VTC IDIQ PWS v15 - Final.pdf

VTC/AV Lifecycle Support 1 Hill Air Force Base 2

Performance Work Statement (PWS) 3

1. SCOPE. 5

Successful award of this contract will provide sustainment of existing and future, traditional and 6 Microsoft Teams-based, Video Teleconferencing (VTC) and Audio-Visual (AV) systems at Hill 7 Air Force Base, the Utah Test and Training Range (UTTR), and Little Mountain Test Facility 8 (LMTF). The Contractor shall provide: 9

- Technical solutions and design services for new and existing VTC or AV systems 11

- Procurement, installation of new VTC and AV systems 12

- User training for new VTC and AV systems 13

- Maintenance services 14

This contract requires the vendor to obtain necessary security clearances and coordinate with Hill 16 Air Force Base personnel on matters involving security impact and cybersecurity compliance 17 including DISA Security Technical Implementation Guides (STIG). The contractor shall provide 18 resources, both technical and functional, required for managing contract performance. 19

1.1 VTC/AV Maintenance Activity Report (MAR): Contractor shall provide the 75 ABW 21 SC COR, a MAR detailing support requests, response times, and resolution. The MAR will 22 include the status of all active tickets during the previous month, including open and closed 23 tickets. The contractor shall include effort to meet STIG compliance, if any. The contractor shall 24 deliver the report to the COR, via email, by the 5th business day of each month. (CDRLA001) 25

1.2 Staffing Roster: Within 10 business days of contract award, Contractor shall provide a 27 list of all personnel who could be called upon to support this contract. Additions to and removal 28 of personnel will be identified to the 75ABW/SC Security Manager within five (5) business days 29 of the change in accordance with (IAW) Section 3.9 of this contract. (CDRLA002) 30 Contractor shall ensure implementation services are performed by industry certified technicians 32 including InfoComm CTS-D and CTS-I certified team members as well as by technicians 33 holding a minimum of AVIXA CTS certifications. Contractor will provide proof of 34 Certifications, upon request by the 75 ABW/SC COR. 35

1.3 User Documentation and Training: Contractor will provide operational training for newly 37 installed systems and ensure customer has copies of all user manuals (digital format preferred) as part of 38 final acceptance inspection. Contractor will report on user training activities in the VTC/AV 39 Maintenance Activity Report. (CDRLA003) 40

2. REQUIREMENTS. 42

2.1 Technical Solutions and Design Services. 44

Contractor shall provide expertise to implement or upgrade VTC and/or AV systems, all 45 requirements/projects must be approved by 75ABW/SC. Contractor shall attend meetings and 46 site walks with the customer and 75 ABW/SC personnel to fully understand requirements. 47 Proposed solutions will include: 49

Complete list of components 51 Costs for equipment, delivery, engineering and installation, and monthly maintenance 52 proposed schedules 53 block diagram to indicate all connection points of the system 54

When possible, the contractor shall propose a solution to support Teams, or the currently 56 approved web-based conferencing solution, over traditional VTC. 57

2.1.1 All proposed VTC and A/V technical solutions will comply with the following security 59 guidance. 60

DISA STIGs and SRGs (Technical Implementation) Enterprise Voice, Video, and Messaging Endpoint SRG Unified Endpoint Management Server & Unified Endpoint Management Agent SRGs Network Infrastructure Policy STIG Traditional Security Checklist Any Vendor-Specific STIGs

Department of the Air Force (DAF) Guidance

DAFMAN 17-1301 Computer Security DAFMAN 17-1302 Communications Security (COMSEC) AFI 17-130 Cybersecurity Program Management DAFMAN 17-1203 Information Technology Asset Management (ITAM) and Accountability

DAF Memo Security Guidance for the use of Collaboration Peripherals and Capabilities in Secure Spaces

AFSSI 7700 EMSEC / TEMPEST

AFSSI 7011 Protected Distribution Systems (PDS)

DoD / DoW Policy Directives

DoDI 8100.04 DoD Unified Capabilities DoDI 8500.01 Cybersecurity DoDI 8510.01 RMF DoDM 5200.01, Vol 3 DoD Information Security Program

Federal, NIST, and CNSS Standards

CNSSI 5000 Guidelines for Voice over Internet Protocol CNSSI 7003 Protected Distribution Systems (PDS) NIST SP 800-53 Security and Privacy Controls

NIST SP 800-115 Technical Guide to Information Security Testing and Assessment

Methods and Procedures Technical Order (MPTO) 00- 33B-5006

Endpoint Security for Information Systems

FIPS 140-2 / FIPS 140-3 Cryptographic module standards

2.1.2 Equipment Standards and Network Connection Compliance. 63

The Contractor is authorized to propose and utilize commercial off-the-shelf (COTS) equipment that 64 meets the technical, performance, and security requirements outlined in this PWS. To ensure 65 compatibility and obtain network connection approval, all proposed equipment must comply with the 66 following mandatory standards: 67

a) Cybersecurity, Security Technical Implementation Guide (STIG)/Security Requirements Guide (SRG), 68 and Approved Products List (APL) Requirements: All hardware and software proposed for installation 69 must be fully configurable to meet current DISA STIG/SRG requirements and satisfy the Risk 70 Management Framework (RMF) controls in accordance with DoDI 8510.01, DAFMAN 17-1301, and 71 AFI 17-101. All Audio Video (AV), Video Teleconferencing (VTC), and Secure VTC (SVTC) codecs, 72 network switches, and Unified Capabilities (UC) products MUST be actively listed on the DISA Unified 73 Capabilities Approved Products List (UC APL) (https://aplits.disa.mil/) in accordance with DoDI 74

8100.04. All AV/VTC/SVTC equipment and peripherals installed in secure discussion spaces or Sensitive 75 Compartmented Information Facilities (SCIFs) MUST be selected from the National Telecommunications 76 Security Working Group (NTSWG) TSG-6 Approved Equipment List in accordance with CNSSI 5000 77 and CNSSI 5002. For installations on the classified enclave (SIPRNet), all Information Assurance (IA) 78 and IA-enabled devices MUST be National Information Assurance Partnership (NIAP) Common Criteria 79 certified and listed on the NIAP Product Compliant List (PCL) (https://www.niap-ccevs.org) IAW 80 CNSSP No. 11. 81

b) Security & Supply Chain Compliance: All proposed equipment must strictly comply with the Trade 82 Agreements Act (TAA) (19 U.S.C. §§ 2501-2581; FAR Subpart 25.4; DFARS Subpart 225.4) and the 83 Buy American Act (BAA) (41 U.S.C. Chapter 83; FAR Subpart 25.1; DFARS Subpart 225.1). All 84 hardware components must be wholly manufactured or substantially transformed in the United States or a 85 TAA-designated country. All hardware must meet the Supply Chain Risk Management (SCRM) 86 requirements of DFARS 252.239-7018 and AFI 17-130 to mitigate foreign intelligence and supply chain 87 vulnerabilities prior to obtaining local connection approval. 88

c) Enclave Cryptography & Boundary Protection: 89

Unclassified Enclave (NIPRNet): All proposed systems and components processing Controlled 90 Unclassified Information (CUI) or Personally Identifiable Information (PII) must enforce NIST FIPS 140-91 3 validated cryptography for data at rest (SC-28) and data in transit (SC-08), and satisfy DAF Privacy 92 Overlays (PT-01, PT-03, PT-05). 93

Classified Enclave (SIPRNet): All classified data at rest and in transit must be protected using NSA-94 validated Type-1 (Suite B) encryption. Standard commercial FIPS-validated encryption is non-compliant 95 for classified data. Commercial cloud-connected agents, public telemetry, and unauthenticated outward 96 links (e.g., Call Home features, Cisco ThousandEyes, or DNA Spaces) are strictly prohibited and must be 97 physically and logically disabled. Displays and printed outputs must support physical classification 98 marking controls (top and bottom banners) IAW DoDM 5200.01 Vol 2. 99

d) Interoperability & Compute-Mediated Architectural Isolation: Unified communications (UC) and 100 AV/VTC/SVTC products must align with Unified Capabilities Requirements (UCR)-CORE standards to 101 guarantee system-wide interoperability. In addition, all AV/VTC/SVTC installations must enforce a 102 Compute-Mediated Architecture: 103

In-room AV switching, processing, and control hardware (e.g., AV-over-IP encoders/decoders, control 104 processors, audio DSPs, touch panels) must reside on a dedicated, isolated, non-routable in-room AV 105 network with private IP space and NO default gateway or trunk interface to base enclaves. 106

Network connectivity to base enclaves must occur STRICTLY through an authorized Government 107 Furnished Equipment (GFE) compute endpoint acting as the sole network boundary via point-to-point 108 peripheral interfaces (HDMI/USB). 109

Installations supporting both NIPRNet and SIPRNet, or operating in context-switching environments, 110 must maintain a complete hardware airgap using NIAP-certified, TSG-6 approved optical A/B (i.e., 111 KVM) switches or positive disconnect device (PDD). Hardware-controlled Push-To-Talk (PTT) or PDD 112 switches are required on all room microphones and cameras. All cameras must possess 360-degree visual 113 status indicators. For secure processing, cameras must feature an attached physical, image-blocking cover 114 (privacy shutter or opaque cap) that is readily identifiable as open or closed IAW CNSSI 5000 (Annex D 115 & Annex K) and TO 00-33B-5006. 116

2.2 Purchasing and Installation. 118

Upon acceptance of proposed solution, Contractor shall provide all components necessary to 119 implement a complete, fully functional system to meet requirements detailed in the accepted 120 technical solution. Contractor shall provide status of hardware ordering, processing, shipping, 121 tracking and project management. 122 Contractor shall manage industry-standard warranty issues for all new components installed. 124 Contractor shall provide one-year labor warranty. 125 Technicians shall follow industry standards to ensure easy replacement of components due to 127 failure. 128 Contractor shall ensure a clean and professional appearance of the space after final system 130 installation is complete. 131 Contractor shall complete installation of additional LAN drops, as required to support a new or 133 existing system. All work shall be accomplished in compliance with UFC 3-580-01 and the Hill 134 Air Force Base Comm Standard (formerly Tab K) and in coordination with 75ABW/SC. 135

After system installation is complete, and in the presence of the purchasing organization and 75 137 ABW/SC personnel, Contractor shall perform a complete system test to ensure all features and 138 functionality meet requirements. When the solution is proven to satisfy all requirements, the 139 purchasing organization will formally accept the system. 140

2.2.3 System Documentation. The contractor shall provide system documentation including 142 but not limited to schematics, wiring diagrams, and interconnection diagrams, to 75 ABW/SC, 143 upon installation, when configuration changes are required, or upon request. 144 Contractor shall provide user training and user manual upon installation, testing, and acceptance 146 of new systems. 147

2.2.4 Packaging, Packing, and Shipping. The contractor shall be responsible for all costs 149 associated with shipment of equipment for repair and/or replacement, including loaner or spare 150 equipment. 151

2.3 Maintenance Services. 153

Contractor shall provide on-going maintenance including but not limited to testing, repair, 154 replacement, technical support, and support services for installation, training, and hardware 155 and/or software upgrades. 156

2.3.1 Security Technical Implementation Guides (STIG) Compliance. The contractor shall 158 ensure compliance with STIGs and OEM specifications through quarterly inspections. Results of 159 these inspections shall be included in the Monthly Report (CDRLA001). 75 ABW/SC may 160 request a compiled list of all VTC/AV systems inspection status. 161

2.3.1.1 STIG Compliance and Remediation Scope. The contractor's responsibilities for 163 STIG/SRG compliance under the fixed-price maintenance CLINs are defined as follows: 164

a. Inspection and Reporting (Included in Fixed-Price Maintenance): The contractor shall 166 perform quarterly STIG/SRG compliance inspections on all covered systems using 167 government-approved tools and the most current DISA STIG/SRG baselines. The contractor 168 shall document all findings and report any non-compliant components or configurations to 169 the 75 ABW/SC COR and Information System Security Manager (ISSM) within three (3) 170 business days of discovery. This inspection and reporting function is considered within the 171 scope of the preventative maintenance CLINs. 172

b. Remediation (Not Included in Fixed-Price Maintenance): The act of remediating STIG/SRG 174 findings is considered corrective action and is outside the scope of the fixed-price 175 preventative maintenance CLINs. If contractor identifies STIG/SRG vulnerabilities, the 176 contractor shall provide a technical recommendation and a separate price quote to perform 177 the remediation. This work may be authorized and funded under the appropriate Engineering 178 (CLIN 0002) or Installation (CLIN 0003) CLINs via a separate task order. 179

2.3.2 Current Systems. Hill Air Force Base currently hosts active High or Mixed Use VTC 181 systems as well as Microsoft Teams systems. Any organization, in coordination with the 182 75ABW/SC COR, may exercise the IDIQ option and provide payment for services or systems. 183 The systems are categorized as follows: 184

Complexity Level Description

TIER 3

Low

(Maintenance and support services)

Provides maintenance and support services of MS Teams only solutions

TIER 2

Low

(Unclassified VTC and AV Systems)

Provides unclassified video teleconferencing Includes minimum amount of equipment supporting video teleconferencing capability Low complexity teleconference environment

TIER 1

High or Mixed Use

(Classified VTC or AV Systems)

Provides secure video teleconferencing capability Includes higher level of equipment and devices enabling the video teleconference capability Provides the ability to select between secure and unsecure channels utilizing the same CODEC and video teleconferencing equipment providing dual capability

A complex teleconferencing environment

2.3.3 Monitoring: Contractor shall monitor existing systems for end of life (EOL) 187 notifications and STIG compliance. See paragraph 2.3.1 for reporting requirements. 188

2.3.3.1 The contractor shall monitor and evaluate VTC and AV systems to ensure compliance 190 with the appropriate Department of Defense (DOD)-approved architectures, programs, standards 191

Security Technical Implementation Guide (STIG), web link: https://www.cyber.mil/stigs 193

2.3.3.2 When components reach EOL or are non-compliant with STIG requirements, the 195 contractor shall notify the 75 ABW/SC COR of the problem, within three (3) days, and provide 196 written recommendations, to address the problem and associated security risks. 197 primary responsibility under this section is fulfilled upon providing written notification and 198 recommendations to the COR. The Government assumes the risk for operational status of non-199 compliant systems pending a funding decision. 200

2.3.4 Staffing Requirements. The Contractor shall have sufficient technicians available to 202 respond to repair orders IAW this PWS, regardless of the number of reported repair orders, 203 locations of the facilities, or systems requiring repair service. 204

75 ABW/SC will provide a workspace, desktop computer, and phone, available to technician(s) 205 when on base. 206

2.3.4.1 Contractor personnel must be able to communicate effectively to ensure understanding of 207 problem resolutions with Customers and 75 ABW/SC personnel. 208

Contractor personnel shall be qualified and maintain certifications as listed throughout this PWS 209 and required by DoD 8570.01, at time of contract award and throughout the duration of the 210 contract. See DoD 8570.01-M, Chapter 2, Figure C2.F1 for the Overview of Basic Information 211 Assurance (IA) Workforce Structure. 212

2.3.5 Request Tracking and Coordination. The COR or 75ABW/SC-designated 213 representative will coordinate incoming requests for VTC and/or AV maintenance support and 214 services, assigning the ticket to a Project Manager who will coordinate with the contractor and 215 system owner. 216

2.3.5.1 ServiceNow Access: The Government's ServiceNow instance is the authoritative system 218 of record for all service and maintenance tickets. Contractor personnel shall be required to use 219 ServiceNow to submit, view, track and update requests for support. Contractor shall provide 220 details about resolution of all requests. 221 The Contractor shall respond to requests for maintenance within the timeframes specified below. 223 o Emergency (Critical) 4 Business Hours 225 o Routine (Medium) 2 Business Days 226 o Minor (Low) 3 Business Days 227

2.3.6 Corrective Maintenance. 75 ABW/SC COR has final determination in categorization of 229 repair assigned to each problem/repair order, and 75 ABW/SC COR may elevate any corrective 230 repair to a higher level. The contractor shall evaluate problem reports and complete corrective 231 maintenance IAW the category of repair (Minor, Routine, or Emergency) referenced below. If 232 repair is not possible, the contractor will provide written recommendation to resolve the failure, 233 within three (3) business days. 234 The contractor shall maintain record of resolution actions for inclusion in the MAR. 236

2.3.6.1 Minor Repairs. Minor issues include color distortion on monitor, on/off light 238 malfunctions on microphone, or other situations that do not prevent performance of the 239 VTC or AV system. The contractor shall resolve reports of minor issues within seven (7) 240 business days unless 75 ABW/SC COR approves additional time. 241

2.3.6.2 Routine Repairs. Scenarios such as a single malfunctioning camera or near/far 243 end monitor malfunction that impede the VTC or AV system from continually 244 performing video teleconferencing or AV communication functions are routine and 245 should be resolved within five (5) business days unless 75 ABW/SC COR approves 246 additional time. 247

2.3.6.3 Emergency Repairs. Emergency issues include codec malfunction or room 249 controller outages which prevent the VTC and AV system performance from satisfying 250 real world operational missions, Life/Safety/Health and Senior Leader requirements. The 251 contractor shall provide onsite maintenance within four (4) hours of notification for 252 emergency repairs and resolve orders for emergency repair service within one (1) 253 business day unless 75 ABW/SC COR approves additional time. 254

2.3.6.4 Allowable Resolution Clock Suspensions. The resolution time clock for a corrective 256 maintenance action may be paused if the contractor is unable to proceed due to factors outside of 257 its direct control. The contractor must document the reason for the pause, the time of the pause, 258 and the time of resumption in the associated service ticket. The COR must concur with the 259 validity of the pause. Allowable conditions for clock suspension include, but are not limited to: 260

c. Awaiting Government Action: The clock may be paused while waiting for the Government 261 to provide necessary resources or permissions. This includes, but is not limited to, facility 262 access, security escorts, network permissions, system credentials, or an approved 263 maintenance window for system downtime. 264

d. Awaiting Parts or Equipment: The clock may be paused while awaiting the delivery of 266 required parts or equipment if said parts are government-furnished or require separate 267 government funding approval prior to contractor acquisition. 268

e. Customer Unavailability: The clock may be paused if the on-site customer or system owner 270 is unavailable to provide access or support resolution, provided the contractor has 271 documented multiple unsuccessful attempts to coordinate. 272

2.3.7 VTC and AV Hardware Replacement. The contractor shall only replace hardware, 274 necessary to restore VTC and AV operations to normal service levels, when repair of the 275 component would cost more than replacement. The contractor shall provide written 276 recommendation for replacement items and costs to 75 ABW/SC COR. 75 ABW/SC COR or 277 designee will evaluate the recommendation, obtain funding from system owner, and execute the 278 purchase with the Contractor. Upon receipt of components, Contractor will perform installation 279 to restore system functionality 280

2.3.7.1 Upon failure of component(s) outside of manufacturer warranty coverage, the system 282 owner will bear responsibility for the cost to purchase the component(s) and labor to complete 283 installation and restore the system to expected functionality. 284

3.0 GENERAL INFORMATION. 286

3.1 Common Access Card (CAC) 288

Contractor shall complete the organization's In-Processing Checklist (if applicable). Contractor 289 shall present document(s) that establish identity; acceptable document(s) include: valid driver's 290 license with photograph, name, date of birth, gender, height, eye color and address; ID card 291 issued by federal, state, or local Government agencies with photograph, name, date of birth, 292 gender, height, eye color and address; U.S. military card; military dependent ID card. A 293 Common Access Card (CAC) is required for all on-site Contractor personnel. The Government 294 shall provide appropriate identification cards which shall be issued, displayed and surrendered as 295 directed in HAFBI 31-101, Installation Security Program. The Contractor Program Manager 296 shall ensure that all employees have the proper identification credentials prior to entering Hill 297 AFB. CACs are used for identification and network access. CACs are not to be worn off base, 298 photographed, or reproduced in any manner. The Contractor shall return all credentials to the 299 organization's security managers or Government Contract Office Representative (COR) and out-300 process via the organization's Out-Processing Checklist, if applicable, upon termination from the 301 contract or contract completion. 302

3.2 Restricted Area Badges and Access to Controlled Areas 304 The Contract Manager or alternate shall complete an AF Form 2586, Unescorted Entry 305 Authorization Certificate, for each employee requiring unescorted entry into controlled areas 306 IAW HAFBI 31-101. The request shall be coordinated through the 75 ABW/SC Security 307 Manager. If approved, employee shall present the AF 2586 to 75 SFS Pass and Identification, 308 building 408 for processing. Employee will receive AF Form 1199C (commonly known as line 309 be needed when changes to the card are requested. When the badge is no longer needed, 311 employee shall pick up the AF 2586 from the organization's security manager and take to 75 SFS 312 to turn in. Employee shall return the AF 2586 to the organization's security managers. The 313 controlled area badges shall be surrendered as required in HAFBI 31-101. 314

3.3 Access to the Network 316

Non-Privileged: We will grant non-privileged access IAW AFMAN 33-282. 318 Limited Privileged: We will grant limited privilege access in IAW AFMAN 33-282. 319

3.4 Computer Connectivity 320

The Government will provide connectivity to the base systems for Government official business 321 for the number of connections required to perform services for this contract. The Contractor 322 shall confine PC/Laptop system configurations to the current Government Standard Desktop 323 Configuration (SDC). Any requests for variations will be submitted to the COR and approved by 324 the Government prior to implementation. Contractor owned equipment shall not be permitted 325 connectivity to the base network 326

3.5 Virtual Private Network (VPN) 327

The Contractor shall not use Contractor owned equipment for VPN access. Only Government 328 owned equipment may be used for VPN access. The Contractor shall submit requests for VPN 329 access in writing to the COR. The request shall include justification and specific personnel that 330 shall utilize access; if approved, the Government will provide sufficient equipment for the 331 Contractor to utilize. The equipment will remain Government property and reside on the 332

3.6 Foreign Object Damage (FOD) and Drop Object Prevention (DOP) 334

Contractor personnel who, in the performance of their assigned duties on this contract, work in, 335 on, around, or travel through areas near aircraft, munitions, aerospace ground equipment (AGE), 336 engines, or components shall comply with FOD prevention requirements prescribed in AFI 21-337

102. 338

3.7 General Contract Information 339

The Contractor shall be responsible for work requirements and work in progress no later than the 340 end of the transition period as defined in Section 3.23. Although it is the responsibility of the 341 Contractor to recruit, retain, and retrain, its employees, the Contractor shall ensure that all 342 employees performing under this contract read, write, speak, and understand English at a 343 technical level and proficiency adequate to the nature of the tasks assigned. 344

3.8 Contractor Employees 345

The Contractor shall provide the initial list of personnel who will support this contract no later 346 than 10 working days after award of contract, and no later than 5 working days after hire of new 347 employee (CDRLA002). Contractor shall provide updated lists as personnel changes occur 348 within 5 business days of the change. The Government shall not be obliged to accept 349 performance by any Contractor employee the contracting officer has identified to the Contractor 350 as a threat to the health, safety, or general well-being of any other person on the installation. The 351 Contracting Officer reserves the right to direct the Contractor to remove any employee from the 352 worksite for reasons of misconduct or for failure to comply with security regulations. Moreover, 353 the Government shall not be obligated to accept performance from any Contractor employee the 354 contracting officer has identified to the Contractor as a threat to good order and discipline, to 355 Government property, or to any Government operation or mission. The Contractor shall ensure 356 personnel obtain favorable local files checks or favorable National Agency Checks, reference 357 Section 3.3, prior to applying for network access. 358

3.8.1 The Contractor shall not employ any person who is an employee of the United States 359 Government if the employment of that person would create a conflict of interest, nor shall the 360 Contractor employ any person who is an employee of the Department of the Air Force, either 361 military or civilian, unless such person seeks and receives approval according to the DoD 362 5500.7-R Joint Ethics Regulations (JER). In addition, the Contractor shall not employ any 363 person who is an employee of the Department of the Air Force if such employment would be 364 contrary to the policies contained in AFI 64-106, Air Force Industrial Labor Relations Activities. 365 The Contractor is cautioned that off-duty active military personnel hired under this contract may 366 be subject to permanent change of station, change in duty hours or deployment. Military 367 Reservists and National Guard members may be subject to recall to active duty. The abrupt 368 absence of these personnel could adversely affect the Contractor's ability to perform. Their 369 absence at any time shall not constitute an excuse for nonperformance under this contract. The 370 Contractor shall not perform this contract in a manner that creates a conflict of interest or the 371 appearance of a conflict of interest vis-à-vis Government employees, e.g., by requesting 372 Government (COR) to survey Government contracts, subcontracts during their off-duty hours. 373

3.8.2 The Contractor shall ensure that its employees conduct themselves in a professional and 374 courteous manner and that they present a neat and professional image appropriate to their duties 375 to include wearing suitable attire and protective clothing as appropriate. The selection, 376 assignment, reassignment, transfer, supervision, management, and control of Contractor 377 employees shall be the responsibility and prerogative of the Contractor; however, the Contractor 378 shall comply with the requirements set forth in this PWS and Hill AFB regulations concerning 379 conduct of employees as referenced herein. Contractor personnel shall comply with directives 380 pertaining to operation of privately owned vehicles on Hill AFB per AFMAN 31-116, Motor 381 Vehicle Traffic Supervision. The Contractor shall employ and maintain a technically trained and 382 experienced work force. 383

3.9 Hours of Operation 384

Contractor personnel shall perform the services required under this contract between the hours of 385 0800 (8:00 am) through 1600 (4:00 pm), totaling not more than 80 hours of service within a two-386 week period, unless otherwise notified by the Government. 387

The Contractor shall optimize personnel staffing and manning to match the PWS requirements 388 and performance criteria between these hours. The Contractor shall perform the services required 389 under this contract during office hours normally followed by the customers. 390

The hours of operation are subject to change and can be different for each area of operation. The 391 Government will provide specific work hours for the Contractor upon request. 392

3.9.1 The Contractor is not required to provide service on the Federally approved holidays 393 including the following: 394

Martin Luther King Day 396 Presidents Day 397 Memorial Day 398 Juneteenth 399 Independence Day 400 Labor Day 401 Columbus Day 402 Veterans Days 403 Thanksgiving Day 404 Christmas Day 405

If the holiday falls on Saturday, we will observe the holiday on the previous Friday. If the 407 holiday falls on a Sunday, we will observe the holiday on the following Monday. The Contractor 408 may be required to observe all energy days and/or other down days as directed by OO-ALC 409 Center Commander and/or AFMC at no cost to the Government. 410

3.9.2 On occasion, services may be required to support an activation or exercise of contingency 411 -412 hours support will be defined in the workload data. This is an unplanned event that would require 413 staff that would need to be able to communicate and perform services for Base infrastructure. 414

3.9.3 The Contractor shall plan for and respond to mission requirements in the event of 415 mobilization, terrorism, natural disaster, or labor disputes. Upon notification by the CO of the 416 requirement to support these operations the Contractor shall provide documentation for all hours 417 worked. 418

3.9.4 Within 60 minutes of notification by the CO, the Contractor shall provide services to 419 support national commitments up to and including a declared war that would generate increased 420 mission requirements. These services shall be provided 24 hours a day, seven (7) days a week, 421 as required. 422

3.9.5 The Contractor shall provide the CO a completed plan for providing maximum support of 423 contingencies. Additionally, the Contractor shall be aware of provisions contained in DODI 424 3020.37, Section 6.6 concerning Government contingency plans. The Contractor shall comply 425 with DODI 3020.37, Sections 6.9 and 6.10. 426

3.10 Security Requirements 427

The highest classification for this requirement is SECRET. The Contractor shall ensure 428 personnel have obtained a favorable local files check or favorable National Agency Check ref: 429 Section 3.3, prior to applying for network access. (The 75 SFS Local Files Check is insufficient 430 for this requirement.) The Contractor shall comply with all security and threat related 431 requirements as specified in DOD 5220.22M, National Industrial security Program Operating 432 Manual (NISPOM); AFI 16-1404, Air Force Information Security Program; AFI 16-1406, Air 433 Force Industrial Security Program; Hill Air Force Base Installation Anti-Terrorism Plan 10-245; 434 AFI 36-3026 V1_IP; Identification Cards for Members of the Uniformed Services, their Eligible 435 Family Members and Other Eligible Personnel, HAFBI 31-101 Installation Security Instruction, 436 HAFB Plan 31-101, Installation Security Plan and subsequent instructions. The Contractor shall 437 comply with Air Force policy to identify, mark, protect, and destroy classified information and 438 material consistent with national policy IAW AFI 16-1404. 439

3.10.1 This contract has classified requirements described in form DD254 and the contractor 440 shall adhere to all addendums and provisions of the DD254. Contractor shall adhere to all 441 OPSEC requirements contained in the DD254 and this performance work statement. 442

3.11 Security Clearance Investigations 443

All Contractor personnel must meet the terms of this PWS and must be United States citizens. 444 Applicable directives include DOD 5200.2-R and AFI 31-501. Any costs associated with 445 obtaining a security clearance shall be the responsibility of the Contractor. 446

3.11.1 Personnel assigned shall have access to information that could cause serious damage; 447 therefore, Contractor personnel assigned to those areas shall obtain or possess a SECRET 448 clearance. IAW AFI 16-1406, paragraph 2.4, Industrial Security Program Management, when 449 Contractors require unescorted entry to restricted areas, access to sensitive unclassified 450 information, access to Government information systems and/or sensitive equipment, not 451 involving access to classified information, the Contractor's personnel security questionnaire is 452 processed by the sponsoring Air Force activity per DOD 5200.2-R and AFI 31-501, Personnel 453 Security Program Management. 454

3.11.2 At contract start date and duration of contract, all Contractor personnel requiring elevated 455 rights accounts to perform assigned duties shall possess a SECRET clearance or interim 456 SECRET clearance. 457

3.11.3 When services are required in a Classified Processing Area (CPA), the contractor shall be 458 escorted by a customer representative with sufficient clearance of open/close the CPA. 459

3.12 Non-Disclosure 460

The Contractor shall not divulge any information about files, data, processing activities or 461 authorized to have access to such information. The Contractor personnel shall abide by all 463 agency rules, procedures, and standards of conduct. The Contractor personnel shall comply with 464 the Federal Information Processing Standards (FIPS) 201 Personal Identity Verification (PIV) of 465 Contractor Employees. The Contractor shall comply with agency personal identity verification 466 procedures identified in the contract that implement Homeland Security Presidential Directive-12 467 (HSPD-12), Office of Management and Budget (OMB) guidance M-05-24, and Federal 468 Information Processing Standards Publication (FIPS PUB) Number 201. The Contractor shall 469 insert this clause in all subcontracts when the sub-Contractor is required to have physical access 470 to a federally controlled facility or access to a Federal information system. The Non-Disclosure 471 Statement shall be due within 10 days of request by the Government. The Government is not 472 obliged to accept performance from the Contractor or any of its employees who decline to sign 473 or otherwise fail to execute a non-disclosure agreement. 474

3.13 Quality Control 475

3.13.1 Quality Control Program 476

The Contractor shall establish a complete quality control program to ensure the requirements of 477 this contract are provided as specified. 478

3.13.2 Quality Assurance 479

Summary Table and Government Quality Assurance Surveillance Plan (QASP) by appointing a 481 COR to monitor performance to ensure services are received. The Government Contract Officer 482 Representative (COR) -site 483 inspections of the Contractor's quality control program (para. 1.3) and receipt of complaints from 484 base personnel. The Government may inspect each task as completed or increase the number of 485 quality control inspections if deemed appropriate because of repeated failures discovered during 486 quality control inspections or because of repeated customer complaints. Likewise, the 487 Government may decrease the number of quality control inspections if merited by performance. 488 The Government will also investigate complaints received from various customers located on the 489 installation. The Contractor shall be responsible for initially validating customer complaints. 490 However, the Government representative shall make final determination of the validity of 491 customer complaint(s) in cases of disagreement with customer(s). 492

3.13.3 Contract Officer Representative (COR) 493

The COR is the authorized Government representative(s) who will perform assessments of the 494 discrepancies occur via a Contractor Performance Assessment Report (CPAR) and will request 496 corrective action. The COR or alternate(s) will make a notation of the discrepancy on their 497 assessment checklist with the date and time the discrepancy was noted and will request the 498 Contractor to initial the entry on the checklist. Any matter concerning the scope, prices, terms or 499 conditions of this contract shall be referred to the Contracting Officer and not to the COR. The 500 services performed by the Contractor, during the period of this contract, are subject to review by 501 the Contracting Officer or authorized representative(s). 502

3.14 Freedom of Information Act (FOIA)/Privacy Act 503

All official Government records affected by this contract are subject to the provisions of the 504 FOIA and Privacy Act. Any request received by the Contractor for access/release of information 505 from these records to the public (including Government/Contractor employees acting as private 506 citizens), whether oral or in writing, shall be immediately brought to the attention of the 507 Contracting Officer. All FOIA requests must be submitted through the Base FOIA Manager to 508 ensure proper processing and compliance. 509

3.15 Operations Security (OPSEC) 510

All Contractors, subcontractors, their employees, associates, and consultants who have access to 511 critical information must comply with Air Force Instruction (AFI) 10-701, Operations Security 512 (OPSEC), and applicable local guidance. OPSEC is a systematic means of identifying and 513 protecting information which an adversary could use against the interests of the US. The critical 514 information list (CIL) identifies sensitive information which requires protection. Counter-515 measures (CM), sometimes called OPSEC measures (OM), are control standards with which all 516 personnel must comply to protect critical information, within AFI 10-701. 517

3.15.1 Responsibilities: Prior to bid, the Contractor is advised to assess program requirements 518 via AFI 10-701. Due to sensitivity, the following cannot be provided prior to contract award: 519 The sponsor must provide or approve OPSEC training curriculum for use by the Contractor. 520 Training must include awareness topics, CIL, CM/OM, threat/vulnerability, awareness of 521 family/friends, and disciplinary action for non-compliance. The following will be provided (if 522 not included in provided training materials): CIL, CM/OM, adversarial collection threat, OPSEC 523 guidance (AFI 10-524 organization, mission, and the contract. 525

3.15.2 The Contractor must identify personnel who will have access to critical information and 526 ensure they have completed required OPSEC training IAW AFI 10-701, Chapter 5, prior to 527 allowing access to critical information. The Contractor shall provide or ensure personnel attend 528 Government supplied training as approved or provided by the sponsor. The Contractor may 529 create or adapt OPSEC training in lieu of sponsor provided training, provided the new training is 530 reviewed and approved by the sponsor. The Contractor may request approval from the sponsor 531 to streamline refresher training by removing awareness topics IAW AFI 10-701, paragraphs 532

5.2.1 and 5.2.2 (only personnel for which a record exists indicating they have been trained on 533 OPSEC awareness at some previous point in their career), organizational and contract specific 534 training must be continued IAW AFI 10-701, paragraphs 5.2.3 and 5.2.4. The Contractor must 535 track OPSEC training statistics including total number of personnel with access to critical 536 information, a list of their names, date of OPSEC training completion, and when annual refresher 537 training is due. Training must be provided before personnel are allowed access to critical 538 information. The Contractor must ensure all personnel comply with OPSEC standards and 539 practices as trained. Training may require modifications based on updates to critical 540 information, CM/OM, intelligence threat, or other fundamental changes to the OPSEC program. 541 Prior to seeking approval through Hill AFB Public Affairs, any information to be released 542 outside of official U.S. Government channels, via any media, must be coordinated through an 543

3.16 Key Control 545

The Contractor shall establish and implement methods of ensuring all facility keys/key cards 546 issued to the Contractor by the Government are not lost, misplaced and are not used by 547 unauthorized persons. NOTE: All references to keys also include key cards. No keys issued to 548 the Contractor by the Government shall be duplicated. The Contractor shall develop procedures 549 covering key control that shall be included in the Quality Control Plan. Such procedures shall 550 include turn-in of any issued keys by personnel that no longer require access to locked areas. 551

3.16.1 The Contractor shall immediately report the occurrences of a loss of a key to the COR. 552

3.16.2 In case of loss or duplication of keys, other than master keys, the Contractor shall, upon 553 written direction of the contracting officer, re-key or replace the affected lock or locks. The 554 Government, at its option, may replace the affected lock(s) or perform re-keying, deduct the cost 555 of re-keying or lock replacement from the monthly payment due the Contractor if Contractor 556 negligence is found. In the event a master key is lost or duplicated, all locks and keys for that 557 system shall be replaced by the Government and the total cost deducted from the monthly 558 payment due the Contractor. 559

3.16.3 The Contractor shall prohibit the use of keys issued by the Government by any persons 560 engaged in the performance of assigned work in those areas, or personnel authorized entrance by 563 the CO. 564

3.17 Lock Combination 565

The Contractor shall establish and implement methods of ensuring that all lock combinations are 566 not revealed to unauthorized persons. The Contractor shall ensure that lock combinations are 567 changed when personnel having access to the combinations no longer have a need to know such 568 combinations. 569

3.18 Records 570

The Contractor shall be responsible for creating, maintaining, and disposing of only those 571 Government required records that are specifically cited in this PWS. 572

3.18.1 All official records (regardless of media) as defined in 44 U.S.C. Part 3301 / AFI 33-364 573 and AFMAN 33-363 are the property of the U.S. Government and shall remain so upon 574 termination or completion of this contract. 575

3.19 Training 576

Contractor is responsible for maintaining the applicability and currency of all licenses, 577 certifications and qualifications associated with the applicable labor categories. All training 578 records for personnel must be maintained by the Contractor and be made available for 579 that personnel providing service are continually attaining required training, and currently 581 licensed and certified for their assigned tasks. These training requirements are continuously 582 subject to changes as industry and policy demands. 583

3.19.1 Government-Provided Training. 585

All contractor personnel requiring a Common Access Card (CAC) for performance under this 586 contract must complete the mandatory government-provided training listed below. 587

a. Mandatory Courses and Deadlines: All courses listed in the table below are mandatory 588 and must be completed within 30 days of contract start date or within 10 business days of 589 a new employee's start date. Annual training must be completed as required to maintain 590 network access. 591

b. Cost Responsibility: The Government will provide access to the necessary online training 592 platforms (e.g., via the Air Force Portal) at no cost. The Contractor shall be responsible 593 for all labor costs (i.e., employee's time) associated with completing these training 594 requirements. 595

Course Nbr Title C11681 Air Force Risk Management Fundamentals Course 2020 CHQSCI0000100DL Level 1 STINFO Training (CBT) MHPADM0003146CB 75 ABW/SC Operational Risk Management MHPADM0265600DL 75 ABW/SC Annual Operation Security (OPSEC) Training MHPADM0312800DL 75 ABW/SC Unit Emergency Management Training MHPADM9800100DL Identifying and Safeguarding Personally Identifiable Information (PII) MHPADM9800500BR Annual Drug-Free Federal Workplace Training MHPCOM9800500VS Using Mobile Devices in a DoD Environment MHPSAF9801502BR 75 ABW/SC Annual Safety Awareness MHPSAF9801800BR GHS Chemical Labeling and SDS Retrieval Training - One-Time MHPSEC9802900BR Annual Training for Cleared Personnel MHPSEC9803000BR 75SC NATO Security Awareness Brief

MLMW0279 DoD Combating Trafficking in Persons (CTIP) General Awareness Course MLMW0432 DAF-Operations Security Awareness Training MLMW2260 TFAT-Annual Cyber Awareness Challenge MLMW2289 DoD Mandatory Controlled Unclassified Information Training MLMW2655 AFQTPXXXXX-222RA, Records Management - User Training

3.20 Continuing Training 597

The Contractor retains full responsibility for ensuring its employees are adequately and 598 appropriately trained to carry out their duties as assigned by the Contractor under this contract. 599 Continuous e-Learning is available via the Air Force Portal. Most of these courses require 600 Contractor funding for contract employees. 601

3.21 Emergency Situations 602

The CO/COR shall notify the Contractor when emergency situations exist (e.g., natural disasters, 603 weather-related situations, base closures), which may cause changes to installation operations 604 tempo. 605

3.22 Environmental Controls 606

3.22.1 Compliance with Laws and Regulations 607

The Contractor shall be knowledgeable of and comply with all applicable Interstate, Federal, 608 State, and Local laws, regulations, and requirements regarding environmental protection. In the 609 event environmental laws/regulations change during the term of this contract, the Contractor is 610 required to comply as such laws come into effect 611

3.22.2 Notification of Environmental Spills 612

If the Contractor spills or releases any substance contained in 40 CFR 302 into the environment, 613 the Contractor or its agent shall immediately report the incident to Hill AFB Fire Dept. at 777-614 1911. The liability and costs associated with the spill or release of such substance(s), to include 615 fines imposed on Hill AFB, damages and clean up, rests solely with the Contractor and its agent. 616

3.22.3 Material Storage and Use 617

control of humidity, temperature, cleanliness, and materials handling. 619

3.23 Orientation/Transition Period 620

Estimated to be 30 days. The Contractor shall ensure a seamless transition to the maximum 621 and equipment will be utilized through the orientation period and a method to ensure 623 performance and to include phase-in timelines. The plan shall also include the number and 624 position titles of personnel to be on site for the orientation period. The Contractor shall begin the 625 orientation and provide a written transition plan. The purpose of the orientation plan is to 626 demonstrate how the Contractor shall meet the following: 627

3.23.1 Observe work accomplished by current employees and become thoroughly familiar with 628 work requirements. 629

3.23.2 Complete personnel requirements (work force), including the hiring of personnel to assure 630 satisfactory performance. Soliciting Government or Contractor personnel for employment 631 during their duty hours is prohibited unless interview arrangements are made through the CO and 632 personnel offices at this installation. 633

3.23.3 Complete Security requirements as identified in the PWS Paragraph 3.10. 634

3.23.4 Complete documentation and requests during the orientation period for all applicable 635 security clearances or NACs, NACIs (if required by HSPD-12), or acceptable local files checks 636 within two weeks of contract award. 637

3.23.5 Complete the development of necessary work plans and procedures based on PWS 638 requirements. 639

3.23.6 The Contractor shall be allowed access to the facilities to familiarize supervisors, key 640 personnel and staff with equipment, reporting, work scheduling and procedures. However, such 641 access shall not interfere with the production efforts of current workforce. To preclude such 642 interference, arrangements for access to the Government facilities shall be made with the COR. 643

3.23.7 If there is a change in Contractor or upon contract completion, the incumbent Contractor 644 shall provide familiarization and allow the follow-on Contractor to observe monthly operations, 645 facilities, work, equipment locations and reporting procedures on a non-interference basis. 646

3.23.8 The incumbent Contractor shall ensure network access is removed for those employees 647 who do…