FA252126QB073 MANDATORY Language.pdf

FA252126QB073 MANDATORY INSTRUCTIONS

Ombudsman

1. An ombudsman has been appointed to hear and facilitate the resolution of concerns from offerors, potential offerors, and others for this acquisition. When requested, the ombudsman will maintain strict confidentiality as to the source of the concern. The existence of the ombudsman does not affect the authority of the program manager, contracting officer, or source selection official. Further, the ombudsman does not participate in the evaluation of proposals, the source selection process, or the adjudication of protests or formal contract disputes. The ombudsman may refer the interested party to another official who can resolve the concern.

2. Before consulting with an ombudsman, interested parties must first address their concerns, issues, disagreements, and/or recommendations to the contracting officer for resolution. Consulting an ombudsman does not alter or postpone the timelines for any other processes (e.g., agency level bid protests, GAO bid protests, requests for debriefings, employee-employer actions, contests of OMB Circular A-76 competition performance decisions).

3. If resolution cannot be made by the contracting officer, the interested party may contact the ombudsman, [Insert names, addresses, telephone numbers, facsimile numbers, and e-mail addresses of Center/MAJCOM/FLDCOM/DRU/DAFRCO ombudsman/ombudsmen]. Concerns, issues, disagreements, and recommendations that cannot be resolved at the Center/MAJCOM/FLDCOM/DRU ombudsman level, may be brought by the interested party for further consideration to the Department of the Air

Force ombudsman, Associate Deputy Assistant Secretary (ADAS) (Contracting), SAF/AQC, 1060 Air Force Pentagon, Washington DC 20330-1060, phone number (571)

256-2395, facsimile number (571) 256-2431.

4. The ombudsman has no authority to render a decision that binds the agency.

5. Do not contact the ombudsman to request copies of the solicitation, verify offer due date, or clarify technical requirements. Such inquiries shall be directed to the contracting officer.

Contractor Access to Department of the Air Force Installations

• The contractor shall obtain base identification and vehicle passes, if required, for all contractor personnel who make frequent visits to or perform work on the Department of the Air Force installation(s) cited in the contract. Contractor personnel are required to wear or prominently display installation identification badges or contractor-furnished, contractor identification badges while visiting or performing work on the installation.

• The contractor shall submit a written request on company letterhead to the contracting officer listing the following: contract number, location of work site, start and stop dates, and names of employees and subcontractor employees needing access to the base. The letter will also specify the individual(s) authorized to sign for a request for base identification credentials or vehicle passes. The contracting officer will endorse the request and forward it to the issuing base pass and registration office or Security Forces for processing. When reporting to the registration office, the authorized contractor individual(s) should provide a valid driver’s license, current vehicle registration, valid vehicle insurance certificate, and any additional requirements to comply with local security procedures.

• During performance of the contract, the contractor shall be responsible for obtaining required identification for newly assigned personnel and for prompt return of credentials and vehicle passes for any employee who no longer requires access to the work site.

• When work under this contract requires unescorted entry to controlled or restricted areas, the contractor shall comply with DAFI 31-101, Integrated Defense, and

DODMAN5200.02_DAFMAN 16-1405 , Air Force Personnel Security Program.

• Upon completion or termination of the contract or expiration of the identification passes, the prime contractor shall ensure that all base identification passes issued to employees and subcontractor employees are returned to the issuing office.

• The contractor shall provide an after-hours contact number or after-hours email in the Emergency Mass Notification System (EMNS) for each of their personnel, whose normal place of duty is on a DoD installation or within a DoD facility. The contractor shall comply with any additional requirements in DAFMAN 10-206 for emergency operational reporting. Foreign Nationals may participate and may remove themselves from the Emergency Mass Notification System at any time. To update information, personnel can access the globe icon on their system desktop screens and choose the “Access Self-

Service” option.

• Failure to comply with these requirements may result in withholding of final payment.

ELIMINATION OF USE OF CLASS I OZONE DEPLETING SUBSTANCES (ODS)

1. Contractors shall not:

https://static.e-publishing.af.mil/production/1/af_a4/publication/dafi31-101/controlled_unclassified_information.pdf https://static.e-publishing.af.mil/production/1/saf_aa/publication/dodman5200.02_dafman16-1405/dodm5200.02_afman16-1405.pdf https://static.e-publishing.af.mil/production/1/saf_aa/publication/dodman5200.02_dafman16-1405/dodm5200.02_afman16-1405.pdf

1. Provide any service or product with any specification, standard, drawing, or other document that requires the use of a Class I ODS in the test, operation, or maintenance of any system, subsystem, item, component, or process; or

2. Provide any specification, standard, drawing, or other document that establishes a test, operation, or maintenance requirement that can only be met by use of a Class I ODS as part of this contract/order.

b. For the purposes of Department of the Air Force policy, the following products that are pure

(i.e., they meet the relevant product specification identified in AFI 32-7086[AR2] ) are Class I

ODSs:

1. Halons: 1011, 1202, 1211, 1301, and 2402;

2. Chlorofluorocarbons (CFCs): CFC-11, CFC-12, CFC-13, CFC-111, CFC-112, CFC-113, CFC-114, CFC-115, CFC-211, CFC-212, CFC- 213, CFC-214, CFC-215, CFC-216, and

CFC-217, and the blends R-500, R-501, R-502, and R-503; and

3. Carbon Tetrachloride, Methyl Chloroform, and Methyl Bromide.

Health and Safety on Government Installations

(a) In performing work under this contract on a Government installation, the contractor shall:

(1) Take all reasonable steps and precautions to prevent accidents and preserve the health and safety of contractor and Government personnel performing or in any way coming in contact with the performance of this contract; and

(2) Take such additional immediate precautions as the contracting officer may reasonably require for health and safety purposes.

(b) The contracting officer may, by written order, direct Department of the Air Force

Occupational Safety and Health (AFOSH) Standards and/or health/safety standards as may be required in the performance of this contract and any adjustments resulting from such direction will be in accordance with the Changes clause of this contract.

(c) Any violation of these health and safety rules and requirements, unless promptly corrected as directed by the contracting officer, shall be grounds for termination of this contract in accordance with the Default clause of this contract.

Security Incident Reporting and Procedures http://static.e-publishing.af.mil/production/1/af_a4/publication/afi32-7086/afi32-7086.pdf https://usaf.dps.mil/sites/AFCC/AQCP/KnowledgeCenter/SitePages/DAF-Contracting-Compass/Part-23---Environment,-Sustainable-Acquisition,-and-Material-Safety.aspx?CID=d7c975cb-ed41-49ba-8b44-9279666ee32b#_msocom_2

(a) The contractor shall follow the below guidance when a contract contains a DD Form 254, DOD Contract Security Classification Specification:

(1) The contractor shall notify the Government Contracting Activity (GCA) of any security incident involving the potential or actual loss, compromise, or suspected compromise of Top

Secret, Secret, and/or Confidential information, referred to as classified information, when the incident is discovered at the contractor’s location.

(i) The contractor shall conduct the requisite inquiry(ies) in accordance with 32 CFR Part 117 and Cognizant Security Office (e.g., Defense Counterintelligence and Security Agency) guidance.

(2) Security incidents occurring at government performance locations where the contractor is categorized as a visitor will be processed and reported in accordance with government host security procedures.

(3) Security incidents involving the potential or actual loss, compromise, or suspected compromise of Special Access Program and/or Sensitive Compartmented Information is under the jurisdiction of the GCA and the contractor shall follow GCA guidance in lieu of this requirement.

(4) This requirement does not relieve the contractor from reporting requirements set forth in 32

CFR Part 117, DFARS 252.204-7012, or as otherwise directed by contract requirements and/or its Cognizant Security Office (e.g., Defense Counterintelligence and Security Agency).

(5) This requirement does not relieve the contractor from adhering to security incident guidance set forth by its Cognizant Security Office (e.g., Defense Counterintelligence and Security

Agency).

(6) The contractor is responsible for ensuring all applicable subcontracts include these security incident reporting requirements.

(7) If the lost or compromised information is beyond the jurisdiction of the U.S. Government and cannot be recovered (e.g., media leak, public website posting, or loss in a foreign country), the notification and location of the compromise (e.g., geographic location of unrecoverable equipment) shall be classified commensurate with the classification level of the compromised material to prevent further unauthorized disclosure in accordance with DoDM5200.01 Volume 3, Enclosure 6. The contractor will contact the GCA for instructions on how to communicate the notification prior to submission in all cases where lost or compromised information is beyond the jurisdiction of the U.S. Government and cannot be recovered.

(8) The contractor shall ensure all notifications determined to contain classified information are properly transmitted and marked in accordance with derivative classification and overarching marking guidelines in accordance with 32 CFR Part 117.

(b) Initial Notification of Security Incident

(1) The contractor shall provide an initial notification of security incident to the GCA within 72 hours of discovery of any incident where classified information may have been subjected to loss, compromise, or suspected compromise for all security incidents involving the contractor’s location unless otherwise directed by contract requirements.

(2) The initial notification to the GCA is considered Controlled Unclassified Information (CUI)

[CUI category OPSEC, FEDCON Distribution/Dissemination Control] unless otherwise determined by the GCA, marked in accordance with DoDI5200.48, and shall be transmitted to the GCA through authorized means (e.g., encrypted email or DoD SAFE).

(3) If the initial notification contains classified information either by content or through classification through compilation, the contractor will contact the GCA for submission guidance and ensure the notification is properly marked in accordance with derivative classification and overarching marking guidelines in accordance with 32 CFR Part 117.

(4) The initial notification shall contain the following information, as available at the time of report:

(i) Prime contract number associated with the security incident.

(ii) Date of security incident occurrence.

(iii) Date of security incident discovery if different from date of occurrence.

(iv) Security Classification Guide (SCG) or guidance used to validate classification level of information involved (unclassified title/date); if SCG title is either classified or if listing SCG information will cause the notification to be classified by compilation, do not include and indicate as such in the initial notification.

(v) Classification level of information involved (e.g., Top Secret, Secret, or Confidential)

(vi) Brief description of incident prompting initial notification. If incident directly or indirectly involved government personnel, include government personnel name(s), email address(s), and office information.

(vii) Communicate whether it is possible for the contractor to properly retain and/or provide the suspected information in question for GCA classification review and/or damage assessment.

(c) Final Notification of Security Incident

(1) The contractor shall provide a final notification to the GCA 10 business days from date of initial notification. If the final notification cannot be made 10 business days from the date of the initial notification, the contractor shall request an extension and receive approval in writing from the GCA.

(2) The final notification to the GCA does not relieve the contractor from reporting requirements set forth by 32 CFR Part 117, DFARS 252.204-7012, or as otherwise directed by contract requirements and/or its Cognizant Security Office (e.g., Defense Counterintelligence and

Security Agency).

(3) The final notification will be considered CUI [CUI category OPSEC, FEDCON

Distribution/Dissemination Control] unless otherwise determined by the GCA, marked in accordance with DoDI5200.48, and sent through authorized means (e.g., encrypted email or DoD

SAFE).

(4) If the final notification contains classified information either by content or through classification through compilation, the contractor is required to contact the GCA for submission guidance and ensure the notification is properly marked in accordance with derivative classification and overarching marking guidelines in accordance with 32 CFR Part 117.

(5) The final notification shall contain the following information:

(i) Prime contract number associated with the security incident.

(ii) Date of security incident occurrence.

(iii) Date of security incident discovery if different from date of occurrence.

(iv) Security Classification Guide (SCG) or guidance used to validate classification level of information involved (unclassified title/date); if SCG title is either classified or if listing SCG information will cause the report to be classified by compilation, do not include this information, and indicate as such in the final notification.

(v) Classification level of information involved (e.g., Top Secret, Secret, or Confidential)

(vii) Detailed description of incident and include the following:

Sequence of events: When, where, and how did the incident occur?

What persons, situations, and/or conditions caused or contributed to the incident?

If incident originated with government personnel, include government personnel name(s), email address(s), and office information.

Include the name(s), email address(s), and office information of all government personnel involved, either directly or indirectly, as appropriate

If classified information is alleged to have been physically lost (e.g., lost classified document), what steps were taken to locate the material?

If security incident was categorized as a data spill, include measures taken to properly sanitize all impacted assets.

(viii) Corrective actions taken to prevent future occurrences

(ix) Result of inquiry (e.g., loss, compromise, suspected compromise, or no compromise)

(x) A copy of the supporting DD Form 254(s) associated with prime contract. If DD Form 254 cannot be provided, the contractor shall indicate the reasons why in the final report.

(d) Definitions

“32 CFR Part 117” means National Industrial Security Program Operating Manual.

“Business days” means days that do not include federal holidays or weekends.

“Classified information” means information the government designates as requiring protection against unauthorized disclosure in the interest of national security, pursuant to E.O. 13526, Classified National Security Information, or any predecessor order, and the Atomic Energy Act of 1954, as amended. Classified information includes national security information (NSI), restricted data (RD), and formerly restricted data (FRD), regardless of its physical form or characteristics (including tangible items other than documents).

“Cognizant security agencies (CSAs)” means agencies E.O. 12829, sec. 202, designates as having National Industrial Security Program implementation and security responsibilities for its own agencies (including component agencies) and any entities and non-CSA agencies under their cognizance. The CSAs are: Department of Defense (DoD); Department of Energy (DOE);

Nuclear Regulatory Commission (NRC); Office of the Director of National Intelligence (ODNI);

and Department of Homeland Security (DHS).

“Cognizant Security Office” means an organizational unit to which the head of a CSA delegates authority to administer industrial security services on behalf of the CSA.

“Compromise” means an unauthorized disclosure of classified information.

“Data spill” means electronic transmission of classified information via unsecure means such as classified information transmitted over an unclassified network.

“DD Form 254” means the Department of Defense Contract Security Classification

Specification.

“Derivative classification” means incorporating, paraphrasing, restating, or generating in new form information that is already classified, and marking the newly developed material consistent with the classification markings that apply to the source information. Includes the classification of information based on classification guidance. The duplication or reproduction of existing classified information is not derivative classification.

“Final Notification of Security Incident” means contractor (or subcontractor) notification to the

Government Contracting Activity communicating the results of the inquiry conducted.

“Government Contracting Activity” means an element of a Component designated and delegated by the Component head or designee with broad authority regarding acquisition functions to include the appropriate resources and personnel (e.g., contracting officers or their designees, program managers, program offices, and security personnel) as defined in DoDM 5220.32, Volume 1.

“Initial Notification of Security Incident” means the contractor’s (or subcontractor) notification to the Government Contracting Activity of a security incident occurrence and surrounding details of occurrence.

“Inquiry” means the initial fact-finding and analysis process to determine the facts of any security incident and conducted to determine whether or not there was a loss of classified information or whether or not unauthorized personnel had, or could have had, access to the information.

“Loss” means the inability to physically locate or account for classified information.

“Security classification guide” means a documentary form of classification guidance issued by an Original Classification Authority that identifies the elements of information regarding a specific subject that must be classified and establishes the level and duration of classification for each such element.

“Security Incident” means an incident that results from the mishandling of classified information.

“Suspected Compromise” means when a result of no loss or compromise of classified information cannot be determined with certainty.