FMS_TCG_Database_PWS_Technical_Document_Final.pdf

PERFORMANCE WORK STATEMENT (PWS)

FOREIGN MILITARY SALES (FMS)

TECHNICAL COORDINATION GROUP (TCG)

DATABASE SYSTEM SUPPORT

PREPARED BY:

AFLCMC/WAM

F-16 FMS

Hill AFB, UT 84056

Dated: 12 February 2024

Version: 1.0

Controlled by: AFLCMC/WAM Controlled by: F-16 System Program Office Foreign Military Sales

POST AWARD CHANGES

Table 1. Post Award Changes

GOV’T/CONTRACTOR

INITIATED

REVISION DATE CHANGE SUMMARY

Table of Contents

1 Purpose

1.1 SCOPE

2 Program Management

2.1 SINGLE POINT OF CONTACT

2.2 CONTRACTOR RESPONSIBILITIES

2.3 SUBCONTRACTOR MANAGEMENT

2.4 TYPE OF CONTRACT

2.5 ENVIRONMENTAL, SAFETY, AND OCCUPATIONAL HEALTH (ESOH)

2.6 VOLUNTARY PROTECTION PROGRAM (VPP)

2.7 RESERVED .................................................................................... ERROR! BOOKMARK NOT DEFINED.

2.8 SUPPLY CHAIN RISK MANAGEMENT PLAN

2.9 GOVERNMENT FURNISHED PROPERTY (GFP)

2.9.1 Lost, Theft or Damage

2.9.2 Asset Management

2.9.3 Request Disposition of GFE and GFP

2.10 MONTHLY STATUS REPORT (MSR)

2.11 KICK-OFF MEETING

2.12 INTEGRATED SUPPORT TEAM MEETINGS

2.13 TECHNICAL INTERCHANGE MEETING (TIM)

2.14 SCHEDULE

2.15 CONFERENCE MINUTES

2.16 PRESENTATION MATERIAL

2.17 TRAVEL

3 Security

3.1 CONTROLLED UNCLASSIFIED INFORMATION (CUI)

3.2 CYBER SECURITY

3.2.1 Cyber Security Risk Management Framework (RMF)

3.2.1.1 Commercial off The Shelf (COTS) Cybersecurity

3.2.1.2 Continual Scanning

3.3 OPERATIONS SECURITY (OPSEC)

3.4 FEDERAL INFORMATION PROCESSING STANDARDS (FIPS)

3.5 BASIC INPUT/OUTPUT SYSTEM (BIOS)

3.6 ACCESS TO CONFIDENTIAL, PROPRIETARY, AND/OR SENSITIVE INFORMATION

3.7 SEPARATION OF CUSTOMER SPECIFIC TECHNICAL DATA

3.7.1 Foreign Military Sales Information (FMS)

3.7.1.1 FMS support size

3.7.1.2 Contamination Plan

4 System Overview

4.1 GFE HARDWARE

4.2 TCG ARCHITECTURE DESIGN

4.2.1 Servers

4.2.2 Software Builds

4.2.2.1 Front End Software

4.2.2.2 Web Server Software

4.2.2.3 Database Server

4.2.3 Database Characteristics

5 Technical/Requirements

5.1 PLACE OF PERFORMANCE

5.2 HOURS OF OPERATION

5.3 OPERATIONAL SUPPORT

5.4 SYSTEM ADMINISTRATION

5.4.1 Database Administration

5.5 INTERNET PROTOCOL (IP)

5.6 SYSTEM PERFORMANCE

5.7 CONNECTION REQUIREMENTS

5.8 SYSTEM STABILITY

5.9 SOFTWARE AND HARDWARE FAILURES

5.9.1 Hardware Malfunction

5.9.2 Database and Software Malfunction

5.9.3 Warranty

5.10 CUSTOMER FAMILIARIZATION TRAINING

5.10.1 Develop, Maintain or Update Training Material

5.10.2 Training Material Data Rights

5.11 HELP DESK SUPPORT PROCESS

5.11.1 Government Admin Support

5.12 CONFIGURATION MANAGEMENT

5.12.1 Configuration Management (CM) Reporting

5.13 SOFTWARE LICENSES

5.14 END OF CONTRACT

5.15 INITIAL OPERATIONAL TESTING

5.16 INITIAL OPERATIONAL CAPABILITY

5.16.1 PRIMARY SERVERS…………….……………………..…………………………………… . 17

5.16.2 Back-Up Servers…………………………………………………………………………….17

5.17 DATA RIGHTS

6 Task Orders

Attachment 1 CDRL List

Attachment 2 Applicable Publications

Attachment 3 Performance Requirements Summary (PRS)

Attachment 4 Known System Characteristics …………………………………………………….… 28

Table of Tables

TABLE 1. POST AWARD CHANGES

TABLE 2. CONTRACT DATA REQUIREMENTS LIST

TABLE 3. APPLICABLE PUBLICATIONS

TABLE 4. CONTRACTOR PERFORMANCE ASSESSMENT RATINGS

TABLE 5. SERVICES SUMMARY

Acronym List

A&A Approval and Authorization AF Air Force Manual AFI Air Force Instruction AFMAN Air Force Manual ARIS Asset Requirements and Identification

System BIOS Basic Input/Output System CBT Computer-Based Training CIO Chief Information Officer CLIN Contract Line-Item Number CM Configuration Management CMRA Contractor Manpower Reporting

Application CMVP Cryptographic Module Validation

Program COR Contracting Officer Representative COTS Commercial off the Shelf CSAT Cost Share Analysis Tool CUI Controlled Unclassified Information DACA Days After Contract Award DFARS Defense Federal Acquisition

Regulation Supplement DISA Defense Information Systems Agency DoD Department of Defense DoDD Department of Defense Directive DoDI Department of Defense Instruction DoDIN Department of Defense Information

Network DoDM Department of Defense Manual EPAF European Participating Air Forces ESOH Environmental, Safety, and

Occupational Health FAR Federal Acquisition Regulation FFP Firm Fixed Price FIPS Federal Information Processing

Standards FMS Foreign Military Sales FY Fiscal Year GFE Government Furnished Equipment GFP Government Furnished Property IAW In Accordance With IDIQ Indefinite Delivery Indefinite

Quantity

IDTODS International Digital Technical Order(s) Delivery System

IMS Integrated Master Schedule IP Internet Protocol KO Contracting Officer MB Megabytes MSR Monthly Status Report NCSP National Cyber Security Partnership NDA Non-Disclosure Agreements NIST National Institute of Standards and

Technology NSTISSP National Security

Telecommunications and Information Systems Security Policy Number

OPSEC Operations Security OSHA Occupational Safety and Health Act PA Proven Aircraft PGM Precision Guided Munitions PM Program Manager of Project Manager PWS Performance Work Statement QASP Quality Assurance Surveillance Plan RMF Risk Management Framework SPO System Program Office STE Special Test Equipment STIG Security Technical Implementation

Guides TCG Technical Coordination Group TIM Technical Interchange Meeting USAF United States Air Force USC United States Code USG United States Government VPP Voluntary Protection Program

Technical Coordination Group (TCG) Website

1 Purpose The purpose of this effort is to support the United States Government (USG) owned, cost-shared European Participating Air Forces (EPAF) and Foreign Military Sales (FMS) Consolidated Technical Coordination Group (TCG) Web-Enabled Database (hereafter referred to as TCG Database) currently utilized by 40 participating countries in the F-16, Precision Guided Munitions (PGM), and Proven Aircraft (PA) FMS TCGs and the F-16 International Digital Technical Order(s) Delivery (IDTODS) system.

1.1 Scope

The contractor shall perform engineering and management services required to support, maintain, and keep the TCG Database operational and accessible to all participating FMS partner nations and USG approved users. The TCG database consists of three (3) TCG, two (2) IDTODS and one (1) Cost Share Analysis Tool (CSAT) database, approximately 380,000 lines of code. The contractor shall be responsible for all personnel, equipment, supplies, facilities, transportation, tools, materials, and other items as necessary to perform the requirements as defined within this Performance Work Statement (PWS). The contractor shall also perform engineering services that updates or transitions the TCG Database as defined in Task Orders.

2 Program Management

2.1 Single Point of Contact

The contractor shall identify a Program Manager (PM) or a Project Manager (PM) who shall be the primary representative responsible for all work in reference to this contract and the primary point of contact for communication between the government PM, Contracting Officer (CO), and the contractor.

2.2 Contractor Responsibilities

The contractor shall exercise management, operational control, and retain full responsibility for performance requirements set forth in this PWS. Government observations shall be conducted as indicated in the Quality Assurance Surveillance Plan (QASP) In Accordance With (IAW) Mandatory Procedure 5301.602 2d, applicable paragraphs within this PWS, applicable clauses in the contract and specific requirements defined in accepted Task Orders.

2.3 Subcontractor Management

The contractor may subcontract with other companies to establish a strong technical capability to meet diverse contract requirements. However, the prime contractor shall be responsible for all aspects of the contract performance (i.e., the technical/administrative data approval), oversight, and the flow of all the requirements to all the sub-contractors. The prime contractor shall merge all subcontract deliverables into a single cohesive deliverable that the prime contractor shall be responsible for.

2.4 Type of Contract

The contract is an Indefinite Delivery Indefinite Quantity (IDIQ) governmental requirement that consist of annual must pay to support the sustainment of the TCG systems as a Firm Fixed Price (FFP) Contract Line-Item Number (CLINs). Items defined in paragraphs one (1) through five (5) of this PWS are all to be considered must pay yearly cost to keep the entirety of the TCG Database functioning as required.

Any enhancements that add extra capability/enhancement shall be defined within a separate Task Order PWS that shall be FFP enhancement.

2.5 Environmental, Safety, and Occupational Health (ESOH)

The Contractor is solely responsible for compliance with all federal, state, and local laws. The contractor shall comply with Public Law 91-596 Occupational Safety and Health Act (OSHA) and the Department of Defense Directive (DoDD) 4715.1E, Environmental, Safety, and Occupational Health (ESOH). These requirements shall be incorporated into the contractor’s safety and health program.

Additionally, the contractor is responsible for the safety and health of all subcontractors’ employees during the performance of this contract.

2.6 Voluntary Protection Program (VPP)

The Air Force is part of OSHA’s VPP. All contractors are required to familiarize themselves with the requirements of VPP. Information on VPP can be accessed at http://www.osha.gov. The intent of the Air Force Safety Program is to prevent injuries and to communicate our safety expectations with potential offers as well as those contractors awarded a government contract. The Air Force’s interest is to protect personnel working in or around contractor operations, and to protect Air Force equipment/property.

2.7 Reserved

This paragraph reserved for future use.

2.8 Supply Chain Risk Management Plan

The contractor shall deliver a Supply Chain Risk Management Plan that incorporates an anti-counterfeit policy. The contractor shall meet FAR 252.246-7007 Contractor Counterfeit Electronic Part Detection and Avoidance System. (CDRL A001, Supply Chain Risk Management Plan)

2.9 Government Furnished Property (GFP)

The Contractor shall submit Government Furnished Equipment (GFE) and/or Government Furnished Property (GFP) to F-16 System Program Office (SPO) FMS PM and Contracting Officer Representative (COR) for all USG-furnished support requirements under the terms of this contract. (CDRL A002, Government Furnished Property (GFP))

2.9.1 Lost, Theft or Damage

In accordance with FAR 52.245-1, Government Property, “loss of Government property” means unintended, unforeseen or accidental loss, damage or destruction to Government property that reduces the Government’s expected economic benefits of the property. Loss of Government property does not include purposeful destructive testing, obsolescence, normal wear and tear or manufacturing defects.

Loss of Government property includes, but is not limited to (1) items that cannot be found after a reasonable search; (2) theft; (3) damage resulting in unexpected harm to property requiring repair to restore the item to usable condition; or (4) destruction resulting from incidents that render the item useless for its intended purpose or beyond economical repair.

2.9.2 Asset Management

The Contractor shall:

a. Identify, manage, status and coordinate with the CO and F-16 SPO FMS PM, as required, for GFE, GFP, Special Test Equipment (STE) issues utilizing the Asset Requirements and Identification System (ARIS) database.

b. Safeguard GFE IAW Federal Acquisition Regulation (FAR) 45 and DFARS 52.245-1.

c. Be responsible for storage and utilization of GFE and GFP.

d. Return GFE and GFP in serviceable condition.

2.9.3 Request Disposition of GFE and GFP

Once GFE and/or GFP are no longer required to support this contract, request disposition instructions from the CO, PM and/or COR.

2.10 Monthly Status Report (MSR)

The Contractor shall submit Monthly Status Reports (MSR) by the tenth of every month. A final MSR is expected to summarize the effort at contract completion. (CDRL A003, Monthly Status Report

(MSR))

2.11 Kick-Off Meeting

The contractor shall convene a kick-off meeting within thirty (30) DACA. (CDRL A004, Presentation Material) (CDRL A005, Conference Minutes)

2.12 Integrated Support Team Meetings

The contractor shall support monthly Integrated Support Team Meetings. This meeting is designed to address any hardware, software, licensing issues and provide update to support tickets. The contractor shall develop presentation material to support this meeting. (CDRL A004, Presentation Material) (CDRL A005, Conference Minutes)

2.13 Technical Interchange Meeting (TIM)

The contractor shall support monthly Technical Interchange Meeting (TIM)s that address status of task orders and provides a venue to discuss any deviations or update to timeline to achieve task order workload. (CDRL A004, Presentation Material) (CDRL A005, Conference Minutes)

2.14 Schedule

The contractor shall develop schedule for each Task Order. The schedule shall be reviewed at all TIMs and added as an attachment to the monthly status report. The contractor shall ensure all contractor and government milestones are incorporated within the schedule. (CDRL A003, Monthly Status Report

(MSR))

2.15 Conference Minutes

The contractor shall be responsible to capture all meeting and conference minutes. (CDRL A005, Conference Minutes)

2.16 Presentation Material

The contractor shall deliver presentation material that is used to support any meeting with the government five (5) calendar days prior to the meeting occurring. (CDRL A004, Presentation Material)

2.17 Travel

No travel requirements are anticipated for the support of this program. If the contractor can validate a need for travel or the government desires for the contractor to travel. Travel shall be captured in an individual Task Order. All travel under this contract shall follow the Joint Travel Federal Regulations.

3 Security

3.1 Controlled Unclassified Information (CUI)

The Contractor shall comply with Department of Defense Instruction (DoDI) 5200.48, Controlled Unclassified Information (CUI). The Contractor shall be responsible for training their personnel and accomplishment of the out-processing procedures identified in Department of Defense Manual (DoDM)

5200.01. The Contractor shall comply with DoDM 5400.07/Air Force Manual (AFMAN) 33-302, Department of Defense (DoD) Freedom of Information Act (FOIA) Program requirements. Protection of unclassified DoD information not approved for public release on non-DoD Information Systems will be protected IAW Department of Defense Instruction (DoDI) 8582.01, Security of Unclassified DoD Information on non-DoD Information Systems. The Contractor shall distribute controlled unclassified information IAW DoDM 3200.14, Principles and Operational Parameters of the DoD Scientific and Technical Information Program, and DoDI 2040.02, International Transfer of Technology, Articles, and Services. The Contractor shall properly mark all such documents IAW DoDI 5230.24, Distribution Statements on Technical Documents. Technical documents not subject to distribution are defined in DoDI 5230.24, DoDD 5230.25, and DoDM 5010.12-M, Procedures for the Acquisition and Management of Technical Data.

3.2 Cybersecurity

The contractor shall assist in the prevention of cyber exploitation and other security issues by implementing preventive measures in compliance with AF cyber-related mandates. The contractor shall ensure all firewalls and intrusion detection, or other information assurance systems, are fully functioning as intended and kept current.

3.2.1 Cyber Security Risk Management Framework (RMF)

The contractor shall ensure that all the requirements meet the DoD Cyber Security Risk Management Framework (RMF). This includes Approval and Authorization (A&A) activities. The contractor shall provide application services that comply with and support DoD and United States Air Force (USAF).

3.2.1.1 Commercial off The Shelf (COTS) Cybersecurity

As specified by this contract or task orders, the contractor shall provide COTS cyber and cyber-enabled products IAW Air Force Instruction (AFI) 17-130, Cyber Security or other specified guidance. These products must be National Security Telecommunications and Information Systems Security Policy Number 11 (NSTISSP-11) compliant, requiring them to be validated by accredited labs under the National Cyber Security Partnership (NCSP) Common Criteria Evaluation and Validation Scheme or National Institute of Standards and Technology (NIST) Federal Information Processing Standards (FIPS) Cryptographic Module Validation Program (CMVP) as applicable. The contractor shall ensure that all systems comply with the Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STIGs), which includes the need for source code scanning and Web Penetration Tests to mitigate vulnerabilities associated with SQL injections, cross-site scripting, and buffer overflows.

3.2.1.2 Continual Scanning

Due to the sensitive nature of the TCG/FMS database and the information store therein, continual scanning for hacker intrusion is imperative and needs to be performed at a minimum quarterly. The contractor shall provide results of these scans in the appropriate MSR. (CDRL A003, Monthly Status Report (MSR))

3.3 Operations Security (OPSEC)

The contractor shall ensure OPSEC is incorporated into the appropriate areas of the contract in accordance with DoDD 5205.02, DoD OPSEC Program and AFI 10-701, OPSEC. The contractor shall flow down all OPSEC requirements to subcontractors that handle Critical Information (CI). CI is defined as specific facts about friendly intentions, capabilities, and activities needed by adversaries for them to plan and act effectively to guarantee failure or unacceptable consequences for friendly mission accomplishment. (CDRL A006, OPSEC Plan)

3.4 Federal Information Processing Standards (FIPS)

The contractor shall ensure that all cryptographic products have Federal Information Processing Standards (FIPS) 140-2 security certification through the FIPS 140-2 approved products list maintained at: http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/1401val2014.htm This applies to: Hard Drives; Data Storages; Wireless Access Points; Flash Memory Cards; Network Security Platforms; Data Storage Media; Cryptographic Software and Modules; Telecommunication Devices; Land Mobile Radios; Routers/Switches; VPN Devices; Firewalls; Self-Encrypting Drives.

3.5 Basic Input/Output System (BIOS)

The contractor shall ensure all products are Basic Input/Output System (BIOS) protection compliant with Section 3.1 “Security Guidelines for System BIOS Implementations of SP 800-147,” per DoD Chief Information Officer (CIO), to prevent the unauthorized modification of BIOS firmware on computer systems.

3.6 Access to Confidential, Proprietary, and/or Sensitive Information In performance of this contract may require the contractor to sign a non-disclosure agreement with another contractor. The contractor shall support the requirement of signing another contractors Non- Disclosure Agreements (NDA). (CDRL A010, Non-Disclosure Agreements (NDA))

3.7 Separation of Customer Specific Technical Data

The contractor shall assist in the prevention of the system vulnerabilities such as computer hacking and other security problems by implementing preventive measures in compliance with AF or IC enterprise architecture.

3.7.1 Foreign Military Sales Information (FMS)

The contractor shall ensure segregation of data exist between each Foreign Military Sales (FMS) customer.

3.7.1.1 FMS support size

The contractor shall support the addition or removal of FMS customers as required to support the FMS population. As of November 2023, the following countries connect to and use the TCG Database:

• Australia

• Bahrain

• Belgium

• Brazil

• Bulgaria

• Chili

• Canada

• Denmark

• Egypt

• Greece

• Indonesia

• Iraq

• Israel

• Japan

• Jordan

• Korea

• Kuwait

• Malaysia

• Mexico

• Morocco

• Oman

• Netherlands

• Norway

• Pakistan

• Poland

• Portugal

• Romania

• Singapore

• Saudi Arabia

• Slovakia

• Spain

• Switzerland

• Thailand

• Taiwan

• Tunisia

• Türkiye

3.7.1.2 Contamination Plan

The contractor shall provide security and information assurance support, protecting information and information systems, and ensuring confidentiality, integrity, authentication, availability, and non-http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/1401val2014.htm repudiation. The contractor shall develop a plan to address contamination of classified information onto the database/system. (CDRL A007, Contamination Plan)

4 System Overview

4.1 GFE Hardware

The following table lists GFE that the government will provide to support this effort.

TCG Database GFE List

Serial Number Description Qty

BHGM9Z1 SERVER 1

3BFZK21 DELL SERVER RACK 1

2328BATCB831300079 TRIPP 16PT KVM SWITCH 1

6BFWZ72 POWER EDGE - SERVER 1

6X5BCM2 POWER EDGE - SERVER 1

6X62XM2 POWER EDGE - SERVER 1

Unk POWEREDGE R740 1 Unk POWEREDGE R240 SERVER 1 Unk POWEREDGE R740 SERVER 1

9QTHK93 R740 OKC DR 1

FGT80ETK19000675 Fortigate - 80E 1 FGT80ETK18018318 Fortigate 80E 1

AS1909152982 Smart UPS 2200 1 AS1909262217 Smart UPS 2200 1 AS1909262216 Smart UPS 2200 1

4.2 TCG Architecture Design

The contractor shall be familiar with the Known System Characteristics document (Attachment 4) as it describes the architecture of TCG Database system to include:

• A general description of the system

• The logical architecture of software, the layers, and top-level components

• The physical architecture of the hardware on which runs the software.

4.2.1 Servers

The contractor shall be able to support three different environments used throughout the development lifecycle:

• Development (localhost on developer’s computers)

• Test (www.tcgtest.net)

• Production (www.tcghome.net)

4.2.2 Software Builds

The current software build information as of November 2023:

• Server Version Build

• TCGF16 v1.0.60 68523f

• TCGPA v1.0.12 45dd1bd

• TCGPGM v1.0.7 12fcc62

• IDTODS (F16) v1.0.27 3d99b8c

• F5 IDTODS v.1.0.4 71891c4

• CSAT v.1.0.12 5afc8a6

4.2.2.1 Front End Software

The contractor shall be knowledgeable and qualified in supporting the front-end software that consist of:

• Development Stack:

o HTML 5 o JavaScript (POJ) o jQuery o Bootstrap o CSS

4.2.2.2 Web Server Software

The contractor shall be knowledgeable and qualified in supporting the web server that consist of two (2) separate servers, one for test and one for Production:

• Development Stack:

o IIS v10.0

6 separate websites on each server

• /tcgf16

• /tcgpa

• /tcgpgm

• /idtod

• /f5dtods

• /csat

PHP 8.1.14

CodeIgniter 3.1.13 (PHP MVC Framework)

4.2.2.3 Database Server

The contractor shall be knowledgeable and qualified in supporting the Database server that consist of two (2) separate servers, one for test and one for Production:

• Oracle 19c Standard Edition

• 6 separate schemas:

o tcgf16 o tcgpa o tcgpgm o idtod v2 o Idtod f5 o Csat

4.2.3 Database Characteristics

The following information provides a snapshot in time (November 2023) in reference to the current Databases used within the TCG Database:

• The current TCG server size/capacity:

o Database Server, 2 TB or 2000 GB o Web Server 7.27 TB or 7270 GB o App Server 2 TB or 2000 GB

• The current IDTODS Server Size/Capacity:

o Database Server- 533.18 GB o Web Server- 1.63 TB or 1633.08 GB o App Server- 533.25 GB

• The current File Storage Size Used:

o TCGF16 = 69.87 GB o TCGPA = 48 GB o TCGPGM = 5.3 GB o F-16 IDTODS = 2.9 GB o F5 IDTODS = 16.8 GB o CSAT = 55.2 GB

5 Technical/Requirements

5.1 Place of Performance

The servers shall be maintained at a location determined by the contractor with the current capabilities of the version specified at time of contract award.

5.2 Hours of Operation

The contractor shall be available during regular business hours 40 hours a week between the hours of 0600 – 1700 MST Monday – Friday. The contractor shall provide an afterhours contact phone number and system administration help desk assistance in the event of a system failure.

5.3 Operational Support

The contractor shall provide operational support services including database administration, systems administration, admin training, and admin help desk support IAW AFI 33-115 Network Operations and DoDM 8140.03 Cyberspace Workforce Qualification and Management Program.

5.4 System Administration

The contractor shall provide all system administration services to ensure system uptime requirements are met, this includes installing hardware/software, network security and incident management, network infrastructure support, maintaining servers or other computer systems and planning for and responding to service outages and other problems.

5.4.1 Database Administration

The contractor shall provide database administration support for logical and physical database designs.

The contractor shall create and test backups of data, provide data cleansing services (such as fixing or removing incorrect, corrupted, incorrectly formatted, duplicate, or incomplete data within a dataset.), verify data integrity, implement access controls to the data, ensuring maximum availability and performance. The contractor shall assist developers of data exposure services to use the database efficiently and effectively.

5.5 Internet Protocol (IP)

Servers located off government facilities require Department of Defense Information Network (DoDIN) approval for government employees to connect while on government facility or when working remotely through the government VPN. The contractor shall acquire three (3) static IP address for the TCG Database and get them approved through the USAF Help Desk to acquire an “exception status” in order to be considered as an approved IP on the USAF firewall. The contractor shall provide registration status of IP address within the monthly status report. (CDRL A003, Monthly Status Report (MSR))

5.6 System Performance

The contractor shall monitor the performance of the system and resolve any issues related to the efficient and effective use of the system in general. The contractor shall provide system performance in the MSR. (CDRL A003, Monthly Status Report (MSR))

5.7 Connection Requirements

The contractor shall support a minimum 50 Megabits per second (Mbps) download and 50 Mbps upload fiber internet connection.

5.8 System Stability

The contractor supporting the TCG databases shall maintain a system uptime of 95% or greater. The contractor shall provide system status and uptime in the MSR. (CDRL A003, Monthly Status Report

(MSR))

5.9 Software and Hardware Failures

The contractor shall diagnose software or hardware failures within four (4) hours. The contractor shall support hardware software and any other related Information technology system that enables customer access and usability.

5.9.1 Hardware Malfunction

The contractor shall troubleshoot and replace any server or supporting hardware that has failed to perform its function or is causing the system to not function or be unstable. (CDRL A003, Monthly Status Report (MSR)) (CDRL A002, Government Furnished Property (GFP))

5.9.2 Database and Software Malfunction

If the TCG database has a malfunction that drives the system offline the contractor shall return the system to operational status within four (4) hours. If the contractor is unable to restore the system within four (4) hours the contractor shall contact the US Government admin to inform and provide an estimate time to recovery. The contractor shall document these incidents in the appropriate MSR. (CDRL A003, Monthly Status Report (MSR))

5.9.3 Warranty

The contractor shall provide any OEM pass through warranty and standard commercial warranties applicable to the products being purchased at no cost. This shall apply to new, refurbished, and remanufactured equipment. The contractor shall provide a list of all warranties within the monthly status report. (CDRL A003, Monthly Status Report (MSR))

5.10 Customer Familiarization Training

The contractor shall provide on-site familiarization training at USG and/or contractor locations only to the USG admins up to one (1) time per quarter.

5.10.1 Develop, Maintain or Update Training Material

The contractor shall develop, maintain and/or update student and instructor training materials. This may include Computer-Based Training (CBT), lesson plans, handouts, manuals, train-the-trainer material, textbooks, workbooks, manuals, evaluation forms and other documentation. The contractor shall deliver training material as required by task orders. (CDRL A008, Technical Reports Study Service / Training Material)

5.10.2 Training Material Data Rights.

The USG owns all rights to the current and future training materials developed by the contractor under this contract. Examples of training requirements may include a combination of CBTs, classroom lecture, demonstration, hands-on experience, and manual/documentation familiarization for each student. The training shall not contain proprietary information and may be augmented/altered by the USG after delivery. (CDRL A008, Technical Reports Study Service / Training Material)

5.11 Help Desk Support Process

The contractor shall support user help desk support tickets submitted through the system. The current process built into the software and how the government uses it is as follows:

1. User submits ticket.

2. Government and contractor receive the ticket, government reviews.

a. Government resolves and closes ticket (contractor sees ticket close)

b. Government assigns to the contractor to resolve.

c. The contractor shall plan to repair up to 50 tickets that can consist of account repair/corrections or loss of abilities to include source code corrections.

d. The contractor shall capture this workload in the MSR. The contractor shall identify details as to the issue, what required correction and how long the correction took the contractor. (CDRL A003, Monthly Status Report (MSR))

5.11.1 Government Admin Support

The contractor shall provide a phone number and email address that is available 24-hours a day, seven (7)-days a week, 365-days a year for technical support to assist assigned government administrators.

5.12 Configuration Management

The contractor shall maintain configuration management on all hardware and software associated with this contract.

5.12.1 Configuration Management (CM) Reporting

The contractor shall develop/update the configuration of the managed system 120 days after contract award. The contractor shall update the configuration management report as needed and deliver to the government after update. The contractor shall update the configuration management report 120 days prior to the period of performance of the contract. (CDRL, A009, Technical Reports Studies Services / Configuration Management Reporting)

5.13 Software Licenses

The contractor shall add a section to the Monthly Status Report that list all software licenses, how much they currently cost, the length of the license, when the governments license expires and website or contact number to extend the license. The contractor shall be responsible to maintain all licenses for the government to support this contract. (CDRL A003, Monthly Status Report (MSR)) (CDRL, A009, Technical Reports Studies Services / Configuration Management Reporting)

5.14 End of Contract

Upon completion of the contract, all items (property, material, software, licenses, etc.) shall be returned to the Government or awardee of the follow-on contract with oversight of the Government. The contractor shall package and overnight ship all items within 24-hours of the end of the period of performance to a United States destination defined by the government.

5.15 Initial Operational Testing

If the TCG database/services have not operated in its current location the contractor shall coordinate initial capability testing with the US Government admin team prior to going operational. The contractor shall also coordinate initial testing of a new capability or requirement defined within a task order PWS.

5.16 Initial Operational Capability

5.16.1 Primary Servers

The contractor shall have 72 hours after receipt of all GFE/GFP to return the TCG Database to fully functional service. The contractor shall coordinate with the US Government admin team once the contractor deems the service operational.

5.16.2 Back-Up Servers

The contractor shall have 72 hours after setting up and validating the primary servers are functional to set up the back-up servers and test with the USG.

5.17 System Status

The contractor shall provide system status in the monthly status report. (CDRL A003, Monthly Status Report (MSR))

5.18 Data Rights

The Government shall have unlimited data rights pertaining to this database, domain ownership, internet, and software certificates, in all data, drawings, designs, specifications, coding, test plans, test procedures, test results, test databases, backup data, user's manuals, notes and other works developed in the performance of this contract.

6 Task Orders The government may require the contractor to support further development of software and or database to support a government requirement. The contractor shall coordinate with the government on any additional work within the scope of this PWS. Additional work consists of but is not limited to, requests for system enhancements, request for studies that support the TCG Database to include transitioning the TCG Database to cloud-based enterprise services eliminating the local server requirements.

Attachment 1 CDRL List

CDRLs identified throughout this PWS are consolidated on Table 2. Contract Data Requirements List.

Table 2. Contract Data Requirements List.

Data Item DID Description Sub-Title PWS

Paragraphs Frequency

A001 DI-

MGMT-

82256

Supply Chain Risk Management Plan

2.8 The contractor shall

deliver the Supply Chain Risk Management Plan 120 calendar Days After Contract Award (DACA). The contractor shall update the Supply Chain Risk Management Plan annually and submit an updated Supply Chain Risk Management Plan upon each option year

120 DACA.

A002 DI-

MGMT-

80269

Government Furnished Property (GFP)

2.9, 5.9.1 The Contractor shall submit a monthly GFE status report within thirty (30) calendar days after the first piece of GFE and/or GFP is received for this contract. The Contractor shall continue to submit monthly reports until all GFE and GFP has been returned according to directions received from the CO as outlined in this PWS

A003 DI-

MGMT-

80368A

Monthly Status Report (MSR)

2.10, 2.14, 3.21, 3.2.1.2, 5.5, 5.6, 5.8, 5.9.1, 5.9.2, 5.9.3, 5.11, 5.17

The Contractor shall submit Monthly Status Reports (MSR) by the tenth of every month.

Data Item DID Description Sub-Title PWS

Paragraphs Frequency

A004 DI-

ADMN-

81373

Presentation Material

2.11, 2.12, 2.13, 2.16

The contractor shall deliver presentation material that is used to support any meeting with the government five (5) calendar days prior to the meeting occurring.

A005 DI-

ADMN-

81250B

Conference Minutes

2.11, 2.12, 2.13, 2.15

The contractor shall deliver all meeting and conference minutes within five (5) business days of meeting completion

A006 DI-

MGMT-

80934C

OPSEC Plan 3.3 The contractor shall produce an OPSEC Plan and deliver it to F-

16 SPO FMS 60

calendar DACA. The contractor shall update their OPSEC Plan once a year and deliver it 60 calendar days after option/ordering period award.

A007 DI-

MISC-

80508B

Technical Reports Studies Services

Contamination Plan

3.7.1.2 The contractor shall

deliver their plan to address contamination thirty (30) calendar days after contract award. The contractor shall subsequently deliver an updated plan thirty (30) calendar days after each opting year award.

A008 DI-

MISC-

80508B

Technical Reports Studies Services

Training Material 5.10.1, 5.10.2 As required or defined by task order.

Data Item DID Description Sub-Title PWS

Paragraphs Frequency

A009 DI-

MISC-

80508B

Technical Reports Studies Services

Configuration Management Reporting

5.12.1, 5.13 The contractor shall develop/update the configuration of the managed system 120 days after contract award. The contractor shall update the configuration management report as needed and deliver to the government after update. The contractor shall update the configuration management report 120 days prior to the period of performance of the contract

A010 DI-

MGMT-

82241

Non-Disclosure Agreements

(NDA)

3.6 As required or defined

by the original PWS and/or task order to support the efforts required on this contract.

Attachment 2 Applicable Publications

The contractor shall follow and reference all publications identified in Table 3. Applicable Publications.

The contractor shall also follow all publications within the PWS that were overlooked and not added to Table 3. Applicable Publications.

Table 3. Applicable Publications.

Publications Sections that

Apply Date of Publication and Changes

Title of Publication

DoDD 4715.1E All March 19, 2005 Incorporating Change 2, December 30

Environmental, Safety, and Occupational Health (ESOH)

DoDI 5200.48 All 6-Mar-20 Controlled Unclassified Information

(CUI)

DoDM 5200.01 All February 24, 2012 Incorporating Change 3, Effective July 28, 2020

DoD Information Security Program:

Protection of Classified Information

DoDM 5400.07 All 5-Apr-19 DoD Freedom of Information Act (FOIA) Program

AFMAN 33-302 All 27-Apr-18 Freedom of Information Act Program

DoDI 8582.01 All 9-Dec-19 Security of Non-DoD Information Systems Processing Unclassified Nonpublic DoD Information

DoDM 3200.14 All March 14, 2014 Incorporating Change 2, October 15, 2018

"Principles and Operational Parameters of the DoD Scientific and Technical

DoDI 2040.02 All March 27, 2014 Incorporating Change 1, July 31, 2017

International Transfers of Technology, Articles, and Services

DoDI 5230.24 All 10-Jan-23 Distribution Statements on DoD Technical Information

Publications Sections that Apply

Date of Publication and Changes

Title of Publication

DoDD 5230.25 All 6 Nov 1984, Incorporating Change 2, October 15, 2018

Withholding of Unclassified Technical Data from Public Disclosure

DoDM 5010.12-M All May 1993 Incorporating Change 1, August 31, 2018

Procedures for the Acquisition and Management of Technical Data

AFI 17-130 All 13-Feb-20 Cybersecurity Program Management

DoDD 5205.02 All November 3, Incorporating Change 2, Effective October 29, 2020

DoD Operations Security (OPSEC) Program Manual

AFI 10-701 All 24 JULY 2019 Incorporating Change 1, 9

JUNE 2020

Operations Security (OPSEC)

AFI 33-115 All 3-May-04 Network Operations (NETOPS)

DoDM 8140.03 All 15-Feb-23 Cyberspace Workforce Qualification and Management Program

Attachment 3 Performance Requirements Summary (PRS)

Contractor Performance Assessment Reporting (CPAR) ratings are defined in FAR 42.1503(h) 4 and depicted in Table 4. Contractor Performance Assessment Ratings.

Table 4. Contractor Performance Assessment Ratings.

Rating Definition Note

(a) Exceptional Performance meets contractual requirements and exceeds many to the Government’s benefit. The contractual performance of the element or sub-element being evaluated was accomplished with few minor problems for which corrective actions taken by the contractor were highly effective.

To justify an Exceptional rating, identify multiple significant events and state how they were of benefit to the Government. A singular benefit, however, could be of such magnitude that it alone constitutes an Exceptional rating. Also, there should have been NO significant weaknesses identified.

(b) Very Good Performance meets contractual requirements and exceeds some to the Government’s benefit. The contractual performance of the element or sub-element being evaluated was accomplished with some minor problems for which corrective actions taken by the contractor were effective.

To justify a Very Good rating, identify a significant event and state how it was a benefit to the Government. There should have been no significant weaknesses identified.

(c) Satisfactory Performance meets contractual requirements. The contractual performance of the element or sub-element contains some minor problems for which corrective actions taken by the contractor appear or were satisfactory.

To justify a Satisfactory rating, there should have been only minor problems, or major problems the contractor recovered from without impact to the contract/order. There should have been NO significant weaknesses identified. A fundamental principle of assigning ratings is that contractors will not be evaluated with a rating lower than Satisfactory solely for not performing beyond the requirements of the contract/order.

(d) Marginal Performance does not meet some contractual requirements. The contractual performance of the element or sub-element being evaluated reflects a serious problem for which the contractor has not yet identified corrective actions. The contractor’s proposed actions

To justify Marginal performance, identify a significant event in each category that the contractor had trouble overcoming and state how it impacted the Government. A Marginal rating should be supported by referencing the management tool that notified the contractor of the appear only marginally effective or were not fully implemented.

contractual deficiency (e.g., management, quality, safety, or environmental deficiency report or letter).

(e) Unsatisfactory Performance does not meet most contractual requirements and recovery is not likely in a timely manner. The contractual performance of the element or sub-element contains a serious problem(s) for which the contractor’s corrective actions appear or were ineffective.

To justify an Unsatisfactory rating, identify multiple significant events in each category that the contractor had trouble overcoming and state how it impacted the Government. A singular problem, however, could be of such serious magnitude that it alone constitutes an unsatisfactory rating.

An Unsatisfactory rating should be supported by referencing the management tools used to notify the contractor of the contractual deficiencies (e.g., management, quality, safety, or environmental deficiency reports, or letters).

The list of satisfactory performance requirements summary for this PWS are defined in Table 5.

Services Summary. Meeting satisfactory performance requirements shall not warrant a higher rating than satisfactory. To achieve a higher rating refer to Table 4. Contractor Performance Assessment Ratings.

Table 5. Services Summary.

Performance Objective PWS Ref Performance Threshold to Achieve

Satisfactory

Supply Chain Risk Management Plan

(CDRL A001)

2.8 Supply Chain Risk Management

Plan

5.9.1 Hardware Malfunction

• The Contractor shall be responsible for all hardware and software used in the performance of this contract.

• Any hardware or software that does not comply with the anti-counterfeit policy must be replaced as soon as possible and with as little system downtime as possible.

Government Furnished Property (CDRL A002)

2.9 Government Furnished Property

(GFP)

5.9.1 Hardware Malfunction

• The Contractor shall provide a monthly report of all GFE or GFP used for this contract (This can be part of the Monthly Status Report.)

• The Contractor shall notify the USAF F-16 TCG PM/COR and the

Performance Objective PWS Ref Performance Threshold to Achieve

Satisfactory contracting officer of any hardware malfunctions within 48 hours

Monthly Status Reports (MSR)

(CDRL A003)

2.10 Monthly Status Report

2.14 Integrated Master Schedule

3.2.1.2 Continual Scanning

5.5 Internet Protocol (IP)

5.6 System Performance

5.8 System Sustainability

5.9.1 Hardware Malfunction

5.9.2 Database & Software

Malfunction

5.9.3 Warranty

5.11.2.d Help Desk Support Process

5.13 Software Licenses

5.16 System Status

• The Contractor delivers MSR with minor errors that are corrected in subsequent MSRs without repeating errors.

• The Contractor shall submit MSRs meeting all DID requirements no later than 10 days into the new month.

Presentation Material

(CDRL A004)

2.11 Kick-Off Meeting

2.12 Integrated Support Team

Meeting

2.13 Technical Interchange

Meetings (TIM)

2.16 Presentation Material

• The Contractor shall convene a kick-off meeting within thirty (30) days after contract award, including presentation materials prior to the meeting and meeting minutes after the meeting with only minor errors

• The Contractor shall submit all meeting presentation materials to the COR 5 calendar days prior all meetings and in compliance with all DID requirements

Conference Minutes

(CDRL A005)

2.11 Kick-Off Meeting • The Contractor shall convene a kick-

off meeting within thirty (30) days after contract award, including presentation materials prior to the

Objective PWS Ref Performance Threshold to Achieve

Satisfactory

2.12 Integrated Support Team

Meeting

2.13 Technical Interchange

Meetings (TIM)

2.15 Conference Minutes

meeting and meeting minutes after the meeting with only minor errors

• The Contractor shall submit all meeting minutes to the COR within 5 calendar days after all meetings and in compliance with all DID requirements

OPSEC Plan (CDRL A006)

3.3 OPSEC Plan • The Contractor shall produce an

OPSEC Plan and deliver it to F-16 TCG PM/COR 60 calendar DACA and meeting all DID requirements.

• The Contractor shall update their OPSEC Plan once a year and deliver it to the F-16 TCG PM/COR 60 calendar days after option/ordering period award and meeting all DID requirements.

Contamination Plan

(CDRL A007)

3.7.1.2 Contamination Plan • The Contractor shall deliver their plan to address contamination thirty

(30) calendar days after contract award and meeting all DID requirements.

• The Contractor shall subsequently deliver an updated plan thirty (30) calendar days after each opting year award and meeting all DID requirements.

Technical Reports/Study Service, Training (CDRL A008)

5.10.1 Develops, Maintains or

Update Training Material

5.10.2 Training Material Data

Rights

• As required or defined by task order, the Contractor shall develop, maintain, or update training material in support of the database administrators and users. (All training materials developed, maintained, or updated will be the property of the USG.)

Technical Reports Studies Services/Configuration Management

5.12.1 Configuration Management

(CM) Reporting

5.13 Software Licenses

• The Contractor shall develop/update the configuration of the managed system 120 (DACA).

• The Contractor shall update the configuration management report as

Objective PWS Ref Performance Threshold to Achieve

Satisfactory

Reporting (CDRL A009) the system configuration changes and deliver to the government after update.

• The Contractor shall update the configuration management report 120 days prior to the end of the period of performance of the contract.

Non-Disclosure Agreements (NDA)

(CDRL A010)

3.6 Access to Confidential, Proprietary, and/or Sensitive Information

• As required or defined by the original PWS and/or task order the Contractor shall have personnel who work on this contract, sign NDAs in support the efforts required on this contract in a timely manner to avoid any delays to any data that needs to be shared.

Attachment 4

FOREIGN MILITARY SALES (FMS)

TECHNICAL COORDINATION GROUP (TCG)

KNOWN SYSTEM CHARACTERISTICS

PREPARED BY:

AFLCMC/WAMI

F-16 FMS

Hill AFB, UT 84056

Dated: 12 February 2024

Controlled by: AFLCMC/WAMI

Controlled by: F-16 System Program Office, F-16 International Branch, F-16 Technical Coordination Group (TCG)

TECHNICAL DESCRIPTION CHANGES

Table 1. Technical Description Changes

GOV’T/CONTRACTOR

INITIATED

REVISION DATE CHANGE SUMMARY

Table of Contents

Table of Contents ………………………………………………………………………………. 30 Table of Table …………………………………………………………………………………….31

1.1 DOCUMENT OVERVIEW

1.2 ABBREVIATIONS

2. ARCHITECTURE

2.1 ARCHITECTURE OVERVIEW

2.2 PHYSICAL ARCHITECTURE OVERVIEW

2.2.1 32

2.2.2 Hardware Component 2 description

2.2.3 Hardware Component 3 description

2.2.4 Hardware Component 4

2.2.5 Hardware Component 5

2.3 LOGICAL ARCHITECTURE OVERVIEW

2.3.1 Software Framework description

2.3.2 Web Server description

2.3.3 Database Server description

2.3.4 Email Server description

3. Dynamic behavior of architecture

3.1 WORKFLOW / SEQUENCE 1

Table of Tables

TABLE 1. TECHNICAL DESCRIPTION CHANGES ………………………………………………….2

1 Introduction

1.1 Document Overview

This document describes the architecture requirements of the TCG websites and IDTODS (referred to from here forward as “system”.

It describes:

• A general description of the system

• The logical architecture of software, the layers and top-level components

• The physical architecture of the hardware on which software runs

1.2 Abbreviations

• IDTODS: International Digital Technical Order(s) Delivery System

• TCG: Technical Coordination Group

• VM: Virtual Machine

• DB: Database

2. Architecture

2.1 Architecture overview

The TCG system consists of a Web server, Database server, and a Reverse Web Proxy server.

The Web server and Database server are virtual machines that are running on the Host server.

The TCG System has a test environment that mirrors the exact setup as the production environment. The system also has two backup servers, one acts as a backup server and the other a disaster recovery server. The backup server is located locally, and the disaster recovery server is located off-site. All servers run as least Windows Server 2016 or later.

2.2 Physical architecture overview

The following sections describe the current hardware components on which the software runs and their interactions/relationships.

2.2.1 Hardware component 1 description

Fortigate 80E

• Block unwanted incoming and outgoing traffic

• Firewall

• Interfaces with all devices within the network

2.2.2 Hardware component 2 description

Dell R730 Server

• Reverse Proxy Server

• Redirects web traffic to the web server

• Interfaces with firewall and web server

2.2.3 Hardware component 3 description

Dell R740 Server

• VM Host Server

• Hyper-V

• Hosts Web Server and Database Server

• Interfaces with firewall, reverse proxy server, and backup server

2.2.4 Hardware Component 4

Dell R740 Server

• Backup Server

• Veeam

• Acts as the backup server

• Interfaces with firewall, and VM host server

2.2.5 Hardware Component 5

Dell R740 Server

• Disaster Recovery Server

• Veeam

• Acts as the offsite disaster recovery server

• Interfaces with firewall, VM host server, and backup server

2.3 Logical architecture overview

The Web VM and DB VM both run on the Host servers for the production and test environments. Running the Web and DB servers as VMs provides the capability to quickly restore or stand up a copy of…