Attachment 1 - PWS - Snap-On Automated Tool Control Box Service for ATO.pdf

Service to Receive and Sustain an Authority to Operate (ATO) for Snap-On Automated Tool Control Boxes

PERFORMANCE WORK STATEMENT (PWS)

Name: 48th Fighter Wing (48 FW)

Organization: 48th Maintenance Group (48 MXG)

Contracting Activity: 48th Contracting Squadron (48 CONS)

Contract Type: Firm-Fixed-Price

Contract Vehicle: Single Award

Executive Summary: Non-personal, non-severable services to complete the work that is required for the 48 MXG to receive and sustain an Authority to Operate (ATO) for its Snap-On Level 5 Automated Tool Control boxes.

Note: An ATO is required before the Snap-On Level 5 Automated Tool Control boxes can be connected to the Air Force Network (AFNet) and allow the 48 MXG to collect data for a pilot program in support of RAF Lakenheath and Spangdahlem AB.

Current as of 17 September 2020

1.0. Background. The 48 MXG purchased Snap-On Level 5 Automated Tool Control boxes in fiscal year 2018, with the intent to use Snap-On’s commercial-off-the-shelf technology to improve the quality of life and accountability procedures for its maintenance personnel. However, these toolboxes were purchased under a Snap-On GSA tool contract without an ATO.

These toolboxes do not meet the minimum security requirements and need to be updated to the current Windows operating system. Snap-On made some adjustments to their system in order to meet the Government’s two-factor authentication requirements. Snap-On also agreed to update its software and is currently making the required updates.

In the meantime, current procedures require 48 MXG personnel to check out a Snap-On Automated Tool Control box and push it for up to a mile away from its origin to its designated protective aircraft shelter. 48 MXG personnel must then push their toolbox back to its origin at the end of each shift, and then those technicians must wait in line to ensure that all tools are returned and accounted for properly.

In order to bring the Snap-On Automated Tool Control boxes into compliance as quickly as possible, the Government will break this project into two phases. First, the Government will secure an ATO, so the toolboxes can be used in its current off-network configuration. Second, the Government will secure an Authority to Connect (ATC) to operate on AFNet.

Moreover, the 48 MXG and 52 MXG have been tasked with running a pilot program for the Snap-On Automated Tool Control boxes to determine if this capability is suitable for consideration as an enterprise-level application.

In summation, if these toolboxes get connected to the AFNet, 48 MXG personnel will be able to virtually check these Snap- On Automated Tool Control boxes in and out, without needing to remove the toolbox from a protective aircraft shelter. It is estimated that this initiative will return at least an hour per day to each maintainer, who must otherwise check a toolbox in and out. If the pilot program is successful, then this capability will be considered for use as an enterprise-level solution.

1.1. Objective. Get the Snap-On Level 5 Automated Tool Control boxes on the AFNet.

1.2. Scope. In order to secure and sustain an ATO, the responsibilities associated with four positions must be fulfilled IAW AFI 17-101, RMF for Air Force Information Technology (IT). These positions are the Information System Owner (ISO), Program Manager (PM), Information Systems Security Manager (ISSM), and Information System Security Officer (ISSO). The ISO and PM positions shall be assigned to Government personnel in order to meet AFI requirements and complete inherently governmental functions. However, the contractor shall provide bodies to assist the ISO and PM by completing all ISO and PM duties that are not inherently governmental. All of the ISSM and ISSO responsibilities, in contrast, shall only be fulfilled by the contractor, who may assign one or more individuals to complete the responsibilities identified in Section 2.

2.0. Description of Services. These services are non-severable. The contractor shall develop and load all artifacts and supporting documentation needed to secure an ATO for the Snap-On Level 5 Automated Tool Control boxes IAW DoDI 8510.01, Risk Management Framework (RMF) for DoD Information Technology (IT). After receiving the ATO, the contractor shall continue to provide the services and deliverables required to sustain the ATO. Furthermore, the contractor shall maintain all of the required credentials for this ATO process, to include SNaP (https://snap.dod.mil/index.do) and eMASS (https://airforce.emass.apps.mil/Public/SiteAgreement?ReturnUrl=%2FApp%2FHome%2FInbox). All contract deliverables and feedback shall be completed and posted to eMASS or any other location that is later specified by the Government. The contractor shall also inform the COR when deliverables are submitted. More specific descriptions of the required services can be seen below.

2.1. ISO. Even though the ISO role shall be held by a Government official, the contractor shall assist the ISO by fulfilling the following responsibilities:

2.1.1. Ensure the development, maintenance, and tracking of the system security plan for the assigned IT.

2.1.2. Ensure that the development of an ISCM strategy is consistent with DoDI 8510.01.

2.1.3. Report the security status of the IT, to include the effectiveness of all implemented security controls, to the ISO.

2.1.4. Communicate access control requirements and complete any ISO-directed security training.

2.1.5. Develop a plan of action and milestones for all identified weaknesses and the appropriate steps to mitigate those weaknesses.

2.1.6. Ensure that the appropriate steps are taken to reduce or eliminate the identified weaknesses, then generate the security authorization package and submit the package(s) to the ISO.

2.1.7. Ensure that the consolidated RMF documentation is maintained for systems with instances at multiple locations.

2.1.8. Review the security controls and risk assessment results before submitting the security authorization package to the ISO, ensuring that the system’s cybersecurity posture satisfactorily supports mission, business and budgetary needs.

2.1.9. Ensure that the system is deployed and operated according to the approved security plan and the authorization package.

2.2. PM. Even though the PM role shall be held by a Government official, the contractor shall assist the PM by fulfilling the following responsibilities:

2.2.1. Identify, implement and ensure full integration of cybersecurity into all phases of the program IAW DoDI 8510.01, AFI 63-101_20-101, Integrated Life Cycle Management, and the DoD Program Manager’s Guidebook for Integrating the Cybersecurity Risk Management Framework (RMF) into the System Acquisition Lifecycle.

2.2.2. Ensure that the appointed ISSM is certified IAW AFMAN 17-1303.

2.2.3. Ensure that the IT is registered IAW AFI 17-110.

2.2.4. Ensure that the development and implementation of a cybersecurity strategy for IT IAW AFMAN 17-1402 and AFI 63- 101_20-101.

2.2.5. Ensure that the applicable cyber tasking orders are received and acted upon, per cyber tasking order directions.

2.2.6. Ensure that the periodic reviews, testing, or assessment of assigned IT are conducted at least annually, and IAW the ISCM strategy.

2.2.7. Ensure that the operational systems maintain a current authorization to operate and recommend to the PM that systems without current authorization are identified for removal from operation.

2.2.8. Manage the corrective actions identified in the plan of action and milestones, in order to provide visibility and status IAW DoDI 8510.01.

2.2.9. Report security incidents to stakeholder organizations and the SCA. Conduct root cause analysis for incidents and develop corrective action plans as input to the plan of action and milestones.

2.2.10. Ensure that a privacy impact assessment is completed (DD Form 2930) for all IS IAW AFI 33-332.

2.3. ISSM. The individual(s) associated with this role shall be a U.S. citizen. Furthermore, the contractor shall fulfill all of the following responsibilities:

2.3.1. Ensure the integration of cybersecurity into and throughout the lifecycle of the IT IAW DoDI 8510.01.

2.3.2. Complete and maintain the required cybersecurity certification IAW AFMAN 17-1303.

2.3.3. Ensure that all of the AF IT cybersecurity-related documentation is current and accessible to the properly authorized individuals.

2.3.4. Maintain the current ATO and ATC, as well as implement corrective actions identified in the plan of action and milestones.

2.3.5. Coordinate the development of an ISCM strategy and monitor any proposed or actual changes to the system and its environment.

2.3.6. Continuously monitor the IT and environment for security-relevant events, assess proposed configuration changes for potential impact to the cybersecurity posture, and assess the quality of security controls implementation against performance indicators.

2.3.7. Ensures that the cybersecurity-related events or configuration changes that impact AF IT authorization or adversely impact the security posture are formally reported.

2.3.8. Ensure that all privileged users receive the necessary technical training and obtain the cybersecurity certification IAW

AFMAN 17-1301.

2.3.9. Ensure that the AF IT is documented, operated, used, maintained and disposed of properly, IAW DoDI 5000.02 and DoDI 8510.01.

2.4. ISSO. The individual(s) associated with this role shall be a U.S. citizen. Furthermore, the contractor shall fulfill all of the following responsibilities:

2.4.1. Implement and enforce all AF cybersecurity policies, procedures, and countermeasures.

2.4.2. Complete and maintain the required cybersecurity certification IAW AFMAN 17-1303.

2.4.3. Ensure that all users have the requisite security clearances and need-to-know, complete the annual cybersecurity training, and are aware of their responsibilities before being granted access to the IT, according to AFMAN 17-1301.

2.4.4. Maintain all authorized user access control documentation IAW the applicable AF Records Information Management System.

2.4.5. Ensure that the software, hardware, and firmware comples with the appropriate security configuration guidelines.

2.4.6. Ensure that the proper configuration management procedures are followed prior to implementation and contingent upon necessary approval.

2.4.7. Initiate protective or corrective measures when a security incident or vulnerability is discovered.

2.4.8. Report security incidents or vulnerabilities IAW AFI 17-203.

2.4.9. Initiate exceptions, deviations, or waivers to cybersecurity requirements.

2.5. Task Requirements. All products resulting from the following sections shall be delivered to the Contracting Officer’s Representative (COR), within the stated timelines.

2.5.1. Initial Package to Secure the ATO.

2.5.1.1. Deliverables: Assessment & Authorization (A&A) Products. The contractor shall submit all comprehensive RMF products supporting the initial ATO request for the Snap-On Automated Tool Control boxes via eMASS no later than 29 March 2021. These products shall include, but are not limited to, all requirements IAW DoDI 8510.01:

2.5.1.1.2. System Security Categorization Memo.

2.5.1.1.3. Security Controls Implementation Plan.

2.5.1.1.4. Security Plan.

2.5.1.1.5. Network.

2.5.1.1.6. Topology.

2.5.1.1.7. Hardware List.

2.5.1.1.8. Software List.

2.5.1.1.9. STIG Applicability List.

2.5.1.1.10. Ports, Protocols, Services Matrix (PPSM) and Registration Number.

2.5.1.1.11. Vulnerability Scans.

2.5.1.1.12. STIG Compliance Scans.

2.5.1.1.13. Authorization Boundary Network Device Configuration Files.

2.5.1.1.14. Plan of Action and Milestones.

2.5.1.1.15. Continuous Monitoring Strategy.

2.5.2. ATO Sustainment.

2.5.2.1. Deliverables: ATO Sustainment Products. The contractor shall provide all comprehensive RMF services and products supporting the sustainment of the ATO for the Snap-On Automated Tool Control boxes IAW DoDI 8510.01 and AFI 17-101:

2.5.2.1.1. System Identification Profile.

2.5.2.1.2. RMF Implementation Plan.

2.5.2.1.3. System Topology.

2.5.2.1.4. RMF Scorecard.

2.5.2.1.5. Security Validation Report.

2.5.2.1.6. Plan of Action and Milestones.

2.5.2.1.7. Artifacts.

2.5.2.1.8. Create SOPs, Checklists, or Other Documentation to Sustain Programs Under the CCRI Umbrella.

2.6. All deliverables shall be assessed IAW the Quality Assurance Surveillance Plan. For more information, please reference Section 6.

3.0. General Requirements.

3.1. Security Clearance Requirements. The contractor will not need to access classified material. At a minimum, the contractor shall have a valid NACI (National Agency Check with Inquiries) in order to complete the required deliverables.

3.2. Place of Performance. The vast majority of this work can be done remotely. When needed, the contractor may travel to RAF Lakenheath, England, in order to scan the Snap-On Automated Tool Control system. During these trips, the contractor should provide all of its required equipment. The Government shall provide the contractor with a desk, chair, monitor and a computer that can read common access cards (CACs), so long as the COR is given 30 days advance notice, if that many days’ notice is possible. The Government will not furnish the contractor with additional laptops or CAC readers.

If deemed necessary, the Government may grant the contractor NIPR access, in order to ensure that the deliverables are met.

3.2.1. Travel. If travel to RAF Lakenheath is required in order to complete the deliverables identified under 2.5.1. or 2.5.2., then the contracting officer may negotiate the travel costs before the required travel occurs.

3.3. System and Network Authorization Access Requests. Contractor personnel who require NIPR access shall sign and submit a DD Form 2875, System Authorization Access Request (SAAR), to the COR as soon as NIPR access is deemed necessary.

3.4. Local Area Network (LAN). If NIPR access is required, then contractor personnel shall have, at a minimum, a valid NACI verified through the Joint Personnel Adjudication System (JPAS) roster. As a result, the contractor shall be provided access to the host base’s unclassified computer network and its inherent capabilities including, but not limited to: Internet access, electronic mail, file and print services and network access. The contractor shall be aware of and abide with all Government regulations concerning the authorized use of the Government’s computer network including the restriction against using the network to recruit Government personnel or advertise job openings.

3.5. Nonpersonal Services. This requirement shall be fulfilled via a nonpersonal services contract, which is defined in FAR Part 37 as a “contract under which the personnel rendering the services are not subject, either by the contract’s terms or by the manner of its administration, to the supervision and control usually prevailing in relationships between the Government and its employees.”

3.5.1. The Government shall not supervise or otherwise control the method by which the contractor performs the required tasks. The contractor shall not supervise or otherwise direct Government employees, nor shall the contractor supervise employees of other contractors outside the contractor’s own subcontracting or teaming arrangements.

3.5.2. Under no circumstances will the Government assign tasks to, or prepare work schedules for individual contractor employees. It shall be the responsibility of the contractor to manage its employees and to guard against any actions that are of the nature of personal services, or give the perception of personal services. If the contractor feels that any action constitute, or are perceived to constitute personal services, then it shall be the contractor’s responsibility to notify the CO immediately. These services shall not be used to perform work that is considered to be an inherently Governmental function. All decisions relative to programs supported by the contractor shall be the sole responsibility of the Government.

3.6. Weekly Activity Reports (WARs). The contractor shall submit WARs to the COR at the end of each business week.

3.7. Contractors Identification. When present on RAF Lakenheath, all contractor personnel shall be required to wear picture identification badges, so as to distinguish themselves from Government employees. When conversing with Government personnel, contractor personnel shall identify themselves as such to avoid situations where sensitive topics might be better discussed solely between Government employees. Contractor personnel shall also identify themselves on any attendance sheet or any coordination documents that they review. Furthermore, contractor personnel shall identify themselves at the onset of every meeting, conference or any other gathering attended in support of any service provisions to the Government. Contractor personnel shall identify themselves on any correspondence, documents or reports accomplished or sent in support of any service provision to the Government, including all forms of correspondence. The contractor shall observe and otherwise be subject to such security regulations as are in effect for the particular premises involved. Electronic mail signature blocks shall identify their company affiliation.

3.7.1. The contractor shall designate, in writing, its primary and secondary point of contact to the CO and COR upon contract award.

4.0. Information Assurance (IA) Technical Considerations. The contractor shall provide security and information assurance support and protection to ensure confidentiality, integrity, authentication, availability, and non-repudiation. The contractor shall also ensure that all deliverables meet the requirements of DoDI 8500-01, Cybersecurity for DoD Information Technology (IT), or the most current standards and guidance that are applicable. The contractor shall provide application services support that are in compliance with and support DoD, USAF and PKI policies. The contractor’s solutions shall comply with National Institute for Standards and Technologies (NIST) and Federal Information Processing Standards (FIPS), as applicable. The contractor shall provide applications services support for Security, Interoperability, Supportability, Sustainability, Usability (SISSU) processes and Enterprise Information Data Repository certification.

4.0.1. Technical and management certifications are required for anyone performing Information Assurance activities.

Therefore, the contractor shall insure personnel are compliant with DoD 8570.01-M.

4.1. Non-Disclosure Agreement (NDA). All contractor personnel, to include sub-contractor employees, shall sign the NDA agreement and provide the original signed letter to the COR within 3 business days of being employed for work on this contract.

4.2. Restricted Entry Requirements. The contractor shall be escorted by the COR or designated personnel for entry into restricted areas and any other location on RAF Lakenheath to meet contract deliverables. If needed, the COR or designated personnel may escort the contractor onto base.

4.3. COMPUSEC Notice. All communications with DoD organizations are subject to COMPUSEC review. Contractor personnel shall be aware that telecommunication networks are continually subject to intercept by unfriendly intelligence organizations. The DoD has authorized the military departments to conduct COMPUSEC monitoring and recording of telephone calls originating from, or terminating at, DoD organizations. Therefore, contractor personnel are advised that any time they place a call to, or receive a call from, an USAF organization, they are subject to COMPUSEC procedures. The contractor shall assume the responsibility for ensuring wide and frequent dissemination of the above information to all employees dealing with official DoD information.

4.4. For Official Use Only (FOUO). The contractor shall comply with DoD 5400.7, Chapter 4 requirements. This regulation sets the policy and procedures for the disclosure of records to the public and for marking, handling, transmitting and safeguarding FOUO material.

4.5. Reporting Requirements. All contractor personnel shall report to the CO or COR any information or circumstances of which they are aware that may pose a threat to the security of DoD personnel, contractor personnel, resources, and classified or unclassified defense information.

5.0. Performance Reporting.

5.1. Quality Control. The contractor shall develop, implement and maintain a comprehensive quality control plan (QCP) that assures compliance with all requirements of this PWS. The QCP shall demonstrate how the contractor plans to ensure quality performance across all products and services under this contract. The quality control plan shall be provided to the CO and COR at the start of the actual performance on this PWS. The QCP shall, at a minimum, document processes for the following:

5.1.1. Providing quality service.

5.1.2. Quality control review of all deliverables.

5.1.3. Providing trained, certified and experienced personnel.

5.1.4. Ensuring timely and effective communications.

5.1.5. Taking preventive and corrective actions.

5.1.6. Meeting reporting requirements.

5.2. Quality Assurance. The Government shall evaluate the performance of the services listed from Section 2 to determine if they meet the performance thresholds. Performance thresholds can be seen in Section 6.3. When the proper level of performance is not met, the CO will issue a Corrective Action Request (CAR). The COR will follow the method of surveillance specified in the QASP. Government personnel will record all surveillance observations. When an observation indicates defective performance, the COR will require the contractor to initial the observation. The initialing of an observation does not necessarily constitute concurrence with the observation. Instead, it only acknowledges that the contractor has been made aware of the defective performance.

5.2.1. CAR. When contract requirements are not met and subsequent corrective action is required, then a CAR or electronic equivalent shall be initiated by the CO or CAR IAW the guidelines listed in the QASP.

5.2.2. Performance Deficiency Resolution. The contractor shall take immediate action to correct all Government-reported deficiencies and prevent recurrence of the deficiency.

5.2.3. Contractor Performance Assessment Reporting (CPARS). The contractor’s performance shall be monitored and documented monthly on the checklist by the Government and reported annually in CPARS. Performance standards shall include the contractor’s ability to comply with the PWS.

5.2.4. Records Access. The contractor shall permit the CO or COR acess to all records, data and facilities used in the performance of the PWS. Access shall be provided within 1 business day of the request and be for the purposes of verification of allowable cost, verification of personnel qualifications and items otherwise deemed necessary by the CO.

5.3. Acceptance and Rejection of Deliverables.

5.3.1. Basis of Acceptance. The basis for acceptance shall be compliance with the requirements set forth in the PWS, the Contractor’s proposal and other terms and conditions of the contract. Deliverable items rejected shall be corrected in accordance with the applicable clauses. Deliverables shall be inspected for content, completeness, accuracy and conformance to PWS requirements. Inspection may include validation of information or software through the use of automated tools, testing or inspections of the deliverables.

5.3.2. General Acceptance Criteria. Deliverables shall be accepted when all discrepancies, errors or other deficiencies identified in writing by the Government have been corrected. The general quality measures, set forth below, will be applied to each deliverable received from the contractor:

5.3.2.1. Accuracy. Deliverables shall be accurate in presentation, technical content, and adhere to accepted elements of style.

5.3.2.2. Clarity. Deliverables shall be clear and concise; engineering terms shall be used, as appropriate. All diagrams shall be easy to understand, legible, and relevant to the supporting narrative. All acronyms shall be clearly and fully specified upon first use.

5.3.2.3. Specifications Validity. All deliverables must satisfy the requirements of the Government, as specified herein.

5.3.2.4. File Editing. All text and diagrammatic files shall be editable by the Government.

5.3.2.5. Format. Deliverables shall follow latest edition of AFH 33-337, The Tongue and Quill.

5.3.2.6. Timeliness. Deliverables shall be submitted on or before the due date specified in Sections 2.5.1.1. and 2.5.2.1.

5.3.2.7. Software development. The final acceptance of the software program will occur when all discrepancies, errors or other deficiencies identified in writing by the Government have been resolved, either through documentation updates, program correction or other mutually agreeable methods.

5.3.3. Written Acceptance/Rejection of Deliverables by the Government. All notifications of rejection shall be accompanied with an explanation of the specific deficiencies causing the rejection.

5.4. Performance Thresholds.

Statements Standards/AQLs Inspections Ratings

2.5.1.1. The contractor

shall submit all comprehensive RMF products supporting the initial ATO request.

All required deliverables are submitted to eMass no later than 29 March 2021.

What: (Deliverables) A&A Products

How: eMASS

Frequency: Once, upon submission.

Who: The COR, along with designated 48 CS personnel, shall inspect all deliverables.

Standards: 5.3.2.

General Acceptance Criteria.

Excellent – Deliverables are submitted one month or more ahead of the due date and complies with Section 5.3.2.

Very Good – Deliverables are submitted between one month and one day ahead of the due date and complies with Section 5.3.2.

Satisfactory – Deliverables are submitted on the due date and complies with Section 5.3.2.

Marginal – Deliverables are submitted between one day and one month after the due date and complies with Section 5.3.2.

Unsatisfactory – Deliverables are submitted later than one month after the due date.

2.5.2.1. The contractor

shall submit all comprehensive RMF services and products supporting the sustainment of the ATO.

All comprehensive RMF services and products supporting the sustainment of the ATO for the Snap-On Automated Tool Control boxes are IAW DoDI 8510.01 and AFI 17-101

What: (Deliverables) A&A Products

How: eMASS

Frequency: Once, upon submission.

Who: The COR, along with designated 48 CS personnel, shall inspect all deliverables.

Standards: 5.3.2.

General Acceptance Criteria.

Excellent – Deliverables are submitted one month or more ahead of the due date and complies with Section 5.3.2.

Very Good – Deliverables are submitted between one month and one day ahead of the due date and complies with Section 5.3.2.

Satisfactory – Deliverables are submitted on the due date and complies with Section 5.3.2.

Marginal – Deliverables are submitted between one day and one month after the due date and complies with Section 5.3.2.

Unsatisfactory – Deliverables are submitted later than one month after the due date.

Statements Standards/AQLs Inspections Ratings

5.3.2. General

Acceptance Criteria.

Deliverables shall be accepted when all discrepancies, errors or other deficiencies identified in writing by the Government have been corrected.

5.3.2.1. Accuracy.

Deliverables shall be accurate in presentation, technical content, and adhere to accepted elements of style.

5.3.2.2. Clarity. Deliverables

shall be clear and concise;

engineering terms shall be used, as appropriate. All diagrams shall be easy to understand, legible, and relevant to the supporting narrative. All acronyms shall be clearly and fully specified upon first use.

5.3.2.3. Specifications

Validity. All deliverables must satisfy the requirements of the Government, as specified herein.

5.3.2.4. File Editing. All text

and diagrammatic files shall be editable by the Government.

5.3.2.5. Format. Deliverables

shall follow the latest edition of AFH 33-337, The Tongue and Quill.

5.3.2.6. Timeliness.

Deliverables shall be submitted on or before the due date specified in Sections

2.5.1.1. and 2.5.2.1.

5.3.2.7. For software

development, the final acceptance of the software program will occur when all discrepancies, errors or other deficiencies identified in writing by the Government have been resolved, either through documentation updates, program correction or other mutually agreeable methods.

5.3.1. Basis of

Acceptance. The basis for acceptance shall be compliance with the requirements set forth in the PWS, the Contractor’s proposal and other terms and conditions of the contract. Deliverable items rejected shall be corrected in accordance with the applicable clauses. Deliverables shall be inspected for content, completeness, accuracy and conformance to PWS requirements.

Inspection may include validation of information or software through the use of automated tools, testing or inspections of the deliverables.

All rejected deliverables shall be resubmitted within three business days.

The contractor can request an extension through the COR and receive approval from the CO.

One rejection will not lower the overall rating for that deliverable.

Two rejections on the same deliverable will not lower the overall frating for that deliverable, providing the final product is accepted within the due date range for that rating.

Three or more rejections on the same deliverable will lower that deliverable’s rating by one rating, providing the final produc is accepted within the due date range for that rating.

Statements Standards/AQLs Inspections Ratings

3.1. Security Clearance

Requirements. The contractor will not need to access classified material.

At a minimum, the contractor shall have a valid NACI in order to complete the required deliverables.

The contractor shall provide proof of a valid NACI upon the start of contract performance and whenever personnel changes occur.

Excellent – N/A

Very Good – Maintain NACI on all employees throughout the entire period of performance. Provide valid NACI within three business days for new employees.

Satisfactory – Maintain NACI on all employees throughout the entire period of performance. Provide valid NACI between four business days and seven business days for new employees.

Marginal – Maintain NACI on all employees throughout the entire period of performance. Provide valid NACI between eight business days and fourteen business days for new employees.

Unsatisfactory – Fail to maintain NACI on all employees throughout the entire period of performance.

3.6. WARs. The contractor shall submit

WARs to the COR at the end of each business week.

Weekly Excellent – Submit WAR one day early.

Very Good – Submit WAR on time.

Satisfactory – Submit WAR one day late.

Marginal – Submit WAR two days late.

Unsatisfactory – Submit WAR more than three days late.

5.2.1. CARs. When contract requirements

are not met and subsequent corrective action is required, then a CAR or electronic equivalent shall be initiated IAW the QASP.

Monthly Excellent – No CARs or customer complaints.

Very Good – No CARs and no more than one customer complaint.

Satisfactory – No more than one CAR and two customer complaints.

Marginal – No more than two CARs and three customer complaints.

Unsatisfactory – Three or more CARs.

6.0. Points of Contact.

6.0.1. Contracting Officer’s Representative: +44 01638 523381 or DSN: 314-226-3381

6.0.2. Contract Specialist: +44 01638 521222 or DSN: 314-226-1222

6.0.3. Contracting Officer: +44 01638 522165 or DSN: 314-226-2165

References

(All Publications and Forms are available for download at: http://www.e-publishing.af.mil/)

DoDM 5200.2, Procedures for the DoD Personnel Security Program

DoD 5205.02-M, DoD Operations Security (OPSEC) Program

DoD 5220.22-M, National Industrial Security Program Operating Manual

DoDD 5230.25, Withholding of Unclassified Technical Data From Public Disclosure

DoD 5400.7, DoD Freedom of Information Act (FOIA) Program

DoDI 8500.01, Cybersecurity

DoDI 8510.01, Risk Management Framework (RMF) for DoD Information Technology (IT)

DoD 8570.01-M, Information Assurance Workforce Improvement Program

AFI 10-701, Operations Security (OPSEC)

AFI 16-1404, Air Force Information Security Program

AFI 17-101, Risk Management Framework (RMF) for Air Force Information Technology (IT)

AFI 17-110, Information Technology Portfolio Management and Capital Planning and Investment Control

AFI 17-130, Cyber Security Program Management

AFMAN 17-1303, Cybersecurity Workforce Improvement Program

AFI 31-101, Integrated Defense (ID)

AFH 33-337, The Tongue and Quill

AFMAN 33-363, Management of Records

AFI 33-364, Records Disposition – Procedures and Responsibilities

AFI 63-101, Integrated Lifecycle Management

AFI 63-138, Acquisition of Services

AE Regulation 600-700, Identification Card and Individual Logistic Support

Forms:

DD 1172-2, Application for Identification Card/DEERS Enrollment

DD 2875, System Authorization Access Request (SAAR)

AE Form 600-77A, Request for Issue of Status of Forces Agreement (SOFA) Identification

Non-Disclosure Agreement For Contractor Employees http://www.e-publishing.af.mil/