FA701424F0078 CISO PWS.pdf

Attachment 1 – Performance Work Statement

SAF/CN

Performance Work Statement (PWS) For

Chief Information Security Officer (CISO) Support

Service Bridge Task Order

30 January 2024

1.0 BACKGROUND

1.1 Cybersecurity affects all Air Force operations, as it is profoundly depended upon for the capabilities provided in the cyberspace domain to execute missions in air, space, and cyberspace. By incorporating the concept of key cyber terrain into daily mindset of every Airman, reduced or eliminated vulnerabilities to core mission systems, weapon systems, platform IT (PIT), and control systems can be achieved, resulting with totality of mission assurance. This new way of thinking is a resultant of increased systems' dependency upon the use of information technology. Through joint collaboration across the Air Force and the Department of Defense-- and Executive Committee ("EXCOM") approved priority lists -- the (Task Force Cyber Secure (TFCS) has developed a cross-cutting list of transformational efforts with focus on enterprise-wide impact and high returns on investment. This prioritized list includes initiatives that document specific organizations' vantage points that impact multiple missions, programs, and systems; it does not include limited reach initiatives, with respect to specific locations, systems, or programs.

1.2 The CISO’s Cybersecurity Division (SAF/CNZ) is tasked to provide oversight and policy guidance to enable mission assurance through effective Cybersecurity risk management across the five Air Force core mission areas (Air and Space Superiority;

Intelligence, Surveillance and Reconnaissance; Rapid Global Mobility; Global Strike; and Command and Control).

2.0 OBJECTIVE

2.1 The contractor shall provide Advisory and Assistance Services (A&AS) to support the Government’s development of policy, governance, processes, and oversight of Cybersecurity Program requirements and responsibilities. These advisory services enable the Division to execute its role as the focal point for Air Force-wide Cybersecurity Programs, ensuring the Air Force is compliant with federal laws, OMB, and DoD Directives.

• Task 1 – Implementing Cybersecurity Risk Framework (CSF)

• Task 2 - Implementing Risk Management Framework (RMF)

TABLE 1: Definitions

Table 1- Acronyms

Acronym Definitions AF Air Force AO Authorizing Official CIO Chief Information Officer CISO Chief Information Security Officer CNSS Committee on National Security Systems CSF Cyber Security Framework DOD Department of Defense DSAWG Defense Information Assurance/Security Accreditation Working

Group FISMA Federal Information Security Management Act IA Information Assurance IAM Information Assurance Manager IRP Investment Review Panel MAJCOM Major Command NIST National Institute of Standards and Technology OMB Office of Management and Budget PPBE Planning, Programming, Budgeting & Execution RMC Risk Management Council RMF Risk Management Framework SECAF Secretary of the Air Force SP3 Strategic Planning and Programming Process TAG Technical Advisory Group TTP Tactics, Techniques and Procedures

3.0 TASK REQUIREMENTS

The contractor shall provide technical expertise to the AF Chief Information Security Officer (CISO) and other personnel within and outside the Cybersecurity Division.

The contractor shall provide expertise and flexibility to achieve a broad range of Cybersecurity functions, ultimately ensuring compliance with capabilities directed in acquisition, Cybersecurity, and other correlative policies. These services are critical to ensure that SAF/CIO A6Z can meet all federal, OMB, DOD, and AF regulatory and statutory requirements.

The contractor shall maintain a strong in-depth awareness of all policies involving the Cybersecurity to include the Cybersecurity Framework and Risk Management Framework issued by NIST, CNSS, AF, and DoD policy/guidance, and Federal agencies.

The contractor shall provide a Phase In/Out Plan with their technical proposal defining the transition process to the new contractor from the incumbent and shall cover actions and time frames for transition at the beginning and the end of this period of performance including any options. The contractor shall maintain the plan, updating as required throughout the period of performance.

3.1 Task 1 - Implementing NIST Cybersecurity Risk Framework (CSF) (current version) The Framework for Improving Critical Infrastructure Cybersecurity (“Cybersecurity Framework”) is a voluntary framework developed through a collaborative process by industry, academia, and government stakeholders. NIST continues, as directed by the Cybersecurity Enhancement Act of 2014, to facilitate and support the development of voluntary, industry-led Cybersecurity standards and best practices. It is designed to be relevant for every size, sector, and type of organization.

The Framework provides an approach to prioritize Cybersecurity resources, make risk decisions, and take action to reduce risk. It enhances Cybersecurity communication within an organization and with other organizations (such as partners, suppliers, regulators, and auditors) and helps organizations identify, manage, and assess Cybersecurity risks. The Cybersecurity Framework’s prioritized, flexible, and cost-effective approach helps to promote the protection and resilience of critical infrastructure and other sectors important to the economy and national security.

3.1.1 The contractor shall serve as a technical advisor ensuring the latest approved version of the Cybersecurity framework is implemented to enable AF organizations practice security techniques to minimize the risk for the AF’s cyber landscape.

3.1.2 The contractor shall plan, analyze, develop, document, track, present, and implement Government approved technical solutions to maintain Cybersecurity for AF information systems, enclaves, major applications, platform information technology (PIT), PIT subsystems, PIT components, PIT control systems, Operational Technology IT internal and external services, and IT hardware, software, and applications.

3.1.3 Must have knowledge to author and implement strategies, roadmaps, policies and

TTPs for Supply Chain Risk Management (SCRM), Defense Industrial Base (DIB), Internet of Things (IOT), Risk Management (including the Risk Executive Function); Cyber Hygiene, Cybersecurity Culture, Crypto Modernization and Emerging Technologies.

3.1.4 Reviews and evaluates security incident response policies, identify gaps and ensure completeness IAW federal, DoD, and Air Force policies.

3.1.5 The contractor shall develop TTPs for the inclusion of threat analysis into cybersecurity program.

3.1.6 The contractor shall assist with development of policies to ensure inclusion of cybersecurity into the Air Force corporate structure (i.e. SP3, PPBE process).

3.1.7 The contractor shall interface with regular recurring and high-level decision boards, interact and coordinate actions, and communicate complex technical solutions to all levels of AF, DoD, Joint, and partner customers supporting key meetings including but not limited to federal, OMB, DoD, AF, DSAWG, IRP, AO Summit, TAG, RMC, and other forum and decision-making bodies.

3.1.8 The contractor shall provide support to assess and implement higher-level

Cybersecurity requirements including but not limited to federal laws, regulations, Presidential, OMB, and DOD directives.

3.1.9 The contractor shall develop and recommend, present and future Cybersecurity requirements for AF IT, OT, and PIT including but not limited to MAJCOM and theater-unique requirements. The contractor shall provide recommendations based on research, analyses, risk assessment and review of concepts, staff packages and other reports.

3.1.10 The contractor shall provide the status of Cybersecurity initiatives in periodic and unscheduled briefings, including but not limited to Air Force, Air Staff, Secretary of the Air Force (SECAF), Joint Staff, DOD briefings, and mission partners.

3.1.11 The contractor shall provide support and guidance as an Air Force subject matter expert for Cybersecurity in, including but not limited to, technical symposia, industry conferences, seminars, meetings, working groups and panels as directed by the Government.

3.1.12 The contractor shall review new and existing methods, procedures, techniques, and approaches to ensure proper security criteria, guidance, and methodology are applied to AF IT, OT, AND PIT being developed and acquired by the DoD and Defense Agencies.

3.1.13 The contractor shall provide Cybersecurity support for the development and implementation of security architectures to meet new and evolving security

3.1.14 The contractor shall provide subject matter expertise and aid during the discussions and development of briefings, papers, etc. with Government personnel in various forums and meetings including but not limited to presentation development, research and white paper development, setup/teardown of meeting, developing meeting minutes, and updating sits/repositories.

3.1.15 The contractor shall provide support in the drafting for formal coordination including but not limited to creation of staff summary packages (both electronic and hard-copy paper version), creating and routing tasks (electronically and hard-copy paper version), and maintain awareness of formal coordination through completion.

3.1.16 The contractor shall prepare, facilitate and provide post-event minutes and summaries for meeting, including but not limited to action officer, executive, and Congressional level hearings, meetings, seminars, conferences, boards, and related activities.

3.1.17 The contractor shall input, edit, maintain/update and present AF cybersecurity management metrics including but not limited to data such as FISMA, cybersecurity scorecard, dashboards, SharePoint sites, and DOD 8570.01 certifications. The contractor shall provide input into the CIO data (information dominance flight plan balanced scorecard) on the AF SharePoint site.

3.1.18 The contractor shall prepare monthly and annual Cybersecurity reports including but not limited to Branch metrics, Division metrics, CISO, SAF/CIO A6, DoD, OMB, and federal requirements.

3.1.19 The contractor shall provide input and recommendation regarding AF policy related to cybersecurity training and workforce certification; formulates policy, tracks compliance, and assists in the support of various cybersecurity and network security initiatives.

3.1.20 The contractor shall provide support in assessing Cybersecurity posture and overseeing requirements development within the core missions and capabilities (RGM, ISR, C2, AS, SS, CS, and ACS) as it pertains to Cybersecurity.

3.1.21 The contractor shall develop and maintain a Project Work Plan to include tasks and scheduling information for projects assigned by the government.

3.1.22 The contractor shall provide Monthly Status Reports to the TR and COR including but not limited to work accomplished, date started, estimated completion date, and list of milestones.

3.1.23 The contractor shall display a rollup from all organizational score cards in executive dashboard format on the assigned collaboration site. The scorecard will provide simple drill down format to each organizational scorecard.

3.2 Task 2 - Implementing NIST Risk Management Framework (RMF)

Support is required to ensure a successful Air Force transition to and comply with the latest approved version of the cyber security requirements such as those resulting from laws, regulations or Presidential directives. RMF is one higher level security requirement the Air Force must comply with. Implementing new security requirements or transitioning to new frameworks have the potential to impact more than 4,800 mission and business systems and thousands of Platform IT systems. Development and implementation of new requirements require coordination with each of the MAJCOMs & Functional communities.

The contractor shall maintain a strong in-depth awareness of the latest approved version of all policies involving the Risk Management Framework including but not limited to NIST, CNSS, DoD, and AF policy/guidance. The contractor shall provide subject matter expert recommendations and support for implementing, updating, changing, and communicating RMF including but not limited to writing policy changes, creating white papers, researching methodologies, creating templates, and producing communication media. The contractor shall inform the force about realistic cyber threats and develop strategic risk understanding (IDFP).

The contractor shall coordinate, support, and monitor the RMF transition by supporting key stakeholders to ensure a successful transition to RMF for the AF. This includes but is not limited to coordinating with various RMF roles like the Authorizing Officials, Security Controls Assessor, Program Managers, Information System Owners, and Information System Security Managers; assist the various RMF roles to remove roadblocks to completing RMF;

document lessons learned; provide metrics on the transition.

3.2.1 The contractor shall serve as a technical advisor ensuring Risk Management

Framework is implemented to enable Air Force organizations practice security techniques to minimize the risk for the AF’s cyber landscape.

3.2.2 The contractor shall serve as Air Staff-level subject matter expert on Cybersecurity, identity, cybersecurity plans, policies, procedures, tactics, techniques and procedures specific to cybersecurity workforce training and certification.

3.2.3 The contractor shall plan, analyze, develop, document, track, present, and implement Government approved technical solutions to maintain Cybersecurity for AF information systems, enclaves, major applications, platform information technology (PIT), PIT subsystems, PIT components, PIT-control systems, Operational Technology IT internal and external services, and IT hardware, software, and applications.

3.2.4 Must have expert knowledge to author and implement strategies, roadmaps, policies and TTPs for Supply Chain Risk Management (SCRM), Defense Industrial Base (DIB), Internet of Things (IOT), Risk Management (including the Risk Executive Function); Cyber Hygiene, Cybersecurity Culture, Crypto Modernization and Emerging Technologies.

3.2.5 Reviews and evaluates security incident response policies, identify gaps and ensure completeness IAW federal, DOD, and Air Force policies.

3.2.6 The contractor shall development of TTPs for the inclusion of threat analysis into cybersecurity program.

3.2.7 The contractor shall assist with development of policies to ensure inclusion of cybersecurity into the Air Force corporate structure (i.e. SP3, PPBE process).

3.2.8 The contractor shall interface with regular recurring and high-level decision boards, interact and coordinate actions, and communicate complex technical solutions to all levels of AF, DoD, Joint, and partner customers supporting key meetings including but not limited to federal, OMB, DoD, AF, DSAWG, IRP, AO Summit, TAG, RMC, and other forum and decision-making bodies.

3.2.9 The contractor shall provide support to assess and implement higher-level

Cybersecurity requirements including but not limited to federal laws, regulations, Presidential, OMB, and DOD directives.

3.2.10 The contractor shall develop and recommend present and future Cybersecurity requirements for AF IT, OT, AND PIT including but not limited to MAJCOM and theater-unique requirements. The contractor shall provide recommendations based on research, analyses, risk assessment and review of concepts, staff packages and other reports.

3.2.11 The contractor shall provide the status of Cybersecurity initiatives in periodic and unscheduled briefings, including but not limited to Air Force, Air Staff, Secretary of the Air Force (SECAF), Joint Staff, DOD briefings, and mission partners.

3.2.12 The contractor shall provide support and guidance as an Air Force subject matter expert for Cybersecurity in, including but not limited to, technical symposia, industry conferences, seminars, meetings, working groups and panels as directed by the Government.

3.2.13 The contractor shall review new and existing methods, procedures, techniques, and approaches to ensure proper security criteria, guidance, and methodology are applied to AF IT, OT, and PIT being developed and acquired by the DoD and Defense Agencies.

3.2.14 The contractor shall provide Cybersecurity support for the development and implementation of security architectures to meet new and evolving security

3.2.15 The contractor shall provide subject matter expertise and aid during the discussions and development of briefings, papers, etc. with Government personnel in various forums and meetings including but not limited to presentation development, research and white paper development, setup/teardown of meeting, developing meeting minutes, and updating sits/repositories.

3.2.16 The contractor shall provide support in the drafting for formal coordination including but not limited to creation of staff summary packages (both electronic and hard-copy paper version), creating and routing tasks (electronically and hardcopy paper version), and maintain awareness of formal coordination through completion.

3.2.17 The contractor shall prepare, facilitate and provide post-event minutes and summaries for meeting, including but not limited to action officer, executive, and Congressional level hearings, meetings, seminars, conferences, boards, and related activities.

3.2.18 The contractor shall input, edit, maintain/update and present AF cybersecurity management metrics including but not limited to data such as FISMA, cybersecurity scorecard, dashboards, SharePoint sites, and DOD 8570.01 certifications. The contractor shall provide input into the CIO data (information dominance flight plan balanced scorecard) on the AF SharePoint site.

3.2.19 The contractor shall prepare monthly and annual Cybersecurity reports including but not limited to Branch metrics, Division metrics, CISO, SAF/CIO A6, DoD, OMB, and federal requirements.

3.2.20 The contractor shall provide input and recommendation regarding AF policy related to cybersecurity training and workforce certification; formulates policy, tracks compliance, and assists in the support of various cybersecurity and network security initiatives.

3.2.21 The contractor shall provide support in assessing Cybersecurity posture and overseeing requirements development within the core missions and capabilities (RGM, ISR, C2, AS, SS, CS, and ACS) as it pertains to Cybersecurity.

3.2.22 The contractor shall provide subject matter expert recommendations and support for implementing, updating, changing, and communicating RMF including but not limited to writing policy changes, creating white papers, researching methodologies, creating templates, and producing communication media.

3.2.23 The contractor shall coordinate, support, and monitor the RMF transition by supporting key stakeholders to ensure a successful transition to RMF for the AF.

This includes but is not limited to coordinating with various RMF roles like the Authorizing Officials, Security Controls Assessor, Program Managers, Information System Owners, and Information System Security Managers; assist the various RMF roles to remove roadblocks to completing RMF; document lessons learned;

provide metrics on the transition.

3.2.24 The contractor shall research, develop, and document repeatable processes and templates to ensure the efficient execution of RMF. This includes but is not limited to creating guidance and templates for continuous monitoring and risk assessment methodology.

3.2.25 The contractor shall develop and maintain a Project Work Plan to include tasks and scheduling information for projects assigned by the government.

3.2.26 The contractor shall provide Monthly Status Reports to the TR and COR including but not limited to work accomplished, date started, estimated completion date, and list of milestones.

3.2.27 The contractor shall display a rollup from all organizational score cards in executive dashboard format on the assigned collaboration site. The scorecard will provide simple drill down format to each organizational scorecard.

4.0 DELIVERABLES

4.1 The Contractor shall provide the contract and task order deliverable(s) in the format specified in paragraph 5.0 of this PWS. All deliverables will be reviewed for timeliness, accuracy, content, completeness and format by the Government and will be accepted or returned for changes within 10 business days. Deliverables requiring changes will be reviewed by the Government after resubmission. If a deliverable due date falls on a weekend or holiday, the Contractor shall submit the deliverable on the last business day prior to the due date. In fulfillment of this effort, the Contractor shall provide the following deliverables (Table 2):

Table 2 Deliverables

Deliverables PWS Reference Deliver To Due Date Weekly Update PWS paragraph 3.1.11 COR Weekly (Monday of each week) addressing previous week’s activity

Monthly Status Report

PWS paragraph 3.1.23 COR Submit no later than the 5th business day of each month addressing the preceding month to include Contract Burn Rate

Quality Control Plan PWS paragraph 10.8 CO/COR Draft provided with proposal (as part of Volume II Submission). Updates provided NLT than 10 calendar days after implementation of changes

Transition Documentation PWS paragraph 3.0

COR Draft provided with proposal. Final provided within 60 days of contract award.

Trip Report PWS paragraph 8.3 CO/COR Five business days after travel has commenced

Meeting Minutes PWS paragraph 3.1.12 COR Two business days after meeting

Enterprise Risk Management Strategy

PWS paragraph 3.2 COR NLT than 60 calendar days after award; Updates provided within 30 calendar days of implementation of changes

Risk Executive Function Charter

PWS paragraph 3.2.4 COR NLT than 60 calendar days after award; Updates provided within 10 calendar days of implementation of changes

AF Risk Management Framework Roadmap PWS paragraph 3.2

COR Updates provided within 30 calendar days of implementation of changes

TTPs for CISO CSF implementation

PWS paragraph 3.1.3 COR NLT than 45 calendar days after award; Updates provided within 30 calendar days of implementation of changes

Internet of Things (IoT) Roadmap IAW

CSF

PWS paragraph 3.1.3 COR NLT than 45 calendar days after award; Updates provided within 30 calendar days of implementation of changes

Platform IT (e.g.

weapons systems, aircraft) Roadmap

IAW CSF

PWS paragraph 3.1.3 COR NLT than 45 calendar days after award; Updates provided within 30 calendar days of implementation of changes

Operational IT (e.g.

Industrial Control Systems) Roadmap

IAW CSF

PWS paragraph 3.1.3 COR NLT than 45 calendar days after award; Updates provided within 10 calendar days of implementation of changes

Supply Chain Risk Management Roadmap IAW CSF

PWS paragraph 3.1.3

COR Updates provided within 10 calendar days of implementation of changes

Defense Industrial Base Roadmap IAW

CSF

PWS paragraph 3.1.3 COR NLT than 45 calendar days after award;

Updates provided within 30 calendar days of implementation of changes

AF Cybersecurity Culture Roadmap

PWS paragraph 3.1.3 COR NLT than 30 calendar days after award;

Updates provided within 30 calendar days of implementation of changes

AF CISO Strategic Communication

PWS paragraph 3.1.4 COR Upon request based on information requirement

(Announcements, web postings, emails, etc.)

Emerging Technology Review

TTP

PWS paragraph 3.1.4 COR NLT than 60 calendar days after award;

Updates provided within 30 calendar days of implementation of changes

Periodic Briefings status of Cybersecurity initiatives in periodic and unscheduled briefings

PWS paragraph 3.1.10 COR Period Briefings, as needed.

Phase In/Phase Out Plan

PWS Paragraph 3.0 CO/COR Initial submission due with proposal. The Phase In/Phase Out Plan is considered a “living document” The Phase In/Out Plan shall be updated at the request of the Government if and when there are changes in the contractor’s management or staffing that would require further documentation

5.0 DELIVERY INSTRUCTIONS

5.1 All deliverables shall be submitted to the COR and/or other required entities as indicated no later than the date specified in Table 1 and IAW the PWS.

5.2 All deliverables shall be submitted electronically, with the exception of physical products (ex., brochures, posters, display booths, etc.).

5.3 Deliverables are to be transmitted via email using MS Office products.

6.0 PERSONNEL REQUIREMENTS

6.1 The contractor shall propose mix of mid-level and senior personnel to bring a variety of experience levels and perspectives to the team (See Table 3).

6.2 The Contractor shall provide qualified personnel who meet or exceed the experience and education necessary to execute this requirement. The Contractor shall submit only one resume for Government review for each position being staffed in order to verify whether or not the individual meets the experience and education requirements of the task order. The Government will not accept or review multiple resumes for each position being staffed, and the Contractor is fully responsible for selecting and staffing its workforce with qualified personnel.

Notification of contractor personnel changes for any requirement will be in writing no later than 10 days prior to the start of work for new personnel or departure of incumbent whichever is earlier.

6.3 The Contractor shall maintain minimal personnel turnover during the period of performance for this requirement. The Contractor shall ensure continuity of services during personnel absences due to sickness, leave, termination from employment such that impact to the Government is minimal. Contractor Key Personnel position vacancies or absences shall not exceed 15 calendar days unless approved by the CO. 6.4 The Government may request removal (permanent or temporary) of any Contractor personnel who are identified as a potential threat to the health, safety, security, general wellbeing or operational mission of any installation and its population.

6.5 The Contractor shall monitor the rate at which the services are being provided (“burn rate”) and shall report the level of hours worked as a percentage of the total hours on a monthly basis.

This information may be contained as part of the monthly status report.

Table 3 Labor Category and Associated Security Level

Labor

Cat

Labor Cat

Historical

FTE

Key Personnel

Clearance

Requirements

127G Program Manager 1 X Secret Project Management Profession (PMP)

123G-3 Information Assurance/Security Specialist (Senior)

3 X TS/SCI IAM Level 3

132G-2 Subject Matter Expert (Senior) 2 X TS/SCI IAM Level 3 132G-3 Subject Matter Expert (Master) 1 X TS/SCI IAM Level 3 137G-3 Training Specialist (Senior) 1 X Secret N/A 105G Business Systems Analyst 1 X Secret N/A 132G-3 Option: Subject Matter Expert (Master) 2 TS/SCI IAM Level 3 114G Option: Enterprise Architect 1 TS/SCI IAM Level 3 134G Option: Technical Editor 1 Secret Degree in writing, computer science or a related cybersecurity field. Three years’ experience in a related job.

135G Option: Technical Writer 2 Secret Degree in writing, computer science or a related cybersecurity field.

131G Option: Strategic/Capital Planner 1 Secret N/A 124G Option: Information Specialist/

Knowledge Engineer 1 TS/SCI IAM Level 3

7.0 DATA

7.1 Unlimited Rights. The government has unlimited rights to all deliverables of this task order to include intellectual property rights. None of the data or documents obtained or created under this task order will be maintained on any systems or databases that could be accessed by non-assigned Contractor personnel.

7.2 Disposition of Data. Documents, data files, reports, correspondence, and all other documents and writings, explanatory, historical documents related thereto, regardless of the medium (or media) by which they were produced, preserved, stored, or created in connection with or for purpose(s) of work performed under this PWS and contract, are property of the government and shall be delivered to the COR or as otherwise provided in this PWS or the resultant contract/order.

7.3 Confidentiality of Records/Information. The contractor is responsible for protecting the confidentiality of any records related to any activity conducted under this PWS and contract which are not considered public information and may be exempt from disclosure under the Freedom of Information Act and/or the Privacy Act. Each contractor or employee of the contractor or subcontractor employee to whom information may be made available or disclosed shall be notified in writing by the contractor that such information may be disclosed only for purposes and to the extent authorized herein. The contractor shall not release any information related to this contract to the public, media or other unauthorized persons or organizations unless the government has granted written approval.

8.0 TRAVEL

8.1 Travel. The contractor may be required to perform periodic travel in accomplishing this contract both within and outside the Continental United States. The contractor shall coordinate specific travel arrangements with the individual CO or COR to obtain advance, written approval for the travel. The contractor’s request for travel shall be in writing and contain the dates, locations, and estimated travel costs. The contractor shall be responsible for obtaining all passenger transportation, lodging, and subsistence, required to perform this contract. Allowable travel costs are described in FAR 31.205-46 and the contractor will submit all travel receipts to the COR for all allowable costs when submitting that month’s invoice for that specific period of performance for the travel.

8.2 All travel requests must be received NLT five (5) business days prior to commencement of travel in the format agreed to by the COR. The actual number of trips may change pending contract demands.

8.3 Travel Authorization and Approval. All travel shall be in accordance with regulatory requirements, such as the Joint Travel Regulation (JTR), and actual travel shall be coordinated and pre-approved by the COR. The Contractor shall provide a written request for travel to the COR at least five (5) business days prior to finalizing any travel arrangements. All travel must be approved by the COR prior to purchase of tickets and commencement of travel. Travel projections are subject to change based on Government requirements.

8.4 Trip Reports. The Contractor shall provide written trip reports and all travel receipts for all travel related to this task order. The trip report shall include the reason for the travel as approved and specifically what was accomplished by the trip in terms of results and specific benefit to the Government. All trip reports shall take into consideration the classification and appropriate handling of such information when filed but shall not include any sensitive or FOUO information.

8.5 Travel Receipts. Within five (5) business days following completion of travel, the Contractor shall provide travel receipts to the COR for all allowable costs IAW PWS 10.3. The Contractor shall provide receipts for all travel to include hotel (regardless of amount), airfare (regardless of amount), and all other expenses that exceed $75.00 or in accordance with the Joint Travel Regulation as amended from time to time. The Contractor must keep a copy of all receipts, regardless of amount, on file in order to support surveillance and/or audit if requested.

8.6 Local Travel. Travel within 50 miles of the contractor’s facility to attend meetings shall be considered a cost of doing business and shall not be separately reimbursed.

9.0 SECURITY

9.1 Performance under this PWS requires that all personnel have a minimum SECRET clearance. Positions requiring a clearance level higher than SECRET are identified accordingly in paragraph 6.0 as part of the position requirements for each organization. All SECRET clearances must be active at contract start or a valid Interim Clearance must be approved and in place prior to contract start for Non-Key Personnel.

9.2 The Contractor, and all Contractor personnel, shall abide by all AF and local rules, procedures, and standards of conduct on physical and personnel security. For all tasks with classified work, the Contractor shall satisfy Clearance Requirements prior to gaining access to classified materials.

9.3 Weapons, Firearms, and Ammunition. Contractor employees are prohibited from possessing weapons, firearms, or ammunition, on themselves or within their contractor-owned vehicle, privately- owned vehicle or rental vehicle while on an Air Force or Government Installation.

9.4 Installation Access. Contractor employees are required to gain entry onto an Air Force or Government Installation to conduct activities related to this PWS. Contractor employees must be eligible to gain entry to the Installation. If a contractor employee is denied access by the Air Force or other Government organization for any reason, the government will not pay for any related expenses to include time for travel, preparation, and delivery.

9.5 For Official Use Only (FOUO). The Contractor shall comply with DoD 5400.7-R, Chapter 4, DoD Freedom of Information Act (FOIA) Program, requirements. This regulation sets policy and procedures for the disclosure of records to the public and for marking, handling, transmitting, and safeguarding FOUO material.

9.6 Reporting Requirements. Contractor personnel shall report to an appropriate authority any information or circumstances of which they are aware that may pose a threat to the safety or security of DoD personnel, contractor personnel, resources, and classified or unclassified defense information.

9.7 Physical Security. The Contractor will be provided the contact information for Installation police forces – Security Forces. All government facilities, equipment, and materials used by the Contractor must be secured before leaving the site of the mediation.

9.8 Contractor Provided Facilities and Equipment. In the event Government space is not available and contractor workspace is required, the contractor shall provide adequate workspace to accommodate all contractor personnel not provided space in Government facilities. The contractor shall be required to provide facilities at the appropriate clearance level for required work by the DD254. In the event Government space is not available and contractor workspace is required, the contractor shall provide contractor controlled facilities with necessary infrastructure support to include telecommunications, furniture and equipment necessary to perform contractual duties.

10.0 ADMINISTRATION CONSIDERATIONS:

10.1 Performance Schedule. The period of performance is stated in the contract.

10.2 Place of Performance. The Contractor shall be required to perform and accomplish tasks identified in this task order at SAF CIO A6, Pentagon, Washington, D.C., full-time. Workspace and GFE will be provided by the Government in accordance with 12.0 of the PWS.

10.3 Base Shutdown/Inclement Weather. The contractor will follow guidance of the installation containing their place of performance to determine reporting schedules whether due to a base closure or inclement weather. The website for guidance regarding status of performance in the National Capitol Region (NCR) is http://www.opm.gov/status/.

10.4 Telework. Telework may be permitted for this contract if approved by the COR, on a situational basis or on a regular basis, as the COR determines. If permitted, the Contractor shall follow guidance of the installation containing their place of performance to determine reporting schedules whether due to a base closure or inclement weather. In the event the Government shuts down or there is inclement weather, the onsite contracted support could be authorized to continue work at their alternate work location. If no alternate work location is available, situational telework will be authorized, unless already previously on a regular basis authorized.

10.5 Parking. The contractor will be authorized parking at the Pentagon should spaces be made available.

10.6 Combating Trafficking in Persons. The Contractor shall comply with FAR 52.222-50, Combating Trafficking in Persons. The COR will monitor Contractor's performance regarding trafficking in persons. The COR shall immediately notify the CO of non-compliance with FAR 52.222-50. The CO shall convey the information to the DoD Combat Trafficking in Persons (CTIP) Law Enforcement Support Office of Under Secretary of Defense (OUSD) Personnel http://www.opm.gov/status/ and Readiness (P&R) Defense Human Resources Activity (DHRA) at http://ctip.defense.gov.

The Department of State's Office to Monitor and Combat Trafficking in Persons is http://www.state.gov/j/tip.

10.7 Service Standards. The Contractor shall provide professional and courteous support to the customer, such as responsiveness, adaptability, flexibility, and timeliness. The Contractor shall follow established quality control procedures and correct problems by established suspense dates.

10.8 Organizational Conflict of Interest. Contractor and subcontractor personnel performing work under this contract may have access to information which may create Organizational Conflict of Interests (OCI) as defined in FAR Subpart 9.5. The Contractor shall notify the CO immediately whenever it becomes aware that such access may result in any actual or potential OCI and shall promptly submit a plan to the CO to avoid or mitigate any such OCI. The contractor’s mitigation plan will be determined to be acceptable solely at the discretion of the CO and in the event the CO unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the CO may affect other remedies as he or she deems necessary, including prohibiting the contractor from participation in subsequent contracted requirements which may be affected by the OCI. The Contractor shall comply with the OCI clause, which will be included in Section C of the task order upon award.

10.9 Contractor Identification. The employees of the Contractor and its subcontractor(s) shall identify themselves using their company affiliation on any attendance sheet or any documents they may review, as well as telephonic communication. Electronic mail signature blocks shall identify their company affiliation.

10.10 Non-Personal Services. The Government will neither supervise contractor employees nor control the method by which the contractor performs the required tasks. Under no circumstances shall the Government assign tasks to, or prepare work schedules for, individual contractor employees. It shall be the responsibility of the Contractor to manage its employees and to guard against any actions that are of the nature of personal services, or give the perception of personal services. If the Contractor believes that any actions constitute, or are perceived to constitute personal services, the Contractor shall notify the CO immediately in writing or by e-mail. These services shall not be used to perform work of a policy/decision making or management nature, i.e., inherently Governmental functions. All decisions relative to programs supported by the Contractor shall be the sole responsibility of the Government.

10.11 Contractor Identification. All contractor/subcontractor personnel shall be required to wear AF-approved or provided picture identification badges so as to distinguish themselves from Government employees. When conversing with Government personnel during business meetings, over the telephone or via electronic mail, contractor/subcontractor personnel shall identify themselves as such to avoid situations arising where sensitive topics might be better discussed solely between Government employees. Contractors/Subcontractors shall identify themselves on any attendance sheet or any coordination documents they may review.

Electronic mail signature blocks shall identify their company affiliation. Where practicable, contractor or subcontractors occupying collocated space with their Government program customer should identify their work space area with their name and company affiliation.

http://ctip.defense.gov/ http://www.state.gov/j/tip http://www.state.gov/j/tip

10.12 Experience/Education Substitution, The contractor may substitute additional experience for education per the guidelines specified below. Work experience substituted for education must be in addition to the minimum requirements stated for each position:

Bachelo r's Degree

6 years work experience may be substituted for a Bachelor's Degree

Associate's Degree plus four years work experience may be substituted for a Bachelor's Degree

Master's Degree

12 years work experience may be substituted for a Master's Degree

Bachelor's Degree plus eight years work experience may be substituted for a Master's Degree

10.13 Contractor’s Quality Control Plan (QCP). A contractor's internal quality control measures, in the form of a QCP, are to be written to satisfy contract/task order requirements for written procedures or to provide direction on how Contractor employees are to perform. The COR will report any deficiencies/non-conformances to the Quality Assurance Program Coordinator (QAPC) and CO for appropriate action. The COR will notify the Contractor in writing of the approval, conditional approval, or rejection of the Contractor’s QCP no later than 30 days after receipt by the COR. In the event the QCP is either conditionally approved or rejected by the Government, the Contractor shall submit a revised QCP that resolves the Government’s concerns within 15 days after receipt of the COR’s notice. The Contractor shall revise its QCP in the event any task order changes make a revision necessary, and shall submit the revised QCP to the COR for review and approval. The Contractor shall submit a Quarterly Quality Control Inspection Report in Contractor format to the Government.

11.0 Services Contract Manpower Reporting Application (CMRA) Requirement.

11.1 The Contractor shall report all Contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract by using a secure data collection site.

The contractor shall completely fill in all required data fields at http://www.ecmra.mil. The reporting period will be each Government fiscal year starting 1 October and ending 30 September. While inputs may be reported any time during the fiscal year, all data shall be reported no later than 31 October following the applicable fiscal year. Contractors may direct questions to the CMRA help desk.

11.1 Uses and Safeguarding of Information: Information from the secure website is considered proprietary when the contract number and Contractor identity are associated with the direct labor hours and direct labor dollars. At no time will any data be released to the public with the Contractor name and contract number associated with the data.

11.2 User Manuals: Data for Air Force service requirements must be input at the Air Force CMRA link. However, user manuals for government personnel and contractors are available at the Army CMRA link at http://www.ecmra.mil

12.0 GOVERNMENT PROVIDED EQUIPMENT

12.1 The Government will provide contractor personnel sitting in Government work space a work station, phone and voice mail system, computer equipment and peripherals, government-standard software suite, access to Air Force-specific software tools, the appropriate NIPRNET, the SIPRNET (where required), the Air Force portal, and PEO-specific local area networks.

The Government does not anticipate providing Government Furnished Property (GFP) for use in contractor work spaces. In the event that the Government does supply GFP to the contractor, the contractor shall maintain a GFP list and provide to the Government on an annual basis.

12.2 Government Provided Equipment/Office. The Contractor will be provided, based on space availability, workspace (desk, chair, laptop computer, internet access, and phone) for each employee who will accomplish work under this contract at an onsite location. It shall be the responsibility of the functional customer’s home organization.

12.3 Contractors shall properly account for and manage all new and existing Government Furnished Equipment and/or Government Furnished Products procured and utilized at the installations in accordance with the applicable FAR and task order requirements. All AF-owned property must be maintained by the Contractor in accordance with applicable maintenance requirements. The Contractor shall safeguard all Government property provided for its use and adhere to the Government property requirements contained in this task order. At the end of each work day, all Government facilities, equipment and materials shall be secured as required by local security procedures and regulations.

12.4 Issuance and Turn in: Government provided equipment will be provided to each contractor employee required to work onsite with a hand-receipt using the same formal procedures that are applicable to all contract employees working with SAF/CIO A6.

Contractors shall return laptops (if issued) to the Government at the end of the contract period of performance, or within three (3) business days following notification of termination of employment or three days prior to final departure from the contract location or alternate work location where the government furnished equipment is being used.

12.5 Laptop Use: Only Government-furnished laptops shall be used on the government network. The Contractor shall obtain CAC and Contractor email addresses for use in the Global Address List (GAL). The laptops will be used primarily at Government duty locations, but may be used at alternate locations upon the written authorization of the COR.

12.6 Government Provided Information. Information provided by the government is to be used only for the purposes of completing work under this PWS and the government retains the rights to all information provided without exception. All information provided shall be protected IAW requirements in this PWS and all applicable laws, DoD or AF regulations and DoD or AF guidelines provided to or available to the contractor covering protection of government information and Personally Identifiable Information (PII).

http://www.ecmra.mil/

13.0 SERVICES SUMMARY (SS)

13.1 Purpose. The SS found at Table 4 lists performance objectives for the required services the Government will surveil. The absence of any task order requirement from the SS shall not detract from its enforceability nor limit the rights or remedies of the Government under any other provision of the task order including the clauses entitled “Inspection of Services” or “Inspection” or “Default” in Section E and Section I of the task order.

13.2 Components. The SS states the performance objective (required service), and threshold (performance standard, accept and reject points (if applicable)) in either a qualitative or quantitative fashion for each critical success factor.

13.3 Right to Surveil. The Government reserves the right to surveil all services and requirements called for in this PWS IAW FAR Part 52.246-4 to determine whether the Contractor is meeting performance objectives and goals. The SS is displayed in Attachment A and performance ratings are listed in Attachment B. The COR will validate/inspect these tasks. Inspection of each task will be documented in the COR folder.

Services Summary

Table 4 Service Summary Performance Objective

SOW Paragraph Performance Threshold

Provide and retain qualified key personnel

Key personnel possess qualifications, certifications and experience as identified in Management Plan Reference: PWS 6.0

a) 95% Key Personnel is on the job at contract start, other personnel are on the job within 21 calendar days of option activation, unless previously negotiated by the Contracting Officer.

b) 100% Vacancies are filled with qualified key personnel within 21 calendar days of vacancy, unless:

(1) Different timeframe approved in writing or otherwise directed in advance by the CO, and

(2) There is no mission impact due to position vacancies or unqualified personnel.

Deliverables/ Schedule Management

Develop and submit all required deliverables Reference: PWS paragraph 4.0

Deliverable requirements are met and received on time AND Critical information is accurate.

Provide minutes from attended boards, meetings, and briefings

PWS Paragraph 3.1.12 98% Deliverables are complete and are “camera ready” for posting to central repository on initial submission

Conduct Formal coordination of policy using AF task

PWS Paragraph 3.1.10 90% of tasks complete containing accurate and complete information on initial submission and task can be closed

Cybersecurity Metrics & reports

PWS paragraph 3.1.4 90% metrics and reports are timely. Performance is complete when established deadline has been met. Critical information is accurate and complete on initial submission

Cybersecurity Policies

PWS 3.2 95% submitted “camera ready” for posting on initial submission. Performance is complete when Policy is “copy ready” for posting to AF e-publishing website and provided within established deadlines.

Project Work Plan

PWS paragraph 3.2.4 95% plans submitted on time. Due 5th of each month; using MS Project

Phase In/Out Plan

PWS paragraph 3.0 Submission is due with the initial proposal and is a ‘living document’. The Phase In/Out Plan shall be updated at the request of the Government if and when there are changes in the contractor’s management or staffing that would require further documentation.

Monthly Performance Rating Definitions

Table 5Monthly Performance Rating Definitions

Rating Definitions Definition Exceeds Standards Contractor performance exceeds contractual requirements and is beneficial to the government. To justify exceeds standards, state which PWS or SOW requirement(s) was exceeded (to include the paragraph number) along with how exceeding this requirement was a benefit to the government.

Meets Standards Contractor performance…