VTC/AV Lifecycle Support 1 Hill Air Force Base 2

Performance Work Statement (PWS) 3

1. SCOPE. 5

Successful award of this contract will provide sustainment of existing and future, traditional and 6 Microsoft Teams-based, Video Teleconferencing (VTC) and Audio-Visual (AV) systems at Hill 7 Air Force Base, the Utah Test and Training Range (UTTR), and Little Mountain Test Facility 8 (LMTF). The Contractor shall provide: 9

- Technical solutions and design services for new and existing VTC or AV systems 11

- Procurement, installation of new VTC and AV systems 12

- User training for new VTC and AV systems 13

- Maintenance services 14

This contract requires the vendor to obtain necessary security clearances and coordinate with Hill 16 Air Force Base personnel on matters involving security impact and cybersecurity compliance 17 including DISA Security Technical Implementation Guides (STIG). The contractor shall provide 18 resources, both technical and functional, required for managing contract performance. 19

1.1 VTC/AV Maintenance Activity Report (MAR): Contractor shall provide the 75 ABW 21 SC COR, a MAR detailing support requests, response times, and resolution. The MAR will 22 include the status of all active tickets during the previous month, including open and closed 23 tickets. The contractor shall include effort to meet STIG compliance, if any. The contractor shall 24 deliver the report to the COR, via email, by the 5th business day of each month. (CDRLA001) 25

1.2 Staffing Roster: Within 10 business days of contract award, Contractor shall provide a 27 list of all personnel who could be called upon to support this contract. Additions to and removal 28 of personnel will be identified to the 75ABW/SC Security Manager within five (5) business days 29 of the change in accordance with (IAW) Section 3.9 of this contract. (CDRLA002) 30 Contractor shall ensure implementation services are performed by industry certified technicians 32 including InfoComm CTS-D and CTS-I certified team members as well as by technicians 33 holding a minimum of AVIXA CTS certifications. Contractor will provide proof of 34 Certifications, upon request by the 75 ABW/SC COR. 35

1.3 User Documentation and Training: Contractor will provide operational training for newly 37 installed systems and ensure customer has copies of all user manuals (digital format preferred) as part of 38 final acceptance inspection. Contractor will report on user training activities in the VTC/AV 39 Maintenance Activity Report. (CDRLA003) 40

2. REQUIREMENTS. 42

2.1 Technical Solutions and Design Services. 44

Contractor shall provide expertise to implement or upgrade VTC and/or AV systems, all 45 requirements/projects must be approved by 75ABW/SC. Contractor shall attend meetings and 46 site walks with the customer and 75 ABW/SC personnel to fully understand requirements. 47 Proposed solutions will include: 49

• Complete list of components 51

• Costs for equipment, delivery, engineering and installation, and monthly maintenance 52

• proposed schedules 53

• block diagram to indicate all connection points of the system 54

When possible, the contractor shall propose a solution to support Teams, or the currently 56 approved web-based conferencing solution, over traditional VTC. 57

2.1.1 All proposed VTC and A/V technical solutions will comply with the following security 59 guidance. 60

DISA STIGs and SRGs (Technical Implementation)

Enterprise Voice, Video, and Messaging Endpoint SRG

Unified Endpoint Management Server & Unified Endpoint Management Agent SRGs

Network Infrastructure Policy STIG

Traditional Security Checklist

Any Vendor-Specific STIGs

Department of the Air Force (DAF) Guidance

DAFMAN 17-1301 Computer Security

DAFMAN 17-1302 Communications Security (COMSEC)

AFI 17-130 Cybersecurity Program Management

DAFMAN 17-1203 Information Technology Asset Management (ITAM) and Accountability

DAF Memo Security Guidance for the use of Collaboration Peripherals and

Capabilities in Secure Spaces

AFSSI 7700 EMSEC / TEMPEST

AFSSI 7011 Protected Distribution Systems (PDS)

DoD / DoW Policy Directives

DoDI 8100.04 DoD Unified Capabilities

DoDI 8500.01 Cybersecurity

DoDI 8510.01 RMF

DoDM 5200.01, Vol 3 DoD Information Security Program

Federal, NIST, and CNSS Standards

CNSSI 5000 Guidelines for Voice over Internet Protocol

CNSSI 7003 Protected Distribution Systems (PDS)

NIST SP 800-53 Security and Privacy Controls

NIST SP 800-115 Technical Guide to Information Security Testing and Assessment

Methods and Procedures

Technical Order (MPTO) 00-

33B-5006

Endpoint Security for Information Systems

FIPS 140-2 / FIPS 140-3 Cryptographic module standards

2.2 Purchasing and Installation. 64

Upon acceptance of proposed solution, Contractor shall provide all components necessary to 65 implement a complete, fully functional system to meet requirements detailed in the accepted 66 technical solution. Contractor shall provide status of hardware ordering, processing, shipping, 67 tracking and project management. 68 Contractor shall manage industry-standard warranty issues for all new components installed. 70 Contractor shall provide one-year labor warranty. 71 Technicians shall follow industry standards to ensure easy replacement of components due to 73 failure. 74 Contractor shall ensure a clean and professional appearance of the space after final system 76 installation is complete. 77 Contractor shall complete installation of additional LAN drops, as required to support a new or 79 existing system. All work shall be accomplished in compliance with UFC 3-580-01 and the Hill 80 Air Force Base Comm Standard (formerly Tab K) and in coordination with 75ABW/SC. 81

After system installation is complete, and in the presence of the purchasing organization and 75 83 ABW/SC personnel, Contractor shall perform a complete system test to ensure all features and 84 functionality meet requirements. When the solution is proven to satisfy all requirements, the 85 purchasing organization will formally accept the system. 86

2.2.3 System Documentation. The contractor shall provide system documentation including 88 but not limited to schematics, wiring diagrams, and interconnection diagrams, to 75 ABW/SC, 89 upon installation, when configuration changes are required, or upon request. 90 Contractor shall provide user training and user manual upon installation, testing, and acceptance 92 of new systems. 93

2.2.4 Packaging, Packing, and Shipping. The contractor shall be responsible for all costs 95 associated with shipment of equipment for repair and/or replacement, including loaner or spare 96 equipment. 97

2.3 Maintenance Services. 99

Contractor shall provide on-going maintenance including but not limited to testing, repair, 100 replacement, technical support, and support services for installation, training, and hardware 101 and/or software upgrades. 102

2.3.1 Security Technical Implementation Guides (STIG) Compliance. The contractor shall 104 ensure compliance with STIGs and OEM specifications through quarterly inspections. Results of 105 these inspections shall be included in the Monthly Report (CDRLA001). 75 ABW/SC may 106 request a compiled list of all VTC/AV systems inspection status. 107

2.3.2 Current Systems. Hill Air Force Base currently hosts active High or Mixed Use VTC 109 systems as well as Microsoft Teams systems. Any organization, in coordination with the 110 75ABW/SC COR, may exercise the IDIQ option and provide payment for services or systems. 111 The systems are categorized as follows: 112

Complexity Level Description

TIER 3

Low

(Maintenance and support services)

• Provides maintenance and support services of MS Teams only solutions

TIER 2

Low

(Unclassified VTC and

AV Systems)

• Provides unclassified video teleconferencing

• Includes minimum amount of equipment supporting video teleconferencing capability

• Low complexity teleconference environment

TIER 1

High or Mixed Use

(Classified VTC or AV

Systems)

• Provides secure video teleconferencing capability

• Includes higher level of equipment and devices enabling the video teleconference capability

• Provides the ability to select between secure and unsecure channels utilizing the same CODEC and video teleconferencing equipment providing dual capability

• A complex teleconferencing environment

2.3.3 Monitoring: Contractor shall monitor existing systems for end of life (EOL) 115 notifications and STIG compliance. See paragraph 2.3.1 for reporting requirements. 116

2.3.3.1 The contractor shall monitor and evaluate VTC and AV systems to ensure compliance 118 with the appropriate Department of Defense (DOD)-approved architectures, programs, standards 119 and guidelines, such as Defense Information Systems Agency’s (DISA) Video Teleconferencing 120 Security Technical Implementation Guide (STIG), web link: https://www.cyber.mil/stigs 121

2.3.3.2 When components reach EOL or are non-compliant with STIG requirements, the 123 contractor shall notify the 75 ABW/SC COR of the problem, within three (3) days, and provide 124 written recommendations, to address the problem and associated security risks. The contractor’s 125 primary responsibility under this section is fulfilled upon providing written notification and 126 recommendations to the COR. The Government assumes the risk for operational status of non-127 compliant systems pending a funding decision. 128 https://www.cyber.mil/stigs

2.3.4 Staffing Requirements. The Contractor shall have sufficient technicians available to 130 respond to repair orders IAW this PWS, regardless of the number of reported repair orders, 131 locations of the facilities, or systems requiring repair service. 132

75 ABW/SC will provide a workspace, desktop computer, and phone, available to technician(s) 133 when on base. 134

2.3.4.1 Contractor personnel must be able to communicate effectively to ensure understanding of 135 problem resolutions with Customers and 75 ABW/SC personnel. 136

Contractor personnel shall be qualified and maintain certifications as listed throughout this PWS 137 and required by DoD 8570.01, at time of contract award and throughout the duration of the 138 contract. See DoD 8570.01-M, Chapter 2, Figure C2.F1 for the Overview of Basic Information 139 Assurance (IA) Workforce Structure. 140

2.3.5 Request Tracking and Coordination. The COR or 75ABW/SC-designated 141 representative will coordinate incoming requests for VTC and/or AV maintenance support and 142 services, assigning the ticket to a Project Manager who will coordinate with the contractor and 143 system owner. 144 The Contractor shall respond to requests for maintenance within the timeframes specified below. 146 o Emergency (Critical) 4 Business Hours 148 o Routine (Medium) 2 Business Days 149 o Minor (Low) 3 Business Days 150

2.3.6 Corrective Maintenance. 75 ABW/SC COR has final determination in categorization of 152 repair assigned to each problem/repair order, and 75 ABW/SC COR may elevate any corrective 153 repair to a higher level. The contractor shall evaluate problem reports and complete corrective 154 maintenance IAW the category of repair (Minor, Routine, or Emergency) referenced below. If 155 repair is not possible, the contractor will provide written recommendation to resolve the failure, 156 within three (3) business days. 157 The contractor shall maintain record of resolution actions for inclusion in the MAR. 159

2.3.6.1 Minor Repairs. Minor issues include color distortion on monitor, on/off light 161 malfunctions on microphone, or other situations that do not prevent performance of the 162 VTC or AV system. The contractor shall resolve reports of minor issues within seven (7) 163 business days unless 75 ABW/SC COR approves additional time. 164

2.3.6.2 Routine Repairs. Scenarios such as a single malfunctioning camera or near/far 166 end monitor malfunction that impede the VTC or AV system from continually 167 performing video teleconferencing or AV communication functions are routine and 168 should be resolved within five (5) business days unless 75 ABW/SC COR approves 169 additional time. 170

2.3.6.3 Emergency Repairs. Emergency issues include codec malfunction or room 172 controller outages which prevent the VTC and AV system performance from satisfying 173 real world operational missions, Life/Safety/Health and Senior Leader requirements. The 174 contractor shall provide onsite maintenance within four (4) hours of notification for 175 emergency repairs and resolve orders for emergency repair service within one (1) 176 business day unless 75 ABW/SCOI approves additional time. 177

2.3.7 VTC and AV Hardware Replacement. The contractor shall only replace hardware, 179 necessary to restore VTC and AV operations to normal service levels, when repair of the 180 component would cost more than replacement. The contractor shall provide written 181 recommendation for replacement items and costs to 75 ABW/SC COR. 75 ABW/SC COR or 182 designee will evaluate the recommendation, obtain funding from system owner, and execute the 183 purchase with the Contractor. Upon receipt of components, Contractor will perform installation 184 to restore system functionality 185

2.3.7.1 Upon failure of component(s) outside of manufacturer warranty coverage, the system 187 owner will bear responsibility for the cost to purchase the component(s) and labor to complete 188 installation and restore the system to expected functionality. 189

3.0 GENERAL INFORMATION. 191

3.1 Common Access Card (CAC) 193

Contractor shall complete the organization's In-Processing Checklist (if applicable). Contractor 194 shall present document(s) that establish identity; acceptable document(s) include: valid driver's 195 license with photograph, name, date of birth, gender, height, eye color and address; ID card 196 issued by federal, state, or local Government agencies with photograph, name, date of birth, 197 gender, height, eye color and address; U.S. military card; military dependent ID card. A 198 Common Access Card (CAC) is required for all on-site Contractor personnel. The Government 199 shall provide appropriate identification cards which shall be issued, displayed and surrendered as 200 directed in HAFBI 31-101, Installation Security Program. The Contractor Program Manager 201 shall ensure that all employees have the proper identification credentials prior to entering Hill 202 AFB. CACs are used for identification and network access. CACs are not to be worn off base, 203 photographed, or reproduced in any manner. The Contractor shall return all credentials to the 204 organization's security managers or Government Contract Office Representative (COR) and out-205 process via the organization's Out-Processing Checklist, if applicable, upon termination from the 206 contract or contract completion. 207

3.2 Restricted Area Badges and Access to Controlled Areas 209 The Contract Manager or alternate shall complete an AF Form 2586, Unescorted Entry 210 Authorization Certificate, for each employee requiring unescorted entry into controlled areas 211 IAW HAFBI 31-101. The request shall be coordinated through the 75 ABW/SC Security 212 Manager. If approved, employee shall present the AF 2586 to 75 SFS Pass and Identification, 213 building 408 for processing. Employee will receive AF Form 1199C (commonly known as line 214 badge). Employee must return AF 2586 to the organization’s security manager. The form will 215 be needed when changes to the card are requested. When the badge is no longer needed, 216 employee shall pick up the AF 2586 from the organization's security manager and take to 75 SFS 217 to turn in. Employee shall return the AF 2586 to the organization's security managers. The 218 controlled area badges shall be surrendered as required in HAFBI 31-101. 219

3.3 Access to the Network 221

• Non-Privileged: We will grant non-privileged access IAW AFMAN 33-282. 223

• Limited Privileged: We will grant limited privilege access in IAW AFMAN 33-282. 224

3.4 Computer Connectivity 225

The Government will provide connectivity to the base systems for Government official business 226 for the number of connections required to perform services for this contract. The Contractor 227 shall confine PC/Laptop system configurations to the current Government Standard Desktop 228 Configuration (SDC). Any requests for variations will be submitted to the COR and approved by 229 the Government prior to implementation. Contractor owned equipment shall not be permitted 230 connectivity to the base network 231

3.5 Virtual Private Network (VPN) 232

The Contractor shall not use Contractor owned equipment for VPN access. Only Government 233 owned equipment may be used for VPN access. The Contractor shall submit requests for VPN 234 access in writing to the COR. The request shall include justification and specific personnel that 235 shall utilize access; if approved, the Government will provide sufficient equipment for the 236 Contractor to utilize. The equipment will remain Government property and reside on the 237 Contractor’s ADPE account for the duration of the approved period. 238

3.6 Foreign Object Damage (FOD) and Drop Object Prevention (DOP) 239

Contractor personnel who, in the performance of their assigned duties on this contract, work in, 240 on, around, or travel through areas near aircraft, munitions, aerospace ground equipment (AGE), 241 engines, or components shall comply with FOD prevention requirements prescribed in AFI 21-242

102. 243

3.7 General Contract Information 244

The Contractor shall be responsible for work requirements and work in progress no later than the 245 end of the transition period as defined in Section 3.23. Although it is the responsibility of the 246 Contractor to recruit, retain, and retrain, its employees, the Contractor shall ensure that all 247 employees performing under this contract read, write, speak, and understand English at a 248 technical level and proficiency adequate to the nature of the tasks assigned. 249

3.8 Contractor Employees 250

The Contractor shall provide the initial list of personnel who will support this contract no later 251 than 10 working days after award of contract, and no later than 5 working days after hire of new 252 employee (CDRLA002). Contractor shall provide updated lists as personnel changes occur 253 within 5 business days of the change. The Government shall not be obliged to accept 254 performance by any Contractor employee the contracting officer has identified to the Contractor 255 as a threat to the health, safety, or general well-being of any other person on the installation. The 256 Contracting Officer reserves the right to direct the Contractor to remove any employee from the 257 worksite for reasons of misconduct or for failure to comply with security regulations. Moreover, 258 the Government shall not be obligated to accept performance from any Contractor employee the 259 contracting officer has identified to the Contractor as a threat to good order and discipline, to 260 Government property, or to any Government operation or mission. The Contractor shall ensure 261 personnel obtain favorable local files checks or favorable National Agency Checks, reference 262 Section 3.3, prior to applying for network access. 263

3.8.1 The Contractor shall not employ any person who is an employee of the United States 264 Government if the employment of that person would create a conflict of interest, nor shall the 265 Contractor employ any person who is an employee of the Department of the Air Force, either 266 military or civilian, unless such person seeks and receives approval according to the DoD 267 5500.7-R Joint Ethics Regulations (JER). In addition, the Contractor shall not employ any 268 person who is an employee of the Department of the Air Force if such employment would be 269 contrary to the policies contained in AFI 64-106, Air Force Industrial Labor Relations Activities. 270 The Contractor is cautioned that off-duty active military personnel hired under this contract may 271 be subject to permanent change of station, change in duty hours or deployment. Military 272 Reservists and National Guard members may be subject to recall to active duty. The abrupt 273 absence of these personnel could adversely affect the Contractor's ability to perform. Their 274 absence at any time shall not constitute an excuse for nonperformance under this contract. The 275 Contractor shall not perform this contract in a manner that creates a conflict of interest or the 276 appearance of a conflict of interest vis-à-vis Government employees, e.g., by requesting 277 Government (COR) to survey Government contracts, subcontracts during their off-duty hours. 278

3.8.2 The Contractor shall ensure that its employees conduct themselves in a professional and 279 courteous manner and that they present a neat and professional image appropriate to their duties 280 to include wearing suitable attire and protective clothing as appropriate. The selection, 281 assignment, reassignment, transfer, supervision, management, and control of Contractor 282 employees shall be the responsibility and prerogative of the Contractor; however, the Contractor 283 shall comply with the requirements set forth in this PWS and Hill AFB regulations concerning 284 conduct of employees as referenced herein. Contractor personnel shall comply with directives 285 pertaining to operation of privately owned vehicles on Hill AFB per AFMAN 31-116, Motor 286 Vehicle Traffic Supervision. The Contractor shall employ and maintain a technically trained and 287 experienced work force. 288

3.9 Hours of Operation 289

Contractor personnel shall perform the services required under this contract between the hours of 290 0800 (8:00 am) through 1600 (4:00 pm), totaling not more than 80 hours of service within a two-291 week period, unless otherwise notified by the Government. 292

The Contractor shall optimize personnel staffing and manning to match the PWS requirements 293 and performance criteria between these hours. The Contractor shall perform the services required 294 under this contract during office hours normally followed by the customers. 295

The hours of operation are subject to change and can be different for each area of operation. The 296 Government will provide specific work hours for the Contractor upon request. 297

3.9.1 The Contractor is not required to provide service on the Federally approved holidays 298 including the following: 299

• New Year’s Day 300

• Martin Luther King Day 301

• Presidents Day 302

• Memorial Day 303

• Juneteenth 304

• Independence Day 305

• Labor Day 306

• Columbus Day 307

• Veterans Days 308

• Thanksgiving Day 309

• Christmas Day 310

If the holiday falls on Saturday, we will observe the holiday on the previous Friday. If the 312 holiday falls on a Sunday, we will observe the holiday on the following Monday. The Contractor 313 may be required to observe all energy days and/or other down days as directed by OO-ALC 314 Center Commander and/or AFMC at no cost to the Government. 315

3.9.2 On occasion, services may be required to support an activation or exercise of contingency 316 plans outside the normal duty hours described above. The Contractor’s responsibilities for after-317 hours support will be defined in the workload data. This is an unplanned event that would require 318 staff that would need to be able to communicate and perform services for Base infrastructure. 319

3.9.3 The Contractor shall plan for and respond to mission requirements in the event of 320 mobilization, terrorism, natural disaster, or labor disputes. Upon notification by the CO of the 321 requirement to support these operations the Contractor shall provide documentation for all hours 322 worked. 323

3.9.4 Within 60 minutes of notification by the CO, the Contractor shall provide services to 324 support national commitments up to and including a declared war that would generate increased 325 mission requirements. These services shall be provided 24 hours a day, seven (7) days a week, 326 as required. 327

3.9.5 The Contractor shall provide the CO a completed plan for providing maximum support of 328 contingencies. Additionally, the Contractor shall be aware of provisions contained in DODI 329 3020.37, Section 6.6 concerning Government contingency plans. The Contractor shall comply 330 with DODI 3020.37, Sections 6.9 and 6.10. 331

3.10 Security Requirements 332

The highest classification for this requirement is SECRET. The Contractor shall ensure 333 personnel have obtained a favorable local files check or favorable National Agency Check ref: 334 Section 3.3, prior to applying for network access. (The 75 SFS Local Files Check is insufficient 335 for this requirement.) The Contractor shall comply with all security and threat related 336 requirements as specified in DOD 5220.22M, National Industrial security Program Operating 337 Manual (NISPOM); AFI 16-1404, Air Force Information Security Program; AFI 16-1406, Air 338 Force Industrial Security Program; Hill Air Force Base Installation Anti-Terrorism Plan 10-245; 339 AFI 36-3026 V1_IP; Identification Cards for Members of the Uniformed Services, their Eligible 340 Family Members and Other Eligible Personnel, HAFBI 31-101 Installation Security Instruction, 341 HAFB Plan 31-101, Installation Security Plan and subsequent instructions. The Contractor shall 342 comply with Air Force policy to identify, mark, protect, and destroy classified information and 343 material consistent with national policy IAW AFI 16-1404. 344

3.10.1 This contract has classified requirements described in form DD254 and the contractor 345 shall adhere to all addendums and provisions of the DD254. Contractor shall adhere to all 346 OPSEC requirements contained in the DD254 and this performance work statement. 347

3.11 Security Clearance Investigations 348

All Contractor personnel must meet the terms of this PWS and must be United States citizens. 349 Applicable directives include DOD 5200.2-R and AFI 31-501. Any costs associated with 350 obtaining a security clearance shall be the responsibility of the Contractor. 351

3.11.1 Personnel assigned shall have access to information that could cause serious damage; 352 therefore, Contractor personnel assigned to those areas shall obtain or possess a SECRET 353 clearance. IAW AFI 16-1406, paragraph 2.4, Industrial Security Program Management, when 354 Contractors require unescorted entry to restricted areas, access to sensitive unclassified 355 information, access to Government information systems and/or sensitive equipment, not 356 involving access to classified information, the Contractor's personnel security questionnaire is 357 processed by the sponsoring Air Force activity per DOD 5200.2-R and AFI 31-501, Personnel 358 Security Program Management. 359

3.11.2 At contract start date and duration of contract, all Contractor personnel requiring elevated 360 rights accounts to perform assigned duties shall possess a SECRET clearance or interim 361 SECRET clearance. 362

3.11.3 When services are required in a Classified Processing Area (CPA), the contractor shall be 363 escorted by a customer representative with sufficient clearance of open/close the CPA. 364

3.12 Non-Disclosure 365

The Contractor shall not divulge any information about files, data, processing activities or 366 functions, user ID’s, passwords, or other knowledge that may be gained, to anyone who is not 367 authorized to have access to such information. The Contractor personnel shall abide by all 368 agency rules, procedures, and standards of conduct. The Contractor personnel shall comply with 369 the Federal Information Processing Standards (FIPS) 201 Personal Identity Verification (PIV) of 370 Contractor Employees. The Contractor shall comply with agency personal identity verification 371 procedures identified in the contract that implement Homeland Security Presidential Directive-12 372 (HSPD-12), Office of Management and Budget (OMB) guidance M-05-24, and Federal 373 Information Processing Standards Publication (FIPS PUB) Number 201. The Contractor shall 374 insert this clause in all subcontracts when the sub-Contractor is required to have physical access 375 to a federally controlled facility or access to a Federal information system. The Non-Disclosure 376 Statement shall be due within 10 days of request by the Government. The Government is not 377 obliged to accept performance from the Contractor or any of its employees who decline to sign 378 or otherwise fail to execute a non-disclosure agreement. 379

3.13 Quality Control 380

3.13.1 Quality Control Program 381

The Contractor shall establish a complete quality control program to ensure the requirements of 382 this contract are provided as specified. 383

3.13.2 Quality Assurance 384

The Government will periodically evaluate the Contractor’s performance IAW the Service 385 Summary Table and Government Quality Assurance Surveillance Plan (QASP) by appointing a 386 COR to monitor performance to ensure services are received. The Government Contract Officer 387 Representative (COR) will evaluate the Contractor’s performance through intermittent on-site 388 inspections of the Contractor's quality control program (para. 1.3) and receipt of complaints from 389 base personnel. The Government may inspect each task as completed or increase the number of 390 quality control inspections if deemed appropriate because of repeated failures discovered during 391 quality control inspections or because of repeated customer complaints. Likewise, the 392 Government may decrease the number of quality control inspections if merited by performance. 393 The Government will also investigate complaints received from various customers located on the 394 installation. The Contractor shall be responsible for initially validating customer complaints. 395 However, the Government representative shall make final determination of the validity of 396 customer complaint(s) in cases of disagreement with customer(s). 397

3.13.3 Contract Officer Representative (COR) 398

The COR is the authorized Government representative(s) who will perform assessments of the 399 Contractor’s performance. The COR or alternate(s) will inform the Contractor when 400 discrepancies occur via a Contractor Performance Assessment Report (CPAR) and will request 401 corrective action. The COR or alternate(s) will make a notation of the discrepancy on their 402 assessment checklist with the date and time the discrepancy was noted and will request the 403 Contractor to initial the entry on the checklist. Any matter concerning the scope, prices, terms or 404 conditions of this contract shall be referred to the Contracting Officer and not to the COR. The 405 services performed by the Contractor, during the period of this contract, are subject to review by 406 the Contracting Officer or authorized representative(s). 407

3.14 Freedom of Information Act (FOIA)/Privacy Act 408

All official Government records affected by this contract are subject to the provisions of the 409 FOIA and Privacy Act. Any request received by the Contractor for access/release of information 410 from these records to the public (including Government/Contractor employees acting as private 411 citizens), whether oral or in writing, shall be immediately brought to the attention of the 412 Contracting Officer. All FOIA requests must be submitted through the Base FOIA Manager to 413 ensure proper processing and compliance. 414

3.15 Operations Security (OPSEC) 415

All Contractors, subcontractors, their employees, associates, and consultants who have access to 416 critical information must comply with Air Force Instruction (AFI) 10-701, Operations Security 417 (OPSEC), and applicable local guidance. OPSEC is a systematic means of identifying and 418 protecting information which an adversary could use against the interests of the US. The critical 419 information list (CIL) identifies sensitive information which requires protection. Counter-420 measures (CM), sometimes called OPSEC measures (OM), are control standards with which all 421 personnel must comply to protect critical information, within AFI 10-701. 422

3.15.1 Responsibilities: Prior to bid, the Contractor is advised to assess program requirements 423 via AFI 10-701. Due to sensitivity, the following cannot be provided prior to contract award: 424 The sponsor must provide or approve OPSEC training curriculum for use by the Contractor. 425 Training must include awareness topics, CIL, CM/OM, threat/vulnerability, awareness of 426 family/friends, and disciplinary action for non-compliance. The following will be provided (if 427 not included in provided training materials): CIL, CM/OM, adversarial collection threat, OPSEC 428 guidance (AFI 10-701 and applicable local guidance) specifically as it applies to the sponsor’s 429 organization, mission, and the contract. 430

3.15.2 The Contractor must identify personnel who will have access to critical information and 431 ensure they have completed required OPSEC training IAW AFI 10-701, Chapter 5, prior to 432 allowing access to critical information. The Contractor shall provide or ensure personnel attend 433 Government supplied training as approved or provided by the sponsor. The Contractor may 434 create or adapt OPSEC training in lieu of sponsor provided training, provided the new training is 435 reviewed and approved by the sponsor. The Contractor may request approval from the sponsor 436 to streamline refresher training by removing awareness topics IAW AFI 10-701, paragraphs 437

5.2.1 and 5.2.2 (only personnel for which a record exists indicating they have been trained on 438 OPSEC awareness at some previous point in their career), organizational and contract specific 439 training must be continued IAW AFI 10-701, paragraphs 5.2.3 and 5.2.4. The Contractor must 440 track OPSEC training statistics including total number of personnel with access to critical 441 information, a list of their names, date of OPSEC training completion, and when annual refresher 442 training is due. Training must be provided before personnel are allowed access to critical 443 information. The Contractor must ensure all personnel comply with OPSEC standards and 444 practices as trained. Training may require modifications based on updates to critical 445 information, CM/OM, intelligence threat, or other fundamental changes to the OPSEC program. 446 Prior to seeking approval through Hill AFB Public Affairs, any information to be released 447 outside of official U.S. Government channels, via any media, must be coordinated through an 448 OPSEC review by (Gov. Organization’s OPSEC program manager/coordinator). 449

3.16 Key Control 450

The Contractor shall establish and implement methods of ensuring all facility keys/key cards 451 issued to the Contractor by the Government are not lost, misplaced and are not used by 452 unauthorized persons. NOTE: All references to keys also include key cards. No keys issued to 453 the Contractor by the Government shall be duplicated. The Contractor shall develop procedures 454 http://static.e-publishing.af.mil/production/1/af_a3_5/publication/afi10-701/afi10-701.pdf http://static.e-publishing.af.mil/production/1/af_a3_5/publication/afi10-701/afi10-701.pdf covering key control that shall be included in the Quality Control Plan. Such procedures shall 455 include turn-in of any issued keys by personnel that no longer require access to locked areas. 456

3.16.1 The Contractor shall immediately report the occurrences of a loss of a key to the COR. 457

3.16.2 In case of loss or duplication of keys, other than master keys, the Contractor shall, upon 458 written direction of the contracting officer, re-key or replace the affected lock or locks. The 459 Government, at its option, may replace the affected lock(s) or perform re-keying, deduct the cost 460 of re-keying or lock replacement from the monthly payment due the Contractor if Contractor 461 negligence is found. In the event a master key is lost or duplicated, all locks and keys for that 462 system shall be replaced by the Government and the total cost deducted from the monthly 463 payment due the Contractor. 464

3.16.3 The Contractor shall prohibit the use of keys issued by the Government by any persons 465 other than the Contractor’s employees. The Contractor shall prohibit the opening of locked 466 areas by Contractor employees to permit entrance of persons other than Contractor’s employees 467 engaged in the performance of assigned work in those areas, or personnel authorized entrance by 468 the CO. 469

3.17 Lock Combination 470

The Contractor shall establish and implement methods of ensuring that all lock combinations are 471 not revealed to unauthorized persons. The Contractor shall ensure that lock combinations are 472 changed when personnel having access to the combinations no longer have a need to know such 473 combinations. 474

3.18 Records 475

The Contractor shall be responsible for creating, maintaining, and disposing of only those 476 Government required records that are specifically cited in this PWS or required by the provisions 477 of a mandatory directive listed in Addendum IV, Applicable Publications and Forms. 478

3.18.1 All official records (regardless of media) as defined in 44 U.S.C. Part 3301 / AFI 33-364 479 and AFMAN 33-363 are the property of the U.S. Government and shall remain so upon 480 termination or completion of this contract. 481

3.19 Training 482

Contractor is responsible for maintaining the applicability and currency of all licenses, 483 certifications and qualifications associated with the applicable labor categories. All training 484 records for personnel must be maintained by the Contractor and be made available for 485 Government inspection upon request. The Government’s intent with this requirement is to ensure 486 that personnel providing service are continually attaining required training, and currently 487 licensed and certified for their assigned tasks. These training requirements are continuously 488 subject to changes as industry and policy demands. 489

3.19.1 Government-Provided Training 491

The Government may provide training as required and as approved by the COR or 75 ABW/SC 492 Unit Training Manager including but not limited to those listed below. All training must be 493 approved by the Functional Director or COR prior to attendance. Most, but not all, of the training 494 is provided via CBT. 495

Course Nbr Title

C11681 Air Force Risk Management Fundamentals Course 2020

CHQSCI0000100DL Level 1 STINFO Training (CBT)

MHPADM0003146CB 75 ABW/SC Operational Risk Management

MHPADM0265600DL 75 ABW/SC Annual Operation Security (OPSEC) Training

MHPADM0312800DL 75 ABW/SC Unit Emergency Management Training

MHPADM9800100DL Identifying and Safeguarding Personally Identifiable Information (PII)

MHPADM9800500BR Annual Drug-Free Federal Workplace Training

MHPCOM9800500VS Using Mobile Devices in a DoD Environment

MHPSAF9801502BR 75 ABW/SC Annual Safety Awareness

MHPSAF9801800BR GHS Chemical Labeling and SDS Retrieval Training - One-Time

MHPSEC9802900BR Annual Training for Cleared Personnel

MHPSEC9803000BR 75SC NATO Security Awareness Brief

MLMW0279 DoD Combating Trafficking in Persons (CTIP) General Awareness Course

MLMW0432 DAF-Operations Security Awareness Training

MLMW2260 TFAT-Annual Cyber Awareness Challenge

MLMW2289 DoD Mandatory Controlled Unclassified Information Training

MLMW2655 AFQTPXXXXX-222RA, Records Management - User Training

3.20 Continuing Training 496

The Contractor retains full responsibility for ensuring its employees are adequately and 497 appropriately trained to carry out their duties as assigned by the Contractor under this contract. 498 Continuous e-Learning is available via the Air Force Portal. Most of these courses require 499 Contractor funding for contract employees. 500

3.21 Emergency Situations 501

The CO/COR shall notify the Contractor when emergency situations exist (e.g., natural disasters, 502 weather-related situations, base closures), which may cause changes to installation operations 503 tempo. 504

3.22 Environmental Controls 505

3.22.1 Compliance with Laws and Regulations 506

The Contractor shall be knowledgeable of and comply with all applicable Interstate, Federal, 507 State, and Local laws, regulations, and requirements regarding environmental protection. In the 508 event environmental laws/regulations change during the term of this contract, the Contractor is 509 required to comply as such laws come into effect 510

3.22.2 Notification of Environmental Spills 511

If the Contractor spills or releases any substance contained in 40 CFR 302 into the environment, 512 the Contractor or its agent shall immediately report the incident to Hill AFB Fire Dept. at 777-513

1911. The liability and costs associated with the spill or release of such substance(s), to include 514 fines imposed on Hill AFB, damages and clean up, rests solely with the Contractor and its agent. 515

3.22.3 Material Storage and Use 516

The Contractor shall follow manufacturer’s guidelines and professional recommendations for 517 control of humidity, temperature, cleanliness, and materials handling. 518

3.23 Orientation/Transition Period 519

Estimated to be 30 days. The Contractor shall ensure a seamless transition to the maximum 520 extent practicable. The Contractor’s orientation plan shall demonstrate how personnel, materials 521 and equipment will be utilized through the orientation period and a method to ensure 522 performance and to include phase-in timelines. The plan shall also include the number and 523 position titles of personnel to be on site for the orientation period. The Contractor shall begin the 524 orientation and provide a written transition plan. The purpose of the orientation plan is to 525 demonstrate how the Contractor shall meet the following: 526

3.23.1 Observe work accomplished by current employees and become thoroughly familiar with 527 work requirements. 528

3.23.2 Complete personnel requirements (work force), including the hiring of personnel to assure 529 satisfactory performance. Soliciting Government or Contractor personnel for employment 530 during their duty hours is prohibited unless interview arrangements are made through the CO and 531 personnel offices at this installation. 532

3.23.3 Complete Security requirements as identified in the PWS Paragraph 3.10. 533

3.23.4 Complete documentation and requests during the orientation period for all applicable 534 security clearances or NACs, NACIs (if required by HSPD-12), or acceptable local files checks 535 within two weeks of contract award. 536

3.23.5 Complete the development of necessary work plans and procedures based on PWS 537 requirements. 538

3.23.6 The Contractor shall be allowed access to the facilities to familiarize supervisors, key 539 personnel and staff with equipment, reporting, work scheduling and procedures. However, such 540 access shall not interfere with the production efforts of current workforce. To preclude such 541 interference, arrangements for access to the Government facilities shall be made with the COR. 542

3.23.7 If there is a change in Contractor or upon contract completion, the incumbent Contractor 543 shall provide familiarization and allow the follow-on Contractor to observe monthly operations, 544 facilities, work, equipment locations and reporting procedures on a non-interference basis. 545

3.23.8 The incumbent Contractor shall ensure network access is removed for those employees 546 who do not intend to work for the new Contractor, upon completion of their employment. 547

3.24 Conformance with Environmental Management Systems 548

The Contractor shall perform work under this contract consistent with the relevant policy and 549 objectives identified in the agency, organizational, or facility Environmental Management 550 System (EMS) applicable for your contract. The Contractor shall perform work in a manner that 551 conforms to all appropriate Environmental Management Programs and Operational Controls 552 identified by the agency, organizational, or facility EMS, and provide monitoring and 553 measurement information as necessary for the organization to address environmental 554 performance relative to the environmental, energy, and transportation management goals. 555

3.24.1 In the event an environmental nonconformance or noncompliance associated with the 556 contracted services is identified, the Contractor shall take corrective and/or preventative actions. 557 In the case of a noncompliance, the Contractor shall respond and take corrective action 558 immediately. In the case of a nonconformance, the Contractor shall respond and take corrective 559 action based on the time schedule established by the EMS Site Coordinator. In addition, the 560 Contractor shall ensure that their employees are aware of the roles and responsibilities identified 561 by the environmental management system and how these requirements affect their work 562 performed under this contract. 563

3.24.2 Upon contract award, the COR will notify the facility-level Environmental Management 564 Systems Coordinator to arrange EMS training for appropriate staff. Thereafter, all on-site 565 Contractor personnel shall complete yearly EPA sponsored environmental training specified for 566 the type of work conducted on-site. 567

3.25 Participation in Government Activities 568

Contractor shall participate in various Government-initiated activities such as Continuous 569 Process Improvement (CPI) initiatives, process identification and management, various 570 meetings, safety programs related to work center hazards/Voluntary Protection Program (VPP) 571 and similar activities as requested by the Government. 572

4.0 Services Summary 574

SS

Performance

Objective

PWS

Section

Performance Threshold Monitoring

Method

1 VTC/AV

Maintenance

Activity Report

(MAR)

(CDRLA001)

1.1

2.3.1

• MAR shall include a list of all VTC/AV systems with operational and STIG-compliance status.

• Report should contain a list of service calls and requests for support including Service Now ticket number(s) and organizations supported including training,

• MAR will be submitted no later than the 5th business day of the month.

COR

3 Staffing Roster

(CDRLA002)

1.2

3.8

• Within 10 business days of contract award, the contractor shall provide a list of all personnel who could be called upon to support this contract.

• Contractor shall notify the Security Manager and COR, in writing, about changes to the staffing roster, including the addition of new personnel or removal of personnel, within five

(5) business days of change.

Security

Manager and

COR

4 User Documentation and Training

(CDRLA003)

1.3 • Contractor will coordinate with customer(s) to provide copies of user manuals, in digital format preferably, and to provide as-needed user training on the use of the system(s).

MAR

6 Corrective

Maintenance

2.3.6

1.1

• Contractor shall respond to requests for corrective maintenance within identified response times.

• Contractor shall include details about corrective maintenance requests and resolution as part of the MAR.

Service Now

Reports

MAR

7 Security

Requirements

3.10 –

3.12

Contractors shall ensure compliance with all security requirements including, but not limited to:

• DD254

• Security Clearance Investigations

• Non-Disclosures

Security

Manager

COR

8 Training 3.19 Contractor shall ensure all personnel complete required training for access to the facilities and network.

75 ABW/SC

Training

Manager

ADDENDUM A: REFERENCES 576

AFPD 40-1 Health Promotion 577 AFPD 91-2 Safety Programs 578 AFI 10-245 Antiterrorism (AT) 579 AFI 16-1404 Air Force Information Security Program 580 AFI 40-101 Health Promotion 581 AFMAN 33-282 Computer Security (COMPUSEC) 582 DODD 5220.22-M National Industrial Security Program Operating Manual (NISPOM) 583 DODD 8500.01E Information Assurance 584 DODI 8500.2 Information Assurance Implementation 585 DODI 8510.01 DOD Information Assurance Certification and Accreditation Process (DIACAP) 586 DOD 8570.01-M Information Assurance Workforce Improvement Program 587 Committee on National Security Systems Instructions (CNSSI) 4009, National Information 588 Assurance Glossary (available at http://www.cnss.gov/full-index.html) 589 Memorandum, Office of the Under Secretary of Defense, 1 April 2005, Subject: Facilitating 590 Classified Visits within Department of Defense (available from the Government requiring 591 agency) Memorandum, Office of Under Secretary of Defense, 5 December 2001, subject: 592 Facilitating Necessary Access to NATO Classified Information (available from the Government 593 requiring agency). 594

ADDENDUM B: ACRONYMS 597

ACRONYM DEFINITION

APL Approved Product List

AV Audio-Visual

CAC Common Access Card

CDRL Contract Deliverables Requirements List

CIL Critical Information List

CM Counter Measures

COR Contract Office Representative

CPI Continuous Process Improvement

CTS Certified Technology Specialist

DISA Defense Information Systems Agency

DoD Department of Defense

EOL End of Life

FOD Foreign Object Damage

FOIA Freedom of Information Act

IAW In Accordance With

JER Joint Ethics Regulations

MAR VTC/AV Maintenance Activity Report

OM OPSEC Measures

OPSEC Operation Security

PMI Preventive Maintenance Inspections

PWS Performance Work Statement

QCP Quality Control Plan

SDC Standard Desktop Configuration

STIG Strategic Technical Implementation Guide

VPN Virtual Private Network

VPP Voluntary Protection Program

VTC Video Teleconferencing