Attach1PWS.pdf

Solicitation #: FA2550-17-R-2006

ATTACHMENT 1 Page 1 of 21

PERFORMANCE-BASED WORK STATEMENT (PWS)

FOR

50TH SPACE WING (50 SW)

SPECIAL SECURITY OPERATIONS (SSO)

SCHRIEVER AIR FORCE BASE (SAFB), COLORADO

EFFECTIVE 29 JUNE 2017

ATTACHMENT 1 Page 2 of 21

Table of Contents

PARA HEADING PAGE

DESCRIPTION OF SERVICES/GENERAL INFORMATION 3

1.1 PROGRAM MANAGEMENT

1.2 TECHNICAL SCI/SAP SECURITY SUPPORT

1.3 QUALITY PROGRAM

1.4 SAFETY

1.5 TRAVEL

SERVICES SUMMARY (SS) 12

GOVERNMENT FURNISHED SERVICES 13

APPENDICES 14

APPENDIX A – INDEX OF ACRONYMS

APPENDIX B – GLOSSARY OF TERMS

APPENDIX C – PUBLICATIONS

APPENDIX D – CONTRACT DATA REQUIREMENTS LIST (CDRLs)

APPENDIX E – LIST OF 50 SW GEOGRAPHICALLY SEPARATED UNITS (GSU)

ATTACHMENT 1 Page 3 of 21

DESCRIPTION OF SERVICES/GENERAL INFORMATION

The contractor shall provide technical support labor to perform Sensitive Compartmented Information (SCI) and Special Access Program (SAP) security oversight functions in support of the 50th Space Wing (50 SW), Special Security Office (SSO), Schriever Air Force Base (SAFB), Colorado for all 50 SW units both CONUS and OCONUS (See Appendix E). The contractor shall provide technical support to the SCI/SAP Physical Security, Personnel Security Program, and SCI/SAP Information Assurance Programs, as well as SAP Security and Security Assistant Support. Technical support includes information system certification and accreditation support, preparation and review of security operating procedures, preparation and review of SCI Facility (SCIF) and SAP Facility (SAPF) accreditation documentation, preparation of SCI/SAP indoctrination paperwork, maintaining personnel security databases, maintenance of personnel security files, preparing and conducting specialized security training, and conducting security staff assistance reviews. Effective performance requires contractor technical expertise in SCI/SAP physical, personnel, and information assurance. The Contractor must possess a current Top Secret security clearance based on a Single Scope Background Investigation (SSBI) current within five (5) years, and must be eligible for access to SCI/SAP, and willing to submit to a random Counterintelligence Polygraph examination. Contractor personnel providing information assurance technical support must meet Information Assurance Management Level II certification requirements identified in Department of Defense (DoD) 8570.01-M, Information Assurance Workforce Improvement Program. Contractor personnel performing physical and personnel duties must have at least five (5) years of experience in the security field. Contractor personnel performing SAP and Security assistant support must also have at least five (5) years of experience.

1.1 PROGRAM MANAGEMENT

Contractor Employees. The Contractor Program Manager (CPM) and contract employees who interact with the Government shall be able to read, write, speak, and understand the English language.

The contractor shall not employ any person who is an employee of the US Government if employing that person would create a conflict of interest. Employees shall be subject to regulations and directives governing the activities of personnel on Government installations. The installation commander may direct the CPM, in writing, to remove any employee from the installation when retention of such employee endangers life, property, security, or where such an employee violates reasonable and necessary base regulations. Contractor employees are required to identify themselves as contractor personnel by introducing themselves or being introduced as contractor personnel and by displaying distinguishing badges or other visible identification for meetings with Government personnel. In addition, contractor personnel shall appropriately identify themselves as contractor employees in telephone conversations and all written correspondence.

Visitor Group Security Agreement (VGSA). The contractor shall enter into a long term VGSA if contract performance is on base for 90 calendar days or more. This agreement shall outline how the contractor integrates security requirements for contract operations with the AF to ensure effective and economical operation on the installation. The agreement should address:

ATTACHMENT 1 Page 4 of 21

1.1.2.1 Security support will be provided by the AF to the contractor to include storage containers for classified information/material, use of base destruction facilities, classified reproduction facilities, use of base classified mail services, security badging, base visitor control, investigation of security incidents, base traffic regulations, the use of security forms, and conducting inspections required by Air Force Instruction (AFI) 16-1404, Air Force Information Security Program, and AFI 16-1406, Air Force Industrial Security Program t.

1.1.2.2 Security support requiring joint AF and contractor coordination includes packaging classified information, mailing and receiving classified materials, implementing emergency procedures for protection of classified information, security checks, and internal security controls for protection of classified material and high value pilferable property.

Clearance Requirements. The contractor shall possess a facility security clearance at the classification level of Top Secret prior to performing contract work. The contractor shall be responsible for obtaining security clearances (Submit Standard Form (SF) 86, Questionnaire for National Security Positions, to the Defense Security Service) for personnel requiring access to classified information. Due to costs involved with security investigations, requests for contractor security clearances shall be kept to an absolute minimum to perform contract requirements.

Pass and Identification Items. The contractor shall ensure the pass and identification items required for contract performance are obtained for personnel and non-government owned vehicles. All items shall be returned to 50 SFS/SFAD within one business day of event (contract end, termination of employee, conclusion of visit, etc.).

Traffic Laws. The contractor personnel shall comply with all base traffic regulations.

Weapons, Firearms, and Ammunition. Contractor personnel are prohibited from possessing weapons, firearms, or ammunition on their person or within their contractor-owned or privately-owned vehicle while on SAFB.

Reporting Requirements. Contractor personnel shall report to the sponsor organization security manager any information or circumstances of which they are aware may pose a threat to the security of DoD personnel, contractor personnel, resources, and classified or unclassified defense information.

Contractor personnel shall be briefed by their immediate supervisor upon initial on-base assignment.

Physical Security. The contractor shall be responsible for safeguarding all government property and controlled forms provided for contractor use. At the end of each work day, all government facilities, equipment, and materials shall be secured.

Controlled/Restricted Areas. The contractor shall implement local base procedures for entry to AF controlled/restricted areas where contractor personnel work. An AF Form 2586, Unescorted Entry Authorization Certificate, must be completed and signed by the sponsoring agencies Security Manager before a Restricted Area Badge will be issued. Contractor personnel shall have a favorably completed National Agency Check (NAC) investigation before receiving a Restricted Area Badge. Interim access can be granted IAW AFI 31-501, Personnel Security Program Management.

Expected Delays. The contractor may experience delays entering and/or exiting the base due to exercises or increased security, base closure or late reporting due to weather conditions, etc. Exercises should be expected, at a minimum, on a quarterly basis.

http://www.e-publishing.af.mil/?rdoFormPub=rdoPub&txtSearchWord=afi31-601&client=AFPW_EPubs&proxystylesheet=AFPW_EPubs&ie=UTF-8&oe=UTF-8&output=xml_no_dtd&site=AFPW_EPubs&btnG.x=9&btnG.y=10 http://www.dtic.mil/whs/directives/infomgt/forms/sfofforms.htm http://www.dtic.mil/whs/directives/infomgt/forms/sfofforms.htm http://www.e-publishing.af.mil/?rdoFormPub=rdoForm&txtSearchWord=2586&client=AFPW_EPubs&proxystylesheet=AFPW_EPubs&ie=UTF-8&oe=UTF-8&output=xml_no_dtd&site=AFPW_EPubs&btnG.x=13&btnG.y=5 http://www.e-publishing.af.mil/?rdoFormPub=rdoForm&txtSearchWord=2586&client=AFPW_EPubs&proxystylesheet=AFPW_EPubs&ie=UTF-8&oe=UTF-8&output=xml_no_dtd&site=AFPW_EPubs&btnG.x=13&btnG.y=5 http://www.e-publishing.af.mil/shared/resource/EPubLibraryV2/EPubLibrary.aspx?type=Pubs&search_title=AFI31-501

ATTACHMENT 1 Page 5 of 21

Place of performance and hours of operation: The 50th Space Wing/Special Security Office (50 SW/SSO) is located at Bldg 300, Rm 270, SAFB, CO. Normal operating hours are 0730-1630, Monday through Friday, excluding Federal Holidays.

Performance of services during crisis declared by the national command authority (NCA).

The contractor shall perform services during a crisis declared by the National Command Authority per contractual requirements. The contractor shall supply a list of personnel including name, address and phone number of those who shall perform the services. All services shall continue unless otherwise directed by the Contracting Officer (CO).

Contingency Operations Plan. The contractor shall establish and maintain a complete contingency plan to ensure continuation of services during periods of emergency, such as a national wartime mobilization in accordance with (IAW) DODI 1100.22, Policy and Procedures for Determining Workforce Mix. The Contractor shall submit a Contingency Operations Plan 10 days after the ontract start date. (CDRL A002)

Manpower reporting.

The contractor shall report ALL contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract for the Department of the Air Force (AF) via a secure data collection site. The contractor is required to completely fill in all required data fields using the following web address http://www.ecmra.mil. Reporting inputs will be for the labor executed during the period of performance during each Government fiscal year (FY), which runs October 1 through September 30. While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year. Contractors may direct questions to the electronic Contractor Manpower Reporting Application (eCMRA) help desk.

http://www.ecmra.mil/

ATTACHMENT 1 Page 6 of 21

1.2 TECHNICAL SCI/SAP SECURITY SUPPORT

The contractor shall provide technical SCI/SAP security support to the SAFB SSO. The contractor shall provide technical guidance by drafting, coordinating, revising, tracking, and preparing security related documents associated with SSO functions. The contractor shall prepare papers in Air Force and 50 SW approved formats, including products such as general security correspondence, accreditation packages and security operating procedures. The contractor shall prepare and conduct specialized security training pertaining to physical, personnel, and information assurance security disciplines established by policies and procedures. To accomplish assigned tasks, the contractor shall participate in technical and programmatic meetings to include possible attendance at locations other than SAFB. The contractor shall exercise security oversight and have exceptional oral and written communication skills.

Assistance with Communications Security (COMSEC) Duties Accomplishment.

1.2.2.1 The contractor shall assist the government primary COMSEC custodian with the process of receiving keying material, publications, and equipment.

1.2.2.2 The contractor shall assist the government primary COMSEC custodian in the conduction of inventories of material and equipment on an as needed basis.

1.2.2.3 The contractor shall assist the government primary COMSEC custodian with the transfer of accountable material, contributing to ensure that the material is properly reported and recorded, and will provide assistance to ensure material is accounted for, from receipt through final disposition.

50 SW SCI/SAP Physical Security Program. The contractor shall effectively assist with managing the Sensitive Compartmented Information (SCI) and Government Special Access Program Security Officer (GSSO)s SAP Physical Security Programs.The contractor shall perform the following specific physical security duties:

1.2.3.1 Review, prepare, coordinate, and disseminate all SCI/SAPF accreditation documentation, (Fixed Facility Checklist (FFC), etc.), prior to formal submission to the SSO/GSSO. Ensure all documentation is annually reviewed, maintained and updated.

1.2.3.2 Provide SCI/SAPF physical security assistance to the SSO/GSSO and supported organizations.

1.2.3.3 Review, prepare, coordinate and disseminate Emergency Action Plans and Standard Operating procedures.

1.2.3.4 Provide TEMPEST Security guidance to the SSO/GSSO and the supported organization.

1.2.3.5 Review TEMPEST accreditation documentation for accuracy prior to formal submission to the SSO/GSSO.

1.2.3.6 Conduct or assist with annual security reviews of all supported physical security programs.

1.2.3.7 Maintain and provide annual training to all facility residents.

1.2.3.8 Conduct annual inventories as required by SCI/SAP guidance.

ATTACHMENT 1 Page 7 of 21

50 SW SCI/SAP Personnel Security Program. The contractor shall manage the SSO/GSSOs SCI/SAP Personnel Security Program. Manage associated security databases, personnel security files, and other administrative files IAW applicable regulations, instructions, policies, and/or established guidelines. Specific tasks include the following:

1.2.4.1 Perform timely data updates to the Joint Access Database Environment (JADE) database for all SSO/GSSO supported organizations.

1.2.4.2 Update and maintain all electronic and hard-copy personnel security files for assigned personnel IAW AF Records Management Directives and Privacy Act requirements.

1.2.4.3 Process, track, and monitor SCI/SAP indoctrination requests for all SSO/GSSO supported organizations.

1.2.4.4 Process incoming and outgoing SCI/SAP visit certifications.

1.2.4.5 Provide initial and annual training to all appointed SCI/SAP indoctrinated personnel.

1.2.4.6 Prepare billet reports on an annual basis or as requested by the Major Command

(MAJCOM).

1.2.4.7 Prepare, monitor and disseminate SCI/SAP billet correspondence and related documentation.

50 SW SCI Personnel Security Program. The contractor shall manage the SSOs SCI Personnel

Security Program. Manage associated security databases, personnel security files and other administrative files IAW applicable regulations, instructions, policies, and/or established guidelines.

Specific tasks include the following:

1.2.5.1 Perform timely data updates to the SCI Billet Structure (SCIBS) database for all supported organizations.

1.2.5.2 Perform timely data updates to the Joint Personnel Access System (JPAS) database for all SSO supported organizations.

1.2.5.3 Update and maintain all electronic and hard-copy personnel security files for assigned personnel IAW AF Records Management Directives and Privacy Act requirements.

1.2.5.4 Process, track, and monitor SCI indoctrination requests for all SSO supported organizations.

1.2.5.5 Process incoming and outgoing SCI visit certifications.

1.2.5.6 Provide initial and annual training to all appointed SCI billet monitors.

1.2.5.7 Prepare billet reports on an annual basis or as requested by the MAJCOM SSO.

1.2.5.8 Prepare, monitor, and disseminate SCI billet correspondence and related documentation.

50 SW Information Assurance Security Program. The contractor shall manage the SSOs

SCI/SAP Information Assurance Program IAW applicable regulations, instructions, policies and/or established guidelines. Specific tasks and qualifications include the following:

1.2.6.1 Ensure Automated Information Systems (AIS) accreditation packages are accurate and complete, and submitted to the appropriate DAA IAW the Joint Special Access Program (SAP) Implementation Guide (JSIG).

ATTACHMENT 1 Page 8 of 21

1.2.6.2 Provide technical support to the SAFB Information Security Officer (ISO) and supported Information System Security Officers (ISSO)s.

1.2.6.3 Conduct annual staff assistance security reviews of all supported information assurance programs.

1.2.6.4 Ensure all SSO SCI/SAP Automated Information Systems (AIS) systems are accredited and maintained IAW the JSIG and Intelligence Community Directive (ICD) 503.

1.2.6.5 Ensure appointed ISSOs comply with Intelligence Community Vulnerability Assessment (ICVA) reporting requirements.

1.2.6.6 Develop and provide monthly training material to appointed ISSOs.

1.2.6.7 Provide technical support to ISSOs to assist them in making proper decisions concerning the levels of concern for confidentiality, integrity, and availability of the data, and the protection levels for confidentiality for the system.

1.2.6.8 Provide technical support to ISSOs in developing procedures for clearing, purging, declassifying, and releasing system memory, media, and output.

1.2.6.9 Maintain a repository for all system accreditation/certification documentation and modifications.

1.2.6.10 Review and forward to the SSO and MAJCOM ISO quarterly site baseline reports.

1.2.6.11 Provide technical support to develop protective and corrective measures when an Information System (IS) incident or vulnerability has been discovered.

1.2.6.12 Provide technical support to the Site ISO in the development and implementation of an effective IS security education, training, and awareness program.

1.2.6.13 Provide technical support to the Site ISO in the development and implementation of procedures IAW JSIG configuration management policies and procedures for authorizing the use of hardware/software on an IS.

1.2.6.14 Provide technical support to the Site ISO in responding to security incidents, and for investigating and reporting security violations and incidents to the Designated Accrediting Authority (DAA)/DAA Representative/Service Certification Organization and to local management, as appropriate.

1.2.6.15 Serve as a member on established configuration management boards.

1.2.6.16 Contractor shall have thorough understanding and application of network security principles, practices and implementations.

1.2.6.17 Contractor shall have thorough understanding of system methodologies including but not limited to client server, web hosting, web content servers, policy servers, directory servers, firewalls, Wide Area Network (WAN), Local Area Network (LAN), Switches, and routers.

1.2.6.18 Contractor shall be Proficienct in the use of tools used to prevent and/or negate malicious code.

1.2.6.19 Contractor shall understanding of Commercial off-the-shelf (COTS) tools that scan at the physical layer of all removable and fixed media types including but not limited to: CDs, hard drives, thumb drives, Zip/Jazz, etc.

ATTACHMENT 1 Page 9 of 21

1.2.6.20 Contractor shall decipher and explain in clear language ICD 503, including Risk Management Framework (RMF).

1.2.6.21 Contractor shall apply a risk management philosophy when faced with security challenges and the ability to articulate the pros and cons in a clear concise manner.

1.2.6.22 Contractor shall have analytical abilities to decipher complex technical configuration management documents.

1.2.6.23 Contractor shall have excellent communication, interpersonal, and team-building skills to engender rapport with military personnel, civilians, and other contractors at all levels.

SCI/SAP Security Program. The contractor shall assist with effectively managing the 50 OG

SCI/SAP Physical and Personnel Security Program. The contractor shall perform the following specific security duties:

1.2.7.1 Review all SCIF/SAPF accreditation documentation for accuracy prior to formal submission to the DAA. Ensure all documentation is annually reviewed, maintained, and updated.

1.2.7.2 Provide SCI/SAP physical security technical guidance.

1.2.7.3 Review, prepare, coordinate, and disseminate Emergency Action Plans and Standard Operating procedures.

1.2.7.4 Review TEMPEST accreditation documentation for accuracy prior to formal submission to the DAA.

1.2.7.5 Assist with conducting annual security reviews/inspections.

1.2.7.6 Assist with SAP inventories as requested.

1.2.7.7 Perform timely data updates to the JPAS database for all assigned personnel.

1.2.7.8 Update and maintain all electronic and hard-copy personnel security files for assigned personnel IAW AF Records Management Directives and Privacy Act requirements.

1.2.7.9 Process, track, and monitor SCI/SAP indoctrination requests.

1.2.7.10 Process incoming and outgoing SCI/SAP visit certifications.

1.2.7.11 Provide initial and annual training to all assigned personnel.

1.2.7.12 Prepare annual billet reports requested by the 50 SW SSO.

1.2.7.13 Prepare, monitor, and disseminate SCI billet correspondence and related documentation.

1.2.7.14 Assist with updating unit security policies, procedures, and training.

SCI/Collateral Security Program. The contractor shall assist with effectively managing Physical and Personnel Security Program within the 50 OG. The contractor shall perform the following specific security duties:

1.2.8.1 Initiate and process SCI initial and periodic investigation paperwork.

1.2.8.2 Review, prepare, coordinate, and disseminate all SCIF accreditation documentation (FFCs, etc.) prior to formal submission to the SSO. Ensure all documentation is annually reviewed, maintained, and updated.

ATTACHMENT 1 Page 10 of 21

1.2.8.3 Review TEMPEST accreditation documentation for accuracy prior to formal submission to the DAA.

1.2.8.4 Process, track, and monitor SCI indoctrination requests for all assigned personnel.

1.2.8.5 Process incoming and outgoing visit certifications.

1.2.8.6 Provide initial, quarterly, and annual training to all assigned personnel.

1.2.8.7 Prepare annual billet reports as requested by the 50 SW SSO.

1.2.8.8 Prepare, monitor, and disseminate SCI billet correspondence and related documentation.

1.2.8.9 Assist with conducting annual security reviews/inspections.

1.2.8.10 Perform timely data updates to the Joint Personnel Access System (JPAS) database for all assigned personnel.

1.2.8.11 Assist with updating unit security policies, procedures, and training.

1.2.8.12 Perform GSA classified safe custodian management duties by ensuring all associated forms and documentation are kept current.

Clearance

1.2.9.1 The contractor shall possess TS Clearance with SCI/SAP eligibility for individuals performing Physical, Personnel, and Information security duties.

1.3 QUALITY PROGRAM.

Quality Control Program. The contractor shall establish, through an independent function, a quality program, which shall encompass all aspects of the contract. The contractor shall submit to the Government a Quality Program Plan 10 duty dates after contract start date. (CDRL A001)

Quality Assurance. The Government will evaluate the contractor’s performance under this contract. Government personnel will record all surveillance observations. When an observation indicates defective performance, the Contracting Officer Representative (COR) will require the Contract Manager or representative at the site to initial the observation. The initialing of the observation does not necessarily constitute concurrence with the observation, only acknowledgment that he or she has been made aware of the defective performance. Such surveillance will be done according to standard inspection procedures or other contract provisions.

1.4 SAFETY.

The contractor shall comply with the all applicable directives as listed in this PWS (see Appendix C – Publications). The contractor shall ensure the safety of all contractor personnel and tasks performed by complying with all applicable federal, state and local safety directives. The 50th Space Wing Safety Office (50 SW/SE) shall be notified of all on-duty mishaps within three (3) business days of occurrence.

The contractor shall notify 50 SW/SE of any Occupational Safety and Health Administration (OSHA) visits to the base or complaints received by OSHA. Mishaps shall be reported to 50 SW/SE by calling 567-7233 (SAFE) and 567-5617. The 50 SW/SE will be permitted to periodically inspect contractor activities to ensure that AF assets and AF personnel are protected. This inspection activity does not in any manner supersede, supplement, or fulfill your responsibility to inspect your work centers to ensure compliance with OSHA standards.

ATTACHMENT 1 Page 11 of 21

Mishaps Reporting. Report all mishaps involving any person sustaining injury or illness resulting from contractor operations and all mishaps involving government property or equipment damaged by the contractor to the Contracting Officer Representative and CO no later than the end of the next business day.

Mishaps Investigation. The Government has the authority to conduct investigations of mishaps in government facilities managed by contractors or to participate in the contractor’s investigation of contractor mishaps. The contractor shall participate in, and cooperate with, government mishap investigations.

Safety Inspections. The Government will conduct facility inspection in government facilities that are occupied by the contractor. Within the 50 United States and its territories (including Geographically Separated Units (GSU)), AF contractors operating for AF facilities located on or off AF installations, are subject to enforcement authority by Federal and State safety and health organizations.

Authorized safety and health officials from states without OSHA approved occupational safety and health plans may be subject to the exceptions contained here, also exercise jurisdiction over contractors operations.

1.5 TRAVEL

Contractor personnel shall be required to travel to support this PWS. All proposed travel to be performed by the contractor must be pre-approved by the COR prior to any travel. Once approved by the contracting officer, the contractor shall make arrangements and pay for all commercial travel expenses.

Travel will consist of approximately 1 trip per year for formal training courses/conferences.

Additionally, approximately three (3) trips per year will be accomplished for GSU support consisting of Personnel and Physical security support. See 4.5 for potential GSU support locations.

The contractor shall be responsible for all employee travel arrangements by commercial means.

Contractor employee travel shall be IAW current Joint Travel Regulations (JTR). Transportation may be provided by the military depending on access to bases and availability of commercial transportation.

If any travel arrangements cause additional costs to the contract that exceed those previously negotiated, written coordination with the PM and approval from the CO is required, prior to undertaking such travel.

ATTACHMENT 1 Page 12 of 21

SERVICES SUMMARY (SS)

PERFORMANCE OBJECTIVE PWS

PARAGRAPHS

PERFORMANCE

THRESHOLD

Review and prepare all SAPF accreditation documentation, (FFCs, etc.), prior to formal submission. Coordinate and disseminate documentation to GSSO and MAJCOM SSO/GSSO. Ensure all documentation is annually reviewed, maintained and updated.

1.2.3.1 1.2.7.1 1.2.8.2

All facilities must maintain full accreditation 100% of time

Maintain and provide annual training to all facility residents.

1.2.3.7 1.2.4.5 1.2.5.6 1.2.7.11

100% trained annually within the anniversary month

Perform timely data updates to the Joint Access Database Environment (JADE) database for all GSSO supported organizations.

1.2.4.1

Same day of information change

Ensure Automated Information Systems (AIS) accreditation packages are accurate and complete, and submitted to the appropriate DAA IAW the Joint Special Access Program (SAP) Implementation Guide (JSIG).

1.2.6.1 100% accurate, review within 5 business days of request

Ensure all SSO SCI/SAP AIS are accredited and maintained IAW the JSIG and Intelligence Community Directive (ICD) 503.

1.2.6.4 All AIS must maintain full

accreditation 100% of time

Process, track, and monitor SCI/SAP indoctrination requests.

1.2.4.3 1.2.5.4 1.2.7.9 1.2.8.4

Process request within 3 days of submission

ATTACHMENT 1 Page 13 of 21

GOVERNMENT FURNISHED SERVICES

The Government will provide office space, furniture, telephone service, and computer access to NIPR, SIPR, and JWICS for contractor personnel required to work on-site at SAFB facilities.

ATTACHMENT 1 Page 14 of 21

APPENDICES

APPENDIX A – INDEX OF ACRONYMS.

Acronym Meaning 21 AMDS/SGPB 21st Aerospace Medicine Squadron/Bioenvironmental Engineering 50 CES/CEV 50th Space Wing Civil Engineering/Environmental Flight 50 SW 50th Space Wing 50 SW/SE 50th Space Wing Safety Office 50 SW/SSO 50th Space Wing/Special Security Office ADP Automated Data Processing ADPS Automated Data Processing System AF Air Force AFI Air Force Instruction AIS Automated Information Systems ANSI American National Standard Institute BCE Base Civil Engineering CFR Code of Federal Regulation CO Contracting Officer COMSEC Communications Security COR Contracting Officer Representative COTS Commercial off-the-shelf DAA Designated Accrediting Authority DCI Director of Central Intelligence DCID Director of Central Intelligence Directive DIA Defense Intelligence Agency DIAM Defense Intelligence Agency Manual DoD Department of Defense DoDIIS DoD Intelligence Information Systems eCMRA electronic Contractor Manpower Reporting Application EEOM-MIS Enterprise Environmental Occupational Health – Management Information

System EMSEC Emanations Security EO Executive Order FFC Fixed Facility Checklist FY Fiscal Year GSSO Government Special Access Program Security Officer GSU Geographically Separated Unit HAZCOM Hazard Communication HAZMAT Hazardous Material HAZWASTE Hazardous Waste IAW in accordance with ICD Intelligence Community Directive ICVA Intelligence Community Vulnerability Assessment IEEE International Institute Electronic Electrical Engineers INFOSEC Information System Security

ATTACHMENT 1 Page 15 of 21

Acronym Meaning IS Information System ISO Information Security Officer ISSO Information System Security Officer JADE Joint Access Database Environment JPAS Joint Personnel Access/Adjudication System JSIG Joint Special Access Program (SAP) Implementation Guide (JSIG) JTR Joint Travel Regulation LAN Local Area Network MAJCOM Major Command MSDS Material Safety Data Sheets NAC National Agency Check NCA National Command Authority OSHA Occupational Safety and Health Administration PAFB Peterson Air Force Base, Colorado PWS Performance-Based Work Statement RFR Radio Frequency Radiation RMF Risk Management Framework SAFB Schriever Air Force Base SAP Special Access Program SAPF Special Access Program Facility SCI Sensitive Compartmented Information SCIBS Sensitive Compartmented Information Billet Structure/System SCIF Sensitive Compartmented Information Facility SF Standard Form SIO Senior Intelligence Officer SS Services Summary SSBI Single Scope Background Investigation SSO Special Security Operations or Office VGSA Visitor Group Security Agreement WAN Wide Area Network

ATTACHMENT 1 Page 16 of 21

APPENDIX B – GLOSSARY OF TERMS.

AIS: Automated Information System - Used interchangeably with Automated Data Processing (ADP) System (ADPS). An assembly of computer hardware, firmware, and software used to categorize, sort, calculate, summarize, store, retrieve, control, process, and/or protect data with a minimum of human intervention. AIS ADPS include process control computers, embedded computer systems that perform general purpose computing functions, supercomputers, personal computers intelligent terminals, word processors and other technologies as may be developed.

EMSEC: Emanations Security - The protection resulting from all measures designed to deny unauthorized persons information of value that might be derived from intercept and analysis of compromising emanations from other than crypto-equipment and telecommunications systems.

GSSO: A government, or government support position, appointed in writing at a government SAPF or organization by the Director or PM to provide security administration and management. The GSSO receives SAP guidance from the PSO.

IAM: Information Assurance Manager - The individual assigned responsibilities for managing the security posture of a DoD Intelligence Information Systems (DoDIIS) Site.

ISSO: Information Security Officer - The individual responsible to the ISO for ensuring that security is provided throughout the life cycle of a system or network from the beginning of the concept through its design, development, operation, maintenance, and secure disposal.

JPAS: Joint Personnel Adjudication System – DoDs automated system that will maintain all collateral and SCI security clearance (eligibility and access) and adjudication information for DoD contractor and government personnel.

JSIG: Joint Special Access Program (SAP) Implementation Guide - A joint services document that describes the protection philosophy and functional procedures involved with an effective Information Systems Security Program. It provides the protection philosophy and functional implementation guidelines and procedures that apply to the protection, use, management, and dissemination of SCI/SAP.

JTR: Joint Travel Regulation PWS: Performance-Based Work Statement – A document that describes the specific requirements the contractor shall meet in performance of a Government contract. It also specifies a standard of performance for the required tasks and the quality level the Government expects the contractor to provide.

SAP: Special Access Program - Any DoD program or activity employing enhanced security measures (e.g., safeguarding, access requirements, etc.) exceeding those normally required for collateral information at the same level of classification shall be established, approved, and managed as a DoD

SAP.

SCI: Sensitive Compartmented Information – Classified information concerning or derived from intelligence sources, methods, or analytical processes, which is required to be handled within formal access control system’s security policies.

There are only three (3) classification levels of national security information – Confidential, Secret and Top Secret. The levels define information, the disclosure of which could reasonably be expected to cause “damage,” “serious damage” or “exceptionally grave damage” to the national security. No other terms may be used to identify classified national security information. Certain information; however, is

ATTACHMENT 1 Page 17 of 21 deemed so sensitive that greater investigative standards and controls are placed on the “access” to such information. Among such information is that dealing with intelligence sources, methods or activities, known as SCI. Access to SCI is governed by standards established by the Director of Central Intelligence (DCI).

SCIBS: Sensitive Compartmented Information Billet System – A database designed to manage SCI billets to include incumbent personnel data.

SCIF: Sensitive Compartmented Information Facility – A SCIF is an accredited area, room, group of rooms, buildings, or installation where SCI may be stored, used, discussed, and/or electronically processed.

SIO: Senior Intelligence Officer – The highest ranking military or civilian individual charged with direct foreign intelligence missions, functions, or responsibilities within a department, agency, component, or element of an Intelligence Community organization.

SSBI: Single Scope Background Investigation – An investigation completed according to DoD 5200.2- R, meeting the investigative scope requirements for SCI access. A personnel security investigation consisting of the following investigative requirements, NAC; spouse NAC; subject interview;

birth/citizenship checks; education, employment, local agency, public record and credit record checks;

neighborhood, employment, listed and developed character reference interviews, accomplished within a ten-year scope. Final SCI adjudication will be held in abeyance pending completion of the investigation.

SSO: Special Security Officer System - A system through which the Director, Defense Intelligence Agency (DIA); the Army, Navy, and Air Force Intelligence Chief; and AF supported Unified and Specified Commands perform their responsibilities for the security, use, and dissemination of SCI to include both physical and electrical means. The symbol SSO is used to refer to both the office and the officer.

TEMPEST: An unclassified short name referring to investigations and studies of compromising emanations.

VGSA: Visitor Group Security Agreement – An agreement between the contractor and the installation security forces that discusses how the contractor integrates security requirements for contract operations.

ATTACHMENT 1 Page 18 of 21

APPENDIX C – PUBLICATIONS.

GENERAL INFORMATION: The publications listed in this appendix are generally referenced in the PWS. The Directive/Guidance (D/G) column indicates the extent of Contractor compliance with the publication that is prescribed by the PWS. A “D” in the column means the publication is a “directive publication”, that requires mandatory compliance by the Contractor. A “G” in the column means the publication is a “guidance publication”. These publications provide guidance for the contractor to perform particular tasks or operations in a manner compatible with Air Force procedures. However, the Contractor is required to comply with the intent of the publication. Additionally any procedures developed by the contractor shall be compatible with the intent of the “G” publications.

All publications should be publically available via the Air Force E-Publishing website (http://www.e-publishing.af.mil) or a general internet search (Google/Bing). If a document cannot be readily accessed due to classification or access limitations, a digital or paper copy shall be provided to the Contractor by the Government.

LIST OF PUBLICATIONS:

D/G Publication # Name Date Applicable

Paragraph PWS Paragraph

D AFI 16-

Air Force Information

Security Program

May

All 1.1.2.1

D AFI 16-

Air Force Industrial Security Program

25 Aug

All 1.1.2.1

D AFI 31-501 Personnel Security Program

Management

27 Jan

All 1.1.9

D AFI 32-

Hazardous Materials

Management

4 Feb

All 1.5.3.

D AF MAN

14-304

The Security, Use, and

Dissemination of Sensitive

Compartmented Information

(SCI)

23 Dec

All 1.0, 1.2.1, 1.2.5, 1.2.6, 1.2.7, 1.2.8

D DoD 5105.21-M-

Sensitive Compartmented

Information Administrative

Security Manual

19 Oct

Volumes 1 & 3 1.0, 1.2.1, 1.2.5, 1.2.6, 1.2.7, 1.2.8.

http://www.e-publishing.af.mil/ http://www.e-publishing.af.mil/ http://www.e-publishing.af.mil/?rdoFormPub=rdoPub&txtSearchWord=afi31-601&client=AFPW_EPubs&proxystylesheet=AFPW_EPubs&ie=UTF-8&oe=UTF-8&output=xml_no_dtd&site=AFPW_EPubs&btnG.x=9&btnG.y=10 http://www.e-publishing.af.mil/?rdoFormPub=rdoPub&txtSearchWord=afi31-601&client=AFPW_EPubs&proxystylesheet=AFPW_EPubs&ie=UTF-8&oe=UTF-8&output=xml_no_dtd&site=AFPW_EPubs&btnG.x=9&btnG.y=10 http://www.e-publishing.af.mil/?rdoFormPub=rdoPub&txtSearchWord=afi31-601&client=AFPW_EPubs&proxystylesheet=AFPW_EPubs&ie=UTF-8&oe=UTF-8&output=xml_no_dtd&site=AFPW_EPubs&btnG.x=9&btnG.y=10 http://www.e-publishing.af.mil/shared/resource/EPubLibraryV2/EPubLibrary.aspx?type=Pubs&search_title=AFI31-501 http://www.e-publishing.af.mil/shared/resource/EPubLibraryV2/EPubLibrary.aspx?type=Pubs&search_title=AFI31-501 http://www.e-publishing.af.mil/shared/resource/EPubLibraryV2/EPubLibrary.aspx?type=Pubs&search_title=AFI31-501 http://www.e-publishing.af.mil/shared/resource/EPubLibraryV2/EPubLibrary.aspx?type=Pubs&search_title=AFI31-501 http://www.e-publishing.af.mil/shared/resource/EPubLibraryV2/EPubLibrary.aspx?type=Pubs&search_title=AFI32-7086 http://www.e-publishing.af.mil/shared/resource/EPubLibraryV2/EPubLibrary.aspx?type=Pubs&search_title=AFI32-7086 http://www.e-publishing.af.mil/shared/resource/EPubLibraryV2/EPubLibrary.aspx?type=Pubs&search_title=AFI32-7086

ATTACHMENT 1 Page 19 of 21

D/G Publication # Name Date Applicable

Paragraph PWS Paragraph

D DoDI 1100.22

Policy and Procedures for Determining

Workforce Mix

12 Apr

All 1.1.13.

D ICD 704 Personnel Security

Standards and Procedures Governing

Eligibility for Access to Sensitive

Compartmented Information

(SCI)

1 Oct

All 1.2.4, 1.2.5, 1.2.7,1.1.3

D EO 12958 Further Amendment to

Executive Order 12958, as Amended, Classified National Security

Information

25 Mar

General understanding 1.2

D DIAM 50-4 DoD Intelligence Information

Systems (DoDIIS)

Information System Security

(INFOSEC)

Program

30 Apr

Chapter 2 1.2.6

D ICD 503 Intelligence Community Information Technology

Systems Security Risk Management, Certification and Accreditation

15 Sep

All 1.2.6

ATTACHMENT 1 Page 20 of 21

D/G Publication # Name Date Applicable

Paragraph PWS Paragraph

D JSIG Joint Special Access

Program (SAP) Implementation

Guide

11 Apr

All 1.2.6

D DoDM 5205.07, V1

DoD Special Access

Program (SAP) Security Manual:

General

Procedures

18 Jun

All 1.2.3, 1.2.4, 1.2.7

D DoDM 5205.07, V2

Special Access Program (SAP)

Security Manual:

Personnel Security

24 Nov

All 1.2.4

D DoDM 5205.07-V3

DoD Special Access

Program (SAP) Security Manual:

Physical Security

April

All 1.2.3

D JTR Joint Travel Regulations Volume 2

1 Apr

All 1.6.4

G Department of Defense

(DoD) 8570.01-M

Information Assurance Workforce

Improvement Program

19 Dec

All 1.0.

file:///C:%5CUsers%5C1408903692A%5CAppData%5CLocal%5CMicrosoft%5CWindows%5CTemporary%20Internet%20Files%5CContent.Outlook%5CAppData%5CLocal%5CMicrosoft%5CWindows%5CTemporary%20Internet%20Files%5CAppData%5CLocal%5CMicrosoft%5CWindows%5CTemporary%20Internet%20Files%5CContent.Outlook%5CAppData%5CLocal%5CMicrosoft%5CWindows%5CTemporary%20Internet%20Files%5CAppData%5CLocal%5CMicrosoft%5CWindows%5CTemporary%20Internet%20Files%5CContent.Outlook%5CAppData%5CLocal%5CMicrosoft%5CWindows%5CTemporary%20Internet%20Files%5CContent.Outlook%5CAppData%5CLocal%5CMicrosoft%5CWindows%5CTemporary%20Internet%20Files%5CBARNETNL%5CDesktop%5Cdefensetravel.dod.mil%5Csite%5Ctravelreg.cfm http://www.dtic.mil/whs/directives/ http://www.dtic.mil/whs/directives/

ATTACHMENT 1 Page 21 of 21

APPENDIX D – CONTRACT DATA REQUIREMENTS LIST (CDRLs).

The contractor shall create several reporting products in the execution of this contract.

Quality Program Plan CDRL A001

Contingency Operations Plan CDRL A002

APPENDIX E – LIST OF 50 SW GEOGRAPHICALLY SEPARATED UNITS (GSU)

SCI/SAP contract support required for the following list of sites, but is not inclusive:

Location Vandenberg AFB, CA

New Boston AFS, N.H.

Diego Garcia, BIOT

Anderson AFB, Guam Waianae, Hawaii

Suitland, MD