draft J-6 BIM IDIQ PWS 20240305.pdf

J-6 Base Infrastructure Modernization IDIQ Performance Work Statement Page 1 of 43

AFLCMC/HNI Connect Portfolio

Base Infrastructure Modernization (BIM)

FA8726-23-R-B001

J-6 Base Infrastructure Modernization IDIQ PWS

Prepared By:

AFLCMC/HNIB

15 Eglin Street, Building 1607 Hanscom AFB, MA 01731-1700

5 March 2024

DRAFT DOCUMENT

POSTED TO SAM.GOV 11 MARCH 2024

J-6 Base Infrastructure Modernization IDIQ Performance Work Statement Page 2 of 43

Table of Contents

1. OVERVIEW

2. PERFORMANCE REQUIREMENTS

3. GENERAL REQUIREMENTS

4. SERVICES SUMMARY

J-6 Base Infrastructure Modernization IDIQ Performance Work Statement Page 3 of 43

APPENDIX A: TECHNICAL REQUIREMENTS

APPENDIX B: SERVICE LEVEL AGREEMENT

APPENDIX C: REFERENCE DOCUMENTATION

APPENDIX D: ACRONYM LIST

APPENDIX E: GOVERNMENT FURNISHED EQUIPMENT LIST

APPENDIX F: GOVERNMENT FURNISHED INFORMATION LIST

APPENDIX G: DEFINITIONS

J-6 Base Infrastructure Modernization IDIQ Performance Work Statement Page 4 of 43

1. OVERVIEW

1.1. Purpose

The purpose of this Multiple Award IDIQ Contract is to modernize and operate network infrastructure at United States Department of the Air Force (DAF) bases throughout the world.

This PWS describes the overarching scope of work to be performed. Specific requirements will be identified in individual Task Orders and may require performance of some, or all, areas of efforts described in this document. The scope of this IDIQ and subsequent Task Orders may include other work related to, but not necessarily identified in this PWS.

1.2. Background

This IDIQ will be awarded and executed by the Air Force Life Cycle Management Center Enterprise IT & Cyber Infrastructure Division and will act as the overarching effort to modernize the Base Area Network (BAN).

An EITaaS integrated program office was formed with SAF/CN, PEO C3I&N, and ACC/A6 personnel, to conduct a Risk Reduction Effort (RRE) to experiment with commodity EITaaS delivered by commercial service providers. Utilizing the authorities under 10 U.S.C. 4023, EITaaS conducted experiments at eight (8) DAF installations to develop lessons learned that would inform a DAF enterprise-wide acquisition. The EIT Portfolio requirements were split into five (5) distinct portfolios; Compute and Store, Connect, End User Devices, Enterprise Services, and Protect. The acquisition strategy is to respond to the HQ ACC validated requirements in the Connect Portfolio. This effort takes lessons learned from the EITaaS RRE Network-as-a-Service effort as well as lessons learned from existing Base IT Infrastructure modernization efforts to modernize the future Base Area Network (BAN) offering at DAF bases world-wide. This effort intends to modernize the Non-Secure Internet Protocol Router (NIPR) and Secure Internet Protocol Router (SIPR) BAN through an as-a-service model utilizing Contractor provided networking services. The Contractor will have to modernize, operate, and maintain base network infrastructure to meet Service Level Agreements (SLAs). The SLAs will be outlined in the Task Orders and will be more aggressive than previous DAF networking contracts. This PWS may use the acronym BAN to describe its requirements, this is commonly referred to as Campus Area Networks (CAN) in the industry. The deployment of the modernized base network will provide an infrastructure to support future Zero Trust efforts. The effort will also include the deployment of two-factor authentication (2FA) capabilities, 802.1x and Network Authentication Controls.

1.3. Current Environment

The BAN is the Department of Defense (DoD) Information Network (DoDIN) Non-secure Internet Protocol Router Network (NIPRNet) and Secret Internet Protocol Router Network (SIPRNet) extension within a DAF base. The BAN architecture is comprised of wired network components, wireless network components, inside plant cabling, outside plant cabling, and distribution services. Depending on the configuration, other networks may/may not be tunneled inside NIPR, while other networks will run on parallel V-LANs across the transport-layer of the

BAN.

J-6 Base Infrastructure Modernization IDIQ Performance Work Statement Page 5 of 43

The BAN network nodes are installed in buildings on base in physically secure areas such as data centers, lockable dedicated rooms (communications closets), or open office areas in lockable cabinets. These node locations in buildings are referred to as Communications Equipment Locations (CEL). The wireless system is an enterprise capability that provides the DAF BANs a single standard transport for wireless systems. It is an extension of the BAN wired infrastructure and it connects base wireless clients to the Air Force Network (AFNET)/NIPRNet via that Infrastructure. The SIPRNet is a classified network used by the DoD to communicate classified information. A High Assurance Internet Protocol Encryptor (HAIPE) is a Type 1 encryption device that complies with the National Security Agency's (NSA) Interoperability Specification for tunneling traffic through lower classification level networks. The BAN is commonly used as a backbone for interconnectivity between SIPRNet HAIPE devices. The currently deployed wireless and wired systems are monitored and managed by a variety of personnel in the Active- Duty Integrated Network Operations and Security Centers (INOSC), Air National Guard Network Operations and Security Center (GNOSC), and base communication squadron personnel. The currently deployed network provides ample capacity for various mission networks on a given base, a Contractor shall be expected to provide capacity for mission networks that will be identified in the Task Orders. The number of mission networks on a particular base or Task Order will vary.

The state of environment across the DAF is a complex array of fragmented and disconnected approaches to the BAN; caused through an overall lack of integration, direction, prioritization, and dedicated funding. This fragmentation and decentralized approach applies to every aspect of the network, metrics tools and otherwise. Every base has been responsible for their own network maintenance, which overall, has occurred on an irregular basis, only when critically needed and resolution of this problem has consistently been deferred to out-years. The DAFs BAN has never kept up with industry. Some bases are decades behind the industry in terms of infrastructures, others are only a few years behind. As it currently stands, most bases should have semi-modern hardware across their network. However, that current hardware may consist of multiple routers in a space that only requires one, leading to equipment being dilapidated or misused.

The Government anticipates that the Contractor will have to adapt to significantly unique situations at each base. For example, this could include redundant equipment, equipment beyond its end of life or end of service expectation, and/or deficient cabling. This current environment is what this BIM IDIQ will address. The Government BAN will closely resemble the following:

J-6 Base Infrastructure Modernization IDIQ Performance Work Statement Page 6 of 43

1.4. Goals and Objectives

The Government seeks to modernize network infrastructure and emulate industry best practices for the DAF’s BAN. This will be accomplished through this BIM IDIQ vehicle. The BIM IDIQ is a DAF initiative leveraging industry to provide standardized, innovative, and agile Information Technology services across the Air and Space Forces. The goal is to increase integration through a modern streamlined network keeping up with the industry standards, utilizing best practices, performance, and modern management techniques to provide the DAF with a mission capable network. This IDIQ intends for the network to be treated as an investment for future mission sets.

The Government seeks a unified, performant, and uniformly maintained network environment that will be a game changer for Multi-Domain Operations. This effort intends to meet the overarching goals of the DAF Chief Information Officer (CIO) to innovate for competitive advantage, optimize for efficiencies and improved capability, evolve cybersecurity for an agile and resilient defense posture, cultivate talent for a ready digital workforce, and the Enterprise IT as a Service Risk Reduction Effort transition.

1.5. Scope

The scope of this IDIQ is to furnish, upgrade, design, test, install and maintain all NIPR and SIPR BAN wired and wireless components. The scope includes operating, monitoring, and sustaining the network according to the included requirements. Bases with flightline operations may have additional requirements that will be defined in a Task Order PWS.

Each Task Order will be issued with a PWS directing the Contractor enabling the rapid transformation of the DAF’s base-centric IT to an enterprise approach leveraging industry best practices. Task Orders may cover one or multiple bases.

The Contractor shall provide a rapid transformation of the DAF’s base-centric IT to an enterprise approach leveraging industry best practices such as the current version of Information Technology Infrastructure Library (ITIL) and alignment with Defense Enterprise Service Management Framework (DESMF) – DoDI 8440.011, as applicable. The Contractor shall deliver capabilities and services in accordance with this PWS and each Task Orders PWS to enable the DAF’s prevalence over all adversaries through the employment of cutting-edge data techniques, technology, and infrastructure.

The Government will place orders over the course of the ordering period for delivery of BIM capabilities and services. The Contractor may be required to provide the Government with services that include taking over operations of the existing base network and running the base network to meet SLA standards. A base is defined as everything within the boundary of the main operating base, to include the Geographically Separated Units (GSU) and other locations assigned to that base. In addition, the Contractor may be required to provide technical expertise, technical services, analysis of alternatives, agile schedule adjustments to improve project timeline, recommended best practices, continual service improvements, and any other efforts required to meet the performance and technical requirements as specified within this PWS and the PWS for each Task Order.

J-6 Base Infrastructure Modernization IDIQ Performance Work Statement Page 7 of 43

2. Performance Requirements

The Contractor will be responsible for delivering, operating, and maintaining a modernized network infrastructure as described by each Task Order and the scope of this IDIQ covers all hardware, software, infrastructure, services, expertise, labor and materials necessary. The following items are the general categories of work that may be required, aligned to appropriate Contract Line Item Numbers (CLIN) of the IDIQ and subsequently issued Task Orders.

2.1. Site Survey

The Contractor may be required to perform a site survey. The purpose of this site survey is for the Contractor to ascertain the true state of the network and establish the baseline for the Design & Architecture. The specific requirements for performance, to include any reports to be provided, will be identified within each Task Order.

2.2. Operate Government Network

The purpose of this phase is to maintain mission operability and gather necessary information to supplement the effectiveness and implementation of the Design & Architecture and Modernization.

The Contractor may be required to operate the Government’s existing network. This may include requirements to perform a Walk-In Takeover (WITO). Upon the initiation, and as supplemented by the Task Order, the Contractor shall be responsible for maintenance and repair of the network necessary to meet existing mission requirements. This includes operating, repairing, remedying, reconfiguring, and any other efforts necessary to ensure the performance, integrity, and resilience of the network is maintained during the time between Task Order award and completed modernization.

This may also include requirements for detailed Transition Plans and the performance of transition services to ensure effective transitions between existing support and the Contractor’s support. These plans and transition services must ensure continued system operations and maintenance, as well as an orderly transition period without any interruption or loss of proficiency of services.

The specific requirements for performance, to include reports, thresholds, plans, timelines, and any other aspects, will be identified within each Task Order.

2.3. Design & Architecture

The Contractor may be required to provide a design and architecture of a modernized network capable of meeting the performance thresholds outlined in the Task Order. The specific requirements for the design and architecture, to include considerations, technical requirements, reports, review and acceptance process, and any other aspects will be identified within each Task Order.

J-6 Base Infrastructure Modernization IDIQ Performance Work Statement Page 8 of 43

2.4. Modernization

The Contractor may be required to implement an accepted design and infrastructure, whether the result of the Contractor’s accepted design or a design provided by the Government. This may include purchase, configuration, and installation of new network hardware, installation of infrastructure (to include fiber optic or other cabling), repair or replacement of existing hardware or infrastructure, and any other efforts necessary to deliver a network that meets the performance thresholds identified in the Task Order.

Contractor shall ensure the installed network is tested, validated, and adjudicated as a passing score as specified in the Task Order PWS. The contractor shall ensure all equipment is STIG validated. The Contractor shall coordinate with the BIM PMO throughout this process.

The specific and/or additional requirements for modernization, to include details regarding testing, validation, technical details, review, and acceptance will be identified within each Task Order.

2.5. Operate Modernized Network

The Contractor may be required to operate the modernized network according to performance thresholds (Service Level Agreements) described in each Task Order. The Contractor shall be responsible for providing all labor, management, materials, and expertise necessary to maintain those levels of performance, to include replacing, repairing, or upgrading hardware, software, or other infrastructure (except to meet additional requirements of the Government as covered in Ancillary Services & Materials).

This may also include requirements for detailed Transition Plans and the performance of transition services to ensure effective transitions between Contractor’s support and Government or Contractor (other than the incumbent) support. These plans and transition services must ensure continued system operations and maintenance, as well as an orderly transition period without any interruption or loss of proficiency of services.

The specific requirements for performance, to include reports, thresholds, plans, timelines, and any other aspects, will be identified within each Task Order.

2.6. Studies & Analysis

The Contractor may be required to conduct studies and analyses beyond the efforts necessary for normal operations. Examples of requirements could include analyzing whether new technologies or capabilities could be incorporated into the network, alternative design approaches, contingency mitigations, or any other inquiry directed by the Government not performed as an aspect of normal network operation services. The specific requirements will be identified within each Task Order as they arise.

2.7. Ancillary Services & Materials

J-6 Base Infrastructure Modernization IDIQ Performance Work Statement Page 9 of 43

The Contractor may be required to perform work that is not directly associated with the items above but is necessary to meet the Government’s requirements. Examples of requirements could include incorporating new technology, additional facilities, expanded capabilities, or any other work within the scope of delivering, operating, and maintaining network infrastructure capable of meeting the changing needs of the Government. The specific requirements will be identified within each Task Order as they arise.

3. GENERAL REQUIREMENTS

3.1. Program Management

3.1.1. Government Responsibilities

A Government Program Manager (PM) will be assigned to perform a variety of tasks/roles for managing the performance of the contract and Contractor and maintain open communication with a Contractor. This communication may occur from on-site personnel and/or the BIM Program Management Office (PMO). Any official direction from the Government will originate from the BIM PMO Procuring Contracting Officer (PCO) or a specifically delegated representative. Any communication from other Government parties, to include local or base leadership, to the Contractor shall be directed to the BIM PMO PM and PCO. The BIM PMO may assist the Contractor in matters that require a Government representative to liaison, facilitate, organize, or mediate with other Government personnel.

3.1.2. Contractor Responsibilities

The Contractor shall be expected to be open, clear, and transparent with the Government on the processes, challenges, successes, and operations needed throughout the life of the IDIQ and any awarded Task Orders. To ensure a rapid reduction and mitigation of implementation issues, the Contractor shall ensure clear, accurate and timely communication with the Government/BIM

PMO.

The Contractor shall integrate and coordinate Task Order execution activity, manage the timeliness, completeness, and quality of problem identification and resolution. The Contractor shall coordinate with the BIM PMO, Task Order Representatives at the individual bases, and External Agencies as detailed in Task Orders.

Contractor employees shall identify and introduce themselves as contractor personnel and display distinguishing badges or other visible identification for all Government interaction including video-teleconferencing, telephone conversations and formal/informal written correspondence.

The Contractor shall deliver status reports providing corrective action plans, timely identification of issues, and effective management of sub-Contractors. The status reports shall also provide planned Contract Data Requirement List (CDRL) deliveries, planned trips, and recommendations for any additional tools, manpower, and support required for successful execution of a Task Order.

J-6 Base Infrastructure Modernization IDIQ Performance Work Statement Page 10 of 43

A Secret security clearance shall be required and adjudicated for all personnel that will need to access the NIPRNet and SIPRNet. The appropriate clearance level requirements will be specified in the Task Orders. A BIM PMO approved Common Access Card (CAC) is required for personnel. See Section 2.16 for additional security requirements.

If the Contractor decides to compete for specific task orders under this IDIQ contract, the contractor may be required to demonstrate compliance with a variety of business systems, such as through Cost Accounting Standards Disclosure Statements (as applicable), statements of formal or informal compliance with Earned Value Management (as applicable), Professional Employee Compensation plans, or any other requirements that will be applicable to Task Orders.

The Contractor shall provide the requested information with their Task Order proposals as required by the Government.

3.2. Kick-Off Meeting (KOM)

3.2.1. IDIQ Kick-Off

The Contractor shall participate in a KOM scheduled by the Government/BIM PMO. The form the meeting takes, teleconference or in-person, will be at the discretion of the Government/BIM PMO. The Government/BIM PMO will introduce team members, staff, and discuss administrative operations pertinent to the IDIQ including a general overview of expected schedule and approach for Task Orders. The Government intends to host the KOM with new Contractors but will only conduct them as necessary to meet on-boarding needs.

3.2.1.1. Contractor Briefing

The Contractor shall provide a briefing that includes the current organizational structure, primary and secondary contacts for the Government, a staffing plan, partnerships with other companies, and operating locations relevant to the BIM program and network services. The Contractor shall provide a hard copy of this briefing. The Contractor shall provide contact details to the Government at this KOM (CDRL A001).

3.2.2. Individual Task Order Kick-Off

The Contractor shall participate in a KOM which will be scheduled by the Government. The meetings may be conducted via teleconference or in-person, at the discretion of the Government.

The Contractor shall introduce team members and staff and shall present and discuss administrative operations pertinent to performing tasks and a general overview of the overall approach to execute this Task Order. The Government will provide a KOM agenda. The Contractor shall provide personnel rosters at the KOMs and shall provide updated rosters when changes occur. Additional specifics for the Task Order KOM will be included in each Task Order.

3.2.3. Installation KOM

J-6 Base Infrastructure Modernization IDIQ Performance Work Statement Page 11 of 43

An additional KOM shall be conducted between the BIM PMO, Task Order Representatives at each base and the Contractor prior to any installation or surveying activity being conducted. The goal of the installation KOM is to inform the base leadership and other parties of the Contractor actions prior to beginning work. The Contractor shall coordinate with Government Representatives for the bases assigned. The Contractor shall present status of base support coordination and the status of all preparations made for the effort. The Contractor shall present and review the Cutover and Methodology section of the Telecommunication Systems Installation Plan (TSIP), along with any added assumptions. The Contractor shall present a detailed and completed cutover schedule.

The Contractor shall present the plan to minimize network downtime and interruption of services to end-users. The Contractor shall identify any tasks, approvals, or scheduling where extraordinary lead time is required. The Contractor shall present upgrade diagrams, in OV-1 DODAF format, and supporting technical information. The Contractor shall review the verification, audit, and acceptance criteria.

3.3. Integrated Product Team (IPT) Meetings

Per Task Order direction, the Contractor shall host IPT meetings with the Government to provide progress, critical path updates and facilitate risk discussions. The Contractor shall provide agendas and minutes for these meetings. The frequency and topic of these IPT meetings will be addressed within the applicable Task Order PWS and meeting topics the Contractor shall participate in will include, at a minimum, financial forecasting report, Technical Interchange Meetings, Program Management Reviews (PMR), risk reviews, and other meetings at the request of the Government. This could include various feedback gathering meetings over the course of the IDIQ to evaluate documents, gather Contractor feedback, and incorporate changes that the Government deems required. The Contractor shall provide an up-to-date personnel organizational chart as required.

3.4. Associate Contractor Agreements (ACA)

The Contractor may be required to enter into an ACA for portions of work that require joint participation in the accomplishment of Government requirements as needed. ACAs shall be delivered to the Government immediately following ratification by all parties.

3.5. Risk Management

Throughout performance of Task Orders, the Contractor shall plan for and establish a process for identifying, tracking, and mitigating project cost, schedule, and performance risks. The Contractor shall incorporate risk mitigation strategies into project planning and technical activities. Use of Contractor risk reporting tools and format may be acceptable unless the Government specifically requires the Contractor to utilize a standardized format.

Risk status shall be reviewed periodically, but quarterly, at a minimum, by the Contractor and provided to the Government. The risk review may be conducted in conjunction with existing meetings, key milestone events, or upon request. Contractor shall identify risks and develop a

J-6 Base Infrastructure Modernization IDIQ Performance Work Statement Page 12 of 43 recommended mitigation plan. The Contractor shall report program risks and risk mitigation strategies in the Monthly Status Report (MSR) in addition to presenting risk report information at the IPT Meetings, PMRs, and document them as appropriate. The Contractor shall incorporate risk mitigation strategies into program planning and technical activities.

3.6. Travel

Contractor personnel may be required to travel in support of Task Orders and will be responsible for making all travel and lodging arrangements to meet Task Order requirements. Travel may include locations within the continental United States (CONUS) or outside of the continental United States (OCONUS).

Unless otherwise specifically authorized by the Contracting Officer, the Contractor shall not exceed the rates identified by the General Services Administration ) for CONUS travel (https://www.gsa.gov/travel/plan-book/per-diem-rates or the Department of State for OCONUS travel (https://aoprals.state.gov/web920/per_diem.asp).

Unless otherwise stated within a Task Order, the Contractor shall submit all costs associated with travel to the PCO to be evaluated for reasonableness prior to incurring the costs. The Government will not reimburse costs determined to be unreasonable. Examples of unreasonable costs include lodging exceeding the limits stated above, excessive types or quantities of rental vehicles, durations beyond necessity for contract performance, or excessive airfare arrangements.

The Joint Travel Regulation (https://www.defensetravel.dod.mil/site/travelreg.cfm) is not applicable to Contractors, but it will be referenced in the Government’s evaluation of travel-associated costs.

3.7. Transfer of Property

Performance under this IDIQ may involve Government Property, to include Government Furnished Property and Contractor Acquired Property. Specific information regarding Government Property, to include lists, processes, accountability requirements, titles, reporting, and other aspects will be identified within each Task Order.

3.8. Schedule

The Contractor shall generate and maintain an Integrated Master Schedule (IMS) for each Task Order.

The IMS for each Task Order shall account for all Task Orders currently being performed, shall account for each base within each Task Order, and shall identify each task and subtask associated thereof.

The schedule shall contain and track planned activities, events, milestones, and document accomplishments (progress) from cradle to grave and be delivered in accordance with the Task Order CDRL. The Contractor shall provide the Government rationales for schedule changes and

J-6 Base Infrastructure Modernization IDIQ Performance Work Statement Page 13 of 43 slippages, as well as a plan to rectify or adjust schedule delays. The Contractor shall evaluate any risks associated with the IMS and provide the Government with mitigation plans.

3.9. Data Management

The Contractor shall provide all data in accordance with the Task Order CDRL, Exhibit (A) (DD 904 Form 1423), and Exhibit (B). The Contractor shall manage the control, status accounting and distribution of Task Order CDRL items and other non-CDRL data.

The Contractor shall provide an organized, online repository to manage, control, status accounting and distribute CDRL items. The Contractor shall provide the BIM PMO with unrestricted electronic access to all document locations and the capability to read and download.

The Contractor shall provide logs and alerts and log management. Further specifics will be specified at the Task Order level.

3.9.1. Data Accession List (DAL)

The Contractor shall deliver a DAL to the Government including unrestricted electronic access (downloading capability) to all documents relevant to the execution of the program during a Task Order for each individual base. Items in the DAL include, but are not limited to reports, technical studies and analysis, technical documents, technical interchange meeting briefings, trade studies, lessons learned, history of version upgrades, configuration item lists, white papers, meeting briefs, meeting/working group minutes, control plans (i.e. corrosion control), and assessment and authorization (A&A).

3.10. Product Support

The Contractor shall develop and maintain a Product Support Plan (PSP). The Contractor shall also deliver the Product Support Form (PSF). The PSP documents the sustainment plan for the Enterprise IT environment, major areas including but not limited to: Requirement, Product Support Strategy, Maintenance plan & Management, Computer Resources, Design Interface, Sustaining/Systems Engineering, Budget & Funding, Program Transition. The PSP is continually updated throughout the products Life Cycle.

The Contractor shall utilize the Government’s Information Technology Service Management (ITSM) solution and incident management systems. The Contractor shall ensure all ITSM activities are consistent with DESMF guidance IAW DoD Instruction 8440.01, Information Technology Service Management. Additional details will be provided at the Task Order level.

3.11. Supplier Management

The Contractor shall develop, execute, and deliver a Supply Chain Risk Management (SCRM) Plan. The Contractor shall scan their full spectrum supply chain and identify, assess, plan for, and mitigate actual or potential threats, vulnerabilities, and disruptions to the DAFs BIM supply chain throughout the lifecycle to ensure mission effectiveness. When assessing supply chain risks, the Contractor shall consider supply chain risk categories identified by the Department of

J-6 Base Infrastructure Modernization IDIQ Performance Work Statement Page 14 of 43 the Air Force to include but not limited to technology and cybersecurity, transportation and distribution, manufacturing and supply, product quality and design, political and regulatory, environmental risks, economic, compliance, human capital, foreign influence, and financial.

The Contractors SCRM Plan shall include a description of how the Contractor shall protect the supply chain from exploitation due to the insertion of counterfeits/malware, unauthorized production, tampering, theft, insertion of malicious software and hardware, functionality alteration, and any other elements that would allow adversaries to gain unauthorized access to data, alter data, interrupt communications, or otherwise disrupt operations. The Contractor shall inform and include the Government in any mitigations or alterations to the program.

The Contractor shall define the process for reporting incidents and shall inform the Government of incidents impacting BIM. The Contractor shall report cyber incidents to appropriate agencies and the Government PCO. The Contractor shall detail how they will adhere to recommendations found within NIST SP 800-161, latest version, which focuses on Cybersecurity (C)-SCRM. The Contractor shall detail how they actively monitor for threats to their, their suppliers, subcontractors and associated integrators supply chains with intent to proactively identify and respond to threats emanating from their supply chain. The Contractor shall establish formal processes and intervals for continuous monitoring and reassessment of their, their suppliers, subcontractors and associated integrators supply chains to proactively identify potential changes to the risk profile. The outcomes of the active monitoring and reassessments of supply chains shall be reported to PMO designated team to include Cyber Security, PM, EN, ISSM and Intelligence. If there are changes to the C-SCRM posture that cannot be adequately mitigated to within acceptable levels, as determined by the PMO, it will be grounds for termination of the contract.

The SCRM Plan shall address the broad spectrum of supply chain risks that have the potential to:

jeopardize the integrity of products, software, services, people, and technologies; compromise intellectual property; disrupt the flow of product, materiel, information, and finances needed for continued Air Force operations; and drive materiel cost increases to the program. The Contractor shall develop and execute processes for identifying supply chain risks as early as possible; the persistent and comprehensive tracking, monitoring, and re-evaluation of supply chain risks and their corresponding mitigation actions; and communicating supply chain risks to affected stakeholders and the Government. The Contractor shall incorporate the recommendations within the OMB M-22-18 memorandum for the Contractor's software and cybersecurity SCRM process.

The Contractor shall provide a Supply Chain Risk Tracking Report for identified actual and potential supply chain risks. The Contractor's SCRM program Plan and processes shall apply to the prime and their suppliers, subcontractors, associated integrators, and Contractors, spanning the entirety of the supply chain, from raw material stage to delivery of a finished product, software, and/or service.

The Contractor shall inform and work with counterintelligence agencies to address foreign intelligence threats. This shall include allowing counterintelligence agencies access to personnel who work on BIM for the purposes of briefings and debriefings. The Contractor shall allow counterintelligence agencies access to personnel and facilities for the purpose of conducting counterintelligence operation and investigations in support of BIM.

J-6 Base Infrastructure Modernization IDIQ Performance Work Statement Page 15 of 43

3.11.1. Counterfeit Protection

The Contractor shall follow all counterfeit protection, compliance and other measures specified within the TO PWS. The Contractor shall manage a risk-based counterfeit detection and avoidance program for all components, trace equipment to the original manufacturer, ensure all counterfeit measures apply to all subcontractors, and deliver only Trade Agreement Act (TAA) compliant hardware IAW FAR 52.225-5. Additional details will be provided at the Task Order level.

3.12. Place of Performance

This enterprise effort will support the worldwide presence of all USAF, USSF, Reserve, and Guard bases/garrisons and associated GSUs within the CONUS and OCONUS. GSUs will be apportioned out with their respective parent base.

3.13. Government Furnished Equipment, Information and Property

The Government will provide access to facilities, equipment, systems, software tools, and program and technical information for the Contractor to perform on Task Orders, as available and necessary. Generally, base support items such as office space, desks, telephone and printers, access to electronic mail, and computers may be made available to the Contractor if available and necessary, but specific offerings may vary and will be identified in each Task Order.

Equipment, software, or materials meeting the definition of Government Furnished Property will be identified in a list attached to the Task Orders. Individual Task Orders will specifically address requirements and offerings of Government Furnished Property.

3.14. Security

The nature of this work requires access to classified and unclassified information. The work performed by the Contractor includes access to classified and unclassified data, information, and spaces, up to a classification of Secret. The Contractor shall have the ability to create, process, and handle should the requirement exist. The Contractor may be required to attend meetings at classified and unclassified levels. Specific security requirements will be identified in each Task Order and within the associated DD-254.

All personnel employed by the Contractor in the performance of this contract, including any representative of the Contractor entering the…