, testing and commissioning/decommissioning of the conferencing systems. Coordinate and schedule installation and/or removal of

VTC suites.

5.3.3. Develop Technical Analysis and Cost Estimates (TACE) to satisfy customer VTC, DVTC, and audiovisual requirements to be approved by the Government for customer purchase.

5.3.4. Provide VTC, DVTC, and multimedia audiovisual user support and instruction

5.3.4.1. Evaluate and manage user video and audio integration and conferencing needs.

5.3.4.2. Recommend VTC settings (e.g. mode, microphone use, etc.) to user.

5.3.4.3. Provide remote and on-site VTC instruction for room facilitators, conference

Page | 3 participants and equipment users. Provide all training documentation created by the Contractor.

5.3.5. Conduct certification test during initial installation with DIA call manager to ensure systems are fully operational. Conduct semi-annual test at the two contingency sites

(Site M and Site R) with DIA to ensure systems are operating properly.

5.3.6. Attend technical exchange meetings, conferences, and provide information to support alignment with DoDIIS IT standards and the AF JWICS Enterprise architecture.

5.4. Task 4 – IT Logistics and Equipment Control Services

5.4.1. Assist in maintaining 100% accountability of IT assets on the IT Asset Management

(ITAM) / Defense Property Accountability System (DPAS) database IAW Air Force

Manual (AFMAN) 17-1203.

5.4.2. Conduct and maintain semi-annual equipment inventories.

5.4.3. Assist with turn-in preparation of excessed IT assets to the Defense Reutilization

Management Office (DRMO) approximately three (3) times per year.

5.4.4. Ship and receive assets through commercial and military channels, including verifying delivery and Bills of Lading.

5.4.5. Facilitate storage and warehousing of IT equipment.

5.4.6. The Government will accept all IT deliveries, while the Contractor documents and fields the equipment upon receipt. The Contractor shall maintain and affix an

ITAM/DPAS identifier label to all accountable equipment.

5.4.7. Arrange for equipment deliveries and pickups throughout the NCR.

5.5. Task 5 – IT Program Management

5.5.1. Perform day-to-day management of overall contract operations.

5.5.2. Ensure all contractor tasks and deliverables are being performed IAW the contract/PWS and ensure quality assurance standards are being met.

5.5.3. Track funding and burn-rate.

5.5.4. Track Service Level Agreements with Outside Technical Service (OTS) providers.

5.5.5. Acquire/procure Government requested hardware for remedial maintenance through commercial marketplace.

5.5.6. Attend technical exchange meetings, conferences, and provide information to support alignment with DoDIIS IT standards and the AF JWICS Enterprise architecture.

5.6. Contractor Furnished Services

5.6.1. Parts and Materials. The Contractor shall repair equipment listed in Appendix D as necessary. Contractor shall identify and acquire replacement parts and materials, to include shipping and handling, required for the repair of the Appendix D equipment, provided sufficient funds remain on the contract for parts and materials. The

Contractor shall purchase parts and materials at the lowest price obtainable and secure reasonable competition for such purchases when available.

5.6.1.1. All parts and materials shall be genuine replacement parts, as manufactured or recommended by the manufacturer. All parts shall be Underwriter’s Laboratory

(UL) approved/Listed. Only new standard parts shall be used in completed repairs. Government is exempted from paying all taxes.

Page | 4

5.6.1.2. Shipments will be completed as requested by the COR. Bills of Lading (BoL) will be completed and delivered to the COR for all shipments. The BoL will include the shipment tracking number, type and quantity of each item shipped, and all serial numbers or other identifying information for contents. Each shipment will have a unique BoL.

5.6.2. Web based Tools. The Contractor shall provide web-based tools designed to track and manage the maintenance listing, incident reporting (technician-provided information), materials acquisition, funds tracking, metrics, labor hour accounting (for charges based on labor hours) and other data points supporting metrics defined in paragraph 6.2.

Web-based tools will support export of data for detailed analysis in Microsoft Excel.

The Contractor shall provide user documentation to the Government to facilitate

Quality Assurance Plan (QAP)/COR training. The COR must be notified of any changes to the web-based tool affecting Government users prior to implementation.

NOTE: All Contractor web-based tools shall operate on the Air Force Standard

Desktop Configuration without requiring waiver, deviation or alterations to system settings.

6. DATA DELIVERABLES

6.1. Deliverable. The specific form and required delivery dates for all deliverables must be specified by the originator consistent with AF needs. In all cases the deliverable must be compliant with the AF writing style. Any papers, recommendations, etc. that the Contractor submits are drafts, not final copies, until approved and accepted by the COR.

6.2. Deliverable/Deliverables Table:

CDRL DID Data Item Title Frequency/Due Date

A001 DI-MGMT-80368 Status Report Not Later Than (NLT) 25 th day of last month in quarter

A002 DI-FNCL-80003 Man-hours Expenditure

Chart

NLT 5

th of each month

A003 DI-MGMT-81468 Contract Funds Status Report NLT 10 th of each month

A004 OSHA Form 300A OSHA Form 300A (Summary of

Work-Related Injuries and

Illnesses); Total Case Incidence

Rate (TCIR) and Days Away, Restricted, and or Transfer Case

Incident Rate (DART) rates

OSHA Form 300A, 15 th of January of each year to

Contracting Officer

A005 DI-SAFT-81563 Accident/Incident Report NLT 5th of each month

A006 DI-MISC-81943 Trip/Travel Report NLT five (5) working days after the trip

A007 DI-MGMT-81834

Contractor’s Personnel Roster NLT ten (10) days after change

Page | 5

A008 DI-ADMN-81505 Record of Meeting Minutes NLT three (3) days after meeting

7. CERTIFICATIONS, LICENSE, PHYSICAL REQUIREMENTS OR OTHER EXPERTISE

REQUIRED

7.1. All services provided within this PWS shall be conducted by contract personnel fully certified IAW the requirements of DoD 8570.1-M, “Information Assurance Workforce

Improvement Program.” The Contractor shall ensure that all contract personnel, including sub-Contractors, meet and maintain the mandatory certification and training requirements set forth in DoD 8570.1-M, and shall provide the Government evidence of required certification and training. Additional certifications are listed, as required, in the tasks below. Any contract employee who cannot meet and maintain the required certification may not perform related functions. If that occurs, the Contractor shall immediately provide an individual who is fully certified in accordance with 8570.1-M to perform the functions at no additional cost to the

Government and at no degradation in level or service provided.

7.2. Task 1 – IT Hardware Maintenance/Technical Support Services

7.2.1. Must possess and maintain at least an Information Assurance Technical (IAT) Level I

Certification in compliance with DoD Directive 8570.1 prior to the first duty day.

7.2.2. A minimum of 6 years of experience providing maintenance, technical, logistics, and life cycle support for the types of equipment listed in Appendix D commensurate with required labor category.

7.3. Task 2 – Network Engineering

7.3.1. Must possess and maintain an IAT II Level Certification in compliance with DoD

Directive 8570.1 prior to the first duty day.

7.3.2. A minimum of 7 years of experience performing integration of new technologies into local and wide area networks and providing network support (e.g., maintenance, logistics, and life cycle support) to Government networks commensurate with required labor category.

7.3.3. A minimum of 4 years of experience with secure VTCs, including DVTCs, and audio and visual integration commensurate with required labor category.

7.4. Task 3 – Video Teleconferencing Services

7.4.1. Must possess and maintain an IAT Level II Certification in compliance with DoD

7.4.2. Must possess and maintain relevant certifications to support existing VTC components prior to the first duty day.

7.4.3. A minimum of 7 years of network management experience and 4 years of experience providing technical support for secure VTC systems experience, including installation, upgrade, and administration of hardware and software, as well as resolution of interoperability issues for the types of systems/equipment listed on the equipment list in Appendix D commensurate with required labor category. JWICS specific experience is preferred.

Page | 6

7.5. Task 4 – IT Logistics and Equipment Control Services

7.5.1. Must possess and maintain at least an IAT Level I Certification in compliance with

DoD Directive 8570.1 prior to the first duty day.

7.5.2. A minimum of 4 years of experience providing technical, logistics, and life cycle IT support commensurate with required labor category, and 2 years of experience with

DoD inventory management processes are preferred.

7.6. Task 5 – Technical IT Program Management

7.6.1. Must possess and maintain an IAT Level II Certification in compliance with DOD

7.6.2. Must possess and maintain relevant certifications to support existing VTC components

7.6.3. A minimum of 9 years of experience in the area of IT to include hardware maintenance, network administration, VTC support and IT logistics commensurate with required labor category.

8. PERSONNEL REQUIREMENTS/KEY PERSONNEL/REPLACEMENT OF CONTRACT

PERSONNEL

8.1. Key Personnel. The contractor shall identify key individuals that have relevant qualifications to ensure program success. The contractor shall notify the COR in the event that key personnel are removed from the effort. (CDRL A007)

9. SERVICE SUMMARY (SS)

9.1. The below is a matrix table listing a summary of performance objectives and performance thresholds required by the Government in contractor performance. The contractor’s performance at the contract level will be assessed monthly by a process that measures success towards achieving defined performance objectives. The SS will be in accordance with AFI 63-101, Acquisition and Sustainment Life Cycle Management, AFI 10-601, Capabilities-Based Requirements Development and Federal Acquisition Regulation (FAR)

Subpart 37.6, Performance-Based Acquisition.

9.2. A Quality Assurance Surveillance Plan (QASP) will be developed by the Government which will include the SS below.

PWS

Para.

Performance Objective Method of

Surveillance

Performance

Threshold

5.1.2. SS – 1

Perform Remedial

Maintenance

Periodic Inspection by

COR

Within 48 hours

90% of the time

5.2.3. SS – 2

Troubleshoot/Remediate

Network Failures

Periodic Inspection by

COR

Network available

98% of the time/month

5.3.4. SS – 3

Provide User VTC Support

Periodic Inspection by

COR

Within 5 duty days of

Page | 7 and Instruction request/upgrade

10. PLACE OF PERFORMANCE

10.1. Primary Work Location. Work shall be performed primarily at 240 Luke Avenue, Bldg

1304, Joint Base Anacostia Bolling (JBAB), Washington, DC 20032. See Appendix C for alternate locations.

11. OPERATIONAL HOURS

11.1. Hours of Operation. Center hours are 0600 and 1700, Monday through Friday, excluding

Federal holidays.

11.2. Government Availability. Government agencies will not be available during scheduled

Federal holidays, inclement weather, weekends, after duty hours, emergencies, Government-directed facility closings or Air Force down days.

11.3. Government Holidays. The following Government holidays are normally observed by

Government personnel: New Year’s Day, Martin Luther King’s Birthday, President’s Day, Memorial Day, Independence Day (4th of July), Labor Day, Columbus Day, Veteran’s Day, Thanksgiving Day, Christmas Day, and any other day designated by Federal Statute, Executive Order, and/or Presidential Proclamation.

12. GOVERNMENT FURNISHED EQUIPMENT, INFORMATION, BADGE, KEYS AND/OR

FACILITIES PROVIDED

12.1. The Government will provide work space and equipment necessary to perform the requirements of this PWS. Office environment including desks, chairs, computers (Windows desktops) as necessary to perform work function, access to non-secure phone system, access to secure phone system, badges for accessing JBAB and building access badges. The

Government shall also provide secure locations for storage of tools and personal items such as coats, work shoes, etc.

13. SAFETY ISSUES

13.1. Lifting of IT equipment and peripherals that weighs up to approximately 30 lbs is required.

(CDRL A004/A005)

14. SECURITY REQUIREMENTS

14.1. Security Facility Clearance Requirements.

The contractor must possess or obtain an appropriate facility security clearance as identified below prior to performing work on a classified Government contract: (SELECT ONE)

Top Secret (SCI) Secret

If the contractor does not possess a facility clearance the Government will request one. The

Page | 8 contractor shall notify the installation’s Information Protection Office before on-base performance of the service. The notification shall include:

a) Name, address, and telephone number of company representatives.

b) The contract number and contracting agency.

c) The highest level of classified information which contractor employees require access to.

d) The location(s) of service performance and future performance, if known.

e) The date service performance begins.

f) Any change to information previously provided under this paragraph.

14.2. Personnel Security Clearance Requirements.

Personnel will require a security clearance as identified below to perform this contract:

(SELECT ONE)

Top Secret (SCI) Secret

All members of the proposed team shall have the necessary Top Secret security clearance and should be eligible for SCI access at contract award.

Contractor shall possess a United States Government TS security clearance and granted access to SCI based on an up-to-date SSBI; selected contractor personnel may be required to satisfy a Counter Intelligence polygraph requirement.

14.3. Security Manager Appointment. The contractor shall appoint a security manager for the on base long-term visitor group. The security manager may be a full-time position or an additional duty position. The security manager shall provide contractor employees with training required by Department of Defense Manual (DoDM) 5200.01, volumes 1-4, DoD

Information Security Program, , and AFI 16-1404, AF Information Security Program. The contractor security manager shall provide initial and follow-on training to contractor personnel who work in AF controlled or restricted areas. AF restricted and controlled areas are explained in AFI 31-101, Air Force Integrated Defense.

14.4. Visit Requests. Contractors participating in the National Industrial Security Program are authorized to use Joint Personnel Adjudication System (JPAS) in lieu of sending Visitor

Authorization Letters (VALs) for classified visits to DoD facilities and military installations.

VALs are only required if the contractor isn’t using JPAS or if contractor personnel whom access level and affiliation are not accurately reflected in JPAS. However, some agencies may still require VALs to be submitted for access to their facilities.

14.5. Obtaining and Retrieving Identification Media. The contractor shall comply with the procedures outlined in Air Force Federal Acquisition Regulation Supplement (AFFARS)

5352.242-9000, Contractor Access to Air Force Installations. The contractor shall ensure contractor employees obtain a DoD Common Access Card (CAC) as required for contract performance in compliance with AFI 36-3026. The contractor must comply with the requirements set forth and prescribed by AFFARS 5352.242-9001, Common Access Cards for Contractor Personnel.

14.6. Identification Requirements. The contractor shall ensure the following identification items as required for contract performance are obtained for employees:

Page | 9

- DoD CAC (AFI 36-3026).

- Base-specific identification as required by local base and/or building security policies

14.7. Visitor Group Security Agreement (VGSA).

14.7.1. The contractor shall enter into a long-term visitor group security agreement for contract performance on base. This agreement shall outline how the contractor integrates security requirements for contract operations with the AF to ensure effective and economical operation on the installation. The agreement shall include:

14.7.1.1. Security support provided by the AF to the contractor shall include storage containers for classified information/material, use of base destruction facilities, classified reproduction facilities, use of base classified mail services, security badging, base visitor control, investigation of security incidents, base traffic regulations and the use of security forms and conducting inspections required by

DoD 5220.22-R, Industrial Security Regulation, AF Policy Directive 31-6, Industrial Security, Air Force Instruction 31-601, Industrial Security Program

Management, DoDM 5200.01, volumes 1-4, DoD Information Security Program, and AFI 16-1404, Information Security Program.

14.7.1.2. Security support requiring joint AF and contractor coordination includes packaging classified information, mailing and receiving classified materials, implementing emergency procedures for protection of classified information, security checks and internal security controls for protection of classified material and high-value pilferable property.

14.7.1.3. On base, the long-term visitor group security agreement may take the place of a

Standard Practice Procedure (SPP).

14.8. Information Security. Contractors performing duties associated with this contract must adhere to all the standards for protecting classified information as specified in DoDM

5200.01, Volumes 1-4, DoD Information Security Program, AFI 16-1404, Information

Security Program and all applicable supplements and operating instructions.

14.9. Computer and Network Access Requirements. Contractor personnel working on this contract must be designated in one of the below IT positions and complete the required security investigation to obtain the required security clearance. This must be accomplished before operating Government furnished computer workstations or systems that have access to

AF e-mail systems or computer systems that access classified information. The contractor shall comply with the DoD 5200.2-R, Personnel Security Program and AFI 33-119, Air

Force Messaging requirements.

(Please check one):

AIS-I Position - Critical-Sensitive Positions. Security Clearance: TOP SECRET based on SSBI background investigation. Responsible for the planning, direction, and implementation of a computer security program; major responsibility for the direction, planning and design of a computer system, including the hardware and software; or, can access a system during the operation or maintenance in such a way, and with a relatively high risk for causing grave damage, or realize a significant personal gain.

AIS-II Position - Noncritical-Sensitive Positions. Security Clearance: SECRET based on a NACLC/ANACI background investigation. Responsibility for systems design, Page | 10 operation, testing, maintenance, and/or monitoring that is carried out under technical review of higher authority in the AIS-I category, includes, but is not limited to; access to and/or processing of proprietary data, information requiring protection under the Privacy Act of 18

1974, and Government-developed privileged information involving the award of contracts.

AIS-III Position - Nonsensitive Positions. No security clearance required but is a

Trusted Position based on NACI background investigation. All other positions involved in

U.S. Government computer activities.

14.10. Reporting Requirements. The contractor shall comply with requirements from AFI 71-

101, Volume-1, and Criminal Investigations, and Volume-2 Protective Service Matters.

Contractor personnel shall report to an appropriate authority (NASIC/SO) any information or circumstances of which they are aware may pose a threat to the security of DoD personnel, contractor personnel, resources, and classified or unclassified defense information. Contractor employees shall be briefed by their immediate supervisor upon initial on-base assignment and as required thereafter.

14.11. Physical Security. Contractor employees shall comply with base Operations

Plans/instructions for Force Protection Condition (FPCON) procedures, Random

Antiterrorism Measures (RAMS) and OPSEC, Emergency Management (EM) and local search/identification requirements. The contractor shall safeguard all Government property including controlled forms provided for contractor use. At the close of each work period, Government training equipment, facilities, support equipment, and other valuable materials shall be secured.

14.12. Wireless Electronic Devices. The following devices are not allowed in areas where classified information is discussed, briefed, or processed to include but not limited to: cell phones, camera cell phones, cordless telephones, wireless microphones, wireless keyboards, wireless mice, wireless or Infrared Local Area Networks (LANs). The term

“Area” above refers to a room and/or to a space the size of a 3-meter radius sphere, centering on the classified source.

14.13. Operating Instructions. The contractor will adhere to all AF activity Operating

Instructions (OI), NASIC, and local Security Program Management for internal circulation control, protection of resources and to regulate entry into AF controlled areas during normal, simulated and actual emergency operations to include local written OIs.

14.14. Access to Locked Facilities:

14.14.1. Key Control. The contractor will adhere to the AF activity OI Key Control, procedures if provided a key. Contractor must properly safeguard all keys and not allow any unauthorized personnel to have access to the keys. The contractor shall not duplicate keys issued by the Government. All Government issued keys will be returned at the end of contract employment or when no longer needed. Lost keys shall be reported immediately to the AF activity that issued the keys. The

Government may replace lost keys or perform re-keying. The total cost of lost keys, re-keying or lock replacement shall be deducted from the monthly payment due to the contractor.

14.14.2. Government Authorization. The contractor shall ensure its employees do not allow

Page | 11

Government issued keys to be used by personnel other than current authorized contractor employees. Contractor employees shall not use keys to open work areas for personnel other than contractor employees engaged in performance of duties, unless authorized by the Government functional director.

14.14.3. Access Lock Combination. Access lock combinations are “For Official Use Only”

(FOUO) and will be protected from disclosure to unauthorized personnel. The contractor will adhere to the AF activity operating instructions ensuring lock combinations are not revealed to un-cleared /unauthorized persons and ensure the safeguard procedures are implemented. The contractor is not authorized to record lock combinations without written approval by the Government functional director.

14.14.4. Security Combinations. Combinations to security containers, secure rooms, or vaults are classified information and must be properly safeguarded. Only contractor employees, who have the proper security clearance and the need-to-know, will be given combinations to security containers, secure rooms, or vaults. Contractor employees are responsible for properly safeguarding combinations. Contractor employees will not record security containers, secure rooms, or vaults combinations without written approval by the Government functional director. Contractors will not change combinations to security containers, secure rooms, or vaults without written approval by the security officer and the Government functional director.

14.14.5. Security Alarm Access Codes. Security alarm access codes are FOUO and will be protected from unauthorized personnel. Security alarm access codes will be given to contractor employees who require entry into areas with security alarms. Contractor employees will adhere to the AF activity operating instructions and will properly safeguard alarm access codes to prevent unauthorized disclosure. Contractors will not record alarm access codes without written approval by the Government functional director.

14.15. Freedom of Information Act Program (FOIA). The contractor shall comply with DoD

Regulation 5400.7-R/Air Force Supplement, DoD Freedom of Information Act Program, requirements. The regulation sets policy and procedures for the disclosure of records to the public and for marking, handling, transmitting, and safeguarding for FOUO material. The contractor shall comply with AFI 33-332, Air Force Privacy Act Program, when collecting and maintaining information protected by the Privacy Act of 1974 authorized by Title 10, United States Code, Section 8013. The contractor shall maintain records in accordance

AFMAN 33-363, Management of Records; and disposed of in accordance with Air Force

Records Information Management System (AFRIMS) Records Disposition Schedule

(RDS) located at https://www.my.af.mil/gcss-af61a/afrims/afrims/.

14.16. Traffic Laws. The contractor and their employees shall comply with all installation traffic regulations.

14.17. Cellular Phone Operation Policy. The contractor shall comply with local base policies regarding cellular phone operation.

14.18. Security Education and Training. The contractors are required to participate in the

Government’s in-house and web-based security training program under the terms of the contract. The Government will provide the contractor with access to the on-line system.

Page | 12

Quarterly all contractors will complete all required security training. Required annual training includes Force Protection (FP), Information Protection (IP), Cyber Surety

Protection (IA), OPSEC, Derivative Classification and Unauthorized Disclosures.

14.19. Personally Identifiable Information Protection. The contractors are required to abide by

AFI 33-322, Air Force Privacy and Civil Liberties Program with regard to protection of personally identifiable information (PII).

15. Travel. The Contractor will be required to travel to other locations in support of the tasks described in this PWS.

15.1. Travel Locations. Contractor employees will be required to travel periodically throughout the NCR as mission dictates for the purpose of attending meetings and gathering information in support of tasks listed in the PWS. Where feasible, the Contractor shall use teleconferencing and electronic media transfers of data as much as possible to limit travel costs. The contractor shall coordinate with the COR before traveling and provide the COR with travel dates, expected duration, origin, destination, and the number and names of personnel traveling. A trip report is due five (5) business days after travel is completed.

(CDRL A006)

16. NON-PERSONAL SERVICES STATEMENT. The Government will neither supervise contractor employees nor control the method by which the contractor performs the required tasks.

Under no circumstances shall the Government assign tasks to, or prepare work schedules for, individual contractor employees. It shall be the responsibility of the contractor to manage its employees and to guard against any actions that are of the nature of personal services, or give the perception of personal services. If the contractor feels that any actions constitute, or are perceived to constitute personal services, it shall be the contractor’s responsibility to notify the CO immediately. These services shall not be used to perform work of a policy/decision making or management nature, i.e., inherently Governmental functions. All decisions relative to programs supported by the contractor shall be the sole responsibility of the Government.

17. BILLABLE HOURS. There may be occasions when support contractors are invited to participate in morale and recreational activities (i.e., holiday parties, golf outings, sports days and other various social events). Contractor employees shall not be directed to attend such events by the

Government. Since a contract employee is not a Government employee, the contract employee cannot be granted the same duty time activities as Government employees. Participation in such events is not billable to this contract and contractor employee participation should be in accordance with the employee’s company’s policies and compensation system.

18. CONTRACTOR IDENTIFICATION. All contractor/subcontractor personnel shall be required to wear AF approved or provided picture identification badges so as to distinguish themselves from

Government employees. When conversing with Government personnel during business meetings, over the telephone or via electronic mail, contractor/subcontractor personnel shall identify themselves as such to avoid situations arising where sensitive topics might be better discussed solely between Government employees. Contractors/subcontractors shall identify themselves on any attendance sheet or any coordination documents they may review. Electronic mail signature blocks shall identify their company affiliation. Where practicable, contractor/subcontractors occupying collocated space with their Government program customer should identify their work space area with their name and company affiliation.

Page | 13

19. GOVERNMENT COR. The Contracting Officer Representative (COR) is an employee of the

United States Government designated by the Contracting Officer to monitor contractor performance. Such appointment shall be in writing and shall state the scope of authority and limitations. This individual has authority to provide technical direction to the contractor as long as that direction is within the scope of the contract, does not constitute a change, and has no funding implications. This individual does not have authority to change the terms and conditions of the contract. The overall COR responsibilities for this contract reside with the following office:

Office Symbol: NASIC-OL/SCM

POC: Laura Rocheleau

Street Address: 240 Luke Avenue, JBAB, DC 20032

Building: 1304

Phone: 703-545-7844

20. COMBATING TRAFFICKING IN PERSONS (CTIP). Trafficking in Persons (TIP) is a worldwide problem posing a transnational threat involving violations of basic human rights. The

DoD has a zero tolerance policy for TIP. As part of the 2013 National Defense Authorization Act, the Pentagon is required to take action against any contractor engaging in any activities related to labor trafficking, sex trafficking and child soldering. The contractor should familiarize its employees with TIP by going to the DoD CTIP site at: http://ctip.defense.gov/Home.aspx. The contractor should immediately report all suspicious activity of its employees to the CO.

21. GENERAL INFORMATION

21.1. Quality Control. The Contractor is responsible for contract management and quality control

(QC), not the Government. The Contractor shall be responsible for QC for all work accomplished during the performance of this contract. All work shall be accomplished using the best commercial practices and be within the Government guidelines. The COR will regularly review the work and documentation produced by the Contractor’s personnel.

(CDRL A001/A003)

21.2. Quality Control Plan. The Contractor shall provide a Quality Control Plan at time of proposal and any updates after contract award. Any update to the QC Plan must be accepted by the Government. The QC Plan shall satisfy the requirements in the Inspection/Acceptance portions of FAR 52.212-4. The QC records of inspections shall identify procedures, prevent and ensure non-recurrence of defective services and proper operation of AF Human Systems

Integration Office (AFHSIO); adequate records of all inspections; nature and number of observations made, the number and type of deficiencies found, and the nature of corrective action taken as appropriate. The Contractor shall submit to the CO an updated plan as changes occur.

22. GENERAL CONTRACTOR PERSONNEL REQUIREMENTS

22.1. Citizenship and Communication Requirement. On-site contract personnel shall read, write, speak and understand English. No foreign nationals shall be employed on this contract.

22.2. Organizational Conflict of Interest. The Contractor shall not employ any person who is an employee or recent retiree of the USG if the employment of that person would create a conflict of interest. The Contractor shall not employ any person who is an employee of the

Page | 14

AF, either military or civilian, unless such person seeks and receives approval in accordance with DoD Directive 5500.7, Standards of Conduct, and, AF policy. The Contractor shall provide to the COR within 3 days after contract award, a signed, Organizational Conflict of

Interest Avoidance or Mitigation Plan addressing the activities of all contract employees.

23. MANPOWER REPORTING REQUIREMENTS

23.1. The contractor shall report ALL contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract for the Air Force via a secure data collection site. The contractor is required to completely fill in all required data fields at http://www.ecmra.mil.

23.2. Reporting inputs will be for the labor executed during the period of performance for each

Government fiscal year (FY), which runs 1 October through 30 September. While inputs may be reported any time during the FY, all data shall be reported no later than 31 October of each calendar year. Contractors may direct questions to the CMRA help desk. (CDRL A002)

23.3. Reporting Period: Contractors are required to input data by 31 October of each year.

23.4. Uses and Safeguarding Information: Information from the secure web site is considered to be proprietary in nature when the contract number and contractor identity are associated with the direct labor hours and direct labor dollars. At no time will any data be released to the public with the contractor name and contract number associated with the data.

23.5. User Manuals for Government personnel and contractors are available at CMRA link at http://www.ecmra.mil.

24. PERFORMANCE REPORTING. The contractor’s contract performance will be monitored by the Government and reported in Contractor Performance Assessment Reports (CPARs) or a

Customer Survey, depending on the dollar amount of the contract. Performance standards shall include the contractor’s ability to provide or satisfy the following:

- Provide satisfactory solutions to requirements with the necessary customer support

- Provide solutions and services that meet or exceed specified performance parameters

- Deliver timely and quality deliverables to include accurate reports and responsive proposals

- Ensure solutions to requirements are in compliance with applicable policy and regulation

25. CYBER SECURITY

25.1. The contractor shall ensure that all system or application deliverables meet the requirements of DoD and AF Information Assurance (IA) policy. Furthermore, the contractor shall ensure that personnel performing IA activities obtain, and remain current with, required technical and/or management certifications.

25.2. Personnel IA: Personnel performing Information Assurance (IA) activities are required to obtain, and remain current with, technical and/or management certifications to ensure compliance with DoD 8570.01-M, Information Assurance Workforce Improvement Program, 19 December 2005 (with all current changes).

26. RECORDS, FILES, AND DOCUMENTS. All physical records, files, documents, and work papers, provided and/or generated by the Government and/or generated for the Government in performance of this PWS, maintained by the contractor which are to be transferred or released to the Government or successor contractor, shall become and remain Government property and shall be maintained and disposed of in accordance with Air Force Manual (AFMAN) 33-363, Page | 15

Management of Records; AFI 33-364, Records Disposition – Procedures and Responsibilities the

FAR, and/or the Defense Federal Acquisition Regulation Supplement (DFARS) as applicable.

Nothing in this section alters the rights of the Government or the contractor with respect to patents, data rights, copyrights, or any other intellectual property or proprietary information as set forth in any other part of this PWS or the Application Services contract of which this PWS is a part

(including all clauses that are or shall be included or incorporated by reference into that contract).

(CDRL A008)

27. PERSONNEL SECURITY. Individuals performing work under this contract shall comply with applicable program security requirements as stated.

The Contract Security Classification Specification (DD Form 254) will encompass all security requirements. All contractors located on military installations shall also comply with Operations

Security (OPSEC) requirements as set forth in DoD Directive 5205.02, Operations Security

Program and AFI 10-701, Operations Security. All contractors shall also follow Communication

Security (COMSEC) and Telecommunications Electronics Material Protected from Emanating

Spurious Transmissions (TEMPEST) regulations. In accordance with DoD 5200.2-R, Personnel

Security Program (Jan 87), DoD military, civilian, consultants, and contractor personnel using unclassified automated information systems, including e-mail, shall have, at a minimum, a completed favorable National Agency Check plus Written Inquiries (NACI).

28. TRANSMISSION OF CLASSIFIED MATERIAL. The contractor shall transmit and deliver classified material/reports in accordance with the National Industrial Security Program Operating

Manual 5220.22 and in accordance with AFI 16-1404, Air Force Information Security Program.

29. PROTECTION OF SYSTEM DATA. Unless otherwise stated in the contract, the contractor shall protect system design-related documents and operational data whether in written form or in electronic form via a network in accordance with all applicable policies and procedures for such data, including DoD Regulation 5400.7-R and DoD Manual 5200.01(v1-v4) to include latest changes, and applicable service/agency/ combatant command policies and procedures. The contractor shall protect system design related documents and operational data at least to the level provided by Secure Sockets Layer (SSL)/Transport Security Layer (TSL)-protected web site connections with certificate and or user ID/password-based access controls. In either case, the certificates used by the Contractor for these protections shall be DoD or IC approved PKI certificates issued by a DoD or IC approved External Certification Authority (ECA) and shall make use of at least 128-bit encryption.

30. SYSTEM AND NETWORK AUTHORIZATION ACCESS REQUESTS. For contractor personnel who require access to DoD, DISA, or Air Force computing equipment or networks, the contractor shall have the employee, prime or subcontracted, sign and submit a System

Authorization Access Report (SAAR), DD Form 2875.

31. PRODUCT STANDARDS AND COMPLIANCE REQUIREMENTS

31.1. Information Assurance (IA) Technical Considerations. The contractor shall provide

Commercial off the Shelf (COTS) IA and IA-enabled products. In accordance with AFI 33-

200, Information Assurance, these products must be Committee on National Systems

Security Policy Number 11 (CNSSP-11) compliant, requiring them to be validated by accredited labs under the National Information Assurance Partnership (NIAP) Common

Criteria Evaluation and Validation Scheme or National Institute of Standards and Technology

Page | 16

(NIST) Federal Information Processing Standards (FIPS) Cryptographic Module Validation

Program (CMVP). The following are some examples of IA and IA-enabled devices:

data/network encryptors, intrusion detection devices such as Firewalls, Intrusion Detection

System, Authentication Servers, Security Gateways, High Assurance IP encryptor and

Virtual Private Networks.

31.2. DoD IPV6 Requirement. All Products must meet the criteria in DoD IPv6 Standard Profiles for IPv6 Capable Products version 5.0 July 2010

(http://jitc.fhu.disa.mil/apl/ipv6/pdf/disr_ipv6_50.pdf). Some examples of IPV6 mandated products from the DoD IPV6 Standards Profile are listed below:

31.2.1. Host/Workstations - a desktop or other end-user computer or workstations running a general purpose operating system such as UNIX, Linux, Windows, or a proprietary operations system that is capable of supporting multiple applications.

31.2.2. Network Appliance or Simple Server - Simple end nodes such as cameras, sensors, automation controllers, networked phones or adapters such as Circuit-to-Packet (CTP) devices, typically with an embedded operating system and specialized software for limited applications. A Network Appliance is typically managed by an end-user, but may support more than one concurrent user remotely via a Web browser interface. A

Simple Server supports a small number of concurrent clients via a web browser interface or other protocol with a client application. Examples of simple servers are stand-alone network print servers, storage servers, Session Initiation Protocol (SIP) 11 servers, a “web camera” appliance that serves pictures via an embedded web server, and a network time server appliance that solely functions to serve NTP requests.

Advanced Server - End Nodes with one or more server-side applications (for example

Dynamic Host Configuration Protocol (DHCPv6), DNS, Network Time Protocol

(NTP), E-mail, File Transfer Protocol (FTP), Hypertext Transfer Protocol (HTTP), web server, storage server or database) to support clients in the network

31.2.3. Intermediate Nodes – Routers, Switches, IA or IA enabled devices.

31.2.4. IPV6 Capable Software - a product that implements functions available via an IPv6 interface to end-users, network nodes or other software, when installed on an appropriate hardware platform.

31.3. BIOS Mandate. All products shall be Basic Input/Output (BIOS) protection compliant with

Section 3.1 “Security Guidelines for System BIOS Implementations of SP 800-147,” per

DoD Chief Information Officer (CIO), in order to prevent the unauthorized modification of

BIOS firmware on computer systems.

31.4. Trade Agreement Act (TAA). All proposed products must be compliant with the Trade

Agreements Act of 1979 (TAA) and related clauses in Section I of this contract. In accordance with DFARS 252.225-7021, the Trade Agreements Certificate at DFARS

252.225-7020 shall be provided for each end item defined and specified in a solicitation that exceeds the TAA threshold subject to the waivers and exceptions provided in FAR 25.4, and

DFARS 225.4 offered in response to any Request for Quote (RFQ) issued under this contract.

Please note that FAR paragraph 25.103(e) includes an exemption from the Buy American

Act (BAA) for acquisition of IT that are commercial items.

32. DATA RIGHTS AND NON-COMMERCIAL COMPUTER SOFTWARE. In order to implement the provisions at DFARS 252.227-7013(b) and (e) and DFARS 252.227-7014(b) and (e)

Page | 17 and DFARS 252.227-7017, the Contractor shall disclose to Government CO any technical data or non-commercial computer software and computer software/source code documentation developed exclusively at government expense in performance of the contract. This disclosure shall be made whether or not an express requirement for the disclosure is included or not included in the PWS or solicitation. The disclosure shall indicate the rights asserted in the technical data and non-commercial computer software by the Contractor and rights that would be acquired by the

Government if the data or non-commercial software was required to be delivered. This disclosure requirement also applies to segregated routines of non-commercial software that may be developed exclusively at Government expense to integrate Commercial Software components or applications provided under a commercial software license or developed to enable Commercial Software to meet requirements of this contract. Performance of this disclosure requirement shall be considered a material performance requirement under which such technical data or non-commercial computer software is developed exclusively at Government expense.

33. SOFTWARE SUPPORT AND DATA RIGHTS. Unless specified otherwise in the contract, the contractor shall fully support all unique software developed to support integrated solutions on this contract. The contractor shall be able to support all software revisions deployed or resident on the system, and sub-systems. The data rights ownership/licensing guidance is specified in DFARS

Contract clauses.

34. COMMERCIAL-OFF-THE-SHELF (COTS) MANUALS AND SUPPLEMENTAL DATA.

The contractor shall provide documentation for all systems services delivered under this contract.

The contractor shall provide COTS manuals, supplemental data for COTS manuals, and documentation in accordance with best commercial practices (i.e. CD-ROM, etc.). This documentation shall include users’ manuals, operators’ manuals, maintenance manuals, and network and application interfaces.

35. SECTION 508 OF THE REHABILITATION ACT. The Contractor shall meet the requirements of the Access Board’s regulations at 36 Code of Federal Regulations (CFR) Part 1194, particularly

1194.22, which implements Section 508 of the Rehabilitation Act of 1973, as amended. Section

508 (as amended) of the Rehabilitation Act of…