Attach 2 PWS DIACAP II

FA3002-10-R-0045

Attachment 2

Headquarters Air Education and Training Command (HQ AETC)

PERFORMANCE WORK STATEMENT (PWS)

For

DIACAP, SISSU and EITDR and related IA Support

Consolidated Tasker Support 24 Mar 2010

1.0. DESCRIPTION OF SERVICES

1.1. General Information: Headquarters Air Education and Training Command requires contractor support to complete short notice, firm fixed price task orders for certification and accreditation(C&A) under the Air Force implementation of DoD Information Assurance Certification and Accreditation Process (DIACAP). Support will also include Security, Interoperability, Sustainability, Supportability and Usability (SISSU) sub-process for small, medium and large systems/enclaves. DIACAP C&A of Automated Information Systems process will lead to an Approval to Operate (ATO) document granting Authority to Connect (ATC) to the Air Force network. Certification and Accreditation tasks and deliverables will be in accordance with the first three phases of the DIACAP and the three phases of the Air Force (AF) Information Technology (IT) Lean Process Version 5.0. Support includes documenting entries/responses for the Enterprise Information Technology Data Repository (EITDR).

1.2 Task Descriptions. The contractor shall successfully complete system C&A, Information Support Plan (ISP) support and services including conducting initial certification tasks and periodic review of security configurations. The contractor shall review policy and procedure changes which have occurred since the system was last certified and accredited. The Contractor shall schedule with the government a task kickoff meeting within five (5) business days after delivery order or contract award start date. The contractor shall initiate the DIACAP Implementation Plan, assign Information Assurance (IA) controls, and complete required security artifacts for upload into the EITDR system. The contractor shall execute and update a Security Implementation Plan (SIP), conduct validation activities, and compile validation results in EITDR to retrieve a DIACAP scorecard. During the period of performance the contractor shall develop Plans of Action and Milestones (POA&M) IAW DODI 8510.01.

1.3 Primary Scope - DIACAP, SISSU and EITDR.

1.3.1 Systems certified and accredited: System descriptions will be provided by the government program manager (PM) for each task order issued. Task orders will be issued for individual requirements/tasks.

1.3.2 Contractor support responsibilities for HQ AETC Directorates/Wings/Tenants are to perform DIACAP tasks and deliverables associated with Phases 1, 2, and 3 listed under Paragraph 1.10. Documentation will consist of a draft ISP manual that contains DoD Air Force Architecture Framework (DoDAF) views for the ISP, as well as input for the SISSU checklist and related EITDR’s input for each system covered by an issued task order. Documentation of tasking and deliverables will be required to be in a certification and accreditation schedule format and delivered within 10 business days of initial task order. Multiple system taskings and deliverables awarded under a single task order will be processed simultaneously by the contractor ensuring timetables are met during the period of performance. Support will include development of both Comprehensive and Executive Packages IAW the IT Lean Guidebook V5.

1.4 Period of Performance. Task orders issued will vary in size and complexity of system/enclave to be certified and assigned to a focal point within 5 business days of award. Small network systems will have an estimated period of performance of 4-7 months, medium systems 6-10 months and large systems 10-12 months for certification process completion. (Table 1.1) Final decisions on size and complexity of each network system being tasked will be negotiated between the Contracting Officer, PM and contractor. Period of performance will include coordination and granting of Designated Approving Authority (DAA) approval.

1.4.1 The chart below is a guide that gauges the scope of a C&A project. The guide is based on a system’s Mission Assurance Category (MAC) and Confidentiality level (Public, Sensitive, Classified) as described in DoD 8500.2, and the number of items e.g. servers requiring certification during the DIACAP process. The scope of each C&A project will be defined in each task order Performance Work Statement (PWS). A contributing factor in determining the scope of a C&A project is the number of locations that a contractor will need to visit to complete the C&A.

Classified Public Sensitive (FOUO)

Table 1.1

Legend:

MAC I - Vital to operational readiness/mission effectiveness of deployed/contingency forces

MAC II – Important to/supports deployed/contingency forces

MAC III – System necessary to conduct day-to-day business

S- Small, M-Medium, L-Large

1.5 Performance Requirements. The Contractor shall provide labor, material and personnel with the experience and education necessary to complete the tasks listed herein. The contractor shall attend monthly security working group meetings and provide technical experience to assist in identifying and recommending security features and/or procedural guidelines to minimize risks to the data processed by automated information systems. The contractor shall communicate/coordinate with HQ Air Force Network Integration Center (AFNIC) during reviews and validation of DIACAP deliverables and artifacts related to the security portion of the SISSU. Periodic status update meetings and program reviews shall be performed on a monthly basis, or as specified by the Contracting Officer (CO). Contract personnel will have authorization to conduct IA control validation on an annual basis to maintain the ATC.

1.5.1 Certification and Accreditation (C&A) Support:

1.5.1.1 Information Assurance and Security Documentation. Contractor personnel will abide by the AF Certification and Accreditation (C&A) process by developing and maintaining documentation that meets or exceeds C&A and DoD Information Security requirements for system deliverables IAW DoD Information Assurance Certification and Accreditation Process (DIACAP), DODI 8510.01, AFI 33-202, Network and Computer Security Vol. 1 and Identity Management Vol. 6. This includes providing technical support and documentation to enable AETC to achieve Federal Information System Management Act (FISMA) validation.

1.5.1.2 FISMA reporting will be provided to satisfy annual reporting guidance requirements in accordance with the Air Force Chief Information Officer CIO 7 April 2007 memo and subsequent released guidance. This document will be provided by the government when requested. FISMA requirements listed in this memorandum shall meet or exceed minimum standards as required by the program manager/system owner or the Quality Assurance Personnel (QAP). The contractor shall develop and provide a Project Status Report on a monthly basis to the QAP by the 20th of the following month. The Contractor shall work with the program office to ensure an updated Plan of Action and Milestones (POA&M) is uploaded into the EITDR in the appropriate phase. Cooperation between the contractor and the system owner shall ensure the appropriate EITDR, FISMA questions are answered and meet minimum solution requirements listed within the database. FISMA minimum requirements must be met or an appropriate POA&M schedule shall be produced for systems that fail. The POA&M will be forwarded to the Information Assurance Office (AETC/A6OK, AFNIC and SAF/XC) for review/validation no later than 7 business days upon known requirement. The FISMA requirements memo shall be initiated within 10 business days of task order delivery assignment and POA&M shall be completed within 90 calendar days of initiation. If FISMA reporting guidance questions are not complete within a 90 calendar day time period a new POA&M must be resubmitted to AETC/A6OK.

1.5.1.3 On Site Contractor Support. The Onsite support shall provide a qualified person to provide AETC Enterprise Wide C&A support for HQ AETC/A6OKat Randolph AFB, TX and HQ Air University (AU--A4/A6) Maxwell AFB, Montgomery AL. These areas include the AETC Enterprise Network Domain Accreditation, wing-level accreditation, HQ AU--HQ AETC sponsored system accreditations and overall C&A management of the AETC Enterprise.

1.5.1.4 The Onsite Contractor will provide onsite DIACAP training IAW DODI

8500.2 as needed to HQ AU--HQ AETC Program Managers (PM’s). The Contractor will provide SISSU training IAW IT LEAN Guidebook Version 5.0 within 14 business days of request. The contractor will provide DIACAP technical expertise (C&A Helpdesk support, assessing IA controls, and assisting in the development of architectural drawings) to PMs and Wing Information Assurance personnel. The Onsite Contractor shall respond within 1 business day to requests for technical assistance from PMs and ascertain the level of assistance required

1.5.1.5 The Onsite contractor shall perform as a technical interface and designated liaison between AFNIC and AETC in the IT Lean Process garnering ATO/ATC’s and act as DIACAP Subject Matter Expert providing a range of support from identification of system requirements to recommending the decommissioning of an Automated Information Systems (AIS). The onsite contractor shall support the Information Assurance Office (AETC/A6OK, AU/A4/A6) with all taskings created by the DIACAP process in order to maintain a central solution focus point. The Onsite Contractor shall provide a weekly status update to HQ AU--HQ AETC/A6O and CO of all C&A projects in progress.

1.5.1.6 The Onsite contractor shall make updates in EITDR to support AETC Enterprise on a weekly basis e.g. uploading documentation to be assessed, providing dates of completion and filling the role as Information Assurance Manager assigned by EITDR and the QAP.

1.6 Annual Federal Information Security Management Act (FISMA) Validation Requirements and Sustainment.

1.6.1 As per SAF/XC and AETC/CV memo Air Force FY 2009 Federal Information

Security Management Act (FISMA) Reporting Guidance May 2009 the contractor will conduct annual FISMA security reviews. Directive References: Title 44

U.S.C. Sections 3541-3549, DoD Directive 8500.1, Information Assurance, DoDI

8510.01, DoD information Assurance Certification and Accreditation Process

(DIACAP) and AFI 33-210, Air Force Certification and Accreditation Program.

1.6.2 Contractor shall conduct Annual IA Control reviews IAW AFI 33-210 and DoDI

8500.2. Within 30 business days of the anniversary of the previous annual review of a system, the contractor shall validate a minimum of 33% percent of the IA controls for each program within the EITDR's system (Min. 35 - Max. 40 questions) as part of the release and support of C&A accredited process.

1.6.3 Contractor shall conduct annual security reviews IAW annual FISMA guidelines;

to include annual control testing, annual security review, and Contingency plan testing. Contractor will also review system POA&Ms and provide guidance to PMs to ensure current POA&Ms are sent to AF-CIO.

1.6.4 Contingency Plan testing shall be conducted by the government PM & contractor on an annual basis in conjunction with the security and IA control review. Contingency Plan testing will be done IAW the annual FISMA guidelines established by SAF/XC. Contractor will validate during the security and IA control review whether Contingency Plan testing was accomplished as required.

1.6.5 Upon completion of Annual IA Control review the contractor will provide documentation per FISMA guidance to HQ AETC/A6OK that shows all requirements have been met for contingency testing, annual security review and security control testing no later than 30 calendar days after anniversary date of previous review. HQ AETC/A6OK shall determine if the IA Control reviews are FISMA compliant.

1.7 Technical Analysis & Evaluation. The contractor shall provide technical security analysis and evaluation support. Security documentation and mission application security safeguards shall be provided to HQ AETC/A6OK or the PM, within a minimum of 10 calendar days to a maximum of 90 calendar days after award of each task order, to assess and evaluate implemented security products and solutions to ensure compliance IAW applicable Public Law, OSD, DoD, AF, MAJCOM and local security requirements related to the individual system C&A efforts (e.g. DoD Instruction 8500.2, Information Assurance (IA) Implementation (6 Feb 03, part E4.A3, Attachment 3 to enclosure 4; Federal Information Security Management Act (FISMA) (H.R. 2458-53); FISMA H.R. 2458-50, Contingency Testing under National Institute of Standards and Technology (NIST) Special Publication 800-34; Office of Management and Budget (OMB) Circular A-130; DoD Directive 3020-26, Defense Continuity Program (DCP) (8 Sep 04); and AFI 10-208, Continuity of Operations (COOP) Program. Compliance will also include recommendation and coordination of support memorandums, for example, service level agreements, under DIACAP, IT LEAN Reengineering and SISSU Process Guidebook.

1.8 Information Support Plan (ISP). An Information support plan shall be provided by the contractor at task order end as described in Chairman of the Joint Chiefs of Staff Instruction (CJCSI) 6212.01D, Interoperability and Supportability of Information Technology and National Security Systems, and DoDI 5000.2, Operation of the Defense Acquisition System (12 May 03). Clinger-Cohen Act (CCA) compliance assigned tasks shall also require an ISP, in accordance with Section 8084(c) of the Appropriations Act for FY 2004 (Public Law 108-87). Table E4.T1 in DoDI 5000.2, which specifies the ISP is required for meeting Global Information Grid (GIG) policies and architecture to include relevant standards. Further details are provided in DoDD 4630.05, Interoperability and Supportability of Information Technology (IT) and National Security Systems (NSS); DoDI 4630.8, Procedures for Interoperability and Supportability of Information Technology (IT) and National Security Systems (NSS); and associated parts of the Defense Acquisition Guidebook.

1.9 Annual Security Review. The contractor shall, provide documentation to the PM for the Annual Security review of an AETC AIS IAW FISMA requirements. This involves reviewing the AIS to ensure the baseline of the AIS has not changed since last ATO/ATC and no changes to the AIS have to be updated.

1.10 Contractor Responsibility. The contractor shall develop a DIACAP C&A package IAW IT Lean/SISSU Guide 5.0 to include 3 phases (Define Need; Design; and Build and Test). Completion of phases 1 through 3, and receipt of an ATO, will be determined based on guidance and/or instructions received by AFNIC that the phase has been completed and the next phase can begin.

1.10.1 Initial Version Review.

1.10.1.1 Contractor will complete initial questions, which determines the path for the DIACAP process. e.g. reaccreditation of the AIS.

1.10.1.2 Contractor/PM fills out Stakeholder list, a list of personnel and their roles in the certification and accreditation process.

1.10.1.3 Contractor/PM will complete the Ports, Protocols and Standards matrix which lists the necessary network connectivity to operate on the Air Force Network.

1.10.1.4 The Contractor and/or PM will complete the Urgent Interim Approval Request (UIAR) consisting of the PM Memo, Information Assurance Officer (IAO) memo, Mission Impact Memorandum, Executive Risk Summary Ports, Protocols and Services Worksheet, and Architectural drawings, if required. Package is required if system is expiring and a new Interim Approval to Operate (IATO) is needed. Sample package can be provided by AETC/A6OK upon request.

1.10.2. Phase I: Define Need

1.10.2.1. PM will provide Security questions from the SISSU checklist located on EITDR to be answered within 7 calendar days from award of task order and forwarded to the reviewer as identified on SISSU Stakeholder list.

1.10.2.2 Validation and approval of security questions IAW IT Lean Guidebook 5 shall be obtained by the contractor from AFNIC. If the security questions are not validated by AFNIC within 10 business days the contractor will notify the PM.

1.10.2.3 Upon approval from AFNIC the contractor is authorized to begin answering IA Controls questions under Design phase. PM will validate/approve remaining SISSU questions IAW IT Lean Guidebook 5.

1.10.2.4. The Contractor shall draft and deliver the architectural framework views identified in Table 1.2 prior to the receipt of an ATO.

Table 1.2 Architectural Framework Views

1.10.3 Phase II: Design Phase

1.10.3.1. The contractor shall review IA controls based on sensitivity level and Mission Assurance Category (MAC) IAW with IT Lean Guidebook 5. AFNIC will validate and approve the IA Controls. IA Controls invalidated by AFNIC will be worked with the PM to provide a resolution. All Security questions (IA Controls) in the Design Phase must be validated by AFNIC before moving to the Build and Test Phase. If the security questions are not validated by AFNIC within 10 business days the contractor will notify the PM.

1.10.4 Phase III: Build and Test Phase

1.10.4.1 Build and Test phase requires testing to ensure network worthiness IAW the DIACAP process.

1.10.4.2 PM will validate/approve the remaining SISSU questions IAW IT Lean Guidebook 5.

1.10.4.3 AFNIC will validate/approve security questions for the build and test system design checklist before continuation of the security approval process. If all security questions in the design and build phase are not validated by AFNIC within 10 business days the contractor will notify the PM in writing

1.10.4.4 The contractor shall obtain a Final Approval to Operate/Connect from

AFSPACE/A6 (DAA).

1.10.5 Reciept of ATO

1.10.5.1 The contractor shall provide a DIACAP scorecard to PM prior to the issuance of an Approval to Connect.

1.10.5.2 The contractor shall ensure the POA&M is updated to identify vulnerabilities that may prevent an award of an ATO.

1.10.6 Sustainment and Release/Support, after the receipt of an ATO, shall be accomplished by the government.

1.11 Required Training Courses & Completion Certificates. IA/IT Training: In the event of new technology in hardware or software implementation directed by the government, AETC will not be responsible for IT training of contractor employees. The training times and dates shall be coordinated with the QAP or the CO before being scheduled.

2.0 SERVICES SUMMARY

3.0 GENERAL INFORMATION

3.1 DELIVERABLES & OTHER REPORTING REQUIREMENTS.

3.1.1 The contractor shall provide meeting minutes for any technical interchange meetings between government PM, AETC/A6OK, and contractor. Meeting minutes shall be forwarded to AETC/A6OK within 5 business days after meeting has occurred.

3.1.2 Complete DIACAP artifacts and documents using tools compatible with current version of Microsoft Office, in DIACAP format to upload into EITDR system for AFNIC validation and AFSPACE A6 (DAA) approval. The contractor is expected to provide the first draft of all control artifacts under Phase 1, 2, and 3. Delivery and format of the first drafts shall be coordinated with the PM and QAP.

3.1.3 Complete Information Support Plan (ISP) IAW authorized DIACAP format.

3.1.4 Develop Status Updates and Reports within 10 business days of Notice to Proceed. The Contractor shall develop an abbreviated work plan to be presented and approved by the Program Manager. The work plan shall be updated, as required IAW PM Instructions. Contractor shall provide a contractor’s progress, status and management report (CPSMR) to HQ AETC/A6OK by the 20th of each month. The CPSMR shall be used to review and evaluate overall progress of the project identifying existing or potential problem areas. The CPSMR shall include a summary of events that occurred during the reporting period, discussion of performance, identification of problems, proposed solutions, corrective actions taken, and outstanding issues.

3.2 REQUIRED SKILLS/EXPERTISE.

3.2.1 Personnel providing support for this requirement shall maintain the appropriate knowledge, skill level, and experience necessary to perform all C&A tasks. Contractor personnel will have extensive knowledge of Office of Secretary of Defense (OSD), Department of Defense (DOD), and Air Force computer security directives and activities necessary to perform assigned C&A tasks. Minimum required experience is listed below:

3.2.2 Information Assurance (IA) Management Level II positions (DoD Directive 8570.1-M) require at a minimum one of the following certifications or one from a higher Management level: Information Security Certificate (ISC) 2 Certified Information Systems Security Professional (CISSP), and/or Certified Information Security Manager (CISM). Technical Level II (IAT Level II) certifications (e.g., Security+) or equivalent certification/experience. The on-site personnel shall be IA Management Level II positions, while the off-site personnel assigned to work on the individual task orders can be a combination of IA Management Level I and II positions.

3.2.3 Information Assurance Contractor Training and Certification. The Contractor shall ensure that personnel accessing information systems have the proper and current information assurance certification to perform information assurance functions in accordance with DoD 8570.01–M, Information Assurance Workforce Improvement Program. The Contractor shall meet the applicable information assurance certification requirements, including:

· DoD approved information assurance workforce certifications appropriate for each category and level as listed in the current version of DoD 8570.01–M

3.2.4 The Contractor shall provide documentation supporting the information assurance certification status of personnel performing information assurance functions. Contractor personnel who do not have proper and current certifications shall be denied access to DoD information systems for the purpose of performing information assurance functions.

3.2.5 Personnel shall have at least 2-5 years information systems security experience.

3.2.6 Contractor personnel shall have working knowledge of the C&A process as defined in the DIACAP, EITDR handbook and Air Force implementation guidance and have the requisite skill sets needed to produce required DIACAP documentation.

3.2.7 Contractor Employees. The contractor shall not employ persons for work on this contract if the employee is identified, by the Government, to be a potential threat to the health, safety, security, general well-being, or operational mission of the installation and its population. Turnover in these positions requires submission of the names and dates of departure of personnel vacating the position within five (5) business days after the contractor has been notified by the employee of their impending departure to the QAP. The name(s) of personnel hired to fill the position shall be provided to the QAP within five (5) business days after replacement hiring action has been completed. Prior to the start of the contract, the contractor shall provide employee name(s) or individual(s) that have the authority to act on behalf of the contractor in all contractual matters relating to daily operations.

3.3 INSTRUCTIONAL DOCUMENTS & BOUNDARY SCHEMATICS.

3.3.1 Each task order will contain a detailed Performance Work Statement (PWS) Addendum for the required service; however, the task order does not amend, modify, or change any of the requirements of this Performance Work Statement (PWS) or the basic contract. In case of conflict between the terms of the task order and the basic contract, the terms of the contract shall take precedence. In the case of conflict between the Addendum and PWS, the PWS shall take precedence.

3.3.2 Drawings will be attached to each Addendum for each project that needs to be evaluated by the contractor and the QAP. This will be done prior to award of task for each project in order to determine network boundaries for each network.

3.4 PLACE OF PERFORMANCE/HOURS OF OPERATION

3.4.1 The Contractor will perform at various AETC facilities (all 12 AETC locations) as identified in each task order and Contractor facilities. Onsite contractor support shall be provided at Randolph AFB, TX and possibly at Maxwell AFB, AL.

3.4.2 Hours of Operations are 0730-1630, Monday through Friday. The onsite contractor shall provide coverage during the hours of 0730-1630, Monday through Friday. Extended or compressed schedules that are mutually beneficial shall be negotiated through the CO. Government furnished resources shall be available during the same hours. If flextime or a compressed work schedule is in effect, contractor work hours shall correspond with government personnel duty hours.

3.4.3 Holidays. AETC observes all federal holidays. Down days declared by the Commander are considered duty days and are not included in the definition of a holiday. Commander declared days off are considered work days and are not included in the definition of a holiday.

4.0 TRAVEL

4.1 On-Site contractor personnel may be required to travel in performance of assigned functions consistent with the scope of this PWS. In performance of services under CLIN 0001, the onsite contractor may be required to travel for the purpose of gathering network/security information, or facilitating the completion of a C&A package or provide training. When travel is required, the QA personnel will submit a request to the Contracting Officer and the Chief QA identifying the purpose, location, dates, and personnel (name and title) needed for the travel. Upon approval by the Contracting Officer, the request will be forwarded to the contractor’s Contract Manager requesting an estimate of travel costs. Costs in excess of maximum per diem rates or the lowest customary standard, coach or equivalent airfare must include written justification for use of the higher amounts approved by an officer of the contractor’s organization and are subject to advance approval by the contracting officer. After review of the estimated costs and verification of funds availability, the Contracting Officer will notify the QA personnel, the Chief QA, and the contractor’s Contract Manager that the travel has been approved. After completion of travel, the contractor shall submit an invoice via WAWF with a detailed breakdown of reimbursable travel costs incurred and receipts for all expenses of $75.00 or more. Invoices containing travel costs in excess of the approved amount must be reviewed by the Contracting Officer prior to approval by the Chief QA. All Travel shall be conducted in accordance with FAR 31.205-46 and Joint Travel Regulations Vol. II, Appendix E, Part III. Travel conducted that does not follow the above procedures and regulations will not be reimbursable to the contractor.

4.2 In performance of services under CLINs 0002 & 0003, contractor personnel may be required to travel in performance of assigned functions consistent with the scope of this PWS and as specified in the individual task order. The contractor shall coordinate travel schedules with the chief QA and government PMs specified in the individual task orders at a minimum of 14 calendar days prior to traveling, or as soon as possible when 14 calendar days advance notification cannot be given by the Government.

5.0 SECURITY.

5.1 Visitor Group Security Agreement (VGSA). The contractor shall enter into a long-term visitor group security agreement if service performance is on base. This agreement shall outline how the contractor integrates security requirements for service operations with the Air Force to ensure effective and economical operation on the installation. The agreement shall include:

a. Security support provided by the Air Force to the contractor shall include storage containers for classified information/material, use of base destruction facilities, classified reproduction facilities, use of base classified mail services, security badging, base visitor control, investigation of security incidents, base traffic regulations and the use of security forms and conducting inspections required by DoD 5220.22-R, Industrial Security Regulation, Air Force Policy Directive 31-6, Industrial Security, and Air Force Instruction 31-601, Industrial Security Program Management.

b. Security support requiring joint Air Force and contractor coordination includes packaging classified information, mailing and receiving classified materials, implementing emergency procedures for protection of classified information, security checks and internal security controls for protection of classified material and high-value pilferable property.

c. On base, the long-term visitor group security agreement may take the place of a Standard Practice Procedure (SPP).

5.2 Obtaining and Retrieving Identification Media. As prescribed by the AFFAR 5352.242-9000, Contractor access to Air Force installations, the contractor shall comply with the following requirements:

a. The contractor shall obtain base identification and vehicle passes for all contractor personnel who make frequent visits to or perform work on the Air Force installation(s) cited in the contract. Contractor personnel are required to wear or prominently display installation identification badges or contractor-furnished identification badges while visiting or performing work on the installation.

b. The contractor shall submit a written request on company letterhead to the Contracting Officer listing the following: contract number, location of work site, start and stop dates, and names of contractor employees needing access to the base. The letter will also specify the contractor individual(s) authorized to sign a request for base identification credentials or vehicle passes. The Contracting Officer will endorse the request and forward it to the issuing base pass and registration office or security forces for processing. When reporting to the registration office, contractor individual(s) shall provide a valid driver's license, current vehicle registration, and valid vehicle insurance certificate to obtain a vehicle pass.

c. During performance of the service, the contractor shall be responsible for obtaining required identification for newly assigned personnel and for prompt return of credentials and vehicle passes for any employee who no longer requires access to the work site.

d. Upon completion or termination of the service or expiration of the identification passes, the contractor shall ensure that all base identification passes issued to contractor employees are returned to the issuing office.

e. Failure to comply with these requirements may result in withholding of final payment.

5.3 Security Clearance Requirements. The minimum level of security clearance required under this PWS is Secret. A Secret security clearance is required for EITDR and/or network access for individuals providing direct support under this PWS. The contractor must possess or obtain an appropriate facility security clearance (Secret) prior to performing work on a classified government contract. If the contractor does not possess a facility clearance the government will request one. The government assumes costs and conducts security investigations for Secret and Confidential security clearances. The contractor shall request security clearances for personnel requiring access to classified information within 15 calendar days after receiving a facility clearance or, if the contractor is already cleared, within 15 calendar days after contract award. Due to costs involved with security investigations, requests for contractor security clearances shall be kept to an absolute minimum necessary to perform service requirements. The contractor shall notify the Information Security Program Manager (ISPM) at each operating location 30 calendar days before on-base performance of the service. The notification shall include:

a. Name, address, and telephone number of company representatives.

b. The contract number and contracting agency.

c. The highest level of classified information which contractor employees require access to.

d. The location(s) of service performance and future performance, if known.

e. The date service performance begins.

f. Any change to information previously provided under this paragraph.

5.4 Suitability Investigations. Contractor personnel without security clearances shall successfully complete, as a minimum, a National Agency Check with Inquiries (NACI), for accessing government installations in excess of six months, and/or operating government furnished workstations that have access to Air Force e-mail systems. These investigations shall be submitted by the government at no additional cost to the contractor. The contractor shall comply with the DoD 5200.2-R, Personnel Security Program, AFI 33-204, Information Assurance (IA) Awareness Program, and AFI 33-202, Computer Security, requirements.

5.5 Personnel Security. Contractor personnel requiring unescorted entry to controlled or restricted areas designated by the installation commander shall comply with base access requirements. These requirements are contained in AFI 31-101, for installation access and AFI 31-501, for suitability determinations.

5.6 Unescorted Entry to Restricted Areas. When contractor employees require unescorted entry to restricted areas, the Air Force shall submit NACI investigations for contractor employees at no additional cost to the contractor. Contractor personnel shall be the subject of a favorably completed NACI investigation to qualify for unescorted entry to a restricted area. The contractor shall comply with DoD 5200.2-R, and AFI 31-501, Personnel Security Program Management, requirements.

5.7 Pass and Identification Items. The contractor shall ensure the following pass and identification items required for service performance are obtained for employees and non-government owned vehicles:

a. AETC Form 58, Civilian Identification Card (AETCI 36-3001).

b. AF Form 75, Visitor/Vehicle Pass (AFI 31-204).

c. DoD Common Access Card (CAC), (AFI 36-3026).

5.8 Retrieving Identification Media. The contractor shall retrieve all identification media, including vehicle decals, from employees who depart for any reason before the contract expires; e.g., terminated for cause, retirement.

5.9 Listing of Employees. The contractor shall maintain a current listing of employees. The list shall include employee's name, social security number, and level of security clearance. The list shall be validated and signed by the company Facility Security Officer (FSO) and provided to the Contracting Officer and ISPM prior to the service start date. Updated listings shall be provided within 5 business days when an employee's status or information changes. A Visit Request for all employees with security clearances is required to be sent through the Joint Personnel Adjudication System (JPAS).

5.10 Security Monitor Appointment. The contractor shall appoint a security representative for the on base long term visitor group. The security representative may be a full-time position or an additional duty position. The security representative shall work with the host organization to provide employees with training required by DoD 5200.1-R, Information Security Program Regulation, Chapter 10, AFPD 31-4, Information Security, and AFI 31-401, Information Security Program Management. The contractor shall provide initial and follow-on training to contractor personnel who work in Air Force controlled/restricted areas. Air Force restricted and controlled areas are explained in AFI 31-101, The Air Force Installation Security Program.

5.11 Additional Security Requirements. In accordance with DoD 5200.1-R and AFI 31-401, the contractor shall comply with AFI 33-202, Computer Security; AFI 33-203, Emission Security (EMSEC) Program; AFI 33-204, Information Protection Security Awareness, Training, and Education (SATE) Program; applicable AFKAGs, AFIs, and AFSSIs for Communications Security (COMSEC); and AFI 10-107, Operations Security (OPSEC). The contractor will comply with DOD Standard 22 – Level 1 AT Awareness training and associated tasking IAW AFI 10-245, Antiterrorism Program standards.

5.12 Freedom Of Information Act Program (FOIA). The contractor shall comply with DoD Regulation 5400.7-R/Air Force Supplement, DoD Freedom Of Information Act Program, requirements. The regulation sets policy and procedures for the disclosure of records to the public and for marking, handling, transmitting, and safeguarding For Official Use Only (FOUO) material. The contractor shall comply with AFI 33-332, Air Force Privacy Act Program, when collecting and maintaining information protected by the Privacy Act of 1974 authorized by Title 10, United States Code, Section 8013. The contractor shall remove or destroy official records only in accordance with AFMAN 33-363, Management Of Records, or other directives authorized in AFI 33-322, Records Management Program.

5.13 Reporting Requirements. The contractor shall comply with AFI 71-101, Volume-1, Criminal Investigations, and Volume-2 Protective Service Matters, requirements. Contractor personnel shall report to an appropriate authority any information or circumstances of which they are aware may pose a threat to the security of DoD personnel, contractor personnel, resources, and classified or unclassified defense information. Contractor employees shall be briefed by their immediate supervisor upon initial on-base assignment and as required thereafter.

5.14 Physical Security. Areas controlled by contractor employees shall comply with base Operations Plans/instructions for FPCON procedures, Random Antiterrorism Measures (RAMS) and local search/identification requirements. The contractor shall safeguard all government property including controlled forms provided for contractor use. At the close of each work period, government training equipment, ground aerospace vehicles, facilities, support equipment, and other valuable materials shall be secured.

5.15 Operating Instructions. The contractor shall develop an Operating Instruction (OI) for internal circulation control, protection of resources and to regulate entry into Air Force controlled areas during normal, simulated and actual emergency operations. The OI shall be written in accordance with AFI 31-101, the local base Operations Plan usually referred to as an OPLAN and AFI 10-245, Air Force Antiterrorism (AT) Standards, and coordinated through the ISPM.

5.16 Controlled/Restricted Areas. The contractor shall implement local base procedures for entry to Air Force controlled/restricted areas where contractor personnel will work.

5.17 Entry Procedures For Controlled Areas. For on-base cleared facilities over sighted by the base ISPM, contractors shall comply with the National Industrial Security Program Operating Manual (NISPOM), previously referred to as the Industrial Security Manual (ISM), to implement controlled area requirements. The ISPM shall approve the establishment, construction, and modification of all contractor designated controlled areas before they may be used to limit access. The contractor shall comply and implement local base procedures for entry to Air Force controlled and restricted areas.

5.18 Key Control. The contractor shall establish and implement key control procedures in the Quality Control Plan to ensure keys issued to the contractor by the government are properly safeguarded and not used by unauthorized personnel. The contractor shall not duplicate keys issued by the government.

5.19 Lost Keys. Lost keys shall be reported immediately to the Contracting Officer. The government replaces lost keys or performs re-keying. The total cost of lost keys, re-keying or lock replacement shall be deducted from the monthly payment due to the contractor.

5.20 Government Authorization. The contractor shall ensure its employees do not allow government issued keys to be used by personnel other than current authorized contractor employees. Contractor employees shall not use keys to open work areas for personnel other than contractor employees engaged in performance of duties, unless authorized by the government functional area chief.

5.21 Lock Combinations. The contractor shall establish procedures in local OIs ensuring lock combinations are not revealed to unauthorized persons and ensure the procedures are implemented. The contractor is not authorized to record lock combinations without written approval by the government functional area chief. Records with written combinations to authorized secure storage containers or Secure Storage Rooms (SSR), shall be marked and safeguarded at the highest classification level as the classified material maintained inside the approved containers. The contractor shall comply with DoD 5200.1-R security requirements for changing combinations to storage containers used to maintain classified materials.

5.22 Traffic Laws. The contractor and their employees shall comply with base traffic regulations.

5.23 Healthcare. Healthcare provided at the local military treatment facility on an emergency reimbursable basis only.

5.24 Mandatory compliance with the provisions for control of classified documentation as outlined on the DD Form 254, “DoDCSCS”. The contractor may be exposed to information covered under the Privacy Act of 1974, and, if so, shall comply with all applicable safeguarding and handling requirements associated with PRIVACY ACT DATA. The contractor shall be familiar and comply with Government Communication-Computer Security policies and instruction/guidelines per AFI 33-119 “Air Force Messaging”, AFI 33-129 “Web Management and Internet Use”, AFI 33-202V1 “Network and Computer Security”, AFSSI 5102 AETC Sup 1 “Computer Security for Operational Systems”, AFMAN 33-223 “Identification and Authentication”, Industrial Security Program Management”, AFI 33-2 “Information Protection”, DOD 5220.22 “National Industrial Security Program”, and others as applicable.

5.25 The Contractor shall comply with regulations listed below to include applicable changes, revisions, and replacements thereto.

AFI 31-401 – Information Security Program Management

AFI 31-501 – Personal Security Program Management

AFI 33-202 V.1 – Network and Computer Security

AFI 33-211 – Communications Security (COMSEC) User Requirements

AFI 33-204 – Information Assurance Awareness Program (Software Licensing and Information Assurance Awareness training)

DOD 5200.1R Appendix 3 – Controlled Unclassified Information

5.26 The above procedures apply to computer security issues for DIACAP, SISSU and EITDR related IA Support. All classified materials must be under the control of authorized government personnel at all times. When classified materials are not in use, they must be stored in a security container or controlled area with open storage classification given by the 902nd Security Forces. Classified material shall only be produced and used on a classified system.

5.27 Support: The AETC Information Assurance Officer shall be supported by the contractor by providing the necessary experience and expertise that captures security architecture for assigned networks; develops security policy; recommends countermeasures to resolve or mitigate security issues using DoD and AF IA Controls; recommends security solutions; and completes all DIACAP C&A activities. Contractor personnel must obtain basic EITDR account-training IAW the EITDR Training Manual. Task orders will be accomplished via coordination with respective system owners, developer’s, Program Manager’s, Information Assurance Officer’s, and Security Manager’s.

5.28 System security solutions will be verified and coordinated by quality assurance personnel (QAP) and contractor personnel to ensure solutions do not conflict with application operation. New security risks shall be well documented using approved standard DIACAP methodologies. Documentation of deliverables will support an informed AFSPACE A6 (DAA) accreditation decision from HQ AFNIC/EV. Appropriate references and recommended solutions for any security problem resolution will be provided by the contractor. Contractor personnel shall be given producer role responsibilities and abilities within the EITDR’s system allowing them to input required Security (SISSU) checklist documentation into EITDR’s database.

6.0 GOVERNMENT FURNISHED ITEMS. The Government will provide the following assets to On-site contractor support staff, assets are provided for official use only:

6.1 Office space, meeting rooms, visual display equipment and computers.

6.2 Local area network to include electronic mail and Internet access.

6.3 DIACAP documents, to include existing drafts or approved Security Testing and Evaluations, Risk Assessments, Interim Certificate to Operate, Certificate to Operate and Certificate of Net worthiness or Approval to Connect documentation will also be provided by the government. This information will be used for general reference and provided by the PM.

6.4 Access will be provided to facilities, equipment, and technical information necessary to perform Phases 1 through 3 of the DIACAP process: Access will be provided to appropriate software, hardware, and databases to perform C&A activities. All provided products and facilities remain Government property and will be returned upon completion of this contract. All documented processes and procedures developed under this PWS become government property. Modification and distribution of completed (DIACAP) products may be utilized at other installations at the discretion of the Government.

7.0 ORGANIZATIONAL CONFLICT OF INTEREST

7.1 In accordance with FAR 9.505 to prevent conflicting roles that may bias the Contractor’s judgment or objectivity, or to preclude the Contractor from obtaining an unfair competitive advantage in concurrent or future acquisitions, the Contractor will be restricted as follows:

1. If the Contractor prepares, or assists in preparing, a work statement to be used in competitively acquiring a system or services – or provides material leading directly, predictably, and without delay to such a work statement – the Contractor may not supply the system, major components of the system, or the services unless (a) it is the sole source, (b) has participated in the development and design work or (c) more than one contractor has been involved in preparing the work statement. To overcome the possibility of bias, the Contractor is prohibited from supplying a system or services acquired on the basis of work statements growing out of its services, unless excepted as stated above.

2. The Contractor may gain access to proprietary information of other companies during contract performance. The Contractor agrees to enter into company-to-company agreements to (a) protect another company’s information from unauthorized use or disclosure for as long as it is considered proprietary by the other company and (b) refrain from using the information for any purpose other than that for which it is furnished. The Contractor also agrees to have its employees who will obtain access to proprietary information of other companies while performing on this contract sign nondisclosure agreements agreeing to (a) protect another company’s information from unauthorized use or disclosure for as long as it is considered proprietary by the other company and (b) refrain from using the information for any purpose other than that for which it is furnished. For information purposes, the Contractor shall furnish copies of the company-to-company agreements to the Contracting Officer and shall make the individual employee nondisclosure agreements available for the Contracting Officer’s review upon request. These agreements are not intended to protect information which is available to the Government or to the Contractor from other sources and furnished voluntarily without restriction.

7.2 The above restrictions shall be included in all subcontracts, teaming arrangements, and other agreements calling for performance of work related to this contract, unless excused in writing by the Contracting Officer.

7.3 The above prohibitions do not apply to developmental work, even if the…