FA524024R0003 Attachment 1 - Performance Work Statement (PWS).pdf

FA524024R0003 HVAC Direct Digital Controls (DDC) Maintenance Services Attachment 1 – Performance Work Statement

Ver. October 2023

PERFORMANCE WORK STATEMENT (PWS)

FOR

HVAC Direct Digital Controls (DDC) maintenance Services

Andersen Air Force Base, Guam

October 2023

Ver. October 2023

1.0 General:

1.1 Scope: The contractor shall provide all personnel, equipment, tools, materials, supervision, and quality control necessary, except as specified in Paragraph 3.0 as Government Furnished, to perform preventative maintenance visits, automation network review/testing, system security evaluations, and system security support required as defined in this PWS.

This requirement signifies a full-service maintenance contract where the contractor takes total service responsibility for all equipment and services identified. The fixed price includes all inspections, maintenance, repairs, and certifications. The contractor assumes all responsibility for preventative maintenance operations to ensure the DDC properly and safely operates within the performance objectives in the Performance Requirements Summary.

Work conducted on the DDC systems shall be In Accordance With (IAW) applicable references listed in Paragraph 6.0, industry standards, and the recommendations of the Original Equipment Manufacturer (OEM).

1.2 Period of Performance (PoP): The Period of Performance shall be one (1) Base Year of twelve (12) months and four (4) option years of twelve (12) months.

Base Year: 30 November 2024 – 31 October 2025 Option Year 1: 30 November 2025 – 31 October 2026 Option Year 2: 30 November 2026 – 31 October 2027 Option Year 3: 30 November 2027 – 31 October 2028 Option Year 4: 30 November 2028 – 31 October 2029

1.3 General Information:

1.3.1 Place and Performance of Services: The contractor shall provide services between the hours of 7:30 a.m. to 4:30 p.m. on Monday through Friday except on recognized US holidays or when the Government facility/installation is closed due to local or national emergencies, administrative closings, or similar Government-directed facility/installation closings. The Contracting Officer’s Representative (COR) or Contracting Officer (CO) must approve in advance, excluding legal holidays, any exceptions to work hours and designated workdays. The contractor must submit a “Request to Work Outside Normal Hours Worksheet” (Technical Exhibit 3), 15 days prior to any work commencing. The performance shall be at AAFB, Guam.

The contractor shall at all times maintain an adequate work force for the uninterrupted performance of all tasks defined within this PWS when the Government facility/installation is not closed for the above reasons. When hiring personnel, the contractor shall keep in mind that the stability and continuity of the work force are essential. Teleworking is not authorized.

1.3.1.1 Telework: The Government does not permit the contractor to telework in support of this requirement. In furtherance of Continuity of Operations Planning (COOP), a telework program may be enacted to ensure that the Government's mission-critical operations stay operational during times of national emergency or incidents of national significance. Telework shall be at no additional cost to the Government.

1.3.1.2 Unscheduled gate closures by the Security Police may occur at any time causing all personnel entering or exiting a closed installation to experience a delay. This cannot be predicted or prevented. Contractors are not compensated for unexpected closures or delays. Vehicles operated by contractor personnel are subject to search pursuant to applicable regulations. Any moving violation of any applicable motor vehicle regulation may result in the termination of the contractor employee’s installation driving privileges.

1.3.1.3 The contractor’s employees shall become familiar with and obey the regulations of the installation, including fire, traffic, safety, and security regulations while on the installation.

Contractor employees should only enter restricted areas when required to do so and only upon prior approval. All contractor employees shall carry proper identification with them at all times and shall be subject to such checks as may be deemed necessary. The contractor shall ensure compliance with all regulations and orders of the installation, which may affect performance.

The Government reserves the right to direct the removal of an employee from Government property or revoke access to Government systems for misconduct, security reasons, or any overt evidence of communicable disease. Removal of contractor employees for reasons stated above does not relieve the contractor from responsibility for total performance of this contract.

1.3.2 Recognized Holidays: The following are recognized United States (US) holidays. The contractor shall not perform services on these days (except where otherwise specified in this PWS, i.e., emergencies):

1.3.2.1 New Year’s Day: January 1st

1.3.2.2 Martin Luther King, Jr.’s Birthday

1.3.2.3 President’s Day

1.3.2.4 Memorial Day

1.3.2.5 Juneteenth National Independence Day: June 19th

1.3.2.6 Independence Day: July 4th

1.3.2.7 Labor Day

1.3.2.8 Columbus Day

1.3.2.9 Veteran’s Day: November 11th

1.3.2.10 Thanksgiving Day

1.3.2.11 Christmas Day: December 25th

1.3.3 Quality Control (QC): The contractor shall develop and maintain an effective Quality Control Plan (QCP) to ensure services are performed in accordance with this PWS, applicable standards, and codes listed in references in Paragraph 6.0. The contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The contractor’s QCP is the means by which it assures itself that its work complies with the requirements of the contract. As a minimum, the contractor shall develop QC procedures that address the areas identified in Technical Exhibit 1, Performance Requirements Summary (PRS).

The QCP shall demonstrate how the contractor ensures quality performance during the contract period of performance. The contractor shall maintain the QCP throughout the period of performance of the contract. The COR/CO shall be provided updates to the QCP as they occur during the period of performance and provide all updates to the QCP to the within two (2)

Ver. October 2023 business days. The QCP shall identify the procedures in writing for inspections, individual responsible, periodic inspection (PI) & preventive maintenance (PM) program, and the location of all inspection records and key control logs which shall always be available to the government upon request. The QCP shall have the inspection forms and records which shall be used for the service. The contractor shall identify to the CO/COR the responsible quality control inspector to notify in case of customer complaints. A final QCP shall be submitted to the COR NLT 10 days after contract award. After acceptance of the QCP, the contractor shall obtain the Contracting Officer’s acceptance in writing of any proposed changes to its QCP.

1.3.4 Quality Assurance (QA): The Government will evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan is primarily focused on what the Government will do to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and acceptable quality level(s) or defect rate(s).

1.3.5 Access and General Protection/Security Policy and Procedures. The contractor shall comply with all applicable installation/facility access and local security policies and procedures, which may be obtained from the COR/CO. The contractor shall also provide all information required for background checks to meet installation access requirements to be accomplished by the local installation’s Security Forces, Director of Emergency Services or local Security Office.

The contractor shall ensure compliance with all personal identity verification requirements as directed by DoD, Headquarters Air Force (HAF) and/or local policy. Should the Force Protection Condition (FPCON) change, the Government may require changes in contractor security matters or processes.

1.3.5.1 The contractor shall obtain base identification and vehicle passes, if required, for all contractor personnel who make frequent visits to or perform work on the Air Force installation(s) cited in the contract. Contractor personnel are required to wear or prominently display installation identification badges or contractor-furnished, contractor identification badges while visiting or performing work on the installation.

1.3.5.2 The contractor shall submit a written request on company letterhead to the contracting officer listing the following: contract number, location of work site, start and stop dates, names of employees and subcontractor employees, and level of security clearance needing access to the base. The letter will also specify the individual(s) authorized to sign for a request for base identification credentials or vehicle passes. The CO will endorse the request and forward it to the issuing base pass and registration office or Security Forces for processing. When reporting to the registration office, the authorized contractor individual(s) should provide a valid driver s license, current vehicle registration, and valid vehicle insurance certificate to obtain a vehicle pass.

1.3.5.3 During performance of the contract, the contractor shall be responsible for obtaining required identification for newly assigned personnel and for prompt return of credentials and vehicle passes for any employee who no longer requires access to the work site.

Ver. October 2023

1.3.5.4 When work under this contract requires unescorted entry to controlled or restricted areas, the contractor shall comply with AFI 31-101, Integrated Defense, and DODMAN5200.02_AFMAN 16-1405, Air Force Personnel Security Program.

1.3.5.5 Upon completion or termination of the contract or expiration of the identification passes, the prime contractor shall ensure that all base identification passes issued to employees and subcontractor employees are returned to the issuing office.

1.3.5.6 Failure to comply with these requirements may result in withholding of final payment.

1.3.5.7 For contractors that do not require CAC but require access to a DoD Facility and/or Installation. The contractor and all associated sub-contractors’ employees shall comply with adjudication standards and procedures using the National Crime Information Center Interstate Identification Index (NCIC-III) and Terrorist Screening Database (TSDB) (Air Force Instruction (AFI) 10-245, AFI 31-101 and Air Force Manual (AFMAN) 31-113), applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by Government representative)

1.3.5.8 All contractor personnel shall obtain access to the installation by participating in the Defense Biometric Identification System (DBIDS) or by obtaining passes each day from the Base Pass and Identification Office. Cost for obtaining passes through the DBIDS program is the responsibility of the contractor. One-day passes, issued through the Base Pass and Identification Office, will be furnished without charge.

1.3.5.9 The contractor shall furnish a completed Employment Eligibility Verification (DHS FORM I-9) form for all personnel requesting badges. This form is available at http://www.uscis.gov/portal/site/uscis by searching or selecting Employment Verification (Form I-9). Immediately report instances of lost or stolen badges to the Contracting Officer. All contractor personnel shall obtain access to the installation by obtaining passes from the AAFB Visitor Control Center for Andersen Air Force Base, Guam properties.

1.3.5.10 Requirement for OPSEC Training. In accordance with AFI 10-701, Operations Security, OPSEC PMs/Signature Managers/Coordinators will provide OPSEC training or training materials to contract employees within 30 days of employees’ initial assignment to the contract and prior to having access to any critical information (CI) and annually thereafter.

General organizational orientations may need to be supplemented by duty-related orientations in the work center targeted toward specific critical information and vulnerabilities associated with the work. Initial training (OPSE 1301 - OPSEC Fundamentals) is located on the ADLS website and refresher OPSEC training is conducted annually (at Commander's Call). The contractor shall submit certificates of completion for each contractor employee to the COR within 15 calendar days after completion of training. As required if AAFB Security Forces determines the need for access to the installation.

1.3.5.11 Company Vehicle Identification. The company name and logo shall be displayed on each of the contractor's vehicles in a manner and size that is clearly visible. All vehicles shall display a valid Guam license plate that complies with the Guam Vehicle Code. Vehicles shall meet all other requirement of the Guam Vehicle Code, such as safety standards, and shall carry http://static.e-publishing.af.mil/production/1/af_a4/publication/afi31-101/generic_wms.pdf https://static.e-publishing.af.mil/production/1/saf_aa/publication/dodman5200.02_afman16-1405/dodm5200.02_afman16-1405.pdf

Ver. October 2023 proof of insurance and Guam registration, if applicable. All vehicles shall be maintained with a clean and orderly appearance. Vehicles shall not be cleaned, washed, or rinsed off on Government property or facilities.

1.3.5.12 Communications Security/Information Technology (COMSEC/IT) Security. All communications with DoD organizations are subject to COMSEC review. All telephone communications networks are continually subject to intercept by unfriendly intelligence organizations. DoD has authorized the military departments to conduct COMSEC monitoring and recording of telephone calls originating from, or terminating at, DoD organizations.

Therefore, the contractor is advised that any time contractor personnel place or receive a call they are subject to COMSEC procedures. The contractor shall ensure wide and frequent dissemination of the above information to all employees dealing with DoD information. The contractor shall abide by all Government regulations concerning the authorized use of the Government's computer network, including the restriction against using the network to recruit Government personnel or advertise job openings.

1.3.6 Physical Security/Access to Buildings. The contractor shall comply with security requirements, plus those imposed by the installation Commander at all times. Personnel with access to special areas shall have the appropriate screening and/or security clearance, and personnel requiring routine access to restricted areas shall wear special badges authorizing access for those areas. Contractor personnel shall not enter restricted or controlled areas or installation facilities unless specifically authorized in performance of their duties. The contractor shall secure all buildings and facilities entered during non-duty hours and shall secure all building and facilities under the contractor’s cognizance at the end of each workday or shift period.

1.3.6.1. Schedule Coordination. The contractor shall be responsible for coordinating all phases of their operations with the appropriate base personnel through the COR/CO. The facilities shall remain in operation while the contractor is working, and it is up to the contractor to coordinate around the normal activities of the facility. The Government may issue keys to the contractor.

The contractor shall use due diligence and be responsible for compromised security systems to include replacement costs that result from their action or inaction.

1.3.6.1.1 Contractor shall contact 36 CES, Customer Service at 366-2916/17/18 to apply for any service interruption. Utility outage requests shall be submitted at least thirty (30) calendar days before any outage and coordinated with COR/CO, affected tenants, and customers.

1.3.6.2 The contractor shall make arrangements for Government escort into secured areas requiring escort. The CO shall provide information on applicable buildings, spaces, and the appropriate point of contact. The contractor may experience delays while waiting for escorts.

The Government estimates the wait period can be up to 30 minutes. The contractor shall notify the COR and appropriate point of contract if an escort is not available after 30 minutes or access to accomplish the work is denied. Unscheduled requirements, e.g., trouble calls, may require a longer wait for an escort.

1.3.6.3 Key Control. NOTE: All references to keys include key cards. The contractor shall establish and implement methods of ensuring that no keys/key cards issued by the Government

Ver. October 2023 are lost or misplaced or are used by unauthorized persons. No keys issued by the Government shall be duplicated. Such procedures shall include turn-in of any issued keys by personnel who no longer require access to locked areas. The contractor shall include procedures covering key control in the QCP.

1.3.6.3.1 The contractor shall immediately report any occurrences of lost or duplicated keys/key cards to the COR.

1.3.6.3.2 In the event keys, other than master keys, are lost or duplicated, the contractor shall, upon direction by the CO, re-key or replace the affected lock or locks; however, the Government, at its option, may replace the affected lock or locks or perform re-keying. When the Government replaces or re-keys the locks, the Government will deduct the total cost of lock replacement or re-keying from the monthly payment due the contractor. In the event a master key is lost or duplicated, the Government will replace all locks and keys for that system and will deduct the total cost from the monthly payment due the contractor.

1.3.6.3.3 The contactor shall prohibit the use of the Government issued keys/key cards by any persons other than the contractor’s employees. The contractor shall prohibit the opening of locked areas by contractor employees to permit entrance of persons other than contactor employees engaged in the performance of services in those areas, or personnel authorized entrance by the CO.

1.3.6.4 Lock Combinations: The contractor shall establish and implement methods of ensuring that no lock combinations are revealed to unauthorized persons. The contractor shall ensure that lock combinations are changed when personnel having access to the combinations no longer have a need to know such combinations.

1.3.7 Special Qualifications: Reserved.

1.3.8 Post Award Conference/Periodic Progress Meetings: The contractor agrees to attend any post award conference convened by the CO in accordance with FAR 42.5. The CO, COR, and other Government personnel, as appropriate, may meet periodically with the contractor to review the contactor’s performance. At these meetings, the CO will apprise the contractor of how the Government views the contractor’s performance and the contractor shall apprise the Government of problems, if any, being experienced. The contractor shall resolve outstanding issues raised by the Government. Contractor attendance at these meetings shall be at no additional cost to the Government.

1.3.9 Contract Manager (CM): The contactor shall designate a CM who shall ensure performance under this contract. The name of this person, and an alternate who shall act for the contractor when the CM is absent, shall be designated in writing to the CO. The CM or alternate shall have full authority to act for the contractor on all contract matters relating to daily operation of this contract. The CM shall work through the CO to resolve issues, receive technical instructions, and ensure adequate performance of services. The CM shall ensure that contractor employees do not perform any services outside the scope of the contract without an official modification issued

Ver. October 2023 by the CO. The CM shall ensure contractor employees understand that services performed outside the scope of the contract are performed wholly at the expense of the contractor.

1.3.10 Identification of Contractor Employees: All contractor personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression that they are Government employees. The contractor shall ensure that all documents or reports produced by contractor personnel are suitably marked as contractor products or that contractor participation is appropriately disclosed. The contractor’s status as a “contractor” shall be predominantly displayed in all correspondence types (to include signature blocks on e-mail) and dealings with Government or non-Government entities. Contractor personnel shall wear identification badges distinguishing themselves as such. The badges shall have the company name, employee name and the word “contractor” displayed.

1.3.10.1 The contractor shall retrieve all identification media (including vehicle passes) from its employees who depart employment for any reason. The contractor shall return all identification media (i.e., badges and vehicles pass) to the CO within 10 days of an employee’s departure.

1.3.11. Combating Trafficking in Persons: The United States Government has adopted a zero-tolerance policy regarding trafficking in persons. Contractors and contractor employees shall not engage in severe forms of trafficking in persons during the period of performance of the contract;

procure commercial sex acts during the period of performance of the contract; or use forced labor in the performance of the contract. The Contractor shall notify its employees of the United States Government’s zero tolerance policy, the actions that will be taken against employees for violations of this policy. The contractor shall take appropriate action, up to and including termination, against employees or subcontractors that violate the US Government policy as described at FAR 22.17.

1.3.12 Organizational Conflicts of Interest (OCI): The contractor and subcontractor personnel performing services under this contract may receive, have access to or participate in the development of proprietary or source selection information (e.g., cost or pricing information, budget information or analyses, specifications, or work statements, etc.) or perform evaluation services which may create a current or subsequent OCIs, as defined in FAR Subpart 9.5. The contractor shall notify the CO immediately whenever it becomes aware that such access or participation may result in any actual or potential OCI and shall promptly submit a plan to the CO to avoid or mitigate any such OCI. The contractor’s mitigation plan will be determined to be acceptable solely at the discretion of the CO. In the event the CO unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the CO may impose other remedies as he or she deems necessary, including prohibiting the contractor from participation in subsequent contracted requirements which may be affected by the OCI.

1.3.13 Phase In / Phase Out Periods: Reserved.

1.4 Performance of Services during Crisis Declared by The National Command Authority or The Local Installation Commander. This service meets the criteria for continuation of performance during a crisis.

1.5 Environmental Control. The contractor shall comply, and assure that all subcontractors comply, with all applicable federal, territory, and local laws, regulations, ordinances, policies, and standards related to environmental matters. Where applicable, the contractor shall use environmentally safe products in the course of completion of their project. The contractor shall maintain, in company vehicle on site, Safety Data Sheets (SDS) for all chemicals. A copy of all SDS shall be provided to the CO and COR. The SDS data is subject to random checks by the government. Contractor shall maintain, and provide on demand, an inventory of materials being brought on the Government facility. The contractor shall complete, and provide on demand, monthly inventories of HAZMAT used, including but not limited to: solvents, paints, degreasers, greases, Ozone Depleting Substances, and oils brought on to the Government facility. If the contractor spills or releases any HAZMAT or other substance contained in 40 CFR 302 into the environment, the contractor shall immediately notify the CO, COR, and appropriate emergency responders. The contractor is responsible for all costs associated with clean-up and restoration, including any applicable fines and/or penalties. The contractor shall maintain a spill plan as required by federal, territory, and local laws and regulations.

1.7 Asbestos.

1.7.1 The contractor shall be responsible to have a trained “Competent Person” as defined in 29 CFR 1926.32(f) onsite that meets the requirements specified in 29 CFR 1926.1101 and is trained in accordance with 40 CFR 763.92(a)(2). It is the Competent Person’s responsibility to ensure any known or suspect Asbestos Containing Materials (ACM) encountered during the performance of this PWS are managed in accordance with all Federal, territory, and local regulations as may be applicable. Any questions regarding suspect or known ACM should be directed to 36 CES Asbestos Program manager.

1.7.2 Miscellaneous Asbestos Debris. The contractor is hereby given notice that miscellaneous asbestos debris from TSI or other sources may be encountered in wall or ceiling cavities, crawl spaces, or chase ways. Any fibrous materials encountered in these areas shall be treated as friable Presumed Asbestos Containing Material (PACM) unless tested and found to be asbestos free.

Any disturbance of ACM or PACM shall comply with all applicable sections of 29 CFR1926.1101. Any abatement activities shall be performed in accordance with 29 CFR1926.1101 or 29 CFR1901.1001 as may be applicable and OAC 3701-34. Any removal or disposal activities shall be performed in accordance with 40CFR 61M and OAC3745-20.

2.0 Definitions and Acronyms:

2.1 Definitions:

2.1.1 Contractor: A supplier or vendor awarded a contract to provide specific supplies or service to the Government. The term used in this contract refers to the prime.

2.1.2 Defective Service: A service output that does not meet the standard of performance associated with the PWS.

Ver. October 2023

2.1.3 Deliverable: Anything that can be physically delivered and includes non-manufactured things such as meeting minutes or reports.

2.1.4 Key Personnel: Contractor personnel that are evaluated in a source selection process and that may be required to be used in the performance of a contract by the PWS. When key personnel are used as an evaluation factor in best value procurement, an offer can be rejected if it does not have a firm commitment from the persons that are listed in the proposal.

2.1.5 Physical Security: Actions that prevent the loss or damage of Government property.

2.1.6 Quality Assurance: The Government procedures to verify that services being performed by the Contractor are performed according to acceptable standards.

2.1.7 Quality Assurance Surveillance Plan (QASP): An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance.

2.1.8 Quality Control: All necessary measures taken by the Contractor to ensure that the quality of an end product or service shall meet contract requirements.

2.1.9 Subcontractor: One that enters into a contract with a prime contractor. The Government does not have privity of contract with the subcontractor.

2.2 Acronyms:

AT/OPSEC Antiterrorism/Operational Security BI Background Investigation CM Contract Manager CO Contracting Officer COR Contracting Officer’s Representative DD254 Department of Defense Contract Security Classification Specification DFARS Defense Federal Acquisition Regulation Supplement DoD Department of Defense DSCA Defense Counterintelligence and Security Agency FAR Federal Acquisition Regulation GFP/M/E/S Government Furnished Property/Material/Equipment/Services HQDA Headquarters, Department of the Army HSPD Homeland Security Presidential Directive IA Information Assurance IS Information System(s) OCI Organizational Conflict of Interest PII Personally Identifiable Information PM Project Manager POC Point of Contact PRS Performance Requirements Summary PWS Performance Work Statement QA Quality Assurance

Ver. October 2023

QASP Quality Assurance Surveillance Plan QC Quality Control QCP Quality Control Program SCR Service Contract Reporting SSN Social Security Number TE Technical Exhibit USD(I) Under Secretary of Defense for Intelligence

3.0 Government Furnished Property, Material, Equipment and Services (GFP/M/E/S): The Government will provide the property, material, equipment, and/or services listed below solely for the purpose of performance under this contract:

3.1 Property: Reserved.

3.2 Utilities: All utilities in the facility will be available for the contactor’s use in the performance of this contract. The contractor shall instruct employees in utilities conservation practices. The contractor shall operate under conditions that preclude the waste of utilities, which include turning off the water faucets or valves after using the required amount.

4.0 Contractor Furnished Property, Materials, and Equipment (CFP/M/E):

4.1 General: Except for those items specifically stated to be Government-Furnished in Paragraph 3.0, the contractor shall furnish everything required to perform these services as indicated in Paragraph 1.1.

4.2 Secret Facility Clearance: Reserved.

4.3 Contractor Security Clearance: Reserved.

5.0 Requirements: The contractor shall supply, deliver, and maintain the Direct Digital Control (DDC) system at Andersen AFB by performing preventative maintenance visits, DDC testing, system security evaluations, and system security support.

5.1 HVAC DDC Preventative Maintenance Visits - The contractor shall perform four site visits annually and the below tasks will be performed at all of the existing HVAC DDC sites:

building(s) 30, 9115, 18001, 18006, 18110, 22002, 23028, 24016, 61202, 61250, 61310, 61312, and 61316.

• Perform automation network review to ensure proper communication between all devices to include operator workstations, global and field controllers, and any/all network devices.

• Perform air handler unit (AHU) and air conditioner service on individual control looper per unit including reviewing communication and alarm logs.

• Perform review and test system interlocks and communications for proper operations.

• Provide 40 hours of unscheduled service calls between scheduled maintenance visits during normal business hours.

Ver. October 2023

• Provide 16 additional hours for engineering labor to be used by system owner when necessary.

5.2 DDC System Security Evaluation and Updates - The contractor performs the below at each site visit:

• Test and optimize each operating system based on SCAP testing prior to getting on-site.

• Provide government POCs with reports indicating SCAP/STIG requirements that cannot be met based on proprietary software.

• Assist local cybersecurity representatives running SCAP to validate score and confirm excluded items from SCAP/STIG requirements.

• Install newest windows updates to operator workstations for each site and ensure functionality after installation.

5.3 DDC Training for Users – The contractor performs the below at each site visit:

• Provide 16 hours of training for the operating and maintenance staff during pre-arranged visits with date(s) and time(s) to be mutually agreed upon on with the Customer.

5.4 DDC Documentation - The contractor provides the below during each site visit:

• PMI Visit report with all changes/updates made to any system

• SCAP testing report with proposed changes

• STIG applicability report for all system devices

• Updated as-built diagrams with any changes

6.0 Applicable Publications: Publications applicable to this PWS are listed below:

Publication (Chapter/Page)

Website

Federal Acquisition Regulation https://www.acquisition.gov/?q=browsefar Defense Federal Acquisition Regulation

Supplement http://www.acq.osd.mil/dpap/dars/dfarspgi/current/inde x.html or https://www.acquisition.gov/dfars Joint Travel Regulation (JTR) https://www.defensetravel.dod.mil/site/travelreg.cfm

DoDM 1000.13-M-V1 DoD Identification (ID) Cards (Enclosure 2, paragraph 3.b) http://www.esd.whs.mil/Directives/issuances/dodm

Federal Information Processing Standards (FIPS) Publication 201-2

Personal Identity Verification (PIV) of Federal Employees and Contractors

(paragraph 9) http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.201- 2.pdf

DoDM 5200.2 Procedures for the DoD Personnel Security Program (PSP) https://www.esd.whs.mil/Directives/issuances/dodm/

DoDI 5200.46 DoD Investigative and Adjudicative Guidance for Issuing the Common

Access Card (CAC) https://www.esd.whs.mil/Directives/issuances/dodi/ https://www.acquisition.gov/?q=browsefar http://www.acq.osd.mil/dpap/dars/dfarspgi/current/index.html http://www.acq.osd.mil/dpap/dars/dfarspgi/current/index.html https://www.acquisition.gov/dfars http://www.esd.whs.mil/Directives/issuances/dodm http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.201-2.pdf http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.201-2.pdf

Ver. October 2023

Homeland Security Presidential Directive (HSPD)-12

Policy for a Common Identification Standard for Federal Employees and

Contractors https://www.dhs.gov/homeland-security-presidential-directive-12

DoDI 5400.11 Department of Defense Privacy and

Civil Liberties Programs

DoD 5400.11-R Department of Defense Privacy

Program https://www.esd.whs.mil/Directives/issuances/dodm/

DoDD 8140.01 Cyberspace Workforce Management https://www.esd.whs.mil/Directives/issuances/dodd/

DoD 8570.01-M Information Assurance Workforce

Improvement Program

DoD 5220.22-M National Industrial Security Program

Operating Manual (NISPOM)

AFI 10-245

Antiterrorism https://www.e-publishing.af.mil/Product- Index/#/?view=pubs&orgID=10141&catID=1&series=

-1&modID=449&tabID=131

AFI 31-101

Security Forces Standards and Procedures https://www.e-publishing.af.mil/Product- Index/#/?view=pubs&orgID=10141&catID=1&series=

-1&modID=449&tabID=131

AFMAN 31-113

Security Forces Standards and Procedures https://www.e-publishing.af.mil/Product- Index/#/?view=pubs&orgID=10141&catID=1&series=

-1&modID=449&tabID=131

AFPD 17-1

Information Dominance Governance and Management https://static.e-publishing.af.mil/production/1/saf_cio_a6/publication/a fpd17-1/afpd_17-1.pdf

AFMAN 17-1301

Computer Security (COMPUSEC) https://static.e-publishing.af.mil/production/1/saf_cn/publication/afma n17-1301/afman17-1301.pdf

AFI 10-701

Operations Security https://static.e-publishing.af.mil/production/1/af_a3/publication/afi10-

701/afi10-701.pdf Department of the Air Force Guidance

Memorandum 2023-32-01 (Control System Cybersecurity)

Government provided

UFGS 25 05 11 (Cybersecurity For Facility-Related Control Systems) https://www.wbdg.org/ffc/dod/unified-facilities-guide-specifications-ufgs/ufgs-25-05-11

Marianas Requirements for ICS/FRCS Cybersecurity and Engineering (RICE)

Government provided https://www.dhs.gov/homeland-security-presidential-directive-12 https://www.dhs.gov/homeland-security-presidential-directive-12 https://www.esd.whs.mil/Directives/issuances/dodi/ https://www.esd.whs.mil/Directives/issuances/dodd/

6.1 Applicable Forms: Forms applicable to the PWS are listed below:

Form Website

DD 1172-2

Application for Identification Card/DEERS Enrollment http://www.dtic.mil/whs/directives/forms/index.htm

I-9 Employment Eligibility Verification https://www.uscis.gov/sites/default/files/files/form/i-9.pdf

DD 441

Department of Defense Security

Agreement http://www.dtic.mil/whs/directives/forms/dd/ddforms0001- 0499.htm

DD 250

Material Inspection and Receiving

Report https://www.esd.whs.mil/Directives/forms/dd0001_0499/ http://www.dtic.mil/whs/directives/forms/forminfo/forminfopage2479.html http://www.dtic.mil/whs/directives/forms/forminfo/forminfopage2479.html http://www.dtic.mil/whs/directives/forms/index.htm https://www.uscis.gov/sites/default/files/files/form/i-9.pdf http://www.dtic.mil/whs/directives/forms/dd/ddforms0001-0499.htm http://www.dtic.mil/whs/directives/forms/dd/ddforms0001-0499.htm https://www.esd.whs.mil/Directives/forms/dd0001_0499/

TECHNICAL EXHIBIT 1

Performance Requirements Summary (PRS)

This PRS includes performance objectives the Government will use to determine contractor performance and will compare contractor performance to the Acceptable Quality Level (AQL).

Performance Objective

Performance Standard Acceptable Quality Level (AQL)

Para 5.1

The contractor shall provide Preventative Maintenance Visits

IAW PWS and the annual schedule quote provided by the contractor

Completed 100% of the time

Para 5.1 ~ 5.4

The contractor shall perform network automation testing

Completed once annually

The contractor shall perform DDC System Security Evaluation and

Updates

The Contractor shall perform DDC Training for Users

The Contractor shall maintain “As- Built” diagrams

TECHNICAL EXHIBIT 2

Deliverables Schedule

PWS Reference / Deliverable Title

Frequency Number of Copies

Medium/Format Submit To

1.4.5.3 AT Level

1 Awareness

Training Certificates

Provide within 15 calendar days after employee completes training.

1 Electronic Submission

Project Manager

1.4.5.11 OPSEC

Training

Certificates

Provide within 15 calendar days after employee completes training.

1 Electronic Submission

Project Manager

1.4.10 Identification

Media

Return within 14 days of employee’s departure from contract performance.

Original(s) Hard Copy Project Manager/

CO

TECHNICAL EXHIBIT 3

Estimated Workload Data

This information is provided for historical background only. It is not a guarantee of workload quantities.

Facility Number Inventory

(1) DDC laptop, Windows 11 OS, loaded with required vendor software, configured for use as maintenance workstation.

(1) managed switch, configured for relevant ports, with enclosure supplied and installed.

(1) DDC laptop, Windows 11 OS, loaded with required vendor software, configured for use as maintenance workstation.

(1) managed switch, configured for relevant ports, with enclosure supplied and installed.

18001

(1) DDC laptop, Windows 11 OS, loaded with required vendor software, configured for use as maintenance workstation.

(1) managed switch, configured for relevant ports, with enclosure supplied and installed.

18006

(1) DDC laptop, Windows 11 OS, loaded with required vendor software, configured for use as maintenance workstation.

(1) managed switch, configured for relevant ports, with enclosure supplied and installed.

18110

(1) DDC laptop, Windows 11 OS, loaded with required vendor software, configured for use as maintenance workstation.

(1) managed switch, configured for relevant ports, with enclosure supplied and installed.

22002

(2) computer servers, Windows Server 2022 OS, all licensing, and vendor software relevant to function.

(1) DDC laptop, Windows 11 OS, loaded with required vendor software, configured for use as maintenance workstation.

(1) managed switch, configured for relevant ports, with enclosure supplied and installed.

Ver. October 2023

23028

(1) DDC laptop, Windows 11 OS, loaded with required vendor software, configured for use as maintenance workstation.

(1) managed switch, configured for relevant ports, with enclosure supplied and installed.

24016

(1) DDC laptop, Windows 11 OS, loaded with required vendor software, configured for use as maintenance workstation.

(1) managed switch, configured for relevant ports, with enclosure supplied and installed.

61202

(1) DDC laptop, Windows 11 OS, loaded with required vendor software, configured for use as maintenance workstation.

(1) managed switch, configured for relevant ports, with enclosure supplied and installed.

61250

(1) DDC laptop, Windows 11 OS, loaded with required vendor software, configured for use as maintenance workstation.

(1) managed switch, configured for relevant ports, with enclosure supplied and installed.

61310

(1) DDC laptop, Windows 11 OS, loaded with required vendor software, configured for use as maintenance workstation.

(1) managed switch, configured for relevant ports, with enclosure supplied and installed.

61312

(1) DDC laptop, Windows 11 OS, loaded with required vendor software, configured for use as maintenance workstation.

(1) managed switch, configured for relevant ports, with enclosure supplied and installed.

61316

(1) DDC laptop, Windows 11 OS, loaded with required vendor software, configured for use as maintenance workstation.

(1) managed switch, configured for relevant ports, with enclosure supplied and installed.

(2) supervisory network controller engines, supplied and configured.

(2) general purpose application field controllers, configured to function within the facility.

Technical Exhibit 4

REQUEST TO WORK OUTSIDE NORMAL DUTY HOURS

(Page intentionally left blank. The current form will be provided at award.)

Technical Exhibit 5

UTILITY OUTAGE COORDINATION

(Page intentionally left blank. The current form will be provided at award.)