AMMENDMENT 1 - ATTACHMENT 1. Performance Work Statement.pdf

AU IOS DaaS Performance Work Statement

Air University International Officer School (IOS) Device as a Service (DaaS)

Performance Work Statement (PWS)

Primary POC for HQ Air University/A6: Mr. Mark Roy Physical Address: Bldg 800, 55 LeMay Plaza So Maxwell Air Force Base, Montgomery AL

Primary POC for International Officer School: Maj Daniel Workman Physical Address: Bldg 904, 120 S Mitchell St.

Maxwell Air Force Base, Montgomery AL

1.0. OBJECTIVE: Air University’s (AU) International Officer School (IOS) at Maxwell AFB, Montgomery AL, has a requirement to obtain laptops though a lease for academic student use while attending resident programs on the AU campus. The procurement of these items is to be provided through a Device as a Service (DaaS) subscription-based Indefinite Delivery/ Indefinite Quantity (ID/IQ) awarded contract. The service will provide AU with end-user devices (laptops) and various managed IT services, to support and maintain these devices through a structured service level agreement. However, the agreed upon awarded contract will provide for increases up to approximately 310 devices over the period of performance (POP). These increases will be necessary to support student influxes in the IOS program over the POP. Increases in student attendance is based on increases each year per SECDEF guidance for this time period. Estimated increases in the number of devices needed per academic school year are listed in Table 1.0. of paragraph 3.0 below.

2.0. DaaS DEPLOYMENT SERVICES SCOPE: The contractor shall provide Deployment Services designed to systematically transition the Government from its current environment to the newly planned and designed environment through managed and coordinated planning and implementation. The Transition Management Service shall provide the coordination and planning necessary to transition the Government to the future state DaaS environment. Pursuant to each party’s responsibilities defined in this PWS.

3.0. PERFORMANCE REQUIREMENTS

3.0.1. Upon establishment of the DaaS contract, order and procure the contractor-provided devices, applicable software, and accessories as defined in Para 4.7. and applicable change orders against the same.

3.0.2. Deliver DaaS devices and provide services to support the following estimated amounts.

Table 1.0. Estimated Minimum Laptop Delivery Requirements to Support Base Year and Option

Years

AU I-PME FY Quota Increases

Base Year (AY24/25) Option Yr 1

(AY25/26) +~12%

Option Yr 2

(AY26/27) +~8%

Option Yr 3

(AY27/28) +~4%

FY24 FY25 FY26 FY27

Total 1ea (min)/240ea

(max) 1ea (min)/260ea

(max) 1ea (min)/290ea

(max) 1ea (min)/310ea

(max)

Note: The amounts in Table 1.0 are not compounded. The number of items increased in each option year will be a percentage of the total number of items provided in the previous year.

3.0.3. Schedule delivery of the contractor-provided devices to the Government site listed herein within 21 days of contract award for the base year and within 30 days of any increased amounts requested through a Task order for this IDIQ contract.

3.0.4. Confirm with the Government the necessary information including, but not limited to:

shipping dock availability, hours of operation and scheduling, truck size accommodation, access to elevators, requirements for carts, applicable mandates for union labor coordination, requirements for the on-site staging area and Certificate of Insurance requirements.

3.0.5. Assign an on-site single point of contact to coordinate the delivery of the contractor-provided devices at the Government’s site listed herein.

3.1. Period of Performance:

3.1.1. Base (CLIN 0001, 0002): 15 Apr 2024 – 14 Apr 2025

3.1.2. Option 1 (CLIN 1001, 1002): 15 Apr 2025 – 14 Apr 2026

3.1.3. Option 2 (CLIN 2001, 2002): 15 Apr 2026 – 14 Apr 2027

3.1.4. Option 3 (CLIN 3001, 3002): 15 Apr 2027 – 14 Apr 2028

4.0. DEVICE PROCUREMENT SCOPE: Device procurement services shall allow the Government to use contractor provided devices without purchasing the devices. The service shall include contractor coordination and delivery of the contractor-provided devices listed in the Hardware/Software Configuration section of this document, to the Government site. The contractor reserves the right to procure and deliver devices of equivalent or enhanced capabilities as those specified herein and applicable change orders. (CDRL A001)

4.0.1. The contractor shall:

4.0.1.1. Order and procure the contractor-provided devices, applicable software, and accessories as defined in the PWS and applicable change orders against the same.

4.0.1.2. Schedule the contractor-provided devices to the Government site listed herein

4.0.1.3. Confirm with the Government necessary information including, but not limited to:

shipping dock availability, hours of operation and scheduling, truck size accommodation, access to elevators, requirements for carts, applicable mandates for union labor coordination, requirements for the on-site staging area and Certificate of Insurance requirements.

4.0.1.4. Assign an on-site single point of contact to coordinate the delivery of the contractor-provided devices at the Government’s site listed herein.4.1. ACCOUNT MANAGEMENT SERVICES SCOPE: The contractor Account Delivery Manager (ADM) shall be the Government’s single point of contact during the performance of DaaS during local business hours for the day-to-day administration, management, and support of the Government’s managed environment along with the continuous and proactive coordination, measurement of the contractor delivery and performance of DaaS and issue resolution for the applicable term. ADM shall also provide relevant contractor consultation and recommendations to assist the Government in maintaining and enhancing the benefits of their managed environment, throughout the term of this PWS. (CDRL A003)

4.1.1. The contractor shall:

4.1.1.1. Provide an ADM who will manage, collaborate and secure various contractor resources to remotely provide delivery management services, except as otherwise specified herein.

4.1.1.2. Provide overall review and management of the services described herein and surveying of the Government’s satisfaction and communication against reported incidents, including device break/fix incidents and related issue resolution and necessary escalations.

4.1.1.3. Coordinate with the Government regarding install, availability, and use of contractor tools necessary to be able to implement DaaS described herein and report against the Government’s adherence and variances to mutually agreed-upon plans, process documents, and procedures, and any recommended changes thereto throughout the term of the applicable Period of Performance (PoP).

4.1.1.4. Manage and track through final disposition and execution all contractor-issued Change Orders.

4.1.1.5. Provide details to scheduled requests for explanations of invoice and invoice reports.

4.1.1.6. Will conduct monthly operational reviews with the Government’s designated Technical

Point of Contact (TPoC) to discuss and evaluate the day-to-day services, operational requirements, and the Government’s satisfaction within the period prior to the review.

4.2. ONSITE TECH SERVICES SCOPE: After initial contractor deployment of the fleet, contractor services shall provide the necessary technicians 4 times per year (on or around 6 May, 1 August, 15 January, and one “floating” date to meet dynamic maintenance requirements) for on-site device maintenance. During these 4 visits, technicians will perform physical, hardware, software, and OS maintenance containing an International Officer School (IOS) User profile on all services within the fleet under this DaaS agreement. (CDRL A004)

4.2.1. The contractor shall:

4.2.1.1. Wipe stored information from device.

4.2.1.2. Clean device.

4.2.1.3. Load new OS and software suite image to device.

4.2.1.4. Ensure that device is fully operational. (to include hardware maintenance/replacement)

4.3. TECHNICAL SUPPORT SERVICES (TSS) SCOPE: During local business hours, the Government may access the contractor’s Technical Support Services (TSS) via phone or online “chat” for remote diagnostics of technical support related issues. At that time a Service Ticket will be created. The contractor shall determine the cause of the issue and provide TSS dependent on the severity of the issue reported. (CDRL A005)

4.3.1. The contractor shall:

4.3.1.1. Remotely use contractor tools to diagnose and remotely repair a defective device (see para. 6.2/6.3 for experience level requirements) or

4.3.1.2. Dispatch service technician to repair defect in materials/workmanship for device issues

(see par 6.3 for experience level requirements)

4.3.1.3. TSS levels 6.2 & 6.3 require 9x5 Next Business Day On-Site response, provided that the

Service Ticket is logged any business day before 4:00 p.m. local time, calls placed after 4:00 p.m. will be logged on the next business day. Coverage window is Monday to Friday from 7:00 a.m. to 4:30 p.m. local time, excluding local public holidays. The contractor shall dispatch a contractor-authorized service technician onsite if the problem has not been already resolved remotely, with the representative arriving on-site to begin hardware repair during the coverage window.

4.3.1.4. Replace the defective device in need of repair with a replacement device of like functionality and performance capability.

4.3.1.5. The contractor shall furnish a monthly repair report to the TPC of all Service Tickets created and their outcome.

4.3.1.6. Repairs to devices that require service technician to return on-site to complete will not be considered a separate request for TSS.

4.3.2. The Government shall:

4.3.2.1. Provide a Government Help Desk to serve as Government employee’s first point of contact for all technical support related incidents for DaaS devices.

4.3.2.2. Provide names of Government Help Desk representatives to the contractor, and any updates throughout the PWS Term.

4.3.2.3. The point of contact available to schedule, meet and escort the dispatched contractor technician to resolve logged tickets for TSS by the contractor shall be the TPC.

4.3.2.4. Return all replaced devices to the contractor after Defective Media Retention (DMR).

4.4. ACCIDENTAL DAMAGE PROTECTION (ADP) SERVICES SCOPE: The contractor shall provide Accidental Damage Protection (“ADP”) Services to resolve reported issues for contractor determined eligible devices that are experiencing operational or mechanical failures solely caused by unforeseen, unintentional, and accidental damage; that would otherwise subject to service limitations. (CDRL A006)

4.4.1. The contractor shall:

4.4.1.1. Provide Next Business Day replacement, provided a Service Ticket is logged any business day before 1:00 p.m. local time. Devices, where Service Tickets are logged after 1:00 p.m., will be replaced in 2 Business Days. The coverage window is Monday to Friday from 8:30 a.m. to 5:30 p.m. excluding local public holidays.

4.4.2. The Government will:

4.4.2.1. Provide an explanation of where and when the accident occurred as well as a detailed description of the actual event. It is the contractor’s sole determination to verify if device operational or mechanical failure was caused by an accident as reported by the Government,

4.4.2.2. The point of contact available to schedule, meet and escort the dispatched contractor technician to resolve logged tickets for TSS by the contractor shall be the TPC.

4.5. DEFECTIVE MEDIA RETENTION (DMR) SCOPE: In combination with TSS and ADP, DMR offers security and control when resolving issues with devices with defective storage disks. The contractor shall diagnose a defective storage disk problem and provide a replacement disk, while the Government retains full custody and control of its data on all defective SSD drive components. (CDRL A007)

4.5.1 The contractor shall:

4.6.1.1. Not take possession and title to any defective disk covered under this PWS.

4.5.2. The Government shall:

4.5.2.1. Destroy and dispose of the retained SSD and ensure that the SSD is not put into use again.

4.6. HARDWARE/SOFTWARE CONFIGURATIONS: The following are required the minimum specification for laptop devices provided by the vendor:

Note: The following are the required minimum specifications for the DaaS TAA approved device:

Hardware:

• All hardware equipment must be TAA Compliant

• 15” display size Laptop Computer

• Gen12 or newer, i5 (or AMD equivalent) processor

• 16GB RAM

• 256GB FIPS TLC SSD

• Windows 11 OS

• Integrated HD 720p Webcam

• HDMI display capability

• WiFi capable

• Built-in Speakers

• 1ea power supply

• Carrying backpack

• Capability to wirelessly cast to monitors and/or smart TVs

• Minimum of 2 USB 2.0 Slots

• Minimum 4/4/0 Warranty

Software:

• Microsoft Office 365 (Air University provided)

• Windows Defender (Vendor provided)

• Video Editing software (such as WeVideo for Windows) (Vendor Provided)

Note: These tools should be commensurate with the tools required of all students by the school/college the student will be attending. Some tools may already be provided by AU in an enterprise license agreement. Additionally, all software must be approved for use on an AF or DoD approved product list (APL) or have reciprocity from another approval site.

5.0. DELIVERABLES

The contractor shall comply with the documentation requirements in the following CDRL table.

Documentation shall be delivered in the formats and numbers specified in the DD Form 1423-1, Contract Data Requirements List’s (CDRLs). The contractor shall be responsible for providing the deliverables to meet the documentation requirements for services performed that are described in this PWS.

CDRL TITLE DESCRIPTION

A001

Device Procurement

Device procurement services shall allow the Government to use contractor provided devices without purchasing the devices. The service shall include contractor coordination and delivery of the contractor-provided devices listed in the Hardware/Software Configuration section to the Government site. The contractor reserves the right to procure and deliver devices of equivalent or enhanced capabilities as those specified herein and applicable change orders.

CDRL TITLE DESCRIPTION

A002 Account Management Services

The contractor Account Delivery Manager (ADM) shall be the Government’s single point of contact during the performance of DaaS during local business hours for the day-to-day administration, management, and support of the Government’s managed environment along with the continuous and proactive coordination, measurement of the contractor delivery and performance of DaaS and issue resolution for the applicable Term. ADM shall also provide relevant contractor consultation and recommendations to assist the Government in maintaining and enhancing the benefits of their managed environment, throughout the Term of this PWS.

A003 Onsite Tech Services

After initial contractor deployment of the fleet, contractor services shall provide the needed technicians 4 times per year when designated by the IOS Cadre to perform wipe, clean, reimage containing an IOS User profile on all services within the fleet under this DaaS agreement.

A004 Technical Support Services (TSS)

During local business hours, the Government may access the contractor’s Technical Support Services (TSS) via phone or online “chat” for remote diagnostics of technical support related issues, at that time a Service Ticket will be created. The contractor shall determine the cause of the issue and provide TSS dependent on the severity of the issue reported.

A005 Accidental Damage Protection (ADP) Services

The contractor shall provide Accidental Damage Protection (“ADP”) Services to resolve reported issues for contractor determined eligible devices that are experiencing operational or mechanical failures solely caused by unforeseen, unintentional, and accidental damage; that would otherwise subject to service limitations.

A006 Defective Media Retention (DMR)

In combination with TSS and ADP, DMR offers security and control when resolving issues with devices with defective storage disks. The contractor shall diagnose a defective storage disk problem and provide a replacement disk, while the Government retains full custody and control of its data on all defective SSD drive components.

5.1. eCMRA Requirement

5.1.1. The contractor shall report ALL contractor labor hours (including subcontractor labor hours) required for performance of services provided under this task order for the HQ AU/A6 via a secure data collection site. The contractor is required to completely fill in all required data fields using the following web address: http://www.ecmra.mil/, and then click on the icon of the DoD organization that is receiving or benefitting from the contracted services.

5.1.2. Reporting inputs will be for the labor executed during the period of performance during each

Government fiscal year, which runs from 1 September through 31 August. While inputs may be reported any time during FY, all data shall be reported no later than 30 September of each calendar year.

http://www.ecmra.mil/

6.0. WORKLOAD PROJECTION

6.1. This is a performance-based acquisition so offers may vary with respect to the labor mix (labor categories/skill levels) and level of effort quoted. The Government reserves the right to prioritize efforts that may impact the temporal execution of certain activities to address emerging requirements or changes to existing requirements. All such changes will incorporate the same contractor capabilities discussed in this document. The Government will approve the specified planned efforts and recommendations for each of the functional areas prior to the contractor beginning any efforts. In addition, the Government will approve changes to the priorities, levels of effort, etc., within the scope of these requirements.

6.2. The contractor is responsible for providing personnel who are fully qualified to perform the requirements identified in this performance work statement such as the ability to transfer data to external hard drive(s) provided by the Government.

7.0. SERVICE SUMMARY (SS)

NUMBER PERFORMANCE OBJECTIVE PWS

PARA.

PERFORMANCE

THRESHOLD

SS-01

The contractor shall provide approximately 200 laptops by NLT 21 days after receipt of the initial task order, all other orders are required no more than 30 days ARO.

1.1 100% of the time

SS-02

The contractor shall provide Image Load Service and shall validate and install the most recent version of Microsoft Windows OS, Google Chrome, Adobe Acrobat Pro, and an Internet Security Suite on all devices. This install shall contain an IOS User profile having agreed upon capabilities/restrictions

4.1. 95% of the time

SS-03

The contractor shall provide the needed technicians 4 times per year when designated by the IOS Cadre to perform wipe, clean, reimage containing an IOS user profile on all services within the fleet under this DaaS agreement

4.3. 95% of the time

SS-04

TSS requires 9x5 Next Business Day On-Site response, provided that the Service Ticket is logged any business day before 4:00 p.m. local time, calls placed after 4:00 p.m. will be logged on the next business day. Coverage window is Monday to Friday from 7:00 a.m. to 4:30 p.m.

local time, excluding local public holidays. The contractor shall dispatch a contractor-authorized service technician onsite if the problem has not been already resolved remotely, with the representative arriving on-site to begin hardware repair during the coverage window

4.4.1.3. 95 % of the time

8.0. PLACE OF PERFORMANCE

All work will be accomplished at Maxwell Air Force Base, AL. Contractor must be able to be vetted into DPAS allowing unescorted access to Base and Air Force Network. Contractor and any/all subcontractors must not have felony convictions or any other past or current legal issues preventing access to work location. Travel on Maxwell AFB between the International Officer’s School (Building 904), 42 Communications Squadron (Building 941) and Headquarters Air University (Building 800), will be required to perform specified task orders.

8.1. Normal Hours of Operation

The majority of the work will be performed within the Government’s facilities at Maxwell AFB, AL. On-site personnel may temporarily perform work at other locations (TDY, alternate work locations, etc.) with Government approval. On-site, the Government will provide dedicated workspaces, however; contractor will be required to provide their own computers and supplies needed for contractor personnel.

The normal on-site full-time work schedule will consist of eight working hours each day, Monday through Friday, between 7:30 a.m. and 4:30 p.m. local time (excluding Federal holidays and base closures). Variations will require prior written approval by the Contractor Officer’s Representative (COR), Program Manager (PM) or Contracting Officer (CO).

9.0. TRAVEL

All travel will be at contractor’s expense and included in the cost of the contract. There will be NO travel reimbursement.

10.0. CONTRACTOR IDENTIFICATION

All contractor/subcontractor personnel shall be required to wear AF-approved or provided picture identification badges so as to distinguish themselves from Government employees. When conversing with Government personnel during business meetings, over the telephone or via electronic mail, contractor/subcontractor personnel shall identify themselves as such to avoid situations arising where sensitive topics might be better discussed solely between Government employees.

Contractors/subcontractors shall identify themselves on any attendance sheet or any coordination documents they may review. Electronic mail signature blocks shall identify their company affiliation.

SECURITY REQUIREMENTS FOR UNCLASSIFIED SERVICES

CAC Required

1. Contractor Notification Responsibilities: The contractor shall notify the contracting office within 30 days before on-base performance of the service. The notification shall include:

a. Name, address, and telephone number of contractor representatives.

b. The contract number and contracting agency.

c. The location(s) of service performance and future performance, if known.

d. The date service performance begins.

e. Any change to information previously provided under this paragraph.

2. Obtaining and Retrieving Identification Media: As prescribed by the DAFFAR 5352.242-9000, Contractor access to Air Force installations, DAFFAR 5352.242-9001, Common Access Cards (CAC) for Contractor Personnel, FAR 52.204-9, Personal Identity Verification of Contractor Personnel, DoDI 5200.46, DoD Investigative and Adjudicative Guidance for Issuing the Common Access Card and DoDM 1000.13, DoD Identification (ID) Cards, ID Card Life-Cycle, the contractor must comply with the requirements set forth in these guidance.

a. The contractor shall obtain base identification and vehicle passes, if required, for all contractor personnel who make frequent visits to or perform work on the Air Force installation(s) cited in the contract. Contractor personnel are required to wear or prominently display installation identification badges or contractor-furnished, contractor identification badges while visiting or performing work on the installation.

b. The contractor shall submit a written request on company letterhead to the contracting officer listing the following: contract number, location of work site, start and stop dates, and names of employees and subcontractor employees needing access to the base. The letter will also specify the individual(s) authorized to sign for a request for base identification credentials or vehicle passes. The contracting officer will endorse the request and forward it to the issuing base pass and registration office or Security Forces for processing. When reporting to the registration office, the authorized contractor individual(s) should provide a valid driver’s license, current vehicle registration, valid vehicle insurance certificate to obtain a vehicle pass. Government ID card holders may not use their credentials to sponsor an individual on to the base to perform work that’s been contracted to an official contractor.

c. Common Access Cards (CACs). For contractors who require a CAC, contractors shall provide a listing of personnel who require a CAC to the contracting officer. The government will provide the contractor instruction on how to complete the Trusted Associate Sponsorship Systems (TASS) application and then notify the contractor when approved. Contractor personnel shall obtain a CAC from the nearest Real Time Automated Personnel Identification Documentation System (RAPIDS) Issuing Facility (typically the local Military Personnel Flight (MPF)). While visiting or performing work on installation(s)/location(s), contractor personnel shall wear or prominently display the CAC as required by the governing local policy. In order to be issued a CAC, the contractor must meet the requirements:

A favorably adjudicated National Agency Check with Inquiries (NACI) (now a Tier 1 or T1 background investigation) or equivalent in accordance with revised Federal Investigative Standards is the minimum background investigation required for a final credentialing determination for a CAC.

A CAC may be issued on an interim basis based on a favorable National Agency Check or a Federal Bureau of Investigation (FBI) National Criminal History Check (fingerprint check) adjudicated by appropriate approved automated procedures or by a trained Security or Human Resources (HR) specialist, and successful submission to the investigative service provider (ISP) of a NACI or a personnel security investigation (PSI) equal or greater in scope.

If the contractor does not meet the minimal criteria for CAC issuance, the COR will work with the unit security assistant and 42 ABW/IP office to initiate the process on behalf of the contractor.

d. During performance of the service, the contractor shall be responsible for obtaining required identification for newly assigned personnel and for prompt return of credentials for any employee who no longer requires access to the work site.

e. When work under this contract requires unescorted entry to controlled or restricted areas, the contractor shall comply with DoDM 5200.08v3_AFMAN 31-101v3, Installation Perimeter Access Control, and DoD 5200.02_AFMAN 16-1405, Air Force Personnel Security Program.

f. Upon completion or termination of the contract or expiration of the identification passes, the prime contractor shall ensure that all base identification passes issued to employees and subcontractor employees are returned to the issuing office.

g. All commercial vehicles will be directed to Gate 3 (Kelly St) or Gate 4 (Congressman Dickenson for Gunter) for processing through the Commercial Vehicle Inspection (CVI) Area, when operational.

During non-duty hours and holidays, commercial vehicle inspections will be conducted at Gate 1 (Maxwell Blvd) or Gate 4 only. Inspection members will conduct thorough inspections of the interior and exterior of the vehicle for items prohibited from the installation such as explosive devices, weapons and ammunition, drugs, and open or closed alcohol containers.

h. Failure to comply with these requirements may result in withholding of final payment.

3. Computer and Network Access Requirements: Contractor personnel that require access to unclassified government computers and operations systems Information Technology (IT) Systems will be designated as Non-sensitive Positions. Contractor personnel must have a Tier 1 and the Tier 1 be favorability adjudicated before operating government furnished computer workstations or systems that have access to Air Force e-mail systems. These investigations shall be submitted by the government at no additional cost to the contractor. NOTE: Since the background investigation process can take up to 18 months, contractor personnel may be issued a CAC before the process is completed after a favorable fingerprint return (3-5 working days) and investigation package submitted to the investigative service provider and the investigation is scheduled.

The servicing Information Protection Office (IPO) is responsible for submitting Tier 3 and Tier 5 investigations for contractor personnel in positions designated as “national security positions” but without a requirement for access to classified information. The servicing IPO will submit these investigation requests based on contract requirements, which will be validated through the Office of Personnel Management’s Position Designation Tool (PDT). These investigations shall be submitted by the Government at no additional cost to the Contractor. The Contractor shall comply with DoDM 5200.02_DAFMAN 16-1405, Air Force Personnel Security Program; and AFI 10-701, Operations Security (OPSEC) instructions, OUSD(I) Memorandum, Clarification of Clearance Requirements for Access to Investigative and Adjudicative Relevant Data, 27 Jun 2019, and DoDI 5200.46, DoD Investigative and Adjudicative Guidance for Issuing the Common Access Card, and Homeland Security Presidential Directive-12 (HSPD-12) requirements.

Contractor personnel will complete the current DoD IAA CyberAwareness Challenge course located in the Air Force myLearning or https://public.cyber.mil/training/cyber-awareness-challenge/.

4. Freedom of Information Act Program (FOIA): The contractor shall comply with DODM 5400.07_AFMAN 33-302, DoD Freedom of Information Act (FOIA) Program, requirements. The regulation sets policy and procedures for the disclosure of records to the public. The contractor shall comply with AFI 33-332, Air Force Privacy and Civil Liberties Program, when collecting and maintaining information protected by the Privacy Act of 1974 authorized by Title 10, United States Code, section 8013. The contractor shall maintain records in AFI 33-322, Records Management and Information Governance Program; and disposed of in accordance with Air Force Records Information Management System (AFRIMS) Records Disposition Schedule (RDS) located at https://www.my.af.mil/gcss-af61a/afrims/afrims/.

5. Controlled Unclassified Information (CUI): The contractor shall comply with DoDI 5200.48_DAFI 16-1403, Controlled Unclassified Information, DoDM 5200.01v1_AFMAN 16-1404v1, Information Security Program, and Freedom of Information Act Program. The contractor shall monitor CUI aggregation and compilation based on the potential to generate classified information pursuant to security classification guidance addressing the accumulation of unclassified data or information.

All CUI associated with this contract must be safeguarded to prevent unauthorized public disclosure. CUI such as PII, Security Classification Guides (SCG), and other technical information with Distribution Statements B, C, D, E or F are not authorized for public release and cannot be placed on a publicly accessible web site or web server. All emails containing such information or attachments must be appropriately marked, and digitally signed and encrypted if being transmitted. All transmissions to personal email accounts (AOL, Yahoo, Hotmail, Comcast, etc.) and posting on social media websites (Facebook, Instagram, Twitter, LinkedIn, etc.) are prohibited. Destroy all CUI associated with this contract by any of the following approved methods: A cross-cut shredder (that produce 1mm x 5mm or 0.04in x 0.2in particles or smaller); a certified commercial destruction vendor; a central destruction facility; incineration; chemical decomposition; pulverizing, disintegration (pulverize or disintegrate with a 3/32in or 2.4mm security screen); or methods approved for classified destruction.

General: There are types of information that are not classified but require application of access and distribution controls and protective measures developed for DoD Controlled Unclassified Information for a variety of reasons. The types of CUI identified for the program are identified in DODI 5200.48 and have replaced legacy formats such as For Official Use Only (FOUO), Law Enforcement Sensitive (LES), as well as some of those developed by other Executive Branch agencies of the U.S. Government and technical data described below as well as protective measures for CUI material.

Formats such as FOUO, LES, et al. are legacy formats no longer in use but are protected as if they have CUI markings. Protections and restrictions can be found in DoDI 5200.48, CUI 06 March 2020.

Technical Data Description: Any recorded information related to experimental, developmental, or engineering works that can be used to define an engineering or manufacturing process, or can be used to design, procure, produce, support, maintain, operate, repair, or overhaul program material. The data may be graphic or pictorial delineations in media (e.g., computer software, drawings, photographs, etc.), text in specifications, related performance or design documents, or computer printouts. Examples of technical data include research and engineering data, engineering drawings, and associated lists, specifications, standards, process sheets, manuals, technical reports, catalog-item identifications, related information, and computer software documentation. The DoD Scientific and Technical Information Program (see DoDI 3200.12.).

CUI Markings: Prescribed marking of CUI documents will be in accordance with DoDI 5200.48, CUI 06 March 2020. CUI may also be identified in security classification guides to ensure the information receives appropriate protection.

Access: CUI may be released to an individual who has a valid need for such access within the scope of their assigned duties, furthering the accomplishment of a lawful and authorized government purpose and would not be detrimental to the interests of the DoD or U.S. Government. Information in any media format will be disseminated on a need-to-know basis. This restricts the use or dissemination of CUI data to those with direct affiliation with the given program/project to conduct official business for the DoD, provided that dissemination is consistent with any further controls imposed by a distribution statement.

Personnel no longer requiring access to CUI must surrender any information in their possession to the program lead, who will take action to terminate further access.

Storing and Handling: During working hours, take reasonable steps to minimize the risk of access to CUI by unauthorized personnel (e.g., not reading, discussing, leaving CUI information unattended where unauthorized personnel are present or display CUI in public places to include the internet). After working hours, store CUI information in locked desks, file cabinets, bookcases, locked rooms, locked/controlled e-files or similar means to prevent theft of program information. Computers used to process CUI do not need to be accredited for classified use. Do not process CUI on public computers (e.g., those available to the public in kiosks, hotels, café’s, etc.) or computers that do not have Public Key Infrastructure (PKI) access controls. Personally owned computers are not authorized to process CUI. Authorized electronic devices provided by the government agency (e.g., laptops, cell phone) used to store CUI must be physically protected and use NIST/NIAP-approved cryptographic products, e.g., DoD approved PKI Certification available at http://iase.disa.mil/pki/eca or http://csrc.nist.gov/cryptval/, which require encryption passcodes to teleconferences/web conferences where CUI may be discussed.

Dissemination: CUI printed documents and material may be transmitted through mail channels or hand-carried without formal courier orders. CUI information may be disseminated to DoD personnel and DoD contractors to conduct official business for the program. If dissemination is required outside of DoD channels contact the program lead, contracting officer, and security manager for approval. Release of technical data will follow the release instructions identified in the distribution statement. Use secure communications whenever available for discussions involving CUI. Send voice and facsimile transmissions only when authorized recipients have acknowledged positive control measures are in place to receive the information.

Destruction: CUI documents shall be disposed of according to provisions of EO 13556, CUI; DoDI 5200.48, CUI 06 March 2020. Component records management directives. Non-record CUI documents may be destroyed by any methods that prevents compromise, e.g., tearing, burning, or shredding of the means approved for the destruction of classified information or by any other means that would make it difficult to recognize or reconstruct the information.

Reporting: Report any loss or unauthorized attempt to gain access to CUI information to the organization’s security manager immediately, but no later than the end of the first duty day. If additional information is required after initial notification, guidance will be provided at that time.

Contractors must complete the DoD Mandatory Controlled Unclassified Information (CUI) training. The CUI training course #IF141.06 at the Defense Security Service Center for Development of Security Excellence (CDSE) Security Awareness Hub at:

DoD Mandatory Controlled Unclassified Information (CUI) Training #IF141.06 – Annually https://securityawareness.usalearning.gov/cui/index.html

6. Reporting Requirements: The contractor shall comply with AFI 71-101, Volume-1, Criminal Investigations, and Volume-2, Protective Service Matters, requirements. Contractor personnel shall report to 42 Air Base Wing Information Protection Office, any information or circumstances of which they are aware may pose a threat to the security of DoD personnel, contractor personnel, resources, and classified or unclassified defense information. Contractor employees shall be briefed by their immediate supervisor upon initial on-base assignment and as required thereafter.

7. Physical Security: Areas controlled by contractor employees shall comply with base operations plans/instructions for FPCON procedures, Random Antiterrorism Measures (RAMS) and local search/identification requirements. The contractor shall safeguard all government property, including controlled forms, provided for contractor use. At the close of each work period, government training equipment, ground aerospace vehicles, facilities, support equipment, and other valuable materials shall be secured.

8. Internal Operating Instructions: The contractor will adhere to the Air Force activity operating instructions (OI) for internal circulation control, protection of resources, and to regulate entry into Air Force controlled areas during normal, simulated, and actual emergency operations.

9. Traffic Laws: The contractor and their employees shall comply with base traffic regulations set forth in AFI 31-218, Motor Vehicle Traffic Supervision and DoDM 5200.08v3_AFMAN 31-101v3, Installation Perimeter Access Control. Personnel in violation may be issued a Central Violations Bureau Form 1805 traffic ticket.

10. Random Installation Entry/Exit Checks: Entry/exit vehicle checks are conducted by order of the 42 ABW Commander. These checks are conducted for the purpose of safeguarding the base and protecting government property by discovering and seizing stolen property, classified information, and contraband.

Refusal to submit to an installation (entry/exit) vehicle check may result in the loss of base driving privileges, revocation of base registration, or debarment action.

11. Cellular Phone Operation Policy: The use of cellular phones while operating a motorized vehicle is prohibited on Maxwell-Gunter. Although discouraged, drivers are authorized to use devices, i.e., ear bud or ear boom, which allows their cellular phone to be operated hands-free. The device must not cover both ears. This policy applies to everyone driving on Maxwell-Gunter AFB. Personnel in violation may be issued a Central Violations Bureau Form 1805 traffic ticket.

12. Security Education and Training: The contractor will be required to participate in the government’s in-house and web-based security training program under the terms of the contract. The government will provide the contractor with access to Air Force MyLearning web site, where they will complete the required training such as but not limit to: Cyber Awareness Challenge 2021 (ZZ133098), Force Protection Training (ZZ133079), and Controlled Unclassified Information (CUI) Training (ZZZ2021CUI) computer base training at the MyLearning web site.

13. Operation Security (OPSEC): The contractor will comply with installation and organizational OPSEC requirements in accordance with AFI 10-701 and applicable supplements. They will also receive a local threat briefing.

14. Wireless Electronic Devices: The contractor will not establish their own Information Technology (IT) systems or networks (Local Area Networks [LAN], Wide Area Network [WAN], Cellular phone/USB Modem as WAN, Wi-Fi as WAN, etc.), or camera system without the direct permission of the Program Manager and governing communications and responsible information systems office (42

CS).

15. Firearms and Ammunition: Transporting weapons or ammunition, concealed or otherwise, IS NOT permitted by any non-law enforcement personnel on Maxwell AFB/Gunter Annex at any time regardless of state issued concealed weapons permits. Violations may result in criminal prosecution under the applicable federal laws.

16. Illegal Weapons. The below weapons are considered illegal, unless specifically authorized by competent authority and are prohibited on Maxwell AFB/Gunter Annex.

Violations may result in criminal prosecution under the applicable federal laws.

a. Switchblade knives or knives with any type of automatic blade release.

b. An incendiary/explosive weapon (e.g., grenades, flash bangs).

c. Fireworks.

d. Homemade mortars, aka "tennis ball launchers" or similar devices.