Solicitation Attachment 7 - IBDSS IDIQ PWS.pdf

Performance Work Statement For Hurlburt Field Integrated Base Defense Security Systems

9 June 2025

Page 2 of 18 Attachment 1 Performance Work

Statement (PWS)

Contents

1.0 PURPOSE

2.0 APPLICABLE DOCUMENTS (AND DEFINITIONS)

3.0 PERFORMANCE REQUIREMENTS

4.0 SECTION 508 ACCESSIBILITY STANDARDS

5.0 CONTRACT ADMINISTRATION

6.0 QUALITY

7.0 DOCUMENTATION AND DELIVERABLES

8.0 SECURITY

9.0 SAFETY ISSUES

10.0 ACCEPTANCE PLAN

Page 3 of 18 Attachment 1

1.0 PURPOSE

1.1 BACKGROUND

The 1st Special Operations Wing (1 SOW), in response to initiatives promulgated by the Air Force Special Operations Command (AFSOC), requires the following but not limited to engineering development, design, procurement, fabrication, configuration, integration, installation, modernization, and logistics solutions for electronic security, physical security and surveillance-type deliverables. These deliverables will support the operational requirements of the United States Special Operations Command (USSOCOM) located at Hurlburt Field where electronic security, physical security and surveillance-type systems are of high or vital interest. This PWS provides the general guidelines and specific requirements to design, develop, and deliver electronic security, physical security and surveillance-type deliverable products. Additionally, this contract seeks to provide experienced integrators and partners, with commercial off the shelf (COTS) security solutions.

1.2 DESCRIPTION OF OBJECTIVE

The objective of this Integrated Base Defense Security Systems Indefinite Delivery/Indefinite Quantity (IDIQ) is to provide the Government with in all in one solution to accomplish the following tasks as specified in task orders:

Conduct site surveys to develop a Installation Design Plan (IDP) and post-installation As-Built drawing packages

Procure required equipment/materials Perform Pre-Installation Test & Checkout (PITCO) Install equipment/material In Accordance With (IAW) the Government-approved IDP Perform System Operation and Verification Test (SOVT) certification Other required deliverables (e.g. Plans of Action and Milestone (POA&M), monthly status reports etc.) for the performance locations defined in the task order (TO).

1.3 SCOPE

The scope of this contract covers the entire spectrum of outcomes associated with the full lifecycle of delivery and support of electronic security, physical security and surveillance-type deliverable products capabilities. This PWS covers requirements as it relates to electronic security, physical security and surveillance-type deliverable product experience with specific COTS solutions and variations of project environments that range in risk and complexity based on size and other factors. Support under this PWS includes supply requirements such as material, shipping, travel, project/program/engineering management, installation, and other technical support associated with the development and delivery of electronic security, physical security and surveillance-type deliverable products.

1.4 SPECIFIC TASKS

The contractor shall have the knowledge and skillset to incorporate the following elements as required in each task order of the IDIQ.

Site Survey: The contractor shall conduct a site survey to verify current site conditions, to include specific tasks as detailed in each resulting TO. The site surveys will consist of in-briefs

Page 4 of 18 Attachment 1 and checklist preparation as well as out-briefs and reports in accordance with TO requirements.

POA&M: The contractor shall develop a POA&M for all tasks and milestones associated with the TO and submit to the Government Technical Point of Contact (TPOC) and Contracting Officer (CO).

Task Order Status Report: The contractor shall provide a task order status report of all activities within the TO to the Government TPOC and CO, initially and at a recurring rate defined in the

TO.

IDP Development: The Contractor shall submit IDPs to the Government TPOC. The Government will require a minimum of five (5) business days to review and provide comments.

All changes will be incorporated into the 100% IDP.

Material Procurement: The contractor shall procure all equipment and material as defined in the

Government-approved IDP. The contractor shall submit a detailed major component material list to the Government TPOC and CO upon approval of the IDP with all high-level components and long-lead items, including but not limited to: control panels, input modules, enclosures, power supplies, IDS/ACS/CCTV devices, tamper switches, batteries, media converters, and switches. After approval, the contractor shall provide monthly material/inventory list that includes: manufacturer, model number, quantity, unit price, total price, contractor purchase request number, contractor purchase order number, shipping tracking information to the contractor�s facility, and shipping tracking information to the Government facility. In addition, the contractor shall be required to provide equipment warranties from Original Equipment Manufacturers (OEMs).

� All electronic equipment purchased for this effort will be compliant with Trade

Agreements Act (TAA) and 52.225-5 Trade Agreements.

Pre-Installation Test & Checkout (PITCO): The contractor shall inspect, conduct power tests, and other reasonable dead-on arrival tests for all applicable equipment to minimize any schedule delays with faulty equipment and materials, as well as serve as the warranty manager by tracking the applicable Government acceptance dates/receipt dates against the serial number of equipment.

Information Assurance: The contractor shall turnover all necessary accreditation documentation to the ESS sustainment contractor (if applicable). This includes but is not limited to: Updated topology/boundary diagram; Hardware and Software List with Firmware Versions & IP Addresses.

Installation: The contractor shall procure and install all equipment/materials as delineated in the specific TO. Installation will take place only after an approved 100% IDP has been delivered to the Government TPOC. The Contractor shall install field devices, make connections between head end location to newly installed field devices, and troubleshoot any communication connection issues between locations. The Contractor shall integrate into approved Monitoring Station (e.g. Vindicator Command and Control (VCC). The Contractor shall be responsible for procuring all the necessary miscellaneous and consumable components to ensure the system is functional and operational.

Page 5 of 18 Attachment 1

System Operational and Verification Test (SOVT): The contractor shall conduct testing and evaluation to ensure that all equipment and systems comply with the performance specifications outlined in the applicable technical manuals, test specifications and requirement documents.

Site Cleanup: The contractor shall keep the work area clean and dispose of any waste and excess debris off base, at the end of each workday.

Closeout Package: The contractor shall submit final turnover documentation, to include a task order closeout report. It shall include the as-built drawings, list of materials, equipment warranties, equipment data sheets, and completed SOVTs as required.

Training: The contractor shall provide operator training manuals and one-page quick reference guides for all systems installed. The contractor shall conduct training for the end-user at the Government site. The contractor shall prepare training course materials prior to conducting the training (to be identified at the TO level) via approval by the Government TPOC.

2.0 APPLICABLE DOCUMENTS (AND DEFINITIONS)

All work shall be accomplished using the most current commercial practices and acceptable industry standards. The applicable references and standards invoked will vary within individual projects and will be specifically called out in each TO. Where backward compatibility with existing systems is required, selected interoperability standards will be invoked by the Government TPOC. (Attachment

2) documents are not exclusive; however, meeting them when applicable to the TO is. The Contractor may request applicable documents from the Government TPOC or CO.

3.0 PERFORMANCE REQUIREMENTS

The following sections list anticipated support requirements throughout the contract life. Provide electronic security, physical security and surveillance-type deliverable products required by individual TOs pursuant to the general requirements specified herein. All activities performed as part of this contract shall be performed IAW best commercial practices and Government standards and regulations, as described herein and within each TO. Each TO will define the user requirements, equipment, supplies, technical specifications, personnel requirements, travel, engineering, Information Assurance (IA), project/program management, logistics, and any other requirements/support for completion of electronic security, physical security and surveillance-type deliverable products for Hurlburt Field.

3.1. TECHNICAL CAPABILITIES

Capabilities with typical electronic security, physical security and surveillance-type deliverable products, vendors, and related certifications necessary to perform work under this PWS as specified below. TOs placed under this IDIQ may require one (1) or more of the deliverable products listed in this section. This is not an all-inclusive list and does not limit the scope of this contract with regards to electronic security, physical security and surveillance-type deliverable products.

3.1.1 Electronic Security and Surveillance-type Equipment

The contactor shall provide functional and technical capabilities supporting of a wide range of access control, intrusion detection, video management, and any other equipment and software associated with

Page 6 of 18 Attachment 1 electronic security, physical security and surveillance-type deliverable products found on the U.S. Air Force Configuration Management Database (CMD) equipment list (Attachment 1) and other Commercial Off The Shelf (COTS) solutions that are accepted by the Government TPOC.

3.1.2 Services/Skill Set

The contractor shall provide functional and technical capabilities supporting a wide range of equipment and software associated with electronic security, physical security and surveillance-type deliverable products. These may include, but are not limited to:

a. Intrusion Detection Systems

b. Access Control Systems (ACS)

c. Closed Circuit Television (CCTV)

d. Relocatable Sensor Systems

e. Semi-Permanent fixed site, expeditionary, and mobile sensor solutions (AI/ML-enabled, layered approach to effects-based Integrated Base Defense)

f. Deployable CCTV Tower solutions

g. Waterside Security sensing solutions

h. Intelligent Video (IV)

i. Secure, scalable wireless mesh

j. Multiple-input multiple-output (MIMO) radio system

k. Wave Relay scalable networking capability

l. MANET (mobile ad-hoc network)

m. Cloud Relay

n. License Plate Recognition technologies

o. Under Vehicle Surveillance System

p. Vehicle Borne IED Detection

q. Perimeter Security Solutions

r. CCTV camera mounting solutions (fixed tubular poles, cabinet-based camera poles, cantilever poles, and Flat and Corner mounted Tilt-down Wall Poles)

s. Team Awareness Kit (TAK) enabled products

t. Passive and Active Barriers

u. Mobile Barrier solutions

v. Wrong Way Detection Systems

w. Ballistics Booths

x. Access Control Point Infrastructure and Construction

y. SCIF Construction

z. Threat, Vulnerability, and Risk Assessments

aa. IBDSS Procurement, Installation, Integration Testing, Training, and Documentation

bb. Electronic Security Systems Follow-on/Certification Training

cc. Electronic Security Systems Program Management and Administrative Support

dd. System Integrator for C-sUAS solutions providing detect, track and defeat effectors

ee. Sensing Solution Provider partner who does not retain data rights

ff. Advanced Wide Area Detection and Assessment capabilities

Equipment Certification

Provide experienced personnel as integrators, who are certified to install and maintain Honeywell Vindicator, Hirsch Velocity, and PSG VICADS. Furthermore, at least one team member must hold certifications demonstrating successful completion of all operation, administration, and maintenance courses for each system. The team must demonstrate experience with a minimum of five IBDSS installations within the past 72 months, including at least one Sensitive Compartmented Information Facilities (SCIF), one access control, and one CCTV installation incorporating video analytics.

Page 7 of 18 Attachment 1

Information Assurance

Provide DoD Risk Management Framework (RMF) artifacts for certification and accreditation of installed equipment for IA compliance of electronic security deliverable products:

a. IA Management Support Tasks

b. IA RMF Execution

c. Development of the Certification and Accreditation Plan

d. Implementation of Applicable Security Technical Implementation Guides (STIGs)

e. IA tools: Enterprise Mission Assurance Support Service (eMASS), Marine Corps Certification and Accreditation Support Tool (MCCAST), Assured Compliance Assessment Solution (ACAS), Security Content Automation Protocol (SCAP), Security Readiness Review (SRR) scripts, etc.

f. IA Collaboration

g. IA Testing and Validation

h. IA Execution: Vulnerability Remediation Asset Manager (VRAM), IAVMS (IA Vulnerability

Management System), etc.

3.2 DELIVERABLE PRODUCT ENVIRONMENT

TOs awarded under this contract may require support in one (1) or more of the complex environments listed below. This is a minimum list of unique environments and other conditions that adds to depth and complexity of product implementation. Additional environments can be introduced at the TO level. Provide resources with relevant knowledge and experience applicable to the following environments:

3.2.1 Information Assurance

Support the development of artifacts (plans, schedules, diagrams, and other related artifacts), performing IA scans, configuring systems, and providing support to satisfy DoD Risk Management Framework (RMF) certification and accreditation requirements. Provide support designing, delivering, integrating, and supporting electronic security, physical security and surveillance-type deliverable products to meet or exceed all applicable network and interoperability certifications, security policies and accreditations as delineated in the specific TO. In some instances, provide similar support for legacy electronic security, physical security and surveillance-type deliverable products accredited under the DoD IA Certification and Accreditation Program (DIACAP).

3.2.2 SCI Facilities

Provide support designing, delivering, securing, integrating, and supporting systems/solutions for Sensitive Compartmented Information Facilities (SCIF) environments as applicable at the TO level IAW Intelligence Community Directive (ICD) 705, Intelligence Community (IC) Tech Spec for ICD/ICS 705, IC Standard Number 705-1, and IC Standard Number 705-2, CNSSAM TEMPEST/1- 13 (latest edition).

3.2.3 Special Access Programs/Special Access Areas

Provide support designing, delivering, integrating, and supporting electronic security, physical security and surveillance-type deliverable products for special access program spaces or special access areas as applicable at the TO level IAW Intelligence Community Directive (ICD) 705, Intelligence Community (IC) Tech Spec for ICD/ICS 705, IC Standard Number 705-1, and IC Standard Number 705-2, CNSSAM TEMPEST/1-13 (latest edition).

3.2.4 Resource Escalation

Provide scalable and surge support for designing, delivering, installing, integrating, and supporting

Page 8 of 18 Attachment 1 associated electronic security, physical security and surveillance-type deliverable products that include resource challenges based on variations in program/project size, schedule, site conditions and number of locations, and requirement variations for single systems distributed across multiple locations. The periods for escalated support may be short in duration to respond to specific electronic security, physical security and surveillance-type deliverable products requirements or extended over a period of time to respond to broader threats in USNORTHCOM AOR.

3.3 DELIVERABLE PRODUCTS

This contract considers the life cycle of any given system and its relationship with other systems, with the objective of obtaining supplies and incidental support services for deliverable products at the TO level. This system of systems approach will integrate functional and operational activities in the most technically proficient and cost-effective manner. These electronic security, physical security and surveillance-type deliverable products include primarily commercial systems as referenced in Section

3.1 but will also include modified commercial systems and military specification systems as required by the TO. Ensure electronic security, physical security and surveillance-type deliverable products and all necessary actions for implementation to meet environmental requirements for transportation, storage, and operation at Hurlburt Field as required by the TO.

As required under each TO, provide turn-key deliverable products to meet end-user needs. The contractor shall provide electronic security, physical security and surveillance-type deliverable products IAW the performance characteristics, interoperability, and interfaces as specified at the TO level. The contractor shall implement and maintain a Quality Assurance (QA) system for electronic security, physical security and surveillance-type deliverable products identified (but not limited to) the CMD (Attachment 1).

3.3.1 Supplies

The following sections describe and are representative, though not all encompassing, of the electronic security, physical security and surveillance-type deliverable products the contractor shall be required to deliver or support in a TO awarded under this contract:

3.3.1.1 Intrusion Detection Deliverable Products

When required at the TO level, the contractor shall survey, analyze, design, develop, procure, fabricate, integrate, deliver, install, test, and train site personnel for intrusion detection efforts at Hurlburt Field. This may include an expansion, upgrade, or replacement of the existing product, or the provision of a new intrusion detection/electronic security system.

3.3.1.2 Access Control Systems (ACS) Deliverable Products

fabricate, integrate, deliver, install, test, and train site personnel for access control at Hurlburt Field.

This may include an expansion, upgrade, or replacement of the existing product, or the provision of a new access control.

3.3.1.3 Video Surveillance / CCTV Deliverable Products

fabricate, integrate, deliver, install, test, and train site personnel for video surveillance/CCTV efforts at Hurlburt Field. This may include an expansion, upgrade, or replacement of the existing capability, or the provision of a new video surveillance/CCTV deliverable product.

3.3.1.4 Physical Security Information Management (PSIM) Deliverable Products fabricate, deliver, integrate, install, test, and train PSIM deliverable products at Hurlburt Field. This may include an expansion, upgrade, or replacement of the existing product, or the provision of a new

Page 9 of 18 Attachment 1

Statement (PWS)

PSIM deliverable product.

3.3.1.5 Physical Security Deliverable Products

When required at the TO level, the contractor shall survey, analyze, design, develop, procure, fabricate, deliver, integrate, install, test, and train Physical Security efforts at Hurlburt Field. This may include an expansion, upgrade, or replacement of an existing Physical Security products, or the provision of a new deliverable product.

3.3.1.6 Counter drone Deliverable Products

When required at the TO level, the contractor shall survey, analyze, design, develop, procure, fabricate, deliver, integrate, install, test, and train counter drone efforts at Hurlburt Field. This may include an expansion, upgrade, or replacement of existing counter drone products, or the provision of a new deliverable product.

3.3.1.7 Contractor Furnished On-site Storage Space

The contractor shall comply with the installation site security documents, such as a construction security plan or logistics security plan, where applicable. For equipment and material to be stored at the installation site, the contractor shall provide a secure space, and/or request and be authorized Government space that meets storage requirements at the TO level.

3.3.2 Other Requirements

3.3.2.1 Program Management (PM)

As required at the TO level, the contractor shall provide PM support to ensure adherence to all technical requirements of the required electronic security, physical security and surveillance-type systems.

3.3.2. Program Support

Some programs require a contractor to work closely with the Government program manager and/or the Government TPOC to support the needs of the program. As directed in TOs, coordinating meetings, developing agenda items, attending high-level meetings, generating minutes, and tracking action items shall be required.

3.3. 3 Cybersecurity Personnel The contractor personnel performing cybersecurity functions shall meet all cybersecurity training, certification, and tracking requirements as cited in DoD 8570.01-M prior to accessing DoD information systems. All completed training will need to be submitted to the TPOC and Contracting Officer.

3.3. Cybersecurity Design Requirements

The contractor shall ensure any equipment/system installed or integrated into US Government platform(s) meets the cybersecurity requirements as specified under DoDI 8500.01 (latest edition/revision).

4.0 SECTION 508 ACCESSIBILITY STANDARDS

The following Section 508 Accessibility Standard(s) (Technical Standards and Functional Performance Criteria) are applicable (if box is checked).

1194.21 - Software Applications and Operating Systems

1194.22 - Web Based Intranet and Internet Information and Applications

Page 10 of 18 Attachment 1

Statement (PWS)

1194.23 - Telecommunications Products

1194.24 - Video and Multimedia Products

1194.25 - Self-Contained, Closed Products

1194.26 - Desktop and Portable Computers

1194.41 - Information, Documentation and Support

The standards above facilitate the assurance that the maximum technical standards are provided to the contractor. Functional performance criteria are the minimally acceptable standards to ensure Section 508 compliance. Blocks checked are to ensure that the minimally acceptable Electronic and Information Technology (E&IT) products are proposed.

5.0 CONTRACT ADMINISTRATION

Contract Administration is required for all TOs; it provides the Government a means for contract management and monitoring. Regardless of the level of support, the ultimate objective of the contractor is ensuring the Government�s requirements are met, delivered on schedule, and performed within budget.

5.1 CONTRACT LIAISON

Assign a program manager (PM), who shall work closely with the CO and Government TPOC. The contractor PM, located in the contractor�s facility, shall ultimately be responsible for ensuring that the contractor�s performance meets all Government contracting requirements within cost and schedule.

The contractor PM shall have the requisite authority for full control over all company resources necessary for contract performance. The contractor PM shall have authority to approve TO proposals or modifications in emergent situations. The contractor PM shall be responsible for, but not limited to, personnel management and personnel/facility security. In support of open communication, the contractor PM shall meet with specified Government TPOC(s) on a monthly (or as required) basis to discuss electronic security, physical security and surveillance-type deliverable products progress at Hurlburt Field for all active TOs issued as part of this contract. The contractor PM shall establish a centralized monthly (or as required) meeting schedule with Government TPOC(s) as part of the POA&M at the TO level.

5.2 SERVICES SUMMARY:

Performance Objectives Performance Thresholds PWS Para #

1 Material Procurement IAW Regulations (TAA Compliance, etc.)

100% Compliance 1.4

2 Pre-installation and Post-Installation Testing

100% Compliance 1.4

3 Information Assurance/Security

100% Compliance 1.4; 7.3

4 Site Cleanup No more than 2 valid customer complaints per month

1.4

5 Training 100% Compliance 1.4 6 Cybersecurity 100% Compliance 3.3.2.3 and

3.3.2.4 7 Quality Assurance (QA)

IAW Contractor QCP No more than 1 instance of non-compliance, validated by COR

6.1

Page 11 of 18 Attachment 1

5.3 COR SURVEILLANCE: The COR will inspect and evaluate the Contractor�s performance objectives to ensure materials are received in accordance with requirements set forth in this PWS.

The COR will inspect by validating actual work performance, checking management information reports, investigating customer complaints, conferring with end users or otherwise inspecting the task results to determine whether performance meets the standards contained in this PWS. The COR may use a random inspections and customer complaints to perform surveillance. Results of the surveillance will be recorded and become the official Air Force record of the Contractor�s performance. The COR is authorized to designate personnel who are authorized to obtain materials from the on-base store. The COR performs technical surveillance over the operation of the store and performs other duties as authorized and required by the CO.

6.0 QUALITY

Upon contract award, the prime contractor shall have and maintain a Quality Assurance (QA) process that meets contract requirements and program objectives while ensuring customer satisfaction and delivery of defect-free electronic security, physical security and surveillance-type deliverable products. The contractor shall have sufficiently documented quality efforts that contain procedures, planning, and all other documentation and data necessary to provide an efficient and effective quality product based on a contractor�s internal auditing system. Ten (10) calendar days after the contract award, the contractor shall provide the Government with a copy of its Quality Assurance Plan (QAP) and any other quality-related documents as specified at the TO level.

If any quality documentation is disapproved or requires revisions, the contractor shall correct the problem(s) and submit revised documentation to the Government TPOC and CO NLT 5 calander days after initial disapproval notification. The contractor shall also require all subcontractors to ensure QA commensurate with electronic security, physical security and surveillance-type deliverable products provided as determined by the prime contractor�s internal audit system. The Government reserves the right to disapprove the contractor�s and/or subcontractor�s QA or portions thereof when the QA fails to meet contractual requirements at either the program or worksite services level. The Government reserves the right to participate in the process improvement elements of the contractor�s QAP and development of quality related documents (as needed). At a minimum, the contractor shall ensure their quality system meets the following key criteria:

Establish documented, capable, and repeatable processes Track issues and associated changes needed Monitor and control critical product and process variations Establish mechanisms for feedback of field product performance Implement and effective root-cause analysis and corrective action system Establish methods and procedures for continuous process improvement

6.1 QUALITY ASSURANCE

The contractor shall perform all quality assurance process audits necessary in the performance of the various tasks as assigned and identified by the respective quality system and the contractor shall deliver related quality plan/procedural documents upon request. The Government reserves the right to perform any additional audits deemed necessary to assure that the contractor processes and related installation, documents, and material meet the prescribed requirements and to reject any or all

Page 12 of 18 Attachment 1 processes or related services, documents, and material in a category when noncompliance is established.

7.0 DOCUMENTATION AND DELIVERABLES

7.1 CONTRACT DELIVERABLES

The following list identifies the deliverables required under this contract. The contractor shall establish and track the required deliverables as applicable under each TO. The contractor shall not develop any data deliverable classified TOP SECRET with Sensitive Compartmented Information (SCI).

Deliverable Description

Material Inspection and Receiving Report/Inventory Tracking Report Warranty Tracking and Administration for Serialized Item Report

Failure Status Repair Report Program Management Reports Plan of Action and Milestones

General Documentation / Technical Reports RMF Artifacts

TO Status Report TO Closeout Report

QAP/Quality Documentation OPSEC Standing Operating Procedure

IDPs & As-Built Installation, SOVT, PITCO, Training

7.2 ELECTRONIC FORMAT

Provide deliverables electronically by email. To ensure information compatibility, the contractor shall guarantee all deliverables, data, correspondence, etc., are provided in a format approved by the receiving Government representative. The contractor shall provide all data in an editable format. The initial or future upgrades costs of the listed computer programs are not chargeable as a direct cost to the Government.

7.3 INFORMATION SYSTEM

7.3.1 Information Security

Provide adequate security for all unclassified DoD information per DoDM 5200.01 passing through non-DoD information system including all subcontractor information systems utilized on contract.

The contractor shall disseminate unclassified DoD information within the scope of assigned duties and with a clear expectation that confidentiality is preserved. Examples of such information include the following: non-public information provided to the contractor, information developed during the course of the contract, and privileged contract information (e.g., program schedules, contract-related tracking, etc.).

7.3.1.1 Safeguards

The contractor shall protect Government information and shall provide compliance documentation.

The contractor and all utilized subcontractors shall abide by the following safeguards:

Page 13 of 18 Attachment 1

(a) Do not process DoD information on public computers (e.g., those available for use by the general public in kiosks or hotel business centers) or computers that do not have access control.

(b) Protect information by at least 1 physical or electronic barrier (e.g., locked container or room, login and password) when not under direct individual control.

(c) Sanitize media (e.g., overwrite) before external release or disposal.

(d) Encrypt all information that has been identified as controlled unclassified information (CUI) when it is stored on mobile computing devices such as laptops and personal digital assistants, or removable storage media such as portable hard drives and digital optical disks, using DoD Authorized Data-at-Rest encryption technology. NOTE: Thumb drives are not authorized for DoD work, storage, or transfer. Use GSA Awarded DAR solutions (GSA # 10359) complying with ASD- NII/DOD-CIO Memorandum, �Encryption of Sensitive Unclassified Data-at-Rest on Mobile Computing Devices and Removable Storage.� The contractor shall ensure all solutions meet FIPS 140-2 compliance requirements.

(e) Limit information transfer to subcontractors or teaming partners with a need to know and a commitment to at least the same level of protection.

(f) Transmit e-mail, text messages, and similar communications using technology and processes that provide the best level of privacy available, given facilities, conditions, and environment.

Examples of recommended technologies or processes include closed networks, virtual private networks, public key-enabled encryption, and Transport Layer Security (TLS). Encrypt organizational wireless connections and use encrypted wireless connections where available when traveling. If encrypted wireless is not available, encrypt application files (e.g., spreadsheet and word processing files), using at least application-provided password protection level encryption.

(g) Transmit voice and fax transmissions only when there is a reasonable assurance that access is limited to authorized recipients.

(h) Do not post DoD information to web-site pages that are publicly available or have access limited only by domain or Internet protocol restriction. Such information may be posted to web-site pages that control access by user identification or password, user certificates, or other technical means and provide protection via use of TLS or other equivalent technologies. Access control may be provided by the intranet (vice the website itself or the application it hosts).

(i) Ensure electronic security, physical security and surveillance-type deliverable products provided, provide protection against computer network intrusions and data exfiltration, minimally including the following:

Current and regularly updated malware protection (e.g., anti-virus, anti-spyware).

Evaluation of inbound and outbound network traffic as appropriate (e.g., at the external boundary, sub-networks, individual hosts) to include blocking unauthorized ingress, egress, and exfiltration through technologies such as firewalls and router policies, intrusion prevention or detection services, and host-based security services.

Prompt application of security-relevant software patches, service packs, and hot fixes.

(j) Ensure compliance other current Federal and DoD information protection and reporting

Page 14 of 18 Attachment 1 requirements for specified categories of information (e.g., medical, critical program information (CPI), personally identifiable information, export controlled, etc.).

(k) Report loss or unauthorized disclosure of information IAW contract or agreement requirements and mechanisms.

7.3.1.2 Compliance

The contractor shall include in their QAP procedures that are compliant with information security requirements per DoDM 5200.01.

8.0 SECURITY

8.1 ORGANIZATION

8.1.1 Security Classification

Classified work shall be performed under this contract as specified at the TO level. Approximately 50% of IBDSS support projected to be performed at Hurlburt Field will be for classified facilities.

U.S. Government security clearance eligibility is required to access and handle classified and certain CUI, attend program meetings, and/or work within restricted areas unescorted. Access to SCI will be limited to U.S. Government Facilities or other U.S. Government sponsored SCIFs authorized on the DD Form 254. The contractor shall not generate any SCI deliverables. SCI access will not be required for all TOs and will be addressed in the order level PWS as required.

8.2 PERSONNEL

The contractor shall conform to the security provisions of DoDI 5220.22/DoD 5220.22-M � National Industrial Security Program Operating Manual (NISPOM), DoD 8570.01-M, and the Privacy Act of 1974. Prior to any labor hours being charged on contract, the contractor shall ensure all personnel (including administrative and subcontractor personnel) have obtained and can maintain favorable background investigations at the appropriate level(s) for access required for the DO, and if applicable, are certified/credentialed for the CSWF. A favorable background determination is determined by either a National Agency Check with Inquiries (NACI), National Agency Check with Law and Credit (NACLC), or Single Scope Background Investigation (SSBI) and favorable Federal Bureau of Investigation (FBI) fingerprint checks. Investigations are not necessarily required for personnel performing unclassified work who do not require access to Government installations/facilities, Government IT systems and IT resources. Cost to meet these security requirements is not directly chargeable to a TO.

8.2.1 Personnel Clearance

Individual TOs issued against this contract may require personnel having higher clearance levels such as SECRET. Prior to starting work on the TO, contractor personnel shall have the required clearance granted by the DoD Consolidated Adjudications Facility (DoD CAF) and shall comply with IT access authorization requirements. In addition, contractor personnel shall possess the appropriate IT level of access for the respective task and position assignment as required by DoDI 8500.01, Cybersecurity. Any future revision to the respective directive and instruction shall be applied to the TO level as required. Contractor personnel shall handle and safeguard any CUI and/or classified information IAW DoD or U.S. Air Force security regulations. The contractor shall immediately report any security violation to the Security Management Office and the Government

Page 15 of 18 Attachment 1

TPOC. Foreign national employees employed in their home countries shall meet equivalent host U.S. Installation Command security requirements.

8.2.2 Security Documentation

The details of any and all security documentation maintained and developed under this contract will become and remain the property of the government.

8.2.3 Base Access

Contractor employees shall provide information to assist in the completion of background checks for employees requiring access to Hurlburt Field. This information shall consist of but is not limited to full name (first, middle, last), social security number, date of birth, address, driver�s license number and state of issue, number of years residency in the state of Florida. This information will be protected under the procedures listed in the Privacy Act of 1974. A background check must be completed prior to access to Hurlburt Field.

If the background check reveals a contractor employee or prospective employee with an adverse criminal history or as a potential threat to the health, safety, operational mission of the installation, then the Government reserves the right to restrict or deny access to Hurlburt Field for that individual.

Upon the termination of employment or termination/cancellation of this contract, the contractor is responsible for collecting the installation access passes. The contractor shall collect the installation access passes the same day employment of an individual has expired/terminated, and shall return them to the issuing office within 3 workdays.

The contractor is ultimately responsible to return all employee base passes to the CO, COR, or COR if employees are terminated or no longer employed for this agreement. If base pass cannot be returned, the Contractor must report the First and Last Name, Date of Birth, and the reason they are no longer employed to the CO, COR, or HAC manager within three (3) calendar days of termination or absence of leave.

8.2.3.1 CAC Requirements

Before the Government will issue a CAC to a contractor employee, the contractor shall provide, at a minimum, a favorably adjudicated National Agency Check with Inquiries (NACI) or an equivalent or higher investigation IAW AFI 10-701 concerning the contractor employee. The contractor employee will be issued a CAC only if duties involve one (1) of the following: (1) Both physical access to a DoD facility and access, via logon, to DoD networks on-site or remotely; (2) Remote access, via logon, to a DoD network using DoD-approved remote access procedures; or (3) Physical access to multiple DoD facilities or multiple non-DoD federally controlled facilities on behalf of the DoD on a recurring basis for a period of 6 months or more. At the discretion of the sponsoring activity, the Government may issue the contractor employee an initial CAC based on a favorable review of the FBI fingerprint check and a successfully scheduled NACI at the Office of Personnel Management.

When When a contractor requires logical access to a government IT system or resource (directly or indirectly), the required CAC shall have a Public Key Infrastructure (PKI). A hardware solution and software (e.g., ActiveGold) are required to securely read the card via a personal computer. As required by DoDM 1000.13-M-V1, CAC PKI certificates shall be associated with an official government issued email address (e.g., .mil, .gov, .edu). Prior to receipt of a CAC with PKI, contractor personnel shall complete the mandatory Cybersecurity Awareness training and submit a signed System Authorization Access Request (SAAR) form to the Government TPOC. Note: In order for personnel to maintain a CAC with PKI, each contractor employee shall complete annual cybersecurity training. The following guidance for training and form submittal is provided;

however, contractor personnel shall seek the latest guidance from their appointed company Security Officer and the Information Assurance Management (IAM) office:

Page 16 of 18 Attachment 1

1. The contractor will be required to complete annual DoD Cybersecurity/IA Awareness training � the Government TPOC will provide applicable training website to complete this requirement.

2. For SAAR-N form. Contractors can obtain a form from the Government TPOC.

8.2.4 Security Training

Regardless of the contract security level required, the contractor shall be responsible for verifying applicable personnel (including subcontractors) receive all required training. At a minimum, the contractor�s designated Security Officer shall track the following information: security clearance information, dates CACs issued & expired dates of badges, Cybersecurity training, Privacy Act training, Personally Identifiable Information (PII) training, and CSWF certifications, etc. The contractor shall educate employees on the procedures for the handling and production of classified material and documents, and other security measures as described in the PWS IAW DoD 5220.22M.

The contractor and all associated subcontractors will brief all employees on the types of behavior to watch for and instruct employees to report suspicious activity to the Government TPOC. This training (specified by the requiring activity ATO) will be completed within 30 calendar days after the contract is awarded and within 30 calendar days after new employees commence contract performance, with the results reported to the Government TPOC within 45 calendar days after the contract is awarded.

Specific AOR training content may be directed by the local Commander at locations cited at the TO level.

8.2.5 Disclosure of Information

Contractor employees shall not discuss or disclose any information provided to them in the performance of their duties to parties other than authorized Government and contractor personnel who have a "need to know". The contractor shall not use any information or documentation developed by the contractor under the direction of the Government for other purposes without the consent of the

CO.

8.3 OPERATIONS SECURITY REQUIREMENTS

Contractor personnel, including subcontractors if applicable, shall adhere to the OPSEC program policies and existing local site OPSEC procedures. The contractor shall develop their own internal OPSEC program specific to the contract and based on OPSEC requirements. At a minimum, the contractor�s program shall identify the current site OPSEC Officer/Coordinator.

All contractor employees with access to a Government information system must be registered IAW applicable Government guidance prior to TO performance and shall complete all DoD IA Awareness training (see PWS Section 8.2.3.1) prior to access to Government information systems.

8.3.1 OPSEC Training

The contractor shall track and ensure applicable personnel receive initial and annual OPSEC awareness training. Training may be provided by the Government or a contractor�s OPSEC Manager.

Contractor training shall, as a minimum, review OPSEC as it relates to contract work, and discuss the Critical Information applicable in the contract/TO. The contractor shall ensure any training materials developed by the contractor shall be reviewed by the OPSEC Officer, who will ensure it is consistent with OPSEC policies. OPSEC training requirements are applicable for personnel during their entire

Page 17 of 18 Attachment 1 term supporting this contract.

8.3.2 OPSEC Program

IF stated in the TO the contractor shall participate in OPSEC program briefings and working meetings provided by the Government and shall complete any required OPSEC survey or data call within the timeframe specified.

All contractor employees shall complete annual OPSEC awareness training at Hurlburt Field.

8.4 DATA HANDLING AND USER CONTROLS

8.4.1 Data Handling

At a minimum, the contractor shall handle all data received or generated under this contract as Controlled Unclassified Information (CUI) material. The handling of any classified information received or generated by the contractor shall be IAW the DD Form 254 and in compliance with all applicable TO references and with any other applicable Government policies and procedures that include DoD/U.S. Air Force.

The contractor shall comply with The Security Agreement (DD Form 441), including DoD 5220.22- M and any revisions, notice of which has been provided to the contractor.

8.4.2 Effective Use of Controls

The contractor shall screen all electronic deliverables or electronically provided information for malicious code using DoD approved anti-virus software prior to delivery to the Government. The contractor shall utilize appropriate controls (firewalls, password protection, encryption, digital certificates, etc.) at all times to protect contract related information processed, stored, or transmitted on the contractor�s and Government�s computers/servers to ensure confidentiality, integrity, availability, authentication, and non-repudiation. This includes ensuring that provisions are in place that will safeguard all aspects of information operations pertaining to this contract in compliance with all applicable SOW references. The contractor shall ensure Data-at-Rest is required on all portable electronic devices including storage of all types. Encryption/digital signing of communications is required for authentication and non-repudiation.

9.0 SAFETY ISSUES

9.1 OCCUPATIONAL SAFETY AND HEALTH REQUIREMENTS

The contractor shall be responsible for ensuring the safety of all contractor employees and other working personnel. The contractor is solely responsible for compliance with the Occupational Safety and Health Act (OSHA) (Public Law 91-596) and the resulting applicable standards, OSHA Standard 29 CFR 1910 (general) and 1926 (shore), and for the protection, safety and health of their employees and any subcontractor employees assigned to the respective TOs under this contract. Without Government assistance, the contractor shall make certain that all safety requirements are met, safety equipment is provided, and safety procedures are documented as part of their quality management system.

9.1.1 Performance at Government facilities

The contractor shall immediately report any incidents involving Government or contractor personnel injuries or property/equipment damage to the CO and the Government TPOC. Additionally, the contractor is responsible for securing the scene and impounding evidence/wreckage until released by the CO.

Page 18 of 18 Attachment 1

9.2 SAFETY EQUIPMENT

The contractor shall provide their personnel with any safety equipment required to perform work under this contract and the equipment must be in satisfactory working order. Personal safety equipment includes, but not be limited to -- hard-hats, safety shoes, safety gloves, goggles, hearing protection, non-flammable clothing for hot work personnel, gas/oxygen detectors for confined spaces, face shields, and other types of safety equipment required to ensure a safe work environment and compliance with applicable country safety regulations.

9.3 SAFETY TRAINING

The contractor shall be responsible for training all personnel that require safety training. Specifically, where contractors are required to enter manholes or underground services utilities, the contractor shall provide a qualified person as required in 29 CFR 1910 or 29 CFR 1926 or as recommended by the National Institute for Occupational Safety and Health (NIOSH) Criteria Document for Confined Spaces. Also, when contractor employees are required to scale a tower, all applicable personnel shall have Secondary Fall Protection and Prevention training.

10.0 ACCEPTANCE PLAN

Inspection and acceptance is performed by the Government TPOC identified at the TO level and reported to the CO.