R1001_Atch_01_-_AFLCMC_Unique_IT_Support_PWS_28Dec2017R2.pdf

Performance Work Statement (PWS) Unique Information Technology (IT) Support

Air Force Life Cycle Management Center (AFLCMC) Chief Information Technology Office (CITO) 28 December 2017

Page i

TABLE OF CONTENTSTABLE OF CONTENTS

1.0 DESCRIPTION OF SERVICES

1.1 Introduction

1.2 Scope

1.3 Tasks

1.4 Top Secret Facility Clearance

1.5 Contract Management and Administration

1.6 Deliverables and Acceptance

1.7 Voluntary Protection Program

1.8 Regulations and Guidance

2.0 SERVICES SUMMARY

2.1 Description

3.0 PERFORMANCE OBJECTIVES

3.1 Contractor Performance

4.0 GOVERNMENT SUPPLIED BASE FACILITIES, EQUIPMENT, SUPPLIES,

AND SERVICES

4.1 Government Furnished Facilities, Equipment, Supplies, and Services

4.2 Manuals, Texts, Briefs, Etc

4.3 Government Furnished Software

4.4 ITEC Equipment Receipt

4.5 Contractor Liability

5.0 GENERAL INFORMATION

5.1 Security

5.2 Data Protection and Non-Disclosures

In/Out Processing

5.3 Location of Work

5.4 Temporary Duty (TDY)/Travel

5.5 Work Hours

5.6 Performance of Services During Crisis Declared by the National Command Authority or Overseas Combatant Commander

5.7 Installation Traffic and Parking Code

5.8 Force Protection Condition (FPCON) Checks

5.9 Quality Control

5.10 Quality Assurance

5.11 Transition

FA8604-18-R-1001

PWS for AFLCMC Unique IT Support

Page ii

APPENDIX A: Contract Data Requirements List (CDRL)

APPENDIX B: Governing Regulations

APPENDIX C: Glossary of Acronyms

1.0 DESCRIPTION OF SERVICES

1.1 Introduction

The mission of the Air Force (AF) Life Cycle Management Center (AFLCMC) is to acquire and support war-winning capabilities, and to provide the Warfighter’s Edge. The Chief Information Technology Office (CITO), in support of AFLCMC, provides a Center-wide focus to the AFLCMC Information Technology (IT) business mission. The CITO provides strategic direction for AFLCMC through execution of IT plans, policies, and requirements and through the introduction of new technological solutions for use across AFLCMC.

1.2 Scope

The scope of this acquisition is to provide all personnel, supervision, and services necessary to accomplish organizational unique Communications and Information (C&I) Systems support for AFLCMC Wright Patterson Air Force Base organizations for Information Technology (IT) functions considered to be outside the definition of core services. The specific support required is outlined in Paragraph 1.3 of this Performance Work Statement (PWS).

The contractor shall execute all work under this contract from a customer, AFLCMC corporate, and Air Force Materiel Command (AFMC) enterprise network perspective. The contractor shall share information, best practices, standardized processes, and standardized configuration and disseminate information across AFLCMC for projects accomplished under this contract.

This effort will include work at AFLCMC organizations located at Wright-Patterson Air Force Base. Task orders (TOs) will be issued to acquire the unique IT support services required by each AFLCMC organization.

1.3 Tasks

The functional tasks required for this contract are as follows:

1.3.1 Interaction with the CITO

1.3.1.1 The contractor shall communicate and collaborate with the government Point of Contact (POC) and Contracting Officer’s Representative (COR) to understand goals and objectives and ensure the CITO goals and objectives are met. This will allow AFLCMC to operate more effectively, create and gain efficiencies and meet AFLCMC information management program goals and, consequently, AFLCMC strategic goals.

1.3.1.2 To meet emerging technology, e-business, and standard requirements as implemented by the Department of Defense (DoD), the AFMC, AFLCMC, the local installation Communications Group (CG), and the CITO, the contractor shall provide functional administrative support for the migration of existing organizational owned/operated applications, databases, and web content servers for new initiatives such as:

a) web server consolidation;

b) Regional Data Centers;

c) helpdesk tools (e.g. Remedy, XACTA);

d) secure communications (e.g. Voice over Internet Protocols (VoIPs), Verifiable

Integrated Processors for Enhanced Reliability (vIPERS), Voice over Secure Internet Protocol (VoSIP));

e) Information Technology Service Management (ITSM);

f) Secret Internet Protocol Router Network (SIPRNet) consolidation;

g) Joint Worldwide Intelligence Communications System (JWICS) consolidation;

h) cloud computing;

i) electronic records management solutions;

j) workflow solutions;

k) video teleconferencing (VTC);

l) AFMC standard configuration; and

m) other downward-directed initiatives and solutions.

1.3.1.3 The contractor shall support IT planning and investment governance through the architecture and portfolio management (PfM) processes. The architecture process will define the standard operating configuration required to fulfill the elements of AFMC’s mission supported by IT and the AFMC application review and consolidation (ARC) for standard tools.

1.3.1.4 The contractor shall: work with each AFLCMC organization’s appointed government POC to:

a) identify all organizationally-developed IT investments (i.e. applications, tools, infrastructure, and services), regardless of funding organization and/or appropriation type;

b) update related data for organizational applications supported under this contract that are identified as portfolio items in including but not limited to the Enterprise Information Technology Data Repository (EITDR), Investment Portfolio Suite

(ITIPS)`;

c) fill out capital investment reports (CIRs) in support of AFLCMC and AFMC; and

d) perform other data calls as required (Contract Data Requirements List (CDRL)

A0002).

1.3.1.5 The contractor shall develop and maintain standard support processes and procedure checklists for all applicable C&I support processes supported under this contract.

1.3.1.6 The contractor shall support the CITO governance process for review of new requirements and periodic assessment of the functionality of requirements supported under this contract. The contractor shall support the Information Technology Resource Group (ITRG) review process by presenting recommendations for new software, processes, initiatives, and requirements to the ITRG representative for inclusion on the ITRG agenda.

1.3.1.7 The contractor shall communicate and collaborate with the ITRG representative and the COR to understand CITO goals and objectives and to ensure that these goals and objectives are met. This will allow AFLCMC to operate more effectively, create and gain efficiencies, and meet AFLCMC information management program goals, and, consequently, AFLCMC strategic goals.

1.3.2 Project Management

1.3.2.1 The contractor shall plan, coordinate, schedule, track, and report on projects and functions supported under this contract using a government POC-approved tool, such as a SharePoint task list (CDRL A0010). The tracker shall include a minimum of the following elements: requestor, date requested, application or software toolset, requested modification, assigned technician, and suspense and closure dates.

1.3.2.2 The contractor shall conduct communications and computer system analyses, special studies, and process reviews as directed by the government. The contractor shall prepare technical reports and/or briefings, as requested by the government, to document and integrate study results (CDRLs A0002, A0009, and A0010).

1.3.2.3 The contractor shall, on request provide project status and address cost, schedule, and performance status of application development, command changes, new initiatives, and program-specific IT issues for functions supported under this contract (CDRL A0010).

1.3.2.4 The contractor shall provide application software project management support for in-house application software systems and databases supported under this contract, including:

a) responding to applicable suspenses;

b) requirements reviews;

c) briefing preparation and presentation;

d) system demonstrations;

e) analysis of alternatives, and

f) cost/schedule/performance status reporting (CDRL A0010).

1.3.2.5 The contractor shall assist the facility manager with planning and executing C&I system requirements resulting from building renovation, furniture upgrades, and personnel relocations.

1.3.3 Customer Support and Helpdesk Interaction

1.3.3.1 The contractor shall utilize the government approved helpdesk tool(s) (e.g. Remedy) which integrates problem reports and change requests associated with functions supported under this contract. The contractor shall: monitor the tool for assigned tickets; respond to user problem calls; identify and implement remedies to problems reported by the using population; and update the tool with status and resolution information. The contractor shall be required to create helpdesk tickets when exercising tasks that require Air Force network (AFNET) Federated Administrative rights (CDRL A0002).

1.3.3.2 The contractor shall develop or utilize a standardized process to manage the periodic checkout of portable computing devices (e.g. laptops, commercial mobile technology (CMT) devices, projectors, and web/digital cameras). Customer requests shall be processed within two (2) working days for contiguous United States (CONUS) devices. For outside the contiguous United States (OCONUS) devices, customer requests shall be processed within five (5) working days.

1.3.3.3 The contractor shall schedule and maintain records on IT equipment checkout and provide the necessary training on their use.

1.3.3.4 The contractor shall validate all access requests for computer, network, application, and SharePoint resources and monitor the change requests through closure. The contractor shall coordinate with the enterprise service desk (ESD) regarding access and systems management and provide user assistance as needed.

1.3.4 Information Systems Security

1.3.4.1 The contractor shall provide dedicated server and desktop support within the sensitive compartmentalized information facility (SCIF), special access program (SAP) facility (SAPF) and secret collateral secure room environments. This includes Non-classified Internet Protocol Router Network (NIPRNet), and classified networks, including, but not limited to SIPRNet, sensitive compartmented information network (SCINET), JWICS, and standalone functions both within and outside special access required (SAR) environments for customers supported under this contract. The contractor shall coordinate in writing, with the organization's government POC, if applicable, regarding any and all SAR support. The contractor shall identify to the COR, in writing, the dedicated support personnel per secure facility (CDRL A0010).

1.3.4.2 The contractor shall provide and identify to the COR a separate primary POC for each system supported, e.g. a SIPR POC, JWICS POC, SAR POC, etc. (CDRL A0008).

1.3.4.3 The contractor shall perform the duties of the Information System Security Manager (ISSM), Information System Security Officer (ISSO), and Cybersecurity Liaison (CL) for all organizational stand-alone computer devices, local area networks (LANs),enclaves, GOTS applications, and all computing devices connected to the AFNET via the NIPRNet, SIPRNet, commercial or DoD-authorized cloud-based network infrastructures, in accordance with (IAW) AFMAN 17-1301, Computer Security (COMPUSEC), dated 10 February 2017.

1.3.4.4 The contractor shall assist in ensuring all systems and networks supported meet DoD, USAF, AFMC, AFLCMC, and local security requirements, including but not limited to:

a) AFMAN 17-1201, User Responsibilities and Guidance for Information Systems, dated 22 March 2017;

b) Air Force Instruction (AFI) 17-130, Cybersecurity Program Management, dated 31

Aug 2015; and

c) AFI 17-101 Risk Management Framework (RMF) for Air Force Information

Technology, dated 2 February 2017.

In compliance with the requirements listed above, the contractor shall:

a) Assist in ensuring the organization is compliant with all network and computer security policies;

b) document security violation reports; and

c) identify and correct known vulnerabilities for all organizational communications devices, including wireless communications devices, stand-alone computing devices, classified enclaves and classified stand-alone networks, in addition to those connected to the AFNET via NIPRNet, SIPRNet, and/or commercial or DoD-authorized cloud-based network infrastructures.

1.3.4.5 The contractor shall work with the organizational government POC, to prepare, update, and maintain Certification and Accreditation (C&A) and Risk Management Framework documentation using the USAF-directed systems (e.g. Enterprise Mission Assurance Support Service (eMASS), XACTA, Air Force SAP Assessment and Authorization Tool (AFSAAT)), IAW, but not limited to, the following:

a) Joint Special Access Program (SAP) Implementation Guide (JSIG), Risk

Management Framework (RMF), dated 11 April 2016;

b) Joint Special Access Program (SAP) Implementation Guide (JSIG), 11 April 2016;

c) National Institutes of Standards and Technology’s (NIST) RMF, dated February

2010;

d) the Federal Information Security Modernization Act (FISMA) of 2014;

e) DoD Instruction (DoDI) 8500.01, Cybersecurity, dated 14 March 2014;

f) DoDI 8510.01, Risk Management Framework (RMF) for DoD Information

Technology (IT), dated 12 March 2014;

g) AFI 17-130, Cybersecurity Program Management, dated 31 August 2015;

h) AFI 17-101 Risk Management Framework (RMF) for Air Force Information

Technology, 2 February 2017,; and/or

i) other applicable DoD, USAF, AFMC, AFLCMC, and/or local accreditation policies.

C&A documentation is required for, but is not limited to, the following:

a) video teleconferencing (VTC);

b) unclassified and classified stand-alone systems;

c) organizational unique software tools;

d) Government-Off-the-Shelf (GOTS) applications;

e) networked and stand-alone LANs; and/or

f) enclaves (CDRLS A0002 & A0003).

1.3.4.5.1 The contractor shall provide this documentation to the government POC, as required (CDRLs A0002 and A0010).

1.3.4.6 The contractor shall inform the organizational government POC, of any changes to the system that affect the currency of the C&A and RMF authority to operate.

1.3.4.7 The contractor shall perform security safeguards, procedures, auditing, and inspection duties to assure compliance with:

a) DoDI 8510.01, Risk Management Framework (RMF) for DoD Information

Technology (IT), dated 12 March 2014;

b) Joint Special Access Program (SAP) Implementation Guide (JSIG), 11 April

2016;

c) DoDI 8510.01, RMF for DoD IT, dated 12 March 2014;

d) AFI 16-1404, AFMC Supp, Air Force Information Security Program, dated 17

February 16;

e) Intelligence Community Directive (ICD) Number 503 (ICD503), Intelligence

Community Information Technology Systems Security Risk Management, Certification, and Accreditation, dated 15 September 2008;

f) other risk management guidelines;

g) C&A and RMF guidelines; and

h) other applicable DoD, USAF, AFMC, AFLCMC, and/or local policies.

Inspection reports and responses shall be coordinated with the government POC. All IA/cybersecurity reports, tasking responses, and cybersecurity action items will be coordinated with the government POC (CDRL A0010).

1.3.4.8 The contractor shall provide information security support, including development and technical review of System Security Plans (SSPs), etc.; and security management duties for unclassified and classified systems, and applications supported under this task (CDRLs A0002 and A0010).

1.3.4.9 The contractor shall ensure the SAR systems, as determined by the government IAM, have an SSP developed in the format of:JSIG’s RMF, dated 11 April 2016, ensuring continual monitoring and updating of the JSIG RMF documentation, (CDRLs A0002 and A0010).

1.3.4.10 The contractor shall perform remanence security IAW AFMAN 17-1301, Computer Security (COMPUSEC), dated 10 February 2017, while working with the organizational IT equipment custodian (ITEC). The ITEC shall work with the ISSO/CL to ensure the computer systems’ memory and other storage media are wiped and certified.

1.3.4.10.1 Methods and Procedures Technical Orders (MPTO) 00-33B-5008, Remanence Security for Information Systems; and AFMAN 17-1301, Computer Security (COMPUSEC), dated 10 February 2017, provide policy, guidelines, and procedures for clearing and sanitizing computer systems memory and other storage media for release outside of and for reuse within controlled environments.

1.3.4.11 The contractor shall establish controls to ensure users operate, maintain, and dispose of information systems according to the current system security policy and existing policies and procedures. The contractor shall ensure the system security policy for each information system is available to all users.

1.3.4.12 The contractor shall ensure that procedures are in place for users to notify the ISSO/CL, Security Manager, or alternate, if problems arise during critical or classified processing.

1.3.4.13 The contractor shall implement the organizational COMPUSEC program, ensuring compliance with all DoD, USAF, AFMC, AFLCMC, or organizational supplements.

The ISSO/CL shall ensure that all applicable actions are being accomplished.

1.3.4.14 The contractor shall report suspected vulnerabilities and security incidents IAW: AFI 17-100, Air Force Information Technology (IT) Service Management, dated 16 September 2014; AFI 16-1404, AFMC Supplement 1, Air Force Information Security Program, 17 February 2016; and AFMAN 17-1301, Computer Security (COMPUSEC), dated 10 February 2017; as well as through the government POC.

1.3.4.15 Upon detecting a suspected or verified incident, the contractor shall immediately notify the primary recipient according to the guidance in MPTO 00-33B-5007, Security Incident Management for Information Systems. Malicious logic reports shall be prepared according to the guidance in AFMAN AFI17-210_AFGM2016-01, the Air Force Guidance Memorandum (AFGM) to AFMAN 17-1301, Computer Security (COMPUSEC), dated 10 February 2017.

1.3.4.16 The contractor shall audit user access and privilege levels as directed by the government POC. Audit information shall be stored IAW paragraph 1.3.16.1 in this document.

1.3.4.17 The contractor shall process all access requests for host systems (e.g. Automated Business Services System (ABSS)), and follow-up change requests. The contractor shall coordinate with the host systems service desk regarding access and systems management of the host systems for users, and provide user assistance as needed.

1.3.4.18 The contractor shall operate IAW the local installation Operating Instruction (OI) and with the latest DoD, USAF, AFMC, AFLCMC, and local directives, policies, instructions and/or supplements.

1.3.4.19 The contractor shall monitor information systems activities to ensure system integrity and perform system access or revocation tasks.

1.3.4.20 The contractor shall establish appropriate restrictions on shared use of programs or files.

1.3.4.21 The contractor shall coordinate with the organization’s government POC, to promote user awareness concerning unauthorized or illegal use of computer hardware and software. The contractor shall ensure organizations do not use freeware, shareware, or public domain software until approved for use (CDRL A0010).

1.3.4.22 The contractor shall provide USAF portal and SharePoint administration support to include the development or maintenance of sites consistent with government personnel direction.

1.3.4.23 The contractor shall provide support for initial set-up/configuration, troubleshooting, and turn-in for all organizational mobile devices (e.g. laptops, CMT, etc.) IAW AFI 10-712 Cyberspace Defense Analysis (CDA) Operation and Notice and Consent Process, dated 17 December 2015.

1.3.4.24 The Contractor shall provide technical assistance and support to personnel requiring access to DoD SIPRNet hosts. Support requires SIPRNet administrative privileges and shall include assisting with and conducting trusted downloads, burning classified compact discs (CDs), maintain and update SIPRNet host system patches, implement mandated system vulnerability mitigations and set up user accesses and accounts. The contractor shall be appointed and certified as a SIPRNet Information Assurance Manager (IAM Level I) and maintain Information Assurance Training (IAT) Level II certification per DoD 8570.01-M, Information Assurance Workforce Improvement Program. Support personnel shall be proficient in the Windows 7 and Windows 10 operating systems (OS), Windows Group Policy Objects, DoD Cybersecurity, NIST RMF, Security Technical Implementation Guides (STIGs), Endpoint Security System/Host based Security System (ESS/HBS) and DoD Public Key Infrastructure

(PKI).

1.3.5 Information Protection and Network Security

1.3.5.1 The contractor shall assist the organizational Commander/Director in ensuring all systems supported under this contract meet DoD, USAF, AFMC, AFLCMC, and local installation security requirements for Accreditation according to, JSIG, , ICD 503, NIST RMF, FISMA, DoDI 8500.01, DoDI 8510.01, or other accreditation policies.

1.3.5.2 To ensure that users comply with security requirements and provide input into the organizations, the contractor shall provide computer security training as required by the ordering organization on each TO (e.g. tri-annual or quarterly) IAW:

a) JSIG, dated 9 Oct 2013;

b) DoDI 8510.01, Risk Management Framework (RMF) for DoD Information

Technology (IT), dated 12 March 2014;

c) AFI 16-1404 Air Force Materiel Command Supplement, Air Force Information

Security Program, dated 17 February 2016; and

d) ICD503, Intelligence Community Information Technology Systems Security, Risk Management, Certification and Accreditation, dated 15 September 2008.

The contractor shall provide training slides and/or information to the organization’s government POC for review prior to release. The contractor shall act as the Office of Primary Responsibility (OPR), and shall provide IA training, maintain test results, and provide reports on completion status, as required (CDRL A0010).

1.3.5.3 The contractor shall prevent loss of information during operational and maintenance activities by taking steps to protect and restore information for functions serviced under this contract.

1.3.5.4 The contractor shall observe and comply with current security guidelines established by each facility (government or contractor). Each contractor employee will be required to take introductory and refresher security training mandated and provided by the government.

1.3.5.5 Operational Security (OPSEC) requirements apply, IAW AFI 10-701, Operations Security (OPSEC), dated 26 August 2013. Critical Information (CI) will be provided to contractor under separate cover and updated as required.

1.3.5.6 The contractor shall recommend computer systems designed to promote data integrity by the use of controlled environments and fault tolerance.

1.3.5.7 In the maintenance activity for repair or replacement, the contractor shall ensure that all user data and software have been backed up and shall electronically erase, beyond restoration, all data residing on the device. If the contractor needs or chooses to return a piece of equipment to a repair facility or other contractor site for repair, all data shall be removed from the piece of equipment, which may include removing the hard disk prior to removing the equipment from the site. IAW AFMAN 17-1301, Computer Security (COMPUSEC) and AFSSI 8580, Remanence Security. The contractor shall be responsible for notifying the organization’s Security Manager and the government POC, if a hard disk containing information has been inadvertently shipped to a maintenance/repair facility or contractor site. The contractor shall also provide a detailed description of the incident in the format designated by the Security Manager within two (2) hours of discovery of the inadvertent shipment, and shall cooperate with any incident investigations. All maintenance activities for equipment returned to a repair facility or other site shall be documented in a memorandum for the record and filed according to records management mandates.

1.3.5.8 In the event of compromising non-sensitive information, the contractor shall work with the organization’s security personnel on measures taken or processes utilized to prevent future occurrences.

1.3.5.9 In the event of compromising sensitive information, the contractor shall work with the organization’s security personnel on measures taken or processes utilized to prevent future occurrences. The contractor shall be held liable and face all security repercussions for their actions if found at fault.

1.3.5.10 The contractor shall assist the government to generate disaster recovery plans for organizational unique hardware and software assets. The contractor shall test disaster recovery plans annually and document the results of those tests. The contractor shall notify the government of the date and time of test recovery procedures at least seven

(7) workdays prior to testing, as required (CDRL A0002).

1.3.5.10.1 The contractor shall coordinate with local MIS personnel supporting Wright-Patterson AFLCMC contracting personnel as required to implement disaster recovery procedures.

1.3.5.11 The contractor shall assist the government to implement contingency plans for organizational unique hardware and software assets IAW DoDI 8510.01, Risk Management Framework (RMF) for DoD Information Technology (IT), dated 12 March 2014.

1.3.5.12 The contractor shall maintain Information Operations Condition (INFOCON) and COMPUSEC checklists IAW AFI 90-201, The Air Force Inspection System, dated 21 April 2015, and any other applicable DoD and USAF guidance.

1.3.5.13 The contractor shall execute self-assessments and record the results in the Management Internal Control Toolset (MICT). Any identified deficiencies shall be corrected within thirty (30) days of discovery. Deficiencies that cannot be corrected within thirty (30) days require a formal plan of action and milestones (POAM) report to be generated and submitted to the COR and the government POC for approval prior to implementation (CDRL A0010).

1.3.5.14 The contractor shall assist with the continuity of operations plans (COOPs) in order to recover from any operational disruptions caused by environmental and/or man-made disasters (fire, flood, sabotage, human error, etc.) and review annually.

1.3.5.14.1 The contractor shall also support non-networked workstations, to include ConWrite COOPs (with re-imaging as required)

1.3.5.15 The contractor shall assist functional system administrators (FSAs) to clear all discrepancies identified in the network scans and account management audits according to current guidance from the Wing Cybersecurity Office (WCO) and ISSM/ISSO/CL. IAW Air Force Instruction (AFI) 17-130, Cybersecurity Program Management, dated 31 Aug 2015. . The contractor shall notify the organizational Commander/Director through the government POC and the COR of any discrepancy that cannot be resolved.

1.3.6 Communication Security (COMSEC) Support

1.3.6.1 The contractor shall provide Communication Security (COMSEC) support which includes storing, installing, inventorying, and destroying COMSEC keying material, including serving as the primary and alternate COMSEC responsible officer (CRO) IAW AFMAN 17-1302, Communications Security (COMSEC) Operations, dated 03 February 2017, and instructions received from the base COMSEC office. The contractor shall ensure the organization is compliant with all COMSEC policies.

The contractor shall report any COMSEC discrepancies or incidents immediately to the government POC and provide periodic updates on the status through resolution in the format requested by the government POC (CDRL A0010).

1.3.6.2 The contractor shall assist the organization’s government POC with the acquisition of COMSEC equipment.

1.3.6.3 The contractor shall assist in performing daily controlled authorization/custody receipt listing (CA/CRL) monitoring/management of COMSEC equipment. This includes Secure Telephone Equipment (STE) devices, encryption devices, KSV-21s, and vIPERS.

1.3.6.4 The contractor shall assist in maintaining the CA/CRL account for crypto equipment (STE, Key Generator (KG), Key Variable (KV) or other encryption devices).

1.3.6.5 The contractor shall assist in inventorying and tracking COMSEC keying material and order keys when required, and shall serve as the ITEC for the COMSEC equipment.

1.3.6.6 The contractor shall assist in supporting all future equipment upgrades, additions, and maintenance of STE telephone instruments, connections, all encryption devices, and electronic keying devices.

1.3.6.7 The contractor shall assist all authorized users in receiving the appropriate access, operation training, and other assistance as necessary by acting as the liaison between the organization, AFNet, and the local installation CG.

1.3.6.8 The contractor shall have individual(s) responsible for assistance with accessing and maintaining safes and COMSEC equipment.

1.3.7 Multi-media (Video Teleconferencing (VTC) and Audio/Visual (AV)) Equipment Support

1.3.7.1 The contractor shall provide unclassified and classified VTC support IAW Air Force Materiel Command Instruction (AFMCI) 33-105, Air Force Materiel Command Tier 1 Video Teleconferencing (VTC), dated 15 July 2010.

1.3.7.2 The contractor shall provide VTC support personnel properly trained and certified to operate the organization’s VTC equipment. The contractor shall successfully accomplish any required computer based training (CBT) and/or required classroom training classes needed to maintain certification to operate the organization’s equipment. The contractor shall understand and support the implementation of Video over Internet Protocol (VidOIP) and other technologies such as video to the desktop, collaborative computing devices (CCDs), the use of DoD collaborative web-based environments and tools, etc., and certified personnel shall perform IA/CL functions associated with the transition and implementation of these technologies. The contractor shall meet IA/CL training requirements from this overarching contract IAW DoD Directive (DoDD) 8140.01, Cyberspace Workforce Management, dated 11 Aug 2015, implemented by DoD 8570.01-M, Information Assurance Workforce Improvement Program, dated 19 Dec 2005.

1.3.7.3 The contractor shall provide VTC setup, hardware and software installation, maintenance and troubleshooting, configuration support, administration, and scheduling of teleconferences, as required.

1.3.7.4 The contractor shall manage, maintain and upgrade all multi-media and AV equipment as required, and provide primary support for VTC system training locally and remotely as required. Implementation of upgrades shall be contingent upon government approval. The contractor shall report real-time status of all upgrades & repairs using the government-approved project tracking method.

1.3.7.5 The contractor shall provide AV set-up and operations support to all official functions, as required.

1.3.7.6 The contractor shall support the certification and accreditation of all VTC systems for the various VTC networks (i.e. Global Video Service (GVS), USAF SAP VTC Network, NIPRNet, etc.) as directed by the government. The contractor shall assist in the development and maintenance of required certification and accreditation documentation for the VTC equipment maintained and operated under this contract

(CDRL A0002).

1.3.7.7 The contractor shall ensure VTC and AV equipment is operational for scheduled meetings. This equipment includes organization-owned bridges, video coder/decoder (CODEC), and other related VTC networking equipment. VTC support requires personnel for all setup and maintenance actions and other program-related sites, as applicable. The contractor shall identify and track VTC failures or discrepancies and actions taken to remediate/resolve the issues. Discrepancies shall be: emailed to the identified government POC within twenty-four (24) hours of being reported; tracked using the government-approved tracking tool; and include a summary in the Monthly Status Report (MSR) (CDRL A0010).

1.3.8 Hardware Maintenance, IT Equipment Custodian (ITEC), and Software Accountability Support

1.3.8.1 The contractor shall assist in the performance of ITEC duties. The contractor shall assist the government in the scheduling and monitoring of hardware maintenance work performed by various maintenance contractors. The contractor shall report equipment failures and coordinate with the appropriate servicing agencies or vendors for warranty and/or maintenance repairs and track equipment in the organizational IT Equipment Inventory database, including documentation and return material/merchandise authorization (RMA) numbers.

1.3.8.2 The contractor shall: support all multi-function print/copy/scan/facsimile devices (MFDs) by monitoring and replacing standard consumables (such as toner, fusers, maintenance kits, waste toner bottles, etc.); perform routine office maintenance of MFDs; and call equipment in for repair as required IAW the proper maintenance agreements/contracts in place. In addition, the contractor shall manage and support MFD and stand-alone facsimile machines within SCIFs and SAPFs.

1.3.8.3 The contractor shall maintain government furnished spare computer systems and printers in working order to facilitate in-processing of new personnel and minimize downtime caused by hardware failure. The contractor shall deploy personal computers to desktops and remove unused or defective personal computers from desktops.

1.3.8.3.1 The contractor shall maintain on-hand spare critical computer components and, in coordination with the government POC, install or replace common personal computer, MFD, printer, and laptop system parts for items that are out of warranty.

This includes configuring, testing, deploying and recommending changes to these systems. The contractor shall configure the systems to operate on the AFNet, and shall coordinate configuration of systems with the local installation client support administrators (CSAs) to operate on AFNet. The contractor shall only use original equipment manufacturer replacement parts when available.

1.3.8.4 The contractor shall provide inventory/configuration control of hardware, software, and maintenance/warranty coverage of ITEC equipment, IAW AFMAN 17-1203, Information Technology (IT) Asset Management (ITAM), dated 19 March 2014.

1.3.8.5 The contractor shall provide support for the ITEC inventory, to include disposal of equipment. The contractor shall provide individuals to be appointed by the government as primary and alternate ITECs. The government-appointed ITECs shall be responsible for tracking and managing the ITEC equipment account and could be held negligent if hand-receipts are not obtained, inventory is not performed, or proper documentation is not maintained. The government-appointed ITECs could be held financially liable for the loss, destruction, or damage to any equipment under their control resulting from willful misconduct, deliberate unauthorized use, or negligence in the use, care, custody, or safeguarding of the property from causes other than fair wear or tear.

1.3.8.6 The contractor shall maintain account paperwork, utilizing the system designated by the government POC or COR, for the equipment assigned, and shall update the account information with additions, deletions, transfers, turn-in and Reports of Surveys (ROSs).

1.3.8.7 The contractor shall perform annual inventories, inventories, as required, and sign for all computer equipment. Losses and irregularities shall be immediately reported to the base Equipment Control Office (ECO), the government POC, and the COR.

The contractor shall abide by AFMAN 17-1203, Information Technology (IT) Asset Management (ITAM), dated 19 March 2014.

1.3.8.8 The following specific duties are required of the government-appointed ITEC custodian:

a) complete ITEC training;

b) issue and maintain AF Form 1297s (Hand Receipts) for all users;

c) maintain a properly documented ITEC folder;

d) notify the ECO office within ten (10) working days of equipment transfers, new equipment received, missing equipment, and equipment that has been exchanged/replaced due to maintenance;

e) out process through the ECO office forty-five (45) days in advance of relinquishing ITEC responsibilities;

f) perform a joint inventory and account for all equipment assigned to their account prior to change of ITEC custodian;

g) obtain permission from the ECO to cannibalize equipment;

h) process excess equipment through the ECO;

i) perform other inventories, as requested; and

j) provide transportation for all authorized equipment relocations and disposal activities.

1.3.8.9 The contractor shall identify, recommend, develop and document support procedures to ensure that supplies are available through coordination with the government’s supply system (CDRL A0002).

1.3.8.10 The contractor shall coordinate and execute all authorized hardware relocations.

After relocation, updated hand receipts shall be issued and the inventory database shall be updated.

1.3.8.11 The ITECs shall work with ESD, the local installation Client Systems Technician/Helpdesk (CST), , and embedded organizational IT technicians to validate computer requirements and hardware/software inventory levels and locations.

1.3.8.12 The contractor shall perform quarterly inventory spot checks of a COR-provided ITEC equipment list including local and ECO records to validate the information.

The report will be made available electronically to the government (CDRL A0010).

1.3.8.13 The contractor shall perform Unit Software License Manager (USLM) duties and manage software IAW AFMAN 17-1203, Information Technology (IT) Asset Management (ITAM), dated 19 March 2014, for all software, software procurement, associated upgrades, registration, and licensing documentation. USLMs shall maintain a hard or soft copy of the software license inventory and “proof-of-license ownership” of GOTS/Commercial Off-the-Shelf (COTS) software in use within the organization.

1.3.8.13.1 USLMs shall store proof of license agreements or licenses (e.g. user manuals, purchase documentation, CDs, etc.) and software media in a secure centralized location (e.g., locked drawer, file cabinet, room, etc.) or electronically if applicable.

1.3.8.13.2 USLMs shall inventory all licensed software annually and, if available utilize auto-discovery tools, to track and report implemented software and license information. The USLM shall obtain written certification of the inventory from the government POC.

1.3.8.13.3 USLMs shall digitally sign the inventory to indicate completion of the inventory, and submit to the Base Software License Manager (BSLM) (or equivalents).

1.3.8.13.4 USLMs shall audit all systems to ensure no illegal or unauthorized copies of software are installed. Sampling procedures may be used if active inventorying/auto discovery systems are available.

1.3.8.13.5 USLMs shall use automated tools to the maximum extent possible for tracking software installed on the base network where applicable.

1.3.8.13.6 USLMs shall ensure all implemented software is certified for use according to AFI 17-101, Risk Management Framework (RMF) for Air Force Information Technology (IT), dated 2 February 2017, and free of viruses and malicious logic.

1.3.8.13.7 USLMs shall ensure all common-user desktop/laptop software on all computer systems comply with the USAF Standard Desktop Configuration (SDC) or other approved configurations.

1.3.8.13.8 USLMs shall redistribute excess or superseded software if it:

a) Is permitted under the license agreement or upgrade policy for that software.

b) Is not classified.

c) Did not provide direct security protection to systems that processed classified information.

d) Is not directly related to or associated with a weapon system, intelligence system, command and control system, communications system, or tactical system.

1.3.8.14 The contractor shall provide general hardware support, networked and local database administration, and application support for ConWrite, Standard Procurement System (SPS), or other contract writing systems. This includes, but is not limited to, coordinating with AFLCMC/PKXY, directorate information technology personnel and/or the 88th Communications Group (CG) for ConWrite software distribution, setting up test machines for software testing, and preparing the AFLCMC/PKXY training room for all training classes

1.3.9 GOTS Application and Environment Maintenance

1.3.9.1 Scope

1.3.9.1.1 Support requirements include the development, maintenance, and enhancement of GOTS applications. Required changes are due to customer requirements, as well as changing USAF directives. The contractor will perform application, database, data, and system backups for the GOTS application-related servers. The contractor shall be a member of the organizations Configuration Control Board (CCB) when directed by the government POC. This includes attending meetings, as well as providing research and input to proposed GOTS application system change requests (CDRLs A0002 and A0010).

1.3.9.1.2 Network support requirements include: the installation and maintenance of hardware, to include servers, domain controllers and desktop computers that are utilized by the GOTS application and its end-users; other associated peripherals; the operation of World Wide Web servers; and helpdesk support. In coordination with the government POC, the contractor will perform system or subsystem software and/or data recovery. The contractor shall provide support in maintaining and troubleshooting the LAN in the building where the GOTS application is utilized/located which may include private IP address space. This support is to include:

monitoring the network switches for errors and reporting them as needed;

connecting computers to the network; coordinating downtime with end users and local installation network personnel; escorting network/phone personnel as needed; resolving network problems for users; diagnosing LAN connectivity and bandwidth issues; and working with local installation network personnel to provide the optimum of performance of the LAN. The contractor shall also coordinate unique functional applications support (examples include, but are not limited to: ConWrite, MatLab, Sparx, Milestones Pro, etc.) with the organization’s IT personnel, the local CG, and other organizations for client software distribution, software testing, and preparing organizational training room(s) for all training classes. The contractor shall provide office automation software support which includes installing and configuring software to meet the USAF SDC and specific needs of source selection personnel. The contractor shall capture hard drive images for standard desktop and laptops, non-standard classified desktops, classified servers and classified laptop configurations. The contractor shall push these images to create new like-systems and keep standalone images updated for classified systems.

(CDRLs A0002 and A0003).

1.3.9.1.3 Programming requirements include the development, maintenance, upgrade, and implementation of GOTS software for local/remote pre-award, source selection, program execution, and contract activities. It also includes the creation and maintenance of private and public SharePoint sites and websites. The contractor shall provide problem analysis and resolution support for the developed automated tools and the private and public websites. The contractor shall provide programming support to include requirements analysis, as well as designing, developing, testing, documenting, and implementing/maintaining automated tools for use in the local/remote GOTS application processes. This may require interviews with process experts, determining the software requirements and whether or not the requirements can be satisfied with existing software and tools or by developing new ones, and providing recommendations or alternatives. The contractor shall customize GOTS and/or templates to facilitate the creation of documents as required from the government CCB (CDRLs A0002, A0005, and A0010).

1.3.9.1.4 The contractor shall develop, maintain, and administer USAF portal sites, as well as organization and community SharePoint sites. This includes, but is not limited to, Intelink, metrics database and tracking system portal sites.

1.3.9.1.5 Technical writers are needed to develop and maintain GOTS documents that are used by the application’s users as well as by the technicians that support the GOTS product (CDRL A0006).

1.3.9.2 The GOTS application shall be fully functional and available for customer use twenty-four (24) hours per day, seven (7) days per week, unless otherwise approved by the government POC (CDRLs A0002, A0005, A0006, and A0010).

1.3.9.3 Trouble Calls

1.3.9.3.1 The contractor shall answer trouble calls for the GOTS application and training rooms, and shall resolve hardware and software problems relating to desktop computers, laptops, and associated peripherals.

1.3.9.3.2 Assistance and necessary training will be provided to the users. If programming must be modified, the contractor shall submit all changes to the CCB (CDRL A0010).

1.3.9.4 GOTS Application & Related Systems Training

1.3.9.4.1 The contractor shall develop training and related documentation packages for the GOTS application and related systems. The contractor shall update the training and documentation packages as required. The contractor shall provide training workshops as identified by the government POC (CDRLs A0006 and A0010).

1.3.9.4.2 The contractor shall also provide this support for other military/federal facilities. The contractor is required to evaluate software requirements or additional software needs, and to provide recommendations for additional requirements (CDRLs A0006 and A0010).

1.3.9.5 The contractor shall accomplish end-of-day security checks for the secured area that houses the GOTS application network servers and systems (CDRL A0010).

1.3.9.6 The contractor shall notify the contracting officer (CO) and the government POC at least one (1) month prior to submitting a proposal for any source selection competition that will be evaluated by the government in the local/remote source selection facility. This notification requirement applies whether the contractor is applying as a prime contractor, as a subcontractor, or as a team member (CDRL A0010).

1.3.10 Support for Maintaining Rooms (e.g. Conference, Training, and Source Selection Rooms)

1.3.10.1 The contractor shall perform support responsibilities for conference, training, and source selection rooms. Support responsibilities are currently listed in AFMAN 17- 1203, Information Technology (IT) Asset Management (ITAM), dated 19 March

2014; and in AFI 17-100, Air Force Information Technology (IT) Service Management, dated 16 September 2014. The contractor shall:

1.3.10.1.1 Notify the USLM (or equivalents) of any actions performed that changes local software licenses installed on computer systems. Contractor must maintain a record of and notify USLMs (or equivalents) when installing software from shared folders or using installation CDs/DVDs. Contractor must also maintain a record of and notify USLM (or equivalents) when uninstalling, upgrading, or performing any actions that change the amount or number of licensed software products installed on the network. Ensure software covered by an Enterprise License Agreement (ELA) is not transferred with hardware that is being replaced or repurposed outside of the ELA scope.

1.3.10.1.2 Ensure all networked computer systems are in compliance (i.e., installed and managed by Group Policies) with the USAF SDC.

1.3.10.1.3 Ensure functional communities of interest systems, servers, workstations, peripherals, communications devices, and software are on-line and supported.

1.3.10.1.4 Implement all actions required by Cyber C2 orders as approved by each system’s configuration control authority according to Paragraph 7 of AFI 17-100, Air Force Information Technology (IT) Service Management, dated 16 September 2014, and coordinate order implementation with servicing CFP, Integrated Network Operations and Security Center (INOSC), users, and external agencies.

1.3.10.1.5 Follow compliance reporting requirements as specified in each Cyber C2 order. Orders may require compliance-based, task-based, or asset-based reporting.

1.3.10.1.6 Support non-network workstations, labs, demo machines, etc. (with re-imaging, as required).

1.3.11 Telephone, Voice Mail, and Commercial Mobile Technology Management (CMT)

1.3.11.1 The contractor shall prepare work requests for various non-secure and secure phone/voice mail services, including, but not limited to: analog, STEs, VoIPs, and vIPERS, and any specific requirements for them; network drops; and unique VTC circuits, as needed. The contractor shall schedule and track work requests with the local installation Telephone Systems Flight (TSF).

1.3.11.2 The contractor shall prepare the requirements documentation for government signature, and manage and coordinate requested CMT services with the local installation CG Requirements Managers and current service providers. The contractor shall: maintain inventory control and hand receipts; perform setup, account management, and troubleshooting activities; resolve hardware/software problems; and coordinate and perform all required operational and security training with users who are issued a CMT device and/or peripheral accessory (e.g. a Common Access Card (CAC) reader).

1.3.11.3 The contractor shall track phone and voice mail configuration changes for the organization. The contractor shall report configuration changes to the organizational Telephone Control Officer (TCO).

1.3.11.4 The contractor shall be responsible for receiving, auditing, adjusting for cost savings, managing, tracking, and, when necessary, investigate and dispute erroneous charges for CMT billing invoices.