DRAFT_-_AF_FIAR_PWS_IDIQ_22_Dec_16.pdf

AF FIAR Follow On Support ID/IQ PWS Contract No. XXX

ID/IQ PWS Page 1 of 48

PERFORMANCE WORK STATEMENT

FOR

AIR FORCE

FINANCIAL IMPROVEMENT & AUDIT READINESS (FIAR) FOLLOW ON

SUPPORT

INDEFINITE DELIVERY / INDEFINITE QUANTITY (ID/IQ)

Solicitation Number: FA7014-17-R-5002

Contract Number XXX

As of 22 December 2016

ID/IQ PWS Page 2 of 48

TABLE OF CONTENTS

SECTION A DESCRIPTION OF SERVICES AND TASK REQUIREMENTS

1.0 BACKGROUND……………………………………………………………………….. 4

1.1 Mission………………………………………………………………………

1.2 Scope……………………………………………………………………………

1.3 Major Objectives………………………………………………………………… ...5

1.4 Other Objectives…………………………………………………………………..5

1.5 Direct MAJCOM/DRU Support

2.0 TASK REQUIREMENTS.............. ……………………………………….............……..6

2.1 Task 1: Administrative/Program Management Office.....………………...……

2.2 Task 2: Enduring Audit Readiness..…………...…………………………………. 8

2.3 Task 3: Corrective Actions………………………………………........………

2.4 Task 4: IPA Audit Liaison Support…...........………………………………....… 12

2.5 Task 5: IT Support……………………………………………

2.6 Task 6: Change Management………………………………………………

2.7 Task 7: SAF/A6 Chief Information Security Officer (CISO) Framework…

SECTION B ENVIRONMENTAL, SAFETY, HEALTH, PERSONNEL AND SECURITY

3.0 ENVIRONMENTAL REQUIREMENTS………………………………………... 16

4.0 SAFETY AND HEALTH REQUIREMENTS……………………………………… 16

5.0 SECURITY……………………………………………………………………………. 16

5.1 Physical Security………………………………………………………………… 16

5.2 Personnel Security………………………………………………………………. 18

6.0 PERSONNEL

6.1 Independent Public Accounting (IPA) Certification.....…………

6.2 Decision Making..…………...…………………………………. 20

6.3 Meeting Participation………………………………………........………

6.4 Human Resources Management…...........………………………………....… 20

6.5 Personnel Qualifications………………………

6.6 Personnel Maintenance………………………………………………

6.7 Key Personnel..........................................................................…

6.8 Rention……………………………………

6.9 Turnover...............................................................................…

6.10 Contractor Identification……………………

6.11 Removal of Personnel at Government Request................................…

7.0 CONTRACT MANAGEMENT

7.1 Financial Management.....……....................................……

7.2 Duty Hours..…………...…………………………………. 25

ID/IQ PWS Page 3 of 48

7.3 Off-site Performance………………………………………........………

7.4 Kick-off Meting…...........………………………………....… 26

7.5 Scope Questions………………………

7.6 Contractor Manpower Reporting……………………………………

SECTION C QUALITY CONTROL

8.0 INSPECTION SYSTEM…………………………………………………………….. 27

9.0 PERFORMANCE EVALUATION…………………………………………………. 28

9.1 Access…………………………………………………………………. 28

9.2 Nonconformance………………………………………………………………… 28

9.3 Issue Notification...………………………………………………………… 29

9.4 Performance Evaluation Meetings……………………………………………. 29

9 .5 Deliverables…………………………………………………………………29

9.6 Services Summary………………………………………………………… 32

9.7 Transition Plan

SECTION D GOVERNMENT FURNISHED ITEMS

10.0 GOVERNMENT FURNISHED ITEMS………………………………………………. 33

10.1 Documents………………………………………………………………………..33

10.2 Local Area Network……………………………………………………………. 33

10.3 Workspace/Telephone……………………………………………………………34

10.4 Computers……………………………………………………………………….. 34

SECTION E TASK ORDER REQUIREMENTS

11.0 NEW TASK ORDER REQUIREMENTS…………………………………………….. 35

11.1 Government Notification to Contractor………………………………………. .35

11.2 Content and Format of Contractor Responses to New Task Order Requirements 36

11.3 Task Order Award…………………………………………………………….. 36

SECTION F APPENDICES

APPENDIX A: General Fund Assessable Units……………………………………37 APPENDIX B: Acronyms APPENDIX C: Mandatory Supplemental Documentation………………………….42 APPENDIX D: Organizational Conflict of Interest APPENDIX E: Labor Categories

ID/IQ PWS Page 4 of 48

AF FIAR Follow On Support ID/IQ PWS Contract No. XXX

SECTION A: DESCRIPTION OF SERVICES

1.0 BACKGROUND.

1.1 Mission. The Financial Improvement and Audit Readiness (FIAR) requirement is owned by the Assistant Secretary of the Air Force (Financial Management and Comptroller) (SAF/FM), and the contract is managed by Air Force District of Washington. SAF/FM has the responsibility for providing the financial management and analytical services necessary for the effective and efficient use of Air Force (AF) resources, to include more than 650,000 military and civilian personnel and a budget of more than $160 billion. SAF/FM serves as the Secretary of the AF's trusted advisor by providing high-quality support to decision makers on budgetary, financial, cost and economic issues while continuously improving the quality, efficiency and customer-focus of AF financial services and operations. The Deputy Assistant Secretary for Financial Operations (SAF/FMF) is responsible at the executive level for ensuring the AF complies with legislative and executive financial management mandates leading to the effective and efficient use of AF resources.

1.2 Scope.

1.2.1 SAF/FM produces AF financial statements to assist financial managers in their decision-making processes by providing relevant and reliable financial information to help the AF meet the requirements of the FIAR. A major objective of SAF/FM is for these financial statements to achieve an unmodified or “clean” audit opinion for each AF financial statement. The Air Force began full financial statement audits in FY 2018.

1.2.2 The AF FIAR Support contract will provide Advisory & Assistance Services (A&AS) support in accordance with (IAW) Federal Acquisition Regulation (FAR) Part 37.2 in the areas of Management and Professional Support Services and Studies, Analyses and Evaluations.

1.2.3 IAW FAR 37.202, A&AS services acquired under this contract may not include routine information technology services, unless they are an integral part of an A&AS contract;

architectural and engineering services as defined in the Brooks Architect-Engineers Act (40 U.S.C. 1102); and research on theoretical mathematics and basic research involving medical biological, physical, social, psychological, or other phenomena.

1.2.4 Initial Task Orders Issued Upon Award of Indefinite Delivery/Indefinite Quantity (ID/IQ) Contract (Minimum Guarantee). Five (5) task orders will be issued upon award of the ID/IQ, with PWSs released with the ID/IQ solicitation. Award of these initial task orders will serve as the minimum guarantee to the Contractor.

1.2.5 Ongoing performance for the AF FIAR Support contract will be required, as specified in each task order, as follows:

ID/IQ PWS Page 5 of 48

Table 1 – Performance Locations

LOCATION/BASE

National Capital Region (NCR) Wright Patterson AFB, OH Columbus, OH Air Force Major Commands (MAJCOM) and Direct Reporting Units (DRU)

• MAJCOMs:

o Air Combat Command (ACC), Langley AFB, VA o Air Education & Training Command (AETC), Lackland AFB, TX o Air Force Global Strike Command (AFGSC), Barksdale AFB, LA o Air Force Materiel Command (AFMC), Wright Patterson AFB, OH o Air Force Reserve Command (AFRC), Robins AFB, GA o Air Force Special Operations Command (AFSOC), Hurlburt AFB, FL o Air Force Space Command (AFSPC), Peterson AFB, CO o Air Mobility Command (AMC), Scott AFB, IL o Air National Guard (ANG), NCR o Pacific Air Forces (PACAF), Hickam AFB, HI (Outside the Continental United States

(OCONUS))

o United States Forces in Europe (USAFE), Ramstein AB, GE (OCONUS)

• DRUs:

United States Transportation Command (USTRANSCOM), Scott AFB, IL Air Force Medical Operations Agency, Fort Detrick, MD Defense Health Headquarters, Falls Church, VA

1.2.6 Travel to support efforts will be required to multiple sites, AF bases, MAJCOMs, and DRUs throughout the Continental United States (CONUS) and Outside CONUS (OCONUS).

1.2.7 Travel will be determined in course of activities defined in specific task orders.

1.2.8 The Contractor shall submit travel requests electronically to the COR five (5) business days in advance for program management. Requests for travel less than five (5) business days in advance require CO approval.

1.3 Major Objectives.

1.3.1 Assist Accounting and Financial Operations (SAF/FMFA) in supporting annual financial statement audit liaison support; enduring audit readiness support; corrective action plans creation, monitoring and resolution; and Information Technology assessment and support in compliance with methodology established in the most current OUSD(C) FIAR Guidance (Note: 'FIAR Guidance' includes all attachments, appendices and hyperlinks)

1.4 Other Objectives.

1.4.1 AF Major Command (MAJCOM) / Direct Reporting Unit (DRU) Liaison Support. The Contractor shall provide MAJCOM liaison support between MAJCOMs/Functional Community and SAF/FMFA to assist with sustaining audit readiness, Office of Management and Budget (OMB) Circular A-123 annual cycles, and financial statement audit liaison support. This

ID/IQ PWS Page 6 of 48 work will be defined in later task order(s).

1.5 Direct MAJCOM/DRU Support:

1.5.1 The Contractor shall provide direct support to AF MAJCOMs and DRUs, with work to be further identified in a separate task order, and will include, but is not limited to:

• Preparing Flowcharts and Narratives of business processes

• Supporting the Performance of Inventory checks

• Supporting the Performance of Inspections

• Creation and implementation of sustainment processes (i.e., checklists)

• Sustainment work

2.0 TASK REQUIREMENTS

2.1 Task 1: Administrative/Program Management Office

The objective of this task is to provide Advisory and Assistance (A&AS) Contractor program management support, auditing expertise, and oversight to all work related to the AF FIAR Follow on Support contact.

2.1.1 Maintain key personnel deemed critical to managing the overall performance of the AF FIAR Follow on Support ID/IQ contract IAW the AF FIAR Support ID/IQ PWS paragraph XX and subparagraphs. Changes to the Contractor-identified Key Personnel as incorporated into the contract, shall be submitted to the CO for approval prior to implementation of change. The Contractor shall provide a detailed description of the change to include the title and criteria required in the AF FIAR Support ID/IQ PWS, Table 8 demonstrating the appropriate expertise and credentials to properly manage the entire requirement and any applicable task order requirements.

2.1.2 Provide primary point(s) of contact to work with the Government on all AF FIAR Support ID/IQ issues.

2.1.3 Respond to Government Contracting Officer (CO) or Program Manager (PM) requests in a timely manner.

2.1.4 Support and/or participate in meetings as follows:

• Weekly Management Update with the Audit Readiness Office (SAF/FMFA)

• Bi-Monthly meeting with Air Force Under Secretary of Management (SAF/MG)

• Monthly FIAR Sub-Committee Meeting

• Monthly Executive Steering Committee (ESC) Meetings

• Monthly OMB Circular A-123 Meetings and associated subordinate organizations meetings

• Monthly Internal Process Reviews (IPR) for each assessable unit

• Monthly Team Update Meeting (TUM) for each SBR assessable unit

• Support for the following meetings:

o Monthly FIAR Committee Meeting

ID/IQ PWS Page 7 of 48 o Bi-Monthly FIAR Governance Board

2.1.5 Possess the requisite skills in AF FIAR Support ID/IQ Contract paragraphs XX and XX, to provide the necessary oversight and program management necessary to ensure Contractor success requirements of contract.

2.1.6 Assist SAF/FMF in answering all FIAR related questions presented from senior leadership.

2.1.7 Performance Reviews.

2.1.7.1 Program Management Reviews (PMR). Attend scheduled PMRs, as notified by the Government. Government personnel, as appropriate, will meet at least semi-annually with the Contractor to review performance. PMRs will be held in the NCR, as deemed appropriate to meet contractual requirements and minimize expense to the Government. The Government will conduct PMRs via teleconference whenever possible to mitigate travel costs; therefore, PMRs will be considered part of the cost of doing business and not a separate line item for reimbursement. PMRs will cover status and feedback on performance measures, Contractor performance, and any significant events. PMRs are intended to serve as an opportunity for open and frank discussions on the current status of the contract. The Government will provide advance copies of PMR agendas, seeking Contractor input/discussion items, and will provide meeting minutes for Contractor review and approval prior to making them official. The Contractor shall provide written notice to the Government identifying any areas of non-concurrence.

2.1.7.2 Other Performance Reviews. In addition to PMRs, the Government may meet with the Contractor, at Government or Contractor request, to discuss Contract-specific issues.

2.1.8 Management Reports. The Contractor shall prepare and submit the following reports in the format established by the Government (see Appendix TBD, Table 3 - Mandatory Supplemental Documentation for current format). See Table 1 – Contract Deliverables for delivery schedule.

• Bi-Weekly Activity Report (BAR). The Contractor shall provide a Bi-Weekly Activity Report by noon Eastern Time every other Friday.

• Travel Request. The Contractor shall submit travel requests electronically to the COR five (5) business days in advance for program management. Requests for travel less than five (5) business days in advance require CO approval.

• Trip Report. The Contractor shall submit trip reports electronically to the COR within two (2) working days after return from business trip for program management support.

2.1.9 Template Management. The Contractor shall:

ID/IQ PWS Page 8 of 48

• Manage all existing templates for audit readiness for currency, fit, form, function, and content for all deliverables required by performance to ensure standardization.

• Ensure utilization of current template versions.

• Make recommendations for improvement to and obtain approval from applicable COR prior to implementation of any template changes.

2.2 Task 2: Enduring Audit Readiness

2.2.1 Entity Level Controls (ELC) and OMB Circular A-123

2.2.1.1 The contractor shall advise and assist with implementation and compliance with:

• Federal Managers’ Financial Integrity Act of 1982 (FMFIA)

• OMB Circular A-123, Management’s Responsibility Enterprise Risk Management and

Internal Control (including Appendix A, Internal Controls Over Financial Reporting)

• OMB Bulletin No 01-02, Audit Requirements for Federal Financial Statements

• Federal Financial Management Improvement Act of 1996 (FFMIA)

• GAO Standards for Internal Control in the Federal Government (Green Book)

2.2.1.2 The A-123 program shall be designed and implemented across the Air Force enterprise in conjunction with existing efforts such as the Management Internal Control Program (MICP), MAJCOM Self-Testing, Sustainment testing, etc. The contractor will support the following requirements:

2.2.1.3 Supporting USAF in evolving its established A-123 and Manager’s Internal Control Program (MICP) into an overall Enterprise Risk Management (ERM) program. Key tasks include the following.

• Develop an overarching ERM program strategy and framework including objectives and metrics.

• Assess AF against the ERM framework and develop a maturity model.

• Develop an implementation roadmap to address the updated OMB Circular A-123 requirements related to ERM.

• Provide any other support that helps advance and achieve AF’s goals surrounding sustaining audit readiness and wound ERM program.

2.2.1.4 Develop recommendations for an effective governance structure to include an Assessment Implementation Team (AIT), Senior Assessment Team (SAT) and Senior Management Control Council (SMCC).

ID/IQ PWS Page 9 of 48

2.2.1.5 Develop and provide training to all applicable stakeholders for all critical elements and phases of the Air Force’s A-123 program.

2.2.1.6 Perform an analysis of existing AUs defined in XX and align them to business cycles (Procure to Pay, Order to Cash, Record to Report, etc) for proper evaluation by the OMB Circular A-123 program.

2.2.1.7 Annually assist the Air Force in performing full cycle of A-123. This shall include, but not limited to:

• Scoping and planning activities that include a documented risk based assessment of Business Process Cycles and Programs, etc. These risk assessments should also include consideration of the Air Forces system environment for financially significant systems, applications, spreadsheets, etc. The risk assessments should also assess financial significant accounts and operating locations.

o Deliverables will include:

Planning and scoping document for A-123 program execution and overall project schedule for the fiscal year

• Documentation and testing to include updating existing internal control process, performing test of Design (TOD) and testing of operating effectiveness (TOE), performing gap assessment on control effectiveness and process improvement. Develop and/or update existing internal control documentation based on business process cycles to include narratives, flowcharts, risk and control matrices, or equivalent. Develop corrective action plans to address self-identified deficiencies (SIDs) resulting from testing failures.

o Deliverables will include:

Updated business process cycles memos Updated risk assessments, internal controls (including required complimentary user entity controls (CUECS)) for each business cycle/assessable unit and a comprehensive master controls catalog

Updated testing plans and resulting TOD and TOE results Draft update of Statement on Standards for Attestation Engagements

(SSAE) No 18 Air Force Analysis Report for each SSAE applicable to the Air Force.

• Reporting and Monitoring results o Deliverables will include:

Input to annual Statement of Assurance and associated briefings

2.2.1.8 Sustainment of relevant assessable unit process information will be sustained and kept current for all assessable units.

2.2.1.9 Document and assess IT Controls via standards consistent with the goals and objectives of 2.14.1.

2.2.2 Service Providers (SP)

2.2.2.1 The Contractor shall support the AF in establishing and maintaining Memorandums of

ID/IQ PWS Page 10 of 48

Understanding (MOUs) and control documentation related to 3rd party providers and receivers of services as they impact the AF FIAR business processes. This support shall include:

• Attendance at the OUSD(C) lead Service Provider Working Group and updating of materials based on guidance received.

• Assist with monitoring any new SP guidance from relevant sources and incorporate into

AF SP monitoring approach.

• Integration of the existing SP monitoring cycle into the A-123 approach defined in Task

2.1. This shall include specific monitoring and tracking of AF controls meeting CUEC classification, their associated FROs, KSDs, and other supporting documentation

• Annual review and updates of all MOUs.

2.2.3 Executive Level Support/Metrics

2.2.3.1 The Contractor shall support the development of executive level briefings and metrics for monitoring and oversight for Task 2.

2.3 Task 3: Corrective Actions

2.3.1 The Contractor shall assist in development and implementation of corrective action plans (CAPs) to remediate issues for all self-identified deficiencies, financial management IPA notice of findings and recommendations (NFRs) and identified financial management relevant GAO, DoDIG, and AFAA audit recommendations, in accordance with FIAR Guidance and AF SOPs.

These task shall include:

• Phase 1 Confirm: document and agree to the deficiencies, assign Office/Organization of Primary Responsibility (OPR) and assign priority levels

• Phase 2 Plan: perform root cause analysis, identify responsible organizations, merge similar findings across AUs into combined CAPs, and determine resources

• Phase 3 Design: develop milestones, tasks, and timeline (e.g., due dates)

• Phase 4 Implement: execute the milestones

• Phase 5 Validate: confirm that CAP addressed the deficiency

• Monitor & Report: inform management of progress at regular intervals (occurs throughout all phases of the CAP process). Submit monthly CAP reports.

2.3.1.1 The Contractor shall consider both as-is and to-be process business processes and IT systems/environments when recommending CAPs to include efficiencies and adequate solutions are considered for applying CAPs in both environments to include:

• Support related to business process re-engineering and standardization.

ID/IQ PWS Page 11 of 48

• Assisting with the development and implementation of updated policies and procedures, including as applicable necessary training activities.

• Assist with updating existing gap analysis on in scope systems that have a financial impact and determine if system controls exist and are operating effectively. Assist where necessary in development of System requirement information in coordination with paragraph

XX.

2.3.1.2 The Contractor shall maintain CAP SOP and update as necessary to remain in compliance with SAF/FMF direction, FIAR Guidance, OMB Circular A-123, Appendix A, and GAO Green Book

2.3.2 Population Completeness/Universe of Transactions

2.3.2.1 In order to comply with Financial Improvement & Audit Readiness, the Air Force (AF) requires the capability to present the IPA a transactional level audit trail that is complete and can support CFO reporting.

2.3.2.2 The Contractor shall assist with the maintenance of the Population Completeness Universe of Transactions (UoT) Framework for Full Financial Statements addressing the accounting transactions and audit requirements necessary to support the all Air Force General Fund Financial Statements (inclusive of Mission Critical Assets Universe of Transactions) via the LoGUoT initiative). This Framework shall include:

• The contractor shall support SAF/FM to maintain the UoT strategy and completeness controls based upon transactional level detail and data pathways (GAFS-R, DEAMS, and other future subsidiary ledgers). Deploy analytical techniques and toolsets to support the development and review of financial system data (e.g., quantitative drill down) as requested by SAF/FM.

• The Universe of Transactions Framework Population Completeness Guide should be considered a living document and the Contractor should assist with necessary updates until population completeness for the AF is achieved. Upon completion, the Guide Framework should be updated yearly to ensure critical updates to processes and data elements are incorporated into the Guide Framework and shared with the IPA, as necessary.

• The Contractor shall assist SAF/FM with participating in working groups related to UoT.

2.3.2.3 The Contractor shall support SAF/FM with ad-hoc data analytics requests over financial statement information.

2.3.3 Mission Critical Asset Manual Reconciliations

2.3.3.1 Manual sustainment of General Fund Mission Critical Assets financial and logistics data reconciliations relevant to General Fund Financial Statements to produce transaction universes that reconcile to the general ledger.

ID/IQ PWS Page 12 of 48

2.3.4 Valuation Baseline and Go Forward Sustainment

2.3.4.1 Assist the Government in sustaining the beginning balances for each category of asset based on existing strategies and approaches for General Equipment, Operating Materials and Supplies, and Real Property until such time as a Go Forward compliant process in place. This will involve supporting the government in development of processes and procedures to obtain necessary Key Supporting Documentation and updating all associated documentation as it relates to beginning balance effort.

2.3.5 Accruals

2.3.5.1 Provide ongoing support for SAF/FMF in implementing corrective actions and continuing to improve internal controls over key SAF/FMF accrual processes. The contractor shall also assist SAF/FMF in developing, documenting, and implementing accrual methodologies/procedures, controls and processes to mitigate relevant FIAR financial reporting risks.

2.4 Task 4: IPA Audit Liaison Support

2.4.1 Provide audit liaison support for the Air Force General Fund full financial statement audit.

2.4.2 Provide audit liaison support where Air Force General Fund is a service provider.

2.4.3 Audit liaison support shall include maintenance and execution of audit infrastructure.

Audit infrastructure support includes:

• The Contractor shall design, configure, provide administrative services, update and use the centralized audit response tools to retain audit documents to facilitate audit liaison activities for financial statement audits. These tools will facilitate the exchange of audit information, including auditor requests for information, samples, and supporting documentation, and financial manager submission of documents in response to auditor requests. Tools will support General Fund and Working Capital Fund audit response tools.

• Contractor support for the Working Capital Fund is limited to design, configure of audit response tools.

2.4.4 Contractor shall assist SAF/FMF in key discussions with IPA and document discussions, decision points, action items, and requests for documentation to SAF/FMF and submission to

IPA.

2.4.5 Monitor audit status and provide updated status to MAJCOMs, SAF/FMF leadership and OSD or other Department of Defense (DOD) Executive leadership briefings as required.

https://www.google.com/search?biw=1600&bih=717&q=maintenance&spell=1&sa=X&ved=0ahUKEwi9h7WIn8vNAhVIaz4KHSh9A2MQvwUIGSgA

ID/IQ PWS Page 13 of 48

2.4.6 Assist SAF/FMFA in logistics related to IPA.

2.4.7 Assist SAF/FMF in generating reports to assess the status of IPA requests for support documentation.

2.4.8 Train/educate the IPA on the Air Force business processes and controls under audit (mission, entity structure, service provider relationship) to facilitate an effective and efficient audit.

2.4.9 Provide support for SAF/FMF and Air Force MAJCOMs by serving as lead/liaison to facilitate requirements and disseminate required data to and from the field for direct support of audit requirements.

2.5 Task 5: IT Support

2.5.1 The Contractor shall provide support in documenting and assessing IT compliance, in both legacy and target environments, to assist SAF/FM and the Air Force in achieving and maintaining an audit ready state for information systems identified in the FIAR assertion process.

Contractor support shall include systems identified in Appendix TBD.

• IT Compliance Assessments/Testing. The contractor shall conduct sustainment assessments consisting of:

2.5.2 Security Controls Assessment. The contractor shall provide support assessing, documenting, testing and monitoring internal controls in alignment with current AF, FISCAM and FIAR Guidance related to systems utilized in the performance of material business processes.

2.5.3 Business Process Control Assessment. The contractor shall provide FFMIA Assessments on AF material systems utilizing DFAS Blue Book.

2.5.4 For system who have completed previous FIAR baseline assessments, the contractor shall conduct update testing to include implemented corrective action plans and sustainment testing of selected internal controls. This approach shall be integrated into the A-123 approach identified in

2.15 and shall include:

2.5.5 Audit remediation support after the completion of IT Compliance Assessments, internal audits, or external audits of AF Financial Management systems.

2.5.6 Advising and assisting AF Management in the prioritization of identified issues, development of corrective actions, and tracking of their resolution.

2.5.7 Assisting system program managers and their designees with required updates and modifications to CAPs as adjustments are required.

ID/IQ PWS Page 14 of 48

2.5.8 Developing and documenting of best practices for distribution and incorporation in FM information assurance guidelines.

2.5.9 For systems requiring critical changes as a result of SIDs, Critical Issues, or NFRs;

support the requirement definition process for system change requests required to address corrective actions. This support shall include:

2.5.10 Support the AF Service Development and Delivery Process (SDDP) as required for development activity related to FIAR business processes. This support shall include:

2.5.11 Supporting the identification of key FFMIA requirements for proposed development activity.

2.5.12 Integration with program managers to provide clarification on FFMIA requirements as required.

2.5.13 Validation testing of the requirement at both the design and testing phases.

• IT Compliance Oversight and Documentation. The contractor shall support AF management in the development, revision, and documentation of IT Compliance strategies. This support shall include:

2.5.14 Maintaining current knowledge of guidance, policies, and regulations; and be able to communicate updates and incorporate into existing IT Compliance strategies.

2.5.15 Coordinating and collaborating with various portfolio managers and program offices.

2.5.16 Assisting with collecting, developing and briefing FIAR IT metrics.

2.5.17 Analyzing system impacts and materiality to the Air Force including coordination of and updates to the official list of FIAR-identified systems maintained by SAF/FMPFS.

2.5.18 Assist SAF/FM with the integration of FIAR information into existing portfolio management initiatives.

2.5.19 Assisting with collecting, developing, briefing and reporting progress on IT Compliance Assessments, corrective actions, and FIAR Metrics.

• Maturity Model. This model should establish a plan to integrate ongoing CFO Compliance activities into processes being established for Risk Management Framework (RMF) authorizations. The Contractor should look to identify areas where the RMF processes can be improved or modified to deliver the output required for ongoing FIAR compliance. These processes will include the following RMF Steps: Categorize, Select, Implement, Assess, Authorize, and Monitor as directed by DODI 8510.01.

ID/IQ PWS Page 15 of 48

• IT FIAR Functional Management Support. The Contractor shall provide support in assisting identified functional communities with the integration of IT Compliance activities into specific corporate initiatives. Including but not limited to:

2.6 Task 6: Change Management

2.6.1 The contractor shall provide broad-based communications and change management support for program management, financial management, and business process improvement and standardization. Strategic communication efforts will enable the AF to achieve the following:

• An integrated and coordinated approach to execute this initiative through the development of communication and change management strategies.

• Assess communication and outreach strategies, approaches, and forums used internally and externally to assist SAF/FMF with internal collaboration and in keeping auditee personnel informed on audit status, protocols and delineating how auditee personnel will interact with the IPA and the processes and procedures as they relate to audit response.

The strategies and approaches shall be consistent with those activities identified in XX.

• Development/sustainment of open communications across the AF Enterprise to build and maintain awareness and support.

• Assist the AF Enterprise through anticipated large-scale organizational changes including organizational strategies, adoption of SOPs and auditability efforts.

2.7 Task 7: SAF/A6 Chief Information Security Officer (CISO) Framework.

2.7.1The Contractor shall assess the design, operating effectiveness, and propose strategy and policies to support AF CISO Framework addressing AF entity level controls associated with IT Security. The Contractor shall:

2.7.2 Provide cyber and network security technical and risk management expertise to AF Chief Information Security Officer.

2.7.3 Assist the Government in cyber security standards, security architectures, and plans to enable the Air Force organizations to practice safe security techniques and technical solutions to protect AF data.

2.7.4 Review innovative methods, procedures, techniques, and approaches to ensure that proper security criteria, guidance, and methodology are applied to information systems and security devices being developed and acquired.

ID/IQ PWS Page 16 of 48

2.7.5 Provide recommendations based on research, analyses, risk assessment and review of concepts, staff packages and other reports.

2.7.6 Provide ERM expertise and support to establish an Air Force wide RMF, track enterprise level risk and support better decision making.

2.7.8 Draft point papers, reports, publications, meeting minutes, and other documents as required.

2.7.9 Develop an acculturation strategy, to include recommended training, to assist the AF in successful transition to the AF CISO framework to support ELCs and appropriate enterprise risk management.

2.7.10 Provide inputs and recommendations regarding AF policy related to IA training and workforce certification and assist in formulating policy, tracking compliance, and assisting in the support of various IA and network security initiatives.

SECTION B: ENVIRONMENTAL, SAFETY, HEALTH AND SECURITY

3.0 ENVIRONMENTAL REQUIREMENTS. The Contractor shall comply with all applicable federal, state and local environmental statutes, instructions, manuals, handbooks, regulations, guidance, policy letters and rules (including all changes and amendments), and all Presidential Executive Orders in effect on the date of award. The Contractor shall comply with the highest degree of environmental protection where any disagreements exist. For OCONUS work, the Contractor shall also comply with all applicable host nation statutes and agreements.

In addition, the Contractor shall comply with the following publications: the Department of Defense (DoD) Overseas Environmental Baseline Guidance Document (OEBGD) or the Final Governing Standards (FGS), if adopted for a particular location.

4.0 SAFETY AND HEALTH REQUIREMENTS. The Contractor shall comply with all applicable Occupational Safety and Health Administration (OSHA) and Air Force Occupational Safety and Health (AFOSH) standards, technical orders, regulations and referenced publications. The Contractor shall comply with the highest degree of safety protection where any disagreements exist.

5.0 SECURITY. The Contractor, and all Contractor personnel, shall abide by all AF and local rules, procedures, and standards of conduct on physical and personnel security. For all tasks with classified work, the Contractor shall satisfy the Clearance Requirements that follow below prior to gaining access to classified materials.

5.1 Physical Security.

5.1.1 The Contractor shall safeguard all Government property and controlled forms provided

ID/IQ PWS Page 17 of 48 for Contractor use and adhere to the Government property requirements contained in this contract. The Contractor shall ensure all Government equipment and materials are secured at the end of each day. Each task order will identify additional security procedures, if applicable.

5.1.2 For Official Use Only (FOUO) and Privacy Act. Comply with requirements of DoD 5400.7-R, Chapter 4, DoD Freedom of Information Act (FOIA) Program, as well as The Privacy Act of 1974, as amended at 5 U.S.C. 552. This regulation/guidance sets policy and procedures for the disclosure of records to the public and for marking, handling, transmitting and safeguarding FOUO and Privacy Act information/material.

5.1.3 Controlled/Restricted Areas. (IF APPLICABLE) The contractor shall implement local base procedures for entry to Air Force controlled/restricted areas where contractor personnel will work. An AF Form 2586, Unescorted Entry Authorization Certificate, must be completed and signed by the sponsoring agencies Security Manager before a Restricted Area Badge will be issued. Contractor employees must have a favorably completed National Agency Check Plus Written Inquiries (NACI) investigation before receiving a Restricted Area Badge. Interim access can be granted IAW AFI 31- 501, Personnel Security Program Management

5.1.4 Key Control. (IF APPLICABLE) The contractor shall establish and implement methods of making sure all keys issued to the contractor by the Government are not lost or misplaced and are not used by unauthorized persons. The contractor shall not duplicate any keys issued by the government.

• The contractor shall immediately report to the Quality Assurance Evaluator (QAE) or Program Manager any occurrences of lost or duplicated keys.

• In the event keys, other than master keys, are lost or duplicated, the contractor may be required, upon written direction of the contracting officer, to re-key or replace the affected lock or locks without cost to the government. The government may, however, at its option, replace the affected lock or locks or perform re-keying and deduct the cost of such from the monthly payment due the contractor. In the event a master key is lost or duplicated, all locks and keys for that system shall be replaced by the government and the total cost deducted from the monthly payment due the contractor.

• The contractor shall prohibit the use of keys, issued by the government, by any persons other than the contractor's employees and the opening of locked areas by contractor employees to permit entrance of persons other than contractor employees engaged in performance of contract work requirements in those areas.

5.1.5 Lock Combinations. (IF APPLICABLE) The contractor shall control access to all government provided lock combinations to preclude unauthorized entry. The contractor is not authorized to record lock combinations without written approval by the government Program Manager. Records with written combinations to authorized secure storage containers, secure storage rooms, or certified vaults, shall be marked and safeguarded at the highest classification level as the classified material maintained inside the approved containers.

ID/IQ PWS Page 18 of 48

5.2 Personnel Security.

5.2.1 All personnel assigned to this contract shall be U.S. citizens.

5.2.2 Prior to performance, all Contractor personnel shall obtain a Secret Clearance and hold either an Interim Secret (favorably completed National Agency Check plus written Inquiries investigation (NAC-I)). Contractor personnel shall have appropriate clearances prior to commencing work unless otherwise approved in writing by the CO. Contractor personnel performing any tasks in their own facilities that require classified AF information must also have an appropriate security clearance.

5.2.3 Controlled/Restricted Areas. Implement local base procedures for entry to AF controlled or restricted areas where Contractor personnel shall work. The Government will complete an AF Form 2586, Unescorted Entry Authorization Certificate, completed and signed by the sponsoring agency’s Security Manager, before a Restricted Area Badge will be issued. Contractor employees shall have a favorably completed NAC-I investigation before receiving a Restricted Area Badge. Interim access shall be granted IAW AFI 31- 501, Personnel Security Program Management.

5.2.3.1 Within 10 calendar days of award of any task order, the Contractor shall provide the Primary COR a list with the names, location of performance and clearance requirements of all company employees assigned to the task order.

5.2.3.2 Visitor Group Security Agreement (VGSA). The contractor shall enter into a long term visitor group security agreement if contract performance is on base for 90 days or more.

This agreement shall outline how the contractor integrates security requirements for contract operations with the Air Force to ensure effective and economical operation on the installation.

The agreement should address:

• Security support provided by the Air Force to the contractor to include storage containers for classified information/material, use of base destruction facilities, classified reproduction facilities, use of base classified mail services, security badging, base visitor control, investigation of security incidents, base traffic regulations, the use of security forms, and conducting inspections required by DOD 5220.22-R, Industrial Security Regulation, and Air Force Instruction 16-1406, Industrial Security Program Management.

• Security support requiring joint Air Force and contractor coordination includes packaging classified information, mailing and receiving classified materials, implementing emergency procedures for protection of classified information, security checks, and internal security controls for protection of classified material and high value pilferable property.

• On base, the long term visitor group security agreement may take the place of a

Standard Practice Procedure (SPP).

ID/IQ PWS Page 19 of 48

5.2.4 Clearance Requirements. The contractor must possess or obtain a facility security clearance (FCL) at the classification level of SECRET prior to performing contract work. If the contractor does not possess a FCL the government (Contracting Office) will request one. The government (DSS) assumes costs and conducts security investigations for facility security clearances. The contractor shall request security clearances (Submit Clearance Paperwork through DSS to the Office of Personnel Management) for personnel requiring access to classified information within 15 days after receiving a facility clearance or, if the contractor is already cleared, within 15 days after contract award. Due to costs involved with security investigations, requests for contractor security clearances shall be kept to an absolute minimum necessary to perform contract requirements.

5.2.5 Notification. The contractor shall notify (Servicing Security Activity (SSA) & Address), 30 days before on base performance of the contract. The notification shall include:

• Name, address, and telephone number of company representatives.

• The contract number and contracting agency.

• The highest level of classified information which contractor employees require access to.

• The location(s) of contract performance.

• The date contract performance begins.

5.2.6 Listing of Employees. The contractor shall maintain a current listing of employees. The list shall include the employee's name, social security number and level of security clearance.

The list shall be validated and signed by the company Facility Security Officer (FSO) and provided to the Sponsoring Agencies Security Manager. An updated listing shall be provided when an employee's status or information changes.

5.2.7 Security Manager Appointment. The contractor shall appoint a security manager for the on base Visitor Group. The security manager may be a full time position or an additional duty position. The security manager shall provide employees with training required by DOD 5200.1-R, Information Security Program Regulation, and AFI 16-1404, "Information Security Program Management". The contractor will also provide initial and follow-on training to contractor personnel who work in Air Force controlled/restricted areas. Air Force restricted areas and controlled areas are explained in AFI 31-101, The Air Force Installation Security Program.

5.2.8 Pass and Identification Items. The contractor shall ensure the pass and identification items required for contract performance are obtained for employees and non-government owned vehicles.

5.2.9 Retrieving Identification Media. The contractor shall retrieve all identification media, including vehicle passes from employees who depart for any reason before the contract expires

ID/IQ PWS Page 20 of 48

(i.e. - terminated for cause, retirement, etc.)

5.2.10 Traffic Laws. The contractor and its employees shall comply with base traffic regulations.

5.2.11 Weapons, Firearms, and Ammunition. Contractor employees are prohibited from possessing weapons, firearms, or ammunition, on themselves or within their contractor-owned vehicle or privately-owned vehicle while on (Name of Installation).

5.2.12 For Official Use Only (FOUO). The contractor shall comply with DoD 5400.7-R, Chapter 4, DoD Freedom of Information Act (FOIA) Program, requirements. This regulation sets policy and procedures for the disclosure of records to the public and for marking, handling, transmitting, and safeguarding FOUO material.

5.2.13 Reporting Requirements. Contractor personnel shall report to an appropriate authority any information or circumstances of which they are aware may pose a threat to the security of DOD personnel, contractor personnel, resources, and classified or unclassified defense information. Con- tractor employees shall be briefed by their immediate supervisor upon initial on-base assignment.

6.0 PERSONNEL

6.1 Independent Public Accounting (IPA) Certification. The Prime Contractor shall be an IPA firm with the qualifications and experience to conduct financial statement audits on large, complex organizations equivalent to the AF and licensed by a recognized state board of accountancy to issue opinions on those financial statements. The Contractor shall notify the Contracting Officer (CO) immediately if, at any time during the contract, the Prime Contractor loses its authority to issue a financial statement audit opinion.

6.2 Decision Making.

6.2.1 The Contractor is not authorized to make decisions on behalf of the Government. The Contractor shall make recommendations to Government personnel for the Government’s decision-making purposes.

6.2.2 Government, not Contractor, personnel will keep SAF/FM, SAF/FMF and SAF/FMFA leadership informed of status.

6.3 Meeting Participation. Contractor personnel shall support FIAR-related meetings convened at the direction of the applicable COR. The Contractor shall provide information in support of meetings and briefings in the format requested by the Government.

6.4 Human Resources Management. The Contractor shall have the capability and experience to large workforce to meet very large task order requirements with very short timelines and multiple locations of performance.

ID/IQ PWS Page 21 of 48

6.5 Personnel Qualifications.

6.5.1 The Contractor shall provide qualified personnel, for each task order, that meet or exceed the stated Knowledge, Skills, and Abilities (KSA) qualification requirements for required work at all levels of performance as defined in paragraph XX below and in Table 8 - Contractor Labor Category Descriptions (as incorporated into the contract at award).

6.5.2 The Contractor shall possess the overall aggregate skills, expertise, and experience in each of the areas identified to successfully complete all ID/IQ and TO requirements.

• Generally Accepted Accounting Principles (GAAP), Government Auditing Standards (GAGAS), and internal control over financial reporting (ICOFR)

• Office of Management and Budget (OMB) Circulars:

o A-123, Management’s Responsibility Enterprise Risk Management and

Internal Control;

o A-134, Financial Accounting Principles and Standards o A-136, Financial Reporting Requirements

• Other pertinent OMB policies and federal financial management systems requirements

• Federal Information Systems Controls Audit Manual (FISCAM) requirements

• OUSD(C) FIAR Guidance

• DoD and Air Force Financial Management

• Adherence to the Federal Accounting Standards Advisor Board (FASAB), Statements of Federal Financial Accounting Concepts (SSAC), and Statements of Federal Accounting Standards (SFFAS)

• Oracle Federal Financials functionality

• AF legacy financial management systems and processes

• Operational AF Financial Data Structure

• Operational AF Data Dictionary

• DoD financial management policies and procedures

• AF policies, systems and procedures for personnel, acquisition, inventory, property and material management

• Current trends in information technology

• Certified Public Accountant (CPA) certification

• Defense Financial Manager (CDFM) certification

• Government Financial Manager (CGFM) certification

• Certified Internal Auditor (CIA) certification, as applicable

• Certified Information Systems Auditor (CISA) certification

6.5.3 All Contractor personnel shall:

• Be capable of working independently

• Competently, legibly and articulately communicate in the English language

6.5.4 The Contractor shall submit proposed resources/batches for the Government’s review, concurrence or non-concurrence. The Government will provide the Contractor a concurrence or non-concurrence decision within seven (7) business days.

ID/IQ PWS Page 22 of 48

6.6 Personnel Maintenance.

15.1 The Contractor shall maintain minimal personnel turnover throughout the life of each task order and ensure continuation of services during personnel absences due to sickness, leave, and voluntary or involuntary termination from employment such that impact to the Government is minimal.

6.7 Key Personnel. Key personnel shall serve as the interface with Government personnel, to include the Government Program Management Office (PMO) and CORs.

6.7.1 Government-identified Key Personnel. Government-identified Key Personnel for this effort are provided below. The titles given for each area are indicative of the function(s) performed by these personnel and do not necessarily represent individual labor categories. For instance, ‘Statement/Project Areas Supervisors and Managers’ may be a subset of a ‘Supervisor/Manager’ labor category.

6.7.2 All Contractor senior executive support personnel who: (1) oversee the entire project;

(2) provide primary interface with client management personnel regarding strategic (vice task order specific) issues; and (3) serve as the final authority in the conduct of engagements and full responsibility for the work performed, including overall project management and final review shall possess:

• A minimum of ten (10) years of financial statement audit experience OR ten (10) years of AF Financial Management experience (or combination thereof equaling ten (10) years) within the last 15 years

6.7.3 The Contractor shall provide a single dedicated senior executive position to this requirement that, in addition to the above experience, shall possess:

• A Certified Public Accountant (CPA) by examination, licensed by the appropriate state licensing authority OR CISA for FISCAM senior executive support personnel; and

• Experience performing financial statement audits in DoD, federal agencies, or commercial Fortune 400 organizations

6.7.4 All Contractor management personnel (other than those specified in XX) who supervise…