N-ITSS_PWS_Task_Order_3_SO.pdf

PERFORMANCE WORK STATEMENT (PWS)

Name: NASIC IT Support Services

Security Office - Task Order 3

Organization: National Air & Space Intelligence Center

Address: 4180 Watson Way, Wright-Patterson AFB, OH 45433

1 PURPOSE

The National Air and Space Intelligence Center (NASIC) is the source for air and space intelligence. NASIC produces integrated, predictive air and space intelligence to enable military operations, force modernization and national policymaking.

The Security Office (SO) enforces and executes comprehensive collateral and SCI information, operations, personnel, integrated defense, industrial and physical security programs in support of the Center’s Intel production mission areas. In regard to this effort, the execution of the Center’s physical security and integrated defense program spanning multiple security facilities is critical to obtain and maintain physical security accreditation and protect national security assets.

The Security Office is located at the National Air and Space Intelligence Center, Wright- Patterson AFB (WPAFB), Fairborn, OH.

2 SCOPE

All work shall be performed at Wright Patterson Air Force Base (WPAFB), Fairborn, Ohio, Springfield Air National Guard Base, Springfield, OH and other AF JWICS areas of responsibility, as required. The majority of work that shall be provided will occur at one of NASIC’s facilities at WPAFB. On-site support shall also be required at other locations on WPAFB. Many of the Center’s buildings are multi-story structures.

The security enterprise encompasses 100 external and internal video surveillance cameras as well as recorders, client workstations, servers and database, approximately 800 intrusion detection points, workstations, servers and database. visitor management system to include 15 client workstations connected to the access control system & 6,000 badges with 2 badging stations, approximately 230 total access control points (with 35,000 access events each day), and includes turnstiles and other access control equipment at four primary entrance/exit points at the main facility and six external facilities. The number of NASIC and tenant unit personnel and the amount of equipment and services required will increase on a yearly basis.

Contractor shall possess a US Government Top Secret (TS) security clearance and granted access to sensitive compartmented information (SCI) based on an up-to-date Single Scope Background Investigation (SSBI); selected contractor personnel may be required to satisfy a Counter Intelligence polygraph requirement. Certain contractor personnel shall also satisfy additional security requirements as detailed in para 7.

All contractor personnel shall comply with NASIC policies, processes, procedures, national and local security rules, regulations and requirements except in specific instances waived by the Contracting Officer Representative (COR) or Quality Assurance Plan (QAP).

Primary hours of support (core work hours) for NASIC facilities at WPAFB shall be 0600

– 1800, Monday through Friday, Eastern Standard Time (EST). Other types of support may be necessary outside the core work hours in order to ensure that NASIC operations are not negatively impacted.

3 REQUIREMENT(S)/DESCRIPTION OF SERVICE(S)

3.1 Physical Access Control System & Intrusion Detection System

Support

3.1.1 Scope (in addition to the enterprise scope detailed above) Contractor shall provide core hour support Contractor shall provide non-core hour support on an on-call basis and as approved by Contracting Officer Representative (COR) or QAP Coordination between NASIC Security Office and NASIC Facility Engineers for modification and new requirements Installation, configuration changes, network layout, and alarm views are documented Adding/deleting users, modifying permissions, and attributes Completing ad hoc queries and reports as requested by Government personnel Contractor shall possess sustainment services support a variety security control and access equipment. Must be able to perform fault diagnosis, repair, overhaul, refurbishment, scheduled preventative maintenance services include installation as well as calibration and alignment. Maintenance support includes electronics and mechanical support such as turnstiles and electronic control unit (ECU) repair also provide a 24x7 technical support.

3.1.2 Qualifications

Contractor shall possess SQL experience in Database Administration of SQL server 2008 R2 and be able to support multiple databases including resolving database integrity issues, blocking and deadlocking issues, replication issues, log shipping issues, connectivity issues and security issues

Contractor shall be experienced with SQL performance tuning, query optimization, using performance monitor, SQL Profiler and other related monitoring and troubleshooting tools

Contractor shall be comfortable writing T-SQL queries and PowerShell scripts.

Candidate must be able to detect and troubleshoot Server related CPU, memory, I/O, disk space and other resource contention Contractor supporting the IDS shall possess LINX Predator Elite System

Administration, Staging, Hardware Installation, and maintenance certification.

Contractor supporting the ACS shall possess SMS StarWatch System

Administration & Hardware Installation and maintenance certification Contractor shall possess experience with installation and maintenance of Bosch

& Linux video recording systems and Bosch CCTV

Contractor shall possess and maintain Information Assurance Technical (IAT) Level II certification as required by DoD Directive 8570.01-M for the work being performed (Security+ requirement)

Contractor shall be experienced in portal electrical latch assemblies Contractor shall be experienced with TOA call box installation and maintenance Contractor shall possess electronics repair capability

3.1.3 Description

Contractor shall follow all approved NASIC policies, processes and procedures Contractor shall maintain and administer NASIC’s Access Control System (ACS), to include all cameras, recorders, remote access units, turnstiles, portal electrical latch assemblies, servers and associated database

Contractor shall provide monthly preventive maintenance schedule is conducted for non-emergency requirements including servers, storage devices, controllers, database backup, and door hardware support.

Contractor shall provide updates to portal tables, access permissions, user accounts, roles, mapping, workspace, and devices for ACS and IDS.

Contractor shall install portal devices using OEM best practices Contractor shall provide non-emergency maintenance completed within approved schedule downtime Contractor shall provide emergency or critical maintenance completed within approved time period Contractor shall ensure defective parts are documented and sent to the vendor for repair Contractor shall ensure vendor repairs are received and tested and returned to

Government bench stock Contractor shall ensure warranty repairs are installed and tested then the devices are returned to operation service for redistribution to the customers Contractor shall provide firmware updates, configurations, and portal assignments.

Contractor shall provide Sonic Crypto/Cisco switches support to included rekeying/assigning IP addresses/subnet Contractor shall install and support over 64 fixed and PTZ Bosch internal and external Cameras Contractor shall support 8 digital recorders Contractor shall provide maintenance of CCTV distribution network, including remote monitoring stations Contractor shall support CCTV alarm call-ups and presets Contractor shall provide Installation and maintenance of multi-vendor

“Omega/Fastlane” turnstile support Contractor shall support NASIC turnstiles which are ingress/egress devices which activate a barrier device during violation to control entrance or exit from the facility

Contractor shall provide Windows/SQL Hardware/Administration support to include software updates, license software changes, update to antivirus application, installation of OEM software updates and patches, executing scripts to add/delete/modify accounts, fields, Organizational Units, filters, and General Policy Object coverage, updating hostnames, internet protocol (IP) numbers and managing IP assignments, changes, conflicts, resolutions, providing SQL

Administration support to review for possible failures or database corruption, proper backup and restore operation, Domain Name Service configuration integration and Network integration services

Contractor shall provide maintenance for Diebold LINX Predator Elite to include database maintenance support for SQL Server like database changes and recover, software updates, bug fixes and patches, OS updates and support, event log and hardware failure monitoring, system backups and mirroring support and configuration control.

Contractor shall provide DAQ StarWatch SMS Enterprise Maintenance to include database maintenance support for SQL Server like database changes and recovery, software updates, bug fixes and patches, OS updates and support, event log and hardware failure monitoring, daily system backups and mirroring support and configuration control

Contractor shall install and maintain the vehicle gate and pedestrian gate control Contractor shall install and maintain the TOA call box for entry point to guard post communication system Contractor shall maintain architectural diagrams and shall document all installations/changes in accordance with NASIC guidance Contractor shall maintain list of equipment associated with this functional area Contractor shall provide monthly functional area reports summarizing work accomplished, work planned in next month and important issues occurring during the month

4 Cyber Security The contractor shall ensure that all system or application deliverables meet the requirements of DoD and AF Information Assurance (IA) policy. Furthermore, the contractor shall ensure that personnel performing IA activities obtain, and remain current with, required technical and/or management certifications.

4.1 System IA

For those solutions that will not inherit existing network security controls, and thus integrate an entirely new application system consisting of a combination of hardware, firmware and software, system security assurance is required at all layers of the TCP/IP DoD Model. The contractor shall ensure that all system deliverables comply with DoD and AF IA policy, specifically DoDI 8500.2, Information Assurance Implementation, and AFI 33-200, Information Assurance Management. To ensure that IA policy is implemented correctly on systems, contractors shall ensure compliance with DoD and AF Certification & Accreditation policy, specifically DoDI 8510.01, DoD Information Assurance Certification and Accreditation Process (DIACAP), and AFI 33-210, Air Force Certification and Accreditation Process (AFCAP). The contractor shall also support activities and meet the requirements of DoDI 8520.02, Public Key Infrastructure (PKI) and Public Key (PK) Enabling, in order to achieve standardized, PKI-supported capabilities for biometrics, digital signatures, encryption, identification and authentication.

4.1.1 Application IA

For those solutions that will be deployed to Infrastructure as a Service (IaaS), Platform as a Service (PaaS) or similar environments, and thus inherit existing network security controls, application security assurance is required at the Application layer of the TCP/IP DoD Model. The contractor shall ensure that all application deliverables adhere to Public Law 111-383, which states the general need for software assurance. Specifically, the contractor shall ensure that all application deliverables comply with the Defense Information Systems Agency (DISA) Application Security & Development Security Technical Implementation Guide (STIG), which includes the need for source code scanning, the DISA Database STIG, and a Web Penetration Test to mitigate vulnerabilities associated with SQL injections, cross-site scripting, and buffer overflows.

The contractor shall also support activities and meet the requirements of DoDI 8520.02, Public Key Infrastructure (PKI) and Public Key (PK) Enabling, in order to achieve standardized, PKI-supported capabilities for biometrics, digital signatures, encryption, identification and authentication.

4.1.2 Personnel IA

Personnel performing Information Assurance (IA) activities are required to obtain, and remain current with, technical and/or management certifications to ensure compliance with DoD 8570.01-M, Information Assurance Workforce Improvement Program, 19 December 2005 (with all current changes).

5 CONTRACTUAL REQUIREMENTS

5.1 Place of Performance

All work shall be performed at Wright Patterson Air Force Base (WPAFB), Fairborn, Ohio, and Springfield Air National Guard Base. The majority of provided support shall occur at NASIC’s primary facility comprised of contiguous buildings 10859, 10856, 10858, 10822, 10828 and 10829, and 280. On-site support shall also be required at other locations on WPAFB. Many of the Center’s buildings are multi-story structures.

5.2 Normal Hours of Operation

Work will be performed 40 hours per week per contractor during core Center hours (0600-1800), Monday-Friday, excluding Federal holidays. Exceptions are detailed in Section 3. In particular, the CFP shall be manned 24/7.

On-Call: ___No X Yes In the event an emergency is declared for WPAFB necessitating the implementation of an alternate work schedule (other than a standard 8-hour day, Monday-Friday work week), services provided under this contract may require implementation of an alternate work schedule, not to exceed a 40-hour work week. The Contracting Officer (or the CO’s designated representative) will make notification to the Contractor point of contact.

A modified work schedule will be adopted for the duration of the declared emergency, and the Contractor shall comply with the provisions of that alternate work schedule.

5.3 Government Furnished Property

GFP Provided? _X__ No ___ Yes

The Government will provide the following:

Office environment including desks, chairs, computers (Windows desktops or Unix workstations) as necessary to perform work function, access to non-secure phone system, access to secure phone system, badges for accessing WPAFB and building access badges. Some contractor personnel (primarily those involved in equipment installation and maintenance) shall share desks, computers and phones. The government shall also provide secure locations for storage of tools and personal items such as coats, work shoes, etc.

5.4 Billable Hours

There may be occasions when support contractors are invited to participate in morale and recreational activities (i.e., holiday parties, golf outings, sports days and other various social events). Contractor employees shall not be directed to attend such events by the Government. Since a contract employee is not a government employee, the contract employee cannot be granted the same duty time activities as Government employees. Participation in such events is not billable to the TO and contractor employee participation should be IAW the employee’s company’s policies and compensation system.

5.5 Non-Personal Services

The Government will neither supervise contractor employees nor control the method by which the contractor performs the required tasks. Under no circumstances shall the Government assign tasks to, or prepare work schedules for, individual contractor employees. It shall be the responsibility of the contractor to manage its employees and to guard against any actions that are of the nature of personal services, or give the perception of personal services. If the contractor feels that any actions constitute, or are perceived to constitute personal services, it shall be the contractor’s responsibility to notify the TO Contracting Officers CO and COR immediately. These services shall not be used to perform work of a policy/decision making or management nature, i.e., inherently Governmental functions. All decisions relative to programs supported by the contractor shall be the sole responsibility of the Government. These operating procedures may be superseded by Theater Commander’s direction during deployments.

5.6 Contractor Identification

All contractor/subcontractor personnel shall be required to wear AF-approved or provided picture identification badges so as to distinguish themselves from Government employees. When conversing with Government personnel during business meetings, over the telephone or via electronic mail, contractor/subcontractor personnel shall identify themselves as such to avoid situations arising where sensitive topics might be better discussed solely between Government employees. Contractors/subcontractors shall identify themselves on any attendance sheet or any coordination documents they may review. Electronic mail signature blocks shall identify their company affiliation.

Where practicable, contractor/subcontractors occupying collocated space with their Government program customer should identify their work space area with their name and company affiliation.

5.7 Performance Reporting

The contractor’s task order performance will be monitored by the Government and reported in Contractor Performance Assessment Reports (CPARs) or a Customer Survey, depending on the dollar amount of the task order. Performance standards shall include the contractor’s ability to provide or satisfy the following:

Provide satisfactory solutions to requirements with the necessary customer support

Provide solutions and services that meet or exceed specified performance parameters

Deliver timely and quality deliverables to include accurate reports and responsive proposals

Ensure solutions to requirements are in compliance with applicable policy and regulation

5.8 Program Management

The contractor shall identify a contract Program Manager (i.e., Project Manager or Project Lead) who shall be the primary representative responsible for all work awarded under the IDIQ contract, participating in Program Management Reviews and ensuring all standards referenced herein are adhered to. Contractor shall ensure quality and accuracy of responsibilities performed under section 3.0 of each task order. The contractor shall use key performance parameters to monitor work performance, measure results, ensure delivery of contracted product deliverables and solutions, support management and decision-making and facilitate communications. The contractor shall identify risks, resolve problems and verify effectiveness of corrective actions. The contractor shall institute and maintain a process that ensures problems and action items discussed with the Government are tracked through resolution and shall provide timely status reporting. Results of contractor actions taken to improve performance shall be tracked, and lessons learned incorporated into applicable processes. The contractor shall establish and maintain a documented set of disciplined, mature, and continuously improving processes for administering Task Order efforts with an emphasis on cost-efficiency, schedule, performance, responsiveness, and consistently high-quality delivery. The contractor shall provide transition plans as required.

Contractor shall provide their organizational chart to the COR to document which contract personnel by-name are supporting each required mission area/task. It should be updated monthly and submitted as part of the Functional Area Report (CDRL A001).

Contractor shall provide a Funds and Man-hours Expenditure Report (CDRL A002) and a Contract Funds Status Report (CDRL A003) NLT 10th of each month.

Contractor shall be trained in basic customer services and customer relations and possess a proven ability to resolve problems efficiently and effectively while recognizing customers’ competence levels and approaching each level appropriately. Contractor shall possess a proven ability to balance, prioritize and organize multiple tasks.

5.8.1 Task Order Manager

A task order manager shall be assigned for each task order under this IDIQ contract.

The task order manager for this task order will operate in a team lead capacity; as primary interface for customer requirements, delegates’ tasks, and manages work-load for other contractors. The task order manager participates and represents responsibilities covered under section 3 of this PWS. Tasks including but not limited to initiation of architecture changes, solution proposal, and customer requirement management will be handled in accordance with defined processes. The contractor shall ensure that all core and non-core hours are covered (if required), ensure coverage during long-term contractor absences and provide weekly status reports back to the contract program manager.

5.8.2 Contractor Vacancies

When a contractor is out due to injury, illness, off-duty assignment (e.g. reserve duty) of an extended nature (i.e. 2 weeks or more) the contractor must address how that function will be accomplished during the absence.

5.8.3 Services Delivery Summary

Reference Section 6, Services Delivery Summary, of this Task Order PWS for specific performance objectives.

The contractor’s performance at the contract level will be assessed quarterly by a process that measures success towards achieving defined performance objectives. The Services Delivery Summary will be in accordance with AFI 63-101, Acquisition and Sustainment Life Cycle Management, AFI 10-601, Capabilities-Based Requirements Development and FAR Subpart 37.6, Performance-Based Acquisition.

5.8.4 Documentation and Data Management

The contractor shall establish, maintain, and administer an integrated data management system for collection, control, publishing, and delivery of all program documents. The data management system shall include but not be limited to the following types of documents: CDRLs, White Papers, Status Reports, Audit Reports, Agendas, Presentation Materials, Minutes, Contract Letters, and Task Order Proposals. The contractor shall provide the Government with electronic access to this data, including access to printable reports.

5.8.5 Records, Files, and Documents

All physical records, files, documents, and work papers, provided and/or generated by the Government and/or generated for the Government in performance of this PWS, maintained by the contractor which are to be transferred or released to the Government or successor contractor, shall become and remain Government property and shall be maintained and disposed of IAW AFMAN 33-363, Management of Records; AFI 33-364, Records Disposition – Procedures and Responsibilities; the Federal Acquisition Regulation, and/or the Defense Federal Acquisition Regulation Supplement, as applicable. Nothing in this section alters the rights of the Government or the contractor with respect to patents, data rights, copyrights, or any other intellectual property or proprietary information as set forth in any other part of this PWS or the Application Services contract of which this PWS is a part (including all clauses that are or shall be included or incorporated by reference into that contract).

5.8.6 Personnel Security

Individuals performing work under these task orders shall comply with applicable program security requirements as stated in the task order.

This task order requires personnel to have a Top Secret Sensitive Compartmented Information (SCI) clearance for which SCI eligibility will be required.

The Contract Security Classification Specification (DD Form 254) will be at the basic contract and task order level and will encompass all security requirements. All contractors located on military installations shall also comply with Operations Security (OPSEC) requirements as set forth in DoD Directive 5205.02, Operations Security Program and AFI 10-701, Operations Security. All contractors shall also follow COMSEC and TEMPEST regulations. In accordance with DoD 5200.2-R, Personnel Security Program (Jan 87), DoD military, civilian, consultants, and contractor personnel using unclassified automated information systems, including e-mail, shall have, at a minimum, a completed favorable National Agency Check plus Written Inquiries (NACI).

5.8.6.1 Transmission of Classified Material

The contractor shall transmit and deliver classified material/reports IAW the National Industrial Security Program Operating Manual (DoD 5220.22-M). These requirements shall be accomplished as specified in this task order. (IAW AFI 16-1404, Air Force Information Security Program)

5.8.6.2 Protection of System Data

Unless otherwise stated in the task order, the contractor shall protect system design-related documents and operational data whether in written form or in electronic form via a network in accordance with all applicable policies and procedures for such data, including DoD Regulation 5400.7-R and DoD Manual 5200.01(v1-v4) to include latest changes, and applicable service/agency/ combatant command policies and procedures.

The contractor shall protect system design related documents and operational data at least to the level provided by Secure Sockets Layer (SSL)/Transport Security Layer (TSL)-protected web site connections with certificate and or user ID/password-based access controls. In either case, the certificates used by the Contractor for these protections shall be DoD or IC approved Public Key Infrastructure (PKI) certificates issued by a DoD or IC approved External Certification Authority (ECA) and shall make use of at least 128-bit encryption.

5.8.6.3 System and Network Authorization Access Requests

For Contractor personnel who require access to DoD, DISA, or Air Force computing equipment or networks, the Contractor shall have the employee, prime or subcontracted, sign and submit a System Authorization Access Report (SAAR), DD Form 2875.

5.8.7 Travel Contractor Line Item (CLIN)

The contractor shall coordinate specific travel arrangements with the individual Contracting Officer or Contracting Officer’s Representative to obtain advance, written approval for the travel about to be conducted. The contractor’s request for travel shall be in writing and contain the dates, locations and estimated costs of the travel.

If any travel arrangements cause additional costs to the task order that exceed those previously negotiated, written approval by CO is required, prior to undertaking such travel. Costs associated with contractor travel shall be in accordance with FAR Part 31.205-46, Travel Costs. The contractor shall travel using the lower cost mode transportation commensurate with the mission requirements. When necessary to use air travel, the contractor shall use economy class or similar accommodations to the extent they are available and commensurate with the mission requirements. Travel will be reimbursed on a cost reimbursable basis; no profit or fee will be paid. A trip report is due 5 business days after travel is completed (CDRL A006).

5.8.8 Equipment and Materiel CLIN

The contractor shall identify any non-labor costs associated with the task order for break/fix and emergencies (e.g. hard drives, power supplies, motherboards, printer parts, network adapters, transceivers, cabling, keypads, connectors, video cards and other similar parts. The contractor shall have a procurement system to track and purchase these items.

5.8.9 Emergency Support CLIN

The Emergency Support CLIN may be used for additional capacity required beyond the firm-fixed price portion of this contract. The Center functions 365/24/7 and additional capacity may be required to maintain critical services in the event of unforeseen outages and/or emergencies which impacts the contractors 40 hour work week.

Approval must be obtained by the COR or ACOR prior to performing the additional hours.

Process and chain of command will be documented in accordance with Attachment TBD, titled “Process and Chain of Command—Emergency Support” which will be attached to the contract document.

Emergency Support requirements will be in support of clearly defined requirements in Section 3 of this PWS. All personnel performing Emergency Support activities shall conform to all requirements defined in the Qualifications paragraph of the functional area in which the Emergency Support activity is being performed. All Emergency Support activities shall be defined by the Description paragraph of the functional area in which the Emergency Support activity is being performed. Emergency Support will be closed when work is completed and/or funding is used up within the Period of Performance the Emergency support was turned on.

5.8.10 Training

Contractor personnel are required to possess the skills necessary to support their company’s minimum requirements of the labor category under which they are performing. Training necessary to meet minimum requirements to include certifications will not be paid for by the Government or charged to TOs by contractors. The contractor shall ensure all applicable persons receive current manufacturer/vendor/OEM training for the functional area the contractor supports (minimum 40 hours per year). Within 6 months of award of contract, at least 50% of all persons shall complete 50% of their required training; within 9 months of award of contract, at least 75% of all persons shall complete 100% of their required training; by the end of the 11 month, 100% of personnel shall have their training 100% of all training completed.

5.8.10.1 Other Government-Provided Training

The contractor’s employees may participate in other Government provided training under the following circumstances:

(1) The contractor employees’ participation is on a space-available basis,

(2) The contractor employees’ participation does not negatively impact performance of this task order,

(3) The Government incurs no additional cost in providing the training due to the contractor employees’ participation, and

(4) Man-hours spent due to the contractor employees’ participation in such training are not invoiced to the task order

5.9 VOLUNTARY PROTECTION PROGRAM (VPP):

5.9.1 Applicability: This section of the PWS applies to “Applicable Contractors” as defined below.

5.9.2 Definitions:

Applicable Contractor

A contractor whose employees worked at least 1,000 hours at the site in any calendar quarter within the last 12 months and is NOT directly supervised by the applicant (installation)

Days Away, Restricted, and or Transfer Case Incident Rate (DART).

The number of recordable injuries and illness cases per 100 full-time employees resulting in days away from work, restricted work activity, and/or job transfer that a site has experienced in a given time frame

Total Case Incidence Rate (TCIR)

Total number of recordable injuries and illness cases per 100 full-time employees that a site has experienced in a given time frame

Voluntary Protection Programs

The Voluntary Protection Program (VPP) promotes effective worksite-based safety and health. In the VPP, management, labor, and OSHA establish cooperative relationships at workplaces that have implemented a comprehensive safety and health management system. Approval into VPP is OSHA’s official recognition of the outstanding efforts of employers and employees who have achieved exemplary occupational safety and health

5.9.3 Requirements

Wright-Patterson AFB is in the process of pursuing VPP recognition or has already been recognized under the OSHA Voluntary Protection Program (VPP). VPP impacts all “applicable contractors” operating on Air Force Installations. The contractor shall be responsible for ensuring their employees and managers have a comprehensive understanding of VPP as well as full compliance with OSHA requirements. The contractor shall follow the safety and health rules of the installation or VPP site. Detailed information on VPP is available on the OSHA website at http://www/osha.gov/dcsp/vpp/index.html.

The contractor shall submit a Safety and Health Plan and corresponding site safety checklist to the Contracting Officer not later than 10 calendar days after contract award. The contractor’s plan shall include appropriate measures to ensure the contractor reacts promptly to investigate, correct, and track alleged safety and health violations and/or uncontrolled hazards in contractor work areas. The plan shall:

Demonstrate a management commitment to employee safety and health;

Identify the application of the safety and health plan to subcontractors;

Identify the roles and responsibilities of the following individuals with respect to safety and VPP: Management, Supervisors, Employees, and Safety Coordinator;

Identify applicable safety rules and regulations;

Include a worksite hazard analysis to include base-line hazard identification and required control measures;

Include a job site analysis to include hazards of tasks required to control measures;

Identify employee safety and health training requirements and the documentation process;

Include a workplace inspection frequency, to include identifying the individual conducting the inspections;

Include employee hazard reporting procedures;

Identify individual(s) responsible for corrective action of hazards;

Identify first aid/injury procedures;

Identify procedures for accident investigation and reporting;

Identify emergency response procedures; and Identify the process for tracking controlled hazards in contractor work areas.

The contractor shall submit their Total Case Incidence Rate (TCIR) and Days Away, Restricted, and or Transfer Case Incident Rate (DART) rates and OSHA Form 300A annually to the contracting office for consolidation and submission as part of the installation’s annual VPP Safety and Health Management report.

TCIR and DART rates are due by the 15th of January of each year (CDRL A005).

The contractor’s Quality Control Plan shall identify the processes and procedures the contractor will use to track compliance with the Safety and Health Plan, and the process and procedures that will be used to correct violations.

The contractor shall establish these VPP requirements for all subcontractors who qualify as applicable contractors under the resulting contract.

OPSEC requirements are necessary to reduce program vulnerability from successful adversary collection and exploitation of critical information. Contractor personnel will participate in

OPSEC program activities. OPSEC will be applied to all activities under this contract. Critical Information lists will be provided by the government. OPSEC Surveys to measure the effectiveness of the OPSEC program may be conducted by the government.

5.10 Manpower Reporting Requirements

The contractor shall report ALL contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract for the Air Force via a secure data collection site. The contractor is required to completely fill in all required data fields at http://www.ecmra.mil.

Reporting inputs will be for the labor executed during the period of performance for each Government fiscal year (FY), which runs 1 October through 30 September. While inputs may be reported any time during the FY, all data shall be reported no later than 31 October* of each calendar year. Contractors may direct questions to the CMRA help desk.

Reporting Period: Contractors are required to input data by 31 October of each year.

Uses and Safeguarding Information: Information from the secure web site is considered to be proprietary in nature when the contract number and contractor identity are associated with the direct labor hours and direct labor dollars. At no time will any data be released to the public with the contractor name and contract number associated with the data.

User Manuals: Data for Air Force service requirements must be input at the Air Force CMRA link. However, user manuals for government personnel and contractors are available at the Army CMRA link at http://www.ecmra.mil.

5.11 Data Rights and Non-Commercial Computer Software

In order to implement the provisions at DFARS 252.227-7013(b) and (e) and DFARS 252.227-7014(b) and (e) and DFARS 252.227-7017, the Contractor shall disclose to the ordering Contracting Officer and ordering office in any proposal for a task order, or after award of a task order if not previously disclosed in the proposal, any technical data or non-commercial computer software and computer software/source code documentation developed exclusively at government expense in performance of the task order. This disclosure shall be made whether or not an express requirement for the disclosure is included or not included in the PWS or solicitation for the order. The disclosure shall indicate the rights asserted in the technical data and non-commercial computer software by the Contractor and rights that would be acquired by the government if the data or non-commercial software was required to be delivered under the task order and its CDRL requirements and any cost/price associated with delivery. This disclosure requirement also applies to segregated routines of non-commercial software that may be developed exclusively at Government expense to integrate Commercial Software components or applications provided under a commercial software license or developed to enable Commercial Software to meet requirements of this Task Order. Performance of this disclosure requirement shall be considered a material performance requirement of any task order under which such technical data or non-commercial computer software is developed exclusively at Government expense.

5.12 Software Support and Data Rights

Unless specified otherwise in the Task Order, the contractor shall fully support all unique software developed to support integrated solutions on this contract. The contractor shall be able to support all software revisions deployed or resident on the system, and sub-systems. The data rights ownership/licensing guidance is specified in Defense Federal Acquisition Regulation Supplement Contract Clauses.

5.13 COTS Manuals and Supplemental Data

The contractor shall provide documentation for all systems services delivered under this Task Order. The contractor shall provide COTS manuals, supplemental data for COTS manuals, and documentation IAW best commercial practices (i.e. CD-ROM, etc.). This documentation shall include users’ manuals, operators’ manuals, maintenance manuals, and network and application interfaces if specified in the task order.

5.14 Section 508 of the Rehabilitation Act

The Contractor shall meet the requirements of the Access Board’s regulations at 36 CFR Part 1194, particularly 1194.22, which implements Section 508 of the Rehabilitation Act of 1973, as amended. Section 508 (as amended) of the Rehabilitation Act of 1973 (20 U.S.C. 794d) established comprehensive requirements to ensure: (1) Federal employees with disabilities are able to use information technology to do their jobs, and

(2) members of the public with disabilities who are seeking information from Federal sources will be able to use information technology to access the information on an equal footing with people who do not have disabilities.

6 SERVICES DELIVERY SUMMARY (SDS)

A Quality Assurance Surveillance Plan (QASP) will be developed by the government which will include the Services Delivery Summary below.

The contractor shall submit a Quality Control plan to ensure that Contractor services conform to contract requirements and standards. This shall include, but not be limited to, documented procedures, inspections, tests (taken at the point of performance) and training. The Contractor shall submit the final Quality Control Plan within 30 days after contract award.

Performance

Objective

PWS

Paragraph

Performance Threshold

Method of Surveillance

1. Architecture & Configuration Diagrams

3.1 MS-Visio, AutoCad

or other approved-format document posted to electronic

Periodic Inspection by COR, QAP or Task Manager folder NLT 3 working days after change

2. Problem Response Times

3.1 Immediate response

during core hours;

two (2) hour response during non-core hours

Periodic Inspection by COR, QAP or Task Manager

3. Adherence to policies, processes, procedures, directives and guidance

3.1 100% compliance unless waived by

COR

100% Surveillance by COR, QAP or Task Manager

4. ACS & IDS must be online

3.1 99.9% of time, 365/24/7

100% Surveillance by COR, QAP or Task Manager

7 SECURITY REQUIREMENTS

7.1 Classified Access Requirements

7.1.1 Security Facility Clearance Requirements:

The contractor must possess or obtain an appropriate facility security clearance as identified below prior to performing work on a classified government contract: (SELECT

ONE)

Top Secret (SCI) Secret

If the contractor does not possess a facility clearance the government will request one.

The contractor shall notify the installation’s Information Protection Office before on-base performance of the service. The notification shall include:

a) Name, address, and telephone number of company representatives.

b) The contract number and contracting agency.

c) The highest level of classified information which contractor employees require access to.

d) The location(s) of service performance and future performance, if known.

e) The date service performance begins.

f) Any change to information previously provided under this paragraph.

7.1.2 Personnel Security Clearance Requirements:

Personnel will require a security clearance as identified below to perform this contract:

(SELECT ONE)

Top Secret (SCI) Secret

The contractor shall request security clearances for personnel requiring access to classified information within 15 business days after receiving a facility clearance or, if the contractor is already cleared, within 15 business days after award. Due to costs involved with security investigations, contractor security clearances shall be kept to an absolute minimum necessary to perform contractual requirements.

Contractor shall possess a US Government Top Secret (TS) security clearance and granted access to sensitive compartmented information (SCI) based on an up-to-date Single Scope Background Investigation (SSBI); selected contractor personnel may be required to satisfy a Counter Intelligence polygraph requirement

7.2 Security Manager Appointment:

The contractor shall appoint a security manager for the on base long-term visitor group.

The security manager may be a full-time position or an additional duty position. The security manager shall provide contractor employees with training required by DoDM 5200.01, volumes 1-4, DoD Information Security Program, , and AFI 16-1404, AF Information Security Program . The contractor security manager shall provide initial and follow-on training to contractor personnel who work in Air Force controlled or restricted areas. Air Force restricted and controlled areas are explained in AFI 31-101, Air Force Integrated Defense.

7.3 Visit Requests:

Contractors participating in the National Industrial Security Program are authorized to use Joint Personnel Adjudication System (JPAS) in lieu of sending Visitor Authorization Letters (VALs) for classified visits to Department of Defense facilities and military installations. VALs are only required if the contractor isn’t using JPAS or if contractor personnel whom access level and affiliation are not accurately reflected in JPAS.

However, some agencies may still require VALs to be submitted for access to their facilities.

7.4 Obtaining and Retrieving Identification Media:

The contractor shall comply with the procedures outlined in AFFARS 5352.242-9000, Contractor Access to Air Force Installations. The contractor shall ensure contractor employees obtain a DOD Common Access Card (CAC) as required for contract performance in compliance with AFI 36-3026. The contractor must comply with the requirements set forth and prescribed by AFFARS 5352.242-9001, Common Access Cards for Contractor Personnel.

7.5 Identification Requirements:

The contractor shall ensure the following identification items as required for contract performance are obtained for employees:

- DoD Common Access Card (AFI 36-3026).

- Base-specific identification as required by local base and/or building security policies

7.6 Visitor Group Security Agreement (VGSA):

The contractor shall enter into a long-term visitor group security agreement for contract performance on base. This agreement shall outline how the contractor integrates security requirements for contract operations with the Air Force to ensure effective and economical operation on the installation. The agreement shall include:

a. Security support provided by the Air Force to the contractor shall include storage containers for classified information/material, use of base destruction facilities, classified reproduction facilities, use of base classified mail services, security badging, base visitor control, investigation of security incidents, base traffic regulations and the use of security forms and conducting inspections required by DoD 5220.22-R, Industrial Security Regulation, Air Force Policy Directive 31-6, Industrial Security, Air Force Instruction 31- 601, Industrial Security Program Management, DoDM 5200.01, volumes 1-4, DoD Information Security Program, and AFI 16-1404, Information Security Program .

b. Security support requiring joint Air Force and contractor coordination includes packaging classified information, mailing and receiving classified materials, implementing emergency procedures for protection of classified information, security checks and internal security controls for protection of classified material and high-value pilferable property.

c. On base, the long-term visitor group security agreement may take the place of a Standard Practice Procedure (SPP).

7.7 Information Security:

The contractors performing duties associated with this task order must adhere to all the standards for protecting classified information as specified in DoDM 5200.01, volumes 1- 4, DoD Information Security Program, Air Force Instruction 16-1404, Information Security Program and all applicable supplements and operating instructions.

7.8 Computer and Network Access Requirements:

Contractor personnel working on this contract must be designated in one of the below IT positions and complete the required security investigation to obtain the required security clearance. This must be accomplished before operating government furnished computer workstations or systems that have access to Air Force e-mail systems or computer systems that access classified information. The contractor shall comply with the DoD 5200.2-R, Personnel Security Program and AFI 33-119, Air Force Messaging, requirements.

(Please check one):

AIS-I Position - Critical-Sensitive Positions. Security Clearance: TOP SECRET based on SSBI background investigation. Responsible for the planning, direction, and implementation of a computer security program; major responsibility for the direction, planning and design of a computer system, including the hardware and software; or, can access a system during the operation or maintenance in such a way, and with a relatively high risk for causing grave damage, or realize a significant personal gain.

AIS-II Position - Noncritical-Sensitive Positions. Security Clearance:

SECRET based on a NACLC/ANACI background investigation. Responsibility for systems design, operation, testing, maintenance, and/or monitoring that is carried out under technical review of higher authority in the AIS-I category, includes, but is not limited to; access to and/or processing of proprietary data, information requiring protection under the Privacy Act of 18 1974, and Government-developed privileged information involving the award of contracts.

AIS-III Position - Nonsensitive Positions. No security clearance required but is a Trusted Position based on NACI background investigation. All other positions involved in U.S. Government computer activities.

7.9 Reporting Requirements:

The contractor shall comply with requirements from AFI 71-101, Volume-1, and Criminal Investigations, and Volume-2 Protective Service Matters. Contractor personnel shall report to an appropriate authority (NASIC/SO) any information or circumstances of which they are aware may pose a threat to the security of DoD personnel, contractor personnel, resources, and classified or unclassified defense information. Contractor employees shall be briefed by their immediate supervisor upon initial on-base assignment and as required thereafter.

7.10 Physical Security:

Contractor employees shall comply with base Operations Plans/instructions for FPCON procedures, Random Antiterrorism Measures (RAMS) and Operation Security (OPSEC), Emergency Management (EM) and local search/identification requirements. The contractor shall safeguard all government property including controlled forms provided for contractor use. At the close of each work period, government training equipment, facilities, support equipment, and other valuable materials shall be secured.

7.11 Wireless Electronic Devices:

The following devices are not allowed in areas where classified information is discussed, briefed, or processed to include but not limited to: cell phones, camera cell phones, cordless telephones, wireless microphones, wireless keyboards, wireless mice, wireless or Infrared Local Area Networks (LANs). The term “Area” above refers to a room and/or to a space the size of a 3-meter radius sphere, centering on the classified source.

7.12 Operating Instructions:

The contractor will adhere to all Air Force activity Operating Instructions (OI), NASIC, and local Security Program Management for internal circulation control, protection of resources and to regulate entry into Air Force controlled areas during normal, simulated and actual emergency operations to include local written OIs.

7.13 Access to Locked Facilities:

7.13.1 Key Control

The contractor will adhere to the Air Force activity Operating Instructions Key Control, procedures if provided a key. Contractor must properly safeguard all keys and not allow any unauthorized personnel to have access to the keys. The contractor shall not duplicate keys issued by the government.