Draft PWS-11-R-0018.pdf

FA3047-11-R-0018

Performance Work Statement

Pa ge 1 o f 4 2

PERFORMANCE WORK STATEMENT

FOR

THE AIR FORCE CENTER FOR ENGINEERING AND THE ENVIRONMENT (AFCEE)

INFORMATION TECHNOLOGY (IT) SUPPORT

AND

MANAGEMENT EXECUTION AND TRACKING SYSTEM (MXT) HELP DESK SUPPORT

AND

SHAREPOINT SUPPORT

27 June 2011

Pa ge 2 o f 4 2

PERFORMANCE WORK STATEMENT

FOR THE

AIR FORCE CENTER FOR ENGINEERING AND THE ENVIRONMENT (AFCEE)

INFORMATION TECHNOLOGY (IT) SUPPORT

TABLE OF CONTENTS

SECTION TITLE PAGE

1 DESCRIPTION OF SERVICES 4

2 SERVICE SUMMARY 20

3 GENERAL INFORMATION 22

3.1 SCOPE OF WORK EFFORT 22

3.2 SECURITY REQUIREMENTS 23

3.3 GOVERNMENT FURNISHED PROPERTY AND SERVICES 23

4 REPORTS 24

5 PERSONNEL CERTIFICATIONS AND QUALIFICATIONS 25

6 APPENDICES 35

APPENDIX A - DEFINITIONS and ACRONYMS 35

APPENDIX B - COMMERCIAL PRODUCT INFORMATION 38

APPENDIX C - APPLICABLE DOCUMENTS and REFERENCES 39

(TECHNICAL EXHIBITS)

TE-A DELINEATION OF REQUIRED DATA ITEMS (Exhibit A) 40

TE-B DELINEATION OF REQUIRED DATA ITEMS (Exhibit B) 40

Pa ge 3 o f 4 2

SECTION 1

DESCRIPTION OF SERVICES

1.0. DESCRIPTION OF SERVICES/GENERAL INFORMATION. The Contractor shall supply all personnel, services, and technical and management support required to perform the non-personal services described in this PWS. The Air Force Center for Engineering and the Environment (AFCEE) is an Air

Force Field Operating Agency (FOA) that is currently a tenant at Port San Antonio TX. As an Air

Force activity, regulations of the US Government, Department of Defense, US Air Force, the host Major

Command, and the host installation all apply. This includes all applicable security regulations, which means for example that personnel are subject to search at all times and without warning and that access is controlled to all Air Force buildings with proper identification and authorization being required for access.

AFCEE’s mission is to provide integrated engineering and environmental products, services, and advocacy that optimize Air Force and Joint capabilities through sustainable installations. AFCEE is responsible for management of the Environmental Restoration, Military Construction (MILCON) and

Housing MILCON programs for the Air Force. AFCEE executes and manages environmental and construction, environmental operations and services and provides architect and engineering support for installations, Major Commands, Headquarters Air Force and others. AFCEE also provides technical expertise and advocacy across a spectrum of construction and environmental programs.

AFCEE is the primary nexus for managing the performance of the Air Force environmental mission and thus considerable IT support is required. The majority of AFCEE personnel are located in Building 171, Port San Antonio, TX with personnel currently employed in regional offices (RO) located in Atlanta, Dallas, and San Francisco with satellite locations on Cape Cod, MA and personnel working on site at various Air Force installations world-wide. When referring to ―off site‖ within this contract the reference will be to the three RO’s and the satellite location at Cape Cod, MA often referred to the Massachusetts

Military Reservation (MMR). AFCEE provides IT support to approximately 800 Government personnel and contractors in these locations. The Computer Systems Section (AFCEE/OSP) is responsible for this support. Under the auspices of the Contracting Officer (CO) and the Contracting Officer Representative

(COR), this contract will provide IT Services in this support with the pricing arrangement of a Firm

Fixed Price (FFP) Contract or Task Order.

1.1 TECHNICAL REQUIREMENTS. For the purpose of this services contract, unless otherwise stated, it is assumed that any lower level of service can be accomplished by the higher level of service. Example Level I system administration services can be accomplished by Level II system administration services in conjunction with the Level II stipulated services. Same would apply to a Level III stipulated service. The nature of the support specified under this contract consists primarily of:

Administration, operation, and maintenance of AFCEE functional servers, systems, and multiuser computer systems and their associated peripheral devices, thereby ensuring their availability and reliability to support the organization’s personnel and mission.

1.1.2 Administration and maintenance of AFCEE databases that reside on AFCEE functional servers, systems, and multiuser computer systems, thereby ensuring that these databases remain available and reliable in support of the organization’s personnel and mission.

Pa ge 4 o f 4 2

1.1.3 Administration, operation, and maintenance of AFCEE desktop and personal computers (PCs) including laptops and docking stations, thereby ensuring that they are functional and available to support the organization’s personnel and mission.

1.1.4 IT customer support to Government personnel and contractors performing Air Force environmental work for AFCEE, taking calls and opening trouble tickets for problems with PCs, functional servers, systems and multiuser computer systems, peripheral devices, and for connectivity to resources outside AFCEE.

1.1.5 Telecommunications support for video teleconferencing, Personal Digital Assistant (PDA) and

Air Cards support thereby ensuring that the organization’s personnel can communicate as required to support the AFCEE mission.

1.1.6 Information Security (INFOSEC) support, guidance, implementation assistance & user training to ensure that AFCEE remains in compliance with all applicable laws, policies, and regulations.

1.1.7 Inventory management support to the AFCEE Equipment Control Officer (ECO) in keeping a current and accurate inventory of AFCEE Automated Data Processing Equipment (ADPE) assets in the Air Force mandatory inventory tracking system and to support Equipment Custodians

(ECs) throughout the organization with their EC duties.

1.1.8 Programming support to (1) maintain, update, and add functionality to the AFCEE website in order that this resource can provide maximum support to the AFCEE mission and (2) develop when approved as an Information Technology (IT) investment, deploy, maintain, and update application programs as required to satisfy mission requirements.

1.1.9 AFCEE Designed Functional Software Training Support to provide training to both Government and AFCEE contractors on the use, maintenance and support of AFCEE designed functional applications.

1.1.10 Support for the Environmental Resources Program Information Management (ERPIMS) System to include:

Process, enter, and perform Quality Control for all data loading processes for the ERPIMS database.

Provide ERPIMS Customer Service support to AFCEE Government personnel and contractors performing Air Force environmental taskings. This includes ERPIMS Information Request

Support.

Provide support to the Government in designing, testing, and developing documentation for

ERPIMS, support system software (including GIS systems), and related applications.

Provide support to the Government with training the users and customers of ERPIMS and its related systems, applications (including GISs) software.

1.1.11 A thorough understanding of the AF Global Information Grid and AFNet Ops Domain

Implementation Plan and support structure is a must to facilitate the continuous support requests for any

AFCEE system operating at Lackland AFB.

Pa ge 5 o f 4 2

1.2 Program Manager (PM) Services. The PM shall be the primary point-of-contact for overall contractual issues. The contractor shall provide the name of the project manager to the contracting officer no later than 10 days after contract award. He/she shall be responsible for ensuring that practical and effective processes are developed to meet the objectives of this contract. .

1.3 IT Support Work Leader Services. The IT Support Work Leader is responsible for the technical and management direction over multi-disciplined, technical and scientifically oriented teams supporting this contract or TO. He/she is responsible for serving as the Contractor’s liaison with the Air Force primarily via the COR. Work Leaders will also interact with Quality Assurance Personnel (QAP), and functional area personnel as necessary. The Contractor must identify the Work Leader in writing within ten days of contract award.

1.4 System and Network Administration and Engineering Services. The Contractor shall provide operations support for all AFCEE multiuser systems in the 802CS computer room including Microsoft

Windows and SUN Solaris-based systems. The Contractor shall comply with established AFCEE plans and schedules for backup and recovery and maintenance and shall also coordinate with the Government to schedule any out-of-cycle system and database backups, rotation of backup data to the off-site security location, and downtime related to anticipated hardware and/or software upgrades. The

Contractor shall provide computer support to maintain and improve functional capabilities of functional servers, systems and all multi-user computer systems that assist in accomplishment of the AFCEE mission. This support shall apply equally to any new computer systems, whether purchased to replace existing systems or to provide new or improved functionality to the organization. These functional servers and systems will generally reside at the 802d Communications Squadron (CS), building 1050, located on Lackland AFB TX. The Contractor will assist Air Force personnel in general oversight of the AFCEE functional servers and systems will report and document any security incidents to AFCEE

INFOSEC personnel. Any required reports will be determined at the TO level. (TE-A) The Contractor shall provide support to maintain and improve functional capabilities of the network that support

AFCEE remote locations. The Contractor shall provide support in maintaining the network infrastructure at remote AFCEE sites and shall report and document any security incidents to AFCEE

INFOSEC personnel. Any required reports will be determined at the TO level.

1.4.1 Systems Administration (SysAdmin) Services. The Contractor shall provide computer support to maintain and improve functional capabilities of functional servers, systems and all multi-user computer systems that assist in accomplishment of the AFCEE mission. This support shall apply equally to any new computer systems, whether purchased to replace existing systems or to provide new or improved functionality to the organization. These functional servers and systems will generally reside at the 802d Communications Squadron (CS), building 1050, located on Lackland AFB TX. The

Contractor shall provide oversight of Air Force personnel in general oversight of the AFCEE functional servers and systems will report and document any security incidents to AFCEE INFOSEC personnel.

Any required reports will be determined at the TO level. (TE-A)

1.4.1.1 Level I System Administration (SA) Services. The Contractor shall provide operation services, monitoring, and tuning of all AFCEE functional multiuser systems in the 802 CS computer room including

Microsoft Windows and SUN Solaris-based systems. The Contractor shall analyze hardware and software problems and provide potential solutions to these functional systems. This support also includes providing technical assistance to the programming staff, helping to automate currently existing manual processes and

Pa ge 6 o f 4 2 updating the various AFCEE functional systems and applications at both on and off site locations with the off site locations being our three RO’s (Atlanta, Dallas and San Francisco) and MMR (Cape Cod MA). SA support services shall include the following:

Creating and deleting user accounts on the functional systems as well as implementing and overseeing system security

When a Time Compliance Network Order (TCNO) is not pushed by the Government to the AFCEE functional servers and systems, this will be accomplished manually by the Contractor.

Designing and configuring functional servers (reconfiguring as necessary) to optimize connectivity and efficiency

Applying patches and upgrades to the functional systems to ensure system security and enhance/improve system functionality

Managing user accounts for functional systems at both local and off site (RO’s and MMR) locations including data entry, and network interfaces

Installing and upgrading new and replacement systems, hardware, software, and operating systems

Defining network requirements, parameters, interface configuration, and regulatory compliance

Any required reports will be determined at the TO level. (TE-A)

1.4.1.2 Level II System Administration Services. The Contractor shall provide operations support for all

AFCEE multiuser systems in the 802CS computer room including Microsoft Windows and SUN Solaris-based systems. The Contractor shall comply with established AFCEE plans and schedules for backup and recovery and maintenance and shall also coordinate with the Government to schedule any out-of-cycle system and database backups, rotation of backup data to the off-site security location, and downtime related to anticipated hardware and/or software upgrades. SA services shall include the following:

Prepare equipment for operation including power-on/off, start-up/shut-down, and maintenance

Perform backup and recovery in accordance with the operational procedures specified by AFCEE

Backup library must contain at a minimum month end, previous week’s end, and good backups for each of the past three days

Operate printers, tape drives, and tape cleaner/evaluators and monitor effectiveness by spot checks

Monitor AFCEE functional server performance, patch/upgrade lists, and regulatory compliance on a daily basis

Identify system failures and equipment problems and take appropriate action within predetermined time frames in accordance with operational instructions and/or equipment operating manuals

Clean and maintain computer equipment and peripherals in order to support efficient operations.

1.4.2 Reserved

1.4.2.1 Reserved

1.4.2.2 Reserved

1.4.3 Network Engineering (NE) Services. NE services include planning and technical advice and assistance to support network resources and connectivity and maintain fully functional mission support

Pa ge 7 o f 4 2 capabilities to include all network devices, interfaces, and component parts. The Contractor shall provide engineering expertise for maintaining and troubleshooting the network along with NetAdmin services as required and oversee the work of any contractor NA personnel and provide planning and technical support to management as required. The Contractor shall also provide NE and management services including: network analysis, feasibility studies, program configuration analysis, network hardware/software analysis, network utilization studies, performance evaluations, design studies, and

Air Force directory support. Other services include:

Monitor operation and configuration of routers/switches for remote AFCEE locations on the network

Support AFCEE personnel with special projects whether at the AFCEE building or at remote locations Gather performance indicators (i.e., metrics) analyze data, and produce reports as required Install, configure, multi-functional printers, for printing, email, scanning, CAC enabling, digital signatures, and encryption transmission

Within 30 days of the issuance of a task order that includes System Administration or System Operations support, the Contractor shall monitor daily reports for system and database backups for Lackland servers

(802CS Core Service), MMR Alternate site storage location and the three REOs (Atlanta, Dallas, and San

Francisco). The backup library at all times must contain at a minimum month end, previous week’s end, and good backups for each of the past three days. Whenever the Government approves an alteration, the

Contractor shall provide the updated schedule within 10 working days. Reports will be determined at the TO level. (TE-A)

1.5 Database Administration Services. Database Administrator (DBA) services shall include creation and deletion of database user accounts, promotion of data integrity, monitoring use and performance of the database, reduction of unnecessary or redundant storage, institution of database security, facilitation of data sharing, performance of regular backups, and of recoveries when needed. The DBA is also responsible for creating instances and views, writing SQL queries as required, managing extents, database backups and recovery, and all typical DBA functions. The contractor shall resolve any database problem that has resulted in unscheduled downtime of more than two full workdays (16 AFCEE core duty hours). This service includes administering several database applications and configuration management software. Contractor shall provide technical assistance of data retrieval and data update to both government and contractor members. Any required reports will be determined at the TO level. (TE-A)

1.5.1 Level I, Database Administration Services. The Contractor shall provide database administration in

Oracle, SQL, and *Net. Support will include DBA I, Backup and Recovery. Contractor shall maintain accounts by setting up user IDs with roles and privileges, problem solving, installing software and software patches, load balancing, resolving computer security issues, performance monitoring and tuning of databases, and performing and monitoring backups. Additional services include the design and customization of complex databases including schema and subschema details. Contractor shall provide relational database software package support. Contractor shall at times administer several database applications and configuration management software along with providing technical assistance like data retrieval and data update to both government and contractor personnel. Any required reports will be determined at the TO level. (TE-A)

1.5.2 Level II, Database Administration Services. The Contractor shall administer complex databases and along with backup and recovery procedures. Additional support includes Oracle System Tuning and Network

Administration (or equivalent). ; otherwise these must be completed at the Contractor’s expense within the

Pa ge 8 o f 4 2 first six months on the job. Any level II DBA must be capable of performing System Administrator roles as specified in section 1.4.1.2 in a back up capacity. Any required reports will be determined at the TO level.

(TE-A)

1.6 Desktop, Laptop and Personal Computer Services. The Contractor shall provide support to ensure that the PCs, laptops, and peripheral/network devices assigned/allocated to AFCEE personnel are fully functional and are running in such a manner that they provide the level of service IAW the

Standard Desktop Configuration to AFCEE personnel in support of their mission. Desktop support personnel must be versed on PC and software configurations used at AFCEE and must be able to assist customers in the use of any component of the standard software load as well as any Commercial-Off-

The-Shelf (COTS) and all Open Database Connection interface software (ODBCs) that is commonly used within the organization. These responsibilities include updating Remedy trouble tickets when appropriate. Any required reports will be determined at the TO level. (TE-A)

1.6.1 Level I Computer Support Technical Services. The Contractor shall diagnose and correct problems with PCs, both hardware and software based, to include peripheral devices such as printers, smartcard readers, external disk drives, speakers, and monitors. The Contractor shall replace fuser and transfer kits in printers. Contractor shall resolve the simplest issues over the phone and identify/categorize more complex user problems and create Remedy tracking tickets in these cases. The Contractor shall have extensive interaction with customers and shall log any customer complaints. Any required reports will be determined at the TO level. (TE-A)

1.6.2 Level II Computer Support Technical Services. The Contractor shall provide relational databases, scientific and technical COTS products support with software such as Access, Oracle, Project, SQL*Server, and Visual Basic. The Contractor shall troubleshoot problems to the PC and peripheral units and when necessary replace and install internal parts (i.e., CD/DVD drives, network and video cards, etc.) including locating and installing any device drivers that may be necessary. The Contractor shall communicate with

SysAdmin personnel and resolve issues between PCs and network devices/interfaces, and with networked databases using (SQL*Net and Oracle ODBCs) as required. Any required reports will be determined at the TO level. (TE-A)

1.6.3 Level III Computer Support Technical Services. The Contractor shall provide technical and management direction over the computer support technical services team. The contractor shall implement internal controls to ensure all elements of the IT department receive current and accurate information as required. The contractor shall ensure that queries on IT status are completed within a reasonable time. The contractor shall provide inputs to the Government upon request or when process flow improvement suggestions could possible ensure an increased and more streamlined work flow improvements. Any required reports will be determined at the TO level. (TE-A)

1.6.4 Level IV Computer Support Technical Services, Special Access. The Contractor shall provide Level

II (1.4.1.2) System Administration, Level II (1.6.2) Computer Support Technical and Level II (1.5.2)

Database Administration Services. Database Administration Services will be for the SQL Database.

Computer Support Technical, System, and Database Administration Services will be equally divided. The

Contractor shall understand the person or persons providing this service shall be subject to urinalysis/drug testing prior to and randomly during appointment of providing these services. Contractor shall also understand that the person providing these services will be required to possess a Secret security clearance and have appropriate level of background investigation prior to the appointment. Contractor shall understand the person or persons providing these services may have access to Sensitive Compartmented Information

Pa ge 9 o f 4 2

Facilities (SCIFs) and access-controlled areas and shall be required to take periodic polygraph examinations upon demand. Any required reports will be determined at TO level. (TE-A)

1.7 AFCEE IT Customer Support Services. The Contractor shall receive customer calls to report problems and/or malfunctions with IT assets. Contractor providing this service shall be professional and e able to resolve the simplest and most common problems over the phone verbally without needing to create a ticket or refer the issue to a technician. For more complex and difficult issues the Contractor shall collect the information needed to open a Remedy ticket along with further information that will be helpful and assign the issue to the appropriate technical personnel based upon the nature of the problem. Any required reports will be determined at the TO level. (TE-A)

1.7.1 Technical Writing Services. The contractor shall create and contribute to: installation guides, configuration and reference guides, online help, troubleshooting, and maintenance documentation. This service will include IT technical writing pertaining to software development lifecycle challenges. Services will require the generation of intuitive graphics and other visual aids. Documentation and writing support will be prepared using Microsoft Office (all applications, including PowerPoint and Access), Adobe

FrameMaker, Adobe Acrobat, Visio, HTML, and Paint Shop Pro. Documentation shall include IA

Acquisition requirements, DOD Architecture diagrams, and Data Vocabulary packages for all programs.

1.7.2 Administrative Record Services. The Contractor shall provide the capability to receive, categorize, log, and index documents including books, papers, maps, photographs, machine readable materials, or other documentary materials, regardless of physical form or characteristics. These items can be made or received by an agency of the United States Government under Federal law or in connection with the transaction of public business and preserved or appropriate for preservation by that agency or its legitimate successor as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the

Government or because of the informational value of data in them.

The Contractor shall redact privileged or sensitive information from documentation included in the publicly accessible portion of the Administrative Record. Contractor shall post this information to the appropriate

AR/IR Web site. Any required reports will be determined at the TO level. (TE-A)

1.7.3 Administrative Services. The Contractor support office automation duties such as word processing and fax support of administrative and clerical work, following a system of formal internal procedures and administrative controls. The Contractor shall prepare and track a wide variety of recurring and nonrecurring correspondence, reports, and other documents while reviewing and finalizing correspondence/documents prepared by others in handwritten or electronic drafts. The Contractor shall proofread and edit correspondence and documents for correct grammar, spelling, capitalization, punctuation, and format.

Additionally the Contractor shall review and process incoming and outgoing correspondence, materials, publications, regulations, and directives while screening and distributing incoming mail. Additional support includes reviewing outgoing correspondence prepared by others for procedural and grammatical accuracy, conformance with general policy, and factual correctness and advises the writer of any deviations or inadequacies. Contractor shall receive telephone calls, greets visitors, and ascertains the nature of the calls or visits. Any required reports will be determined at the TO level. (TE-A)

1.8 Video Teleconferencing (VTC)/PDA/Air Cards Services. The Contractor shall support Blackberry configuration and troubleshooting, Audio Visual configuration and troubleshooting. This support includes coordinating and setting-up teleconferences for AFCEE personnel, troubleshooting and maintenance of

AFCEE VTC system(s) and coordinating any repairs and upgrades. The Contractor shall schedule

Pa ge 1 0 o f 4 2 conferences with the Defense Video Services (DVS) Hub (or equivalent), receive and distribute confirmation instructions, perform pre-conference testing, establish conference connections, and re-establish any connections that are lost or dropped. Contractor shall install and maintain VTC systems. PDA and Air

Cards support responsibilities include set up and maintaining operation for PDA and Air Cards to AFCEE users. Any required reports will be determined at the TO level. (TE-A)

1.8.1 Level I, Telecommunications Services. The Contractor shall support digital telephones, telephone switches, FAX machines, video Teleconferencing, audio visual support, and management of wireless devices. Additional support shall include voice over IP systems and shall diagnose and troubleshoot telephone equipment and infrastructure to include performing minor repairs on the spot. Any required reports will be determined at the TO level. (TE-A)

1.8.2 Level II, Telecommunications Services. The Contractor shall provide advanced complex diagnosis and repair tasks. The Contractor shall plan, design, and install new telephone systems including VoIP systems. Additional support will include diagnosing high-speed data lines and satellite communication systems as well working telecom issues within the DoD environment. Any required reports will be determined at the TO level. (TE-A)1.9 Information Assurance Services. Any Information Assurance Services

1.9 Information Assurance Services. Any Information Assurance Services required reports will be determined at the TO level. (TE-A)

1.9.1 Level I System Information Assurance (IAM1) Services. The Contractor shall provide support in compliance with Department of Defense (DOD) and Department of the Air Force regulations, policies, and IA best security business practices to ensure the hardware and software in use at AFCEE meets all required security mandates. This support includes at the direction of the AFCEE Government

IAO or IAM developing, reviewing, validating and maintaining AFCEE certification and accreditation

(C&A) packages pertaining to AFCEE functional servers, networks, and systems. The Contractor shall assist the AFCEE IAO or IAM in implementing and enforcing national, DoD, and Air Force security policies and directives. Support also requires coordination, guidance, and tracking the implementation of directed TCNOs and AFCERTs. The Contractor shall apply Information Technology (IT) security principles, methods, and security products to protect and maintain the availability, integrity, confidentiality, and accountability of AFCEE information systems resources and information processed throughout any AFCEE system. Contractor shall support AFCEE Computer Security (COMPUSEC) while ensuring AFCEE systems are accredited, comprehensively tested, and certified to connect to the network. The Contractor shall provide the leads in the protection of IT functional systems and servers from malicious logic (e.g., virus, worm, Trojan Horse, etc.) attacks by ensuring appropriate preventive measures are applied. Contractor shall lead the development of AFCEE’s portfolio for IT systems and maintains corporate responsibility for managing the Enterprise Information Technology Data Repository

(EITDR) used by DoD to justify the acquisition of IT resources and prioritize IT capital investments.

Contractor shall support the system and network defense which is an ongoing activity that attempts to protect AFCEE IT resources from threats, internal and external. Although mostly controlled through

AFNET but at times this support will be requested from AFNET or the 802 nd

Communications

Squadron on Lackland AFB Texas. Contractor shall monitor, review, and maintain currency with the latest issues and breaking news in the IA and IT arenas and be prepared to implement protective and/or corrective measures. The contractor shall use the sources of this currency which include online information, equipment and security vendor updates, as well as communication with INFOSEC

Pa ge 1 1 o f 4 2 professionals. Effectively structured defense often has countermeasures in place even before receipt of a directive or notification from the Air Force IA hierarchy, along with prompt implementation of countermeasures when directed by higher headquarters. Contractor shall support the system and network defense services which include:

Monitoring systems compliance to ensure system/network availability, reliability and integrity

Evaluation of incidents, threats, and vulnerabilities facing Air Force ADPE

Taking proactive and reactive defensive measures to protect AFCEE ADPE assets

Implementing tools, patches, and corrective measures as directed by the IAO

Establish and periodically review/update ADPE and IA contingency plans

Expeditious and complete compliance with TCNOs and AFCERTs when received

The Contractor shall support any Information Assurance requirements and initiatives provided by the

AFCEE Systems Information Assurance Manager (IAM). This support consists primarily of protecting all data, systems, utilities, applications, and equipment from potential sources of harm as well as the technical and administrative aspects of complying with and responding to IA tasking (primarily TCNOs and AFCERTs) as they are directed by higher headquarters. The Contractor shall provide the IAM with support and assistance to coordinate advisories (AFCERTs and TCNOs) with higher HQ and with system NAs. The Contractor shall;

Verify and coordinate on any required compliance and/or responses, following-up as necessary

Ensure that TCNOs and AFCERTS are satisfied and responded to by the suspense/implementation date

Officially acknowledge receipt of AFCERT and TCNO advisories within three (3) days of issue

Preparing, tracking and maintaining required security certification of the AFCEE functional servers and networks

AFCEE portfolio currently maintains and manages approximately 36 investments in various stages of lifecycle and accreditation. Security artifacts are typically written to specific systems and have mixed release cycles across the portfolio, requiring continuous updates and assessments to ensure security compliance is maintained. The Configuration Management part of this service will be, the contractor shall ensure all security artifacts are updated when the security requirements are changed in either policy, system or applications.

A very important part of IA Services is the Federal Information Security Management Act (FISMA) which was meant to bolster computer and network security within the federal government and affiliated parties

(such as government contractors) by mandating yearly audits. The security of data is an important element of planning, acquisition, and management of Federal Information Technology Systems. The AFCEE portfolio is very diverse and systems/applications are in multiple versions across many different hardware platforms and Operating systems, the FISMA reporting requirements mandates continuous monitoring, updating and reporting. To meet this mandate and the many changes in the IA arena, it is expected that continuous monitoring is the only way to meet the requirements of the security testing, contingency planning and updating of security artifacts and policy. This activity requires direct support of the System and Database administrators to meet the review, testing and analysis in direct support of the IAM. This support includes;

Contingency Planning and Testing

Continuous Review and monitoring of security artifacts

Annual security testing and compliance

Pa ge 1 2 o f 4 2

1.9.2 Level II System Information Assurance (IAM2) Services. The Contractor shall provide support, at the direction of the AFCEE IAO or IAM in preparing, tracking and maintaining required security certification of the AFCEE functional servers and networks including assisting the AFCEE IAO or IAM in implementing and enforcing national, DoD, and Air Force security policies and directives which will include coordinating with the AFCEE IAO or IAM along with NetOps personnel in the implementation of TCNOs and AFCERTs. The Contractor shall maintain the AFCEE IA program and apply IT security principles, methods, and products to protect and maintain the availability, integrity, confidentiality, and accountability of information system resources and information processed on any AFCEE system. The Contractor shall develop and update AFCEE policy for the INFOSEC programs providing advice and guidance in the development and operation of systems. Disseminates information and ensures computer security practices are adhered to by all functional areas. Contractor shall Identify and analyze system vulnerabilities to ensure the appropriate level of protection is maintained. Contractor shall ensure all software is certified prior to installation and use on communications and computer systems ensuring software designs address information system security requirements through test scripts and compliance reviews. Contractor shall perform risk analysis, testing, and certification when modifications/changes occur to computer systems.

Reviews all hardware, software, and firmware products that provide security features prior to use on any accredited AFCEE information system or network and provides analysis and recommendations to the

AFCEE IAM and Program Manager. Contractor shall execute computer security plans and monitoring to enforce mandatory access control techniques and methods of information systems protection. Contractor shall evaluate unusual circumstances through system/application reviews to recognize and define potential vulnerabilities and all incidents involving viruses, tampering, or unauthorized system entry and reports this information to the AFCEE IAM. The Contractor shall control access to prevent unauthorized persons from connecting to network. Limits access to privileged programs (i.e., operating systems, configuration files, and databases), utilities, and security-relevant programs/data files to authorized personnel.

The Contractor shall provide Certification and Accreditation (C&A ) support to AFCEE to ensure

Information Assurance (IA) is properly implemented for Air Force procured Information Systems and

Guest systems operating on the Air Force Global Information Grid (AF-GIG). The Contractor shall support the AFCEE IAO and or IAM in implementing and enforcing national, DoD and Air Force security policies and directives. This service includes supporting the AFCEE IAO or IAM in preparing, tracking and maintaining required security certification of the AFCEE functional servers and networks to include coordinating with the AFCEE IAM or IAO and NetOps personnel in the implementation of TCNOs and AFCERTs. The DoD-required process for accomplishing C&A is the

Department of Defense Information Assurance Certification and Accreditation Process (DIACAP).

Any AFCEE System and applications must be certified and accredited to operate on the AF and DoD

Networks. Configuration Management is the catalyst to ensure that as changes in the security architecture occur, they are reviewed by the Configuration Control Board before any changes to system/application baselines are implemented. C&A requires that policy and security artifacts are reviewed and the baseline changes documented and updated to reflect the required change(s).

The Contractor shall prepare, track and maintain required security certifications of the AFCEE functional servers and networks including assisting the AFCEE IAM or IAO in implementing and enforcing national, DoD, and Air Force security policies and directives which will include coordinating with the AFCEE IAM or

IAO and NetOps personnel in the implementation of Security Technical Implementation Guide(s) (STIGs) and/or National Security Agency (NSA) Systems and Network Attack Center security guides (SNAC).

Pa ge 1 3 o f 4 2

Implementation of the STIGs/SNAC may require updates to effected supporting security artifacts and documentation to reflect the compliance changes. The Contractor shall notify the IAM/IAO of the necessary changes and to provide results of the security implementation change(s). The Contractor shall adhere to

AFCEE configuration management controls and guidelines and shall maintain a database that tracks system modifications. This database shall contain descriptive information on the change(s) to be affected and the status and milestones accomplished to date. All database or software-related work, including ad hoc reports, maintenance, development, and enhancements, shall be logged by the Contractor into the database without exception. The database and all data entered into it are the property of the Government and shall be made current by the Contractor and turned over to the Government with all data intact at the completion of the contract.

The references section (5.11.4) of this PWS lists the primary Air Force and DoD regulations and instructions that apply to the Information Systems Security arena and any mandated associated training.

These documents will also be supplemented by policy letters and memos issued at all levels of the IA hierarchy from the AFCEE IAO or IAM all the way up to the Air Force CIO. The AFCEE Information

Assurance Officer (or designee) or Information Assurance Manager will provide this information to the contractor. Prompt and complete compliance is essential in order to protect AFCEE IT resources and is required by the Contractor. The Contractor’s shall:

Keeping abreast of all policy dealing with threats and vulnerabilities pertinent to AFCEE ADPE

Enforcing and verifying compliance (by all AFCEE personnel) with IA policy and directives

Monitoring and actively enforcing system/network certification and user training requirements

Performing periodic security assessments and serving as liaison with the IAO on IA issues

1.10 Inventory Management Control Services. The Contractor shall support the AFCEE Equipment

Control Officer (ECO) in all responsibilities and shall serve as the alternate. The Contractor shall ensure the integrity and accuracy of the ADPE inventory by inputting and/or transferring computer equipment items in the authorized Air Force inventory management system within two workdays of receipt. Once the

Government identifies excess equipment, the contractor shall begin processing it for disposal within 7 days of notification in writing. Other duties include: ensuring that all ADPE is properly signed and accounted for, transporting ADPE items between AFCEE worksites, storage locations, and Defense Reutilization and

Marketing Office (DRMO) as required, ensure that stock levels are reported to management and Primary

ECO on a weekly basis, and that AFCEE ADPE storage locations are kept in an orderly manner. Contractor shall support ECs with their periodic inventories as well as ADPE disposition and must operate Government vehicles to transport ADPE between work and storage locations as required. All new equipment received will be entered in to the Air Force inventory management system within 10 days from delivery date. Any

1.11 Programming Services. Any Task Order issued that consists solely of programming tasks, the

Contractor shall identify a Programming Support Task Leader to exercise technical and management direction over multi-disciplined teams. Any software development will be in support of an approved Air

Force Information Technology (IT) investment system. Any programming required reports will be

1.11.1 Basic AFCEE Website Services. The Contractor shall develop, implement, update, and maintain pages, graphics, and functionality that are presented on the AFCEE website. Website programming and maintenance efforts will involve the use of all commonly used web programming languages and utilities with

Pa ge 1 4 o f 4 2 special emphasis upon: HTML, JavaScript, Silverlight, Paintshop Pro, Database integration using Structured

Query Language (SQL) server/Access, Active Server Page (ASP), Active Server Page.net (ASP.net), Text

Editor, and MS Designer. The AFCEE Public and Private portal websites have built-in content manager software which is forms-based screens for text and headlines entries. This content manager software will be common to all Air Force Web Sites on the public and private portals. Any required reports will be

1.11.1.1 Advanced AFCEE Website Services. The Contractor shall in addition to everything in section

1.11.1 above utilizing the same as well as advanced web programming languages maintain the functional applications residing on the local AFCEE website to include the Private Air Force Portal AFCEE website and the Public AFCEE website within AFPIMs consisting of over 20,000 pages. There are approximately 9 functional legacy web applications supporting the AFCEE mission that reside on a local virtual public web server. Examples of the applications include, but are not limited to the following: past performance website used to gather past performance information from contractors competing for AFCEE contracts;

database collection of information related to the Clean Air Act; performance-based contracting tool that gathers data that is entered regarding different sites that may meet the requirements to use a performance-based contract; golf course environmental management site that is a repository of environmental information about Air Force golf courses; water resources management application that provides information and links to resources that will assist in managing the numerous and complex provisions of the Clean Water Act (CWA) and Safe Drinking Water Act (SDWA) that directly impact Air Force installations; Broad Agency

Announcement (BAA)—Collects applications from contractors wishing to apply for funds to perform field-tested innovative technologies and methodologies; and various intranet applications that manage employee information, financial data, manpower, and IT software/hardware. The support shall include programming support to maintain, update, and add functionality to the AFCEE website and application programs. Any

1.11.2.1 Level I Application Programming Services. The Contractor shall provide programming support using all components of the Microsoft Visual Studio suite and the ability to interface (and develop interfaces) with MS SQL and Oracle databases, World Wide Web applications and Open Database Connection (ODBC) utilities. Application programmers will provide solid oral and written communication skills in written clear and effective software documentation. The Contractor shall provide object-oriented application programming in gathering, application design, and prototyping with software and regression testing and application implementation.

The Contractor shall maintain current application programs and database interfaces in support of AFCEE requirements. Software application programming support generally involves minor updates or changes to existing code using Microsoft Visual Studio suite, Delphi, SharePoint Designer, C# and interfacing (and developing interfaces) with MS SQL Server and Oracle databases. Currently supported applications/systems include (but are not limited to) SharePoint, ERPIMS, Contractor Deliverable Upload Tool (CDUT), Management, Execution and Tracking System (MXT), and the Air Force Environmental Internet Data Call

System (AFEIDCS). All software products shall be accompanied by the required documentation to update any impacted AFCEE certification and accreditation packages in accordance with mandated DoD and/or Air

Force policies and procedures.

The Contractor will be responsible for ensuring that all software development identifies and institutes implementation the Air Force of Systems Engineering Processes (SEP). SE begins with comprehensive planning. It addresses architecting, requirements development and management, design, technical management and control, and test and evaluation (T&E) / verification and validation (V&V). These

Pa ge 1 5 o f 4 2 fundamental elements must be accomplished on all development, acquisition, and sustainment projects. They are not to be implemented independently, but must be integrated to mutually reinforce each other. Program or project teams should tailor the breadth and depth of application of the various SE sub-elements and processes to the complexities and needs of their specific effort, commensurate with its point in the life cycle.

―Tailor‖ does not mean ―eliminate without adequate supporting rationale.‖

The SEP should be developed in concert with the technical planning supporting the Acquisition Strategy, the

Initial Capabilities Document (ICD), and other relevant predecessor documents. It must remain consistent with the program’s Life Cycle Management Plan (LCMP) (or legacy Product Support Master Plan [PSMP]), Capability Development Document (CDD), and Capability Production Document (CPD) as program planning and execution mature. With concurrence of the highest SEP signatory, existing legacy planning documentation may be updated to include additional required content for a SEP. Such documents will be subject to the review, update, and approval process.

The SEP must be reviewed annually, and updated as required throughout the life cycle of the program to reflect significant events such as changes in program office organization, a major supplier or contractor, or funding profiles. The PM or higher signature authority may also direct a SEP update.

AFCEE manages several legacy IT systems that support the management and execution of their programs.

Software application programming support will be required and will generally involve minor updates or changes to existing code using Microsoft Visual Studio suite, Delphi, SharePoint Designer, C# and interfacing (and developing interfaces) with MS SQL Server and Oracle databases. An example of these legacy systems includes, but is not limited to, the following:

A Management, Execution and Tracking system (MXT) that integrates financial, contracting, environmental, construction and services project planning and oversight, contract management and reporting of data. The Oracle based system is utilized AFCEE wide to support worldwide mission. The system supports more than 600 user accounts, 4 million records, 6000 active/pending projects and provides oversight of projects totaling over $12B at any given time.

An Environmental Installation Restoration Program Management System (EIRPMS) that is used to store and manage data collected for Air Force environmental projects. The system is a relational Oracle database that incorporates a range of environmental data—contracting data, locations and sites of the sampling events, lithology, hydrology, well completion, well maintenance, samples taken, tests run on those samples, analytical results from those tests, remediation system parameters and performance characteristics. The system supports over 300 users and contains over 90M records. IT support for this system includes: processing, entering, and perform QA/QC for all data loading processes for the database; providing Customer Support Services to AFCEE Government personnel and contractors performing Air Force environmental taskings; assisting the Government in designing, testing, and developing documentation for support system software (including GIS systems), and related applications; and assistance with training the users and customers of the program and its related systems, applications (including GISs) software.

Any software development will support an approved Air Force IT investment system.