Attachment_6_-_Performance_Work_Statement_(12_August_2014).pdf

AN/FMQ-22

Automatic Meteorological Station (AMS)

Performance Work Statement (PWS)

12 August 2014

REVISION HISTORY

Revision Number

Date Description Pages/Sections Affected

1.0 11 Apr 2014 Initial Document N/A

1.0.1 12 Aug 2014 Replace all References to Technical

Requirements Document (TRD) with Sensor Specification Document (SSD)

5, 7, and 22

Table of Contents

1 INTRODUCTION

1.1 Scope

1.1.1 System Baselines

1.2 Performance Objectives

2 SERVICES SUMMARY

2.1 Services Summary

2.2 References

3 PROGRAM MANAGEMENT

3.1 Program Management Plan

3.2 Meetings

3.2.1 Post Award Conference

3.2.2 Integrated Product Teams (IPTs)

3.2.3 Program Management Reviews (PMRs)

3.2.4 Technical Interchange Meetings (TIMs)

3.3 Quality Assurance

3.3.1 Quality Assurance Program Plan (QAPP)

3.3.2 Data Accession List (DAL)

3.4 Travel

3.4.1 Day-to-day CLS Travel

3.4.2 Other Travel

3.4.3 Trip Reports

3.5 Transition

3.5.1 Transition Plan

3.5.2 Ramp-up Phase

3.6 Contractor Manpower Reporting

4 PROGRAM PROTECTION PLAN (PPP)

4.1 Supply Chain Risk Management (SCRM)

5 INFORMATION ASSURANCE (IA)

5.1 Computer Resource Support

5.1.1 Air Force Standard Desktop Configuration (SDC)

5.2 System Security, Certification and Accreditation (C&A) and Networthiness

5.2.1 Security Compliance

5.2.2 C&A Documentation

5.2.3 Authorization to Connect/Interim Authorization to Test/Certificate of Networthiness (CoN)

5.2.4 IA Control Identification

5.2.5 IA Control Implementation

5.2.6 DIACAP Certification Test and Evaluation (CT&E)

5.2.7 IA Sustainment

5.2.8 Contractor Response to Security Guidance

5.3 Laptop Option CLIN

5.3.1 Air Force SDC

5.3.2 System Security, C&A and Networthiness

5.3.3 C&A Documentation

5.3.4 IA Control Implementation

5.3.5 Air Force Time Compliance Network Orders (TCNOs) and Army IA Vulnerability Alerts (IAVA)

5.3.6 Contractor Response to Security Guidance

6 SYSTEM SUSTAINMENT

6.1 On-Call Support Requirements

6.1.1 REMEDY® Usage

6.2 Contractor Performance

6.2.1 Operational Availability (Ao) Tracking

6.2.2 Mission Capability Definitions

6.3 Spares

6.3.1 Peculiar Support Equipment (PSE)

6.3.2 Item Unique Identification (IUID)

6.3.3 Commercial Warranties

6.4 Packaging, Handling, Storage, and Transportation (PHS&T)

6.5 Deficiency Reporting (DR) Process

6.6 Configuration Management

6.6.1 Configuration Status Accounting Information (CSAI)

6.7 System Manuals/TOs

6.8 Training/Training Materials

6.9 Government Furnished Equipment (GFE)

7 SYSTEM CONFIGURATION CHANGES

7.1 Government Requested Modifications

7.2 Engineering Change Proposals (ECPs)

7.3 Configuration Control Board (CCB) Process

7.3.1 Certification Test and Evaluation (CT&E)

7.3.2 Qualification Test & Evaluation (QT&E)

7.3.3 TO Verification

7.3.4 Updated Documentation

8 CONTRACT DATA REQUIREMENTS LIST (CDRLs)

8.1 CDRLs

Table 2-1 Service Summary Thresholds Table 2-2: References Table 6-1: Acts Outside Contractor Control Table 8-1: CDRLs

1 INTRODUCTION

1.1 Scope

This Performance Work Statement (PWS) establishes the requirements to provide Contractor Logistics Support (CLS) necessary to sustain the AN/FMQ-22 AMS in its approved configuration worldwide in accordance with the requirements as stated in the AN/FMQ-22 Sensor Specification Document (SSD). This includes, but is not limited to the Program Management, Logistics Support [Helpdesk Support, Maintenance, Spares and Repair Management, Operational Safety, Suitability, and Effectiveness (OSS&E) impact analysis, CCB support, Obsolescence, Systems Engineering, System Availability rate, Mission Capable rates, Mean Time Between Failure (MTBF) rate, Government Furnished Property (GFP) and/or Government Furnished Equipment (GFE) Management, materials, shipping, travel, etc.], Computer Resource Support, Engineering/Contract Change Proposals (ECP/CCP), IA, Technical Manual development and maintenance, and CDRL deliverables. The contractor shall also support and/or perform system design changes, upgrades, and enhancements due to technical refresh of component capability, obsolescence, and diminishing sources. Any travel directed by the Government, not specified under the CLS CLIN will be done under the Travel CLIN X007.

1.1.1 System Baselines

There are two system baselines referenced in this PWS. The base contract solely provides support for the system baseline while the Networked Laptop Configuration Option CLIN provides support for the secondary system baseline.

The system baseline contains a maintenance laptop that will not be connected to any DoD networks. The maintenance laptop, as it is considered PSE, will not require recurring IA related activities.

The secondary system baseline, also referred to as the networked laptop configuration, contains a laptop that will be connected to DoD networks. As such, this secondary system baseline will require recurring IA related activities to ensure the networked laptop’s continued compliance with applicable DIACAP and DoD network regulations.

The PMO is currently working to transition AN/FMQ-22s from the secondary system baseline to the system baseline. Therefore, the Network Laptop Configuration Option CLIN supporting the secondary system baseline will only be exercised if fielded AN/FMQ-22s have not been transitioned to the system baseline at the time of CLS contract award.

1.2 Performance Objectives

The Contractor shall achieve the performance objectives in accordance with this PWS and SSD.

The Contractor shall provide all labor and materials necessary to plan, manage, and execute in accordance with the requirements of this PWS and the AN/FMQ-22 SSD. Requirements described in this PWS apply to all fixed AN/FMQ-22 AMS located on US government controlled properties worldwide, including all site expansions, modifications, and upgrades underway or scheduled for the current fielded systems.

2 SERVICES SUMMARY

2.1 Services Summary

The Defense Contract Management Agency (DCMA) is the administrative office for this contract and DCMA will utilize input from the Program Manager before making quality assurance decisions (including inspection and acceptance). DCMA will audit the contractor’s processes to ensure they are in-place and will use the data from the contractor inspection reports to assess contractor performance. If the contractor does not have processes in place or does not follow their stated processes, then the contractor shall establish a corrective action plan to correct the deficiency in the manner identified by the Program Management Office (PMO)/DCMA. A Contracting Officer’s Representative (COR) assigned by the Procuring Contracting Officer (PCO) may also assist. (CDRL A016)

Table 2-1 Service Summary Thresholds

Performance Objective PWS Para Performance Threshold

The Contractor shall provide labor and material required to sustain the AN/FMQ-22 in its approved configuration in accordance with the requirements of this PWS and the

SSD.

3, 5, 6.1.1, 6.2, 6.3, 6.6, 6.7, 6.8, 6.9, 7.1

The Contractor shall not degrade the baseline capabilities of the AN/FMQ-22.

The Contractor shall maintain an Operational Availability (Ao)

6.2 Performance is acceptable when the Ao of

96% or greater.

The contractor shall meet all Helpdesk Requirements and Helpdesk Performance, including staffing, hours, trouble calls, and logging.

6.1, 6.2 The Contractor on-call support helpdesk shall be staffed for, and respond to, all technical support calls during CONUS working hours 0800 to 1700 CST, Monday through Friday, except authorized holidays.

The Contractor shall deliver spare parts to any locations as directed by the Government within 3 business days of receiving a requirement for installation in the continental United States (CONUS) and within 4 business days to installations outside the continental United States (OCONUS).

6.1, 6.2, 6.3, 6.4

On-time deliveries are achieved 85% of the time.

Contract Data Requirements to be submitted in accordance with (IAW) CDRLs

8 Deliverable items received on-time with no more than two errors corrected to error free within 10 business days at no additional cost to the Government.

2.2 References

Table 2-2: References

AF Policy Directive 33-2, Information Assurance Program DoD Directive 8500.01E, Information Assurance DoD Instruction 8510.01, DOD Information Assurance Certification and Accreditation Process

(DIACAP)

DoD Instruction 8581.01, Information Assurance Policy for Space Systems Used by the Department of Defense MIL-STD-130N, DoD Standard Practice for Identification Marking of US Military Property Technical Order (TO) 00-5-3. AF Technical Order Lifecycle Management TO 00-5-15, Air Force Time Compliance Technical Order Process TO 00-25-195, Source, Maintenance, and Recoverability (SMR) Coding of Air Force Weapons, Systems, and Equipment TO 00-35D-54 USAF Deficiency Reporting, Investigation, and Resolution MIL-HDBK-61A (SE) Configuration Management Guidance MIL-STD-3046, DoD Interim Standard Practice Configuration Management DoD 5010.12-M, Procedures for the Acquisition and Management of Technical Data DoD Instruction 5000.64 DoD Directive 8570.01-M DoD Ports, Protocols, and Services Management (PPSM) Category Assurance List (CAL) DoDI 8551.1 Ports Protocols and Services Management DoD PPSM Exception Management Process DoDI 8500.2, Information Assurance Implementation AFI 33-200 Information Assurance Management Air Force PPS Matrix, Release 4.0 AFI 33-210, Air Force Certification and Accreditation Program AFPD 33-2, Information Assurance Program, 3 August 2011 AF IT Lean Reengineering and SISSU Process Guidebook, v5.0, 24 October 2008 DISA Security Technical and Implementation Guidelines (STIGs) (latest release) DISA Security Readiness Review (SRR) scripts (latest release) NIST Publication 800-37 Revision 1, Guide for Applying the Risk Management Framework to Federal Information Systems Chairman of the Joint Chiefs of Staff Instruction (CJCSI 6510.01F) AFSSI 5021, Vulnerability and Incident Reporting AFI 33-138, Enterprise Network Operations Notification and Tracking Army Regulation 25-2 Army Information Assurance MIL-PRF-32216A, Evaluation of Commercial Off-The-Shelf (COTS) Manuals and Preparation of Supplemental Data AN/FMQ-22 Technical Requirements Document MIL-HDBK-260, Reference Data for Logistics Metrics, Table 1 AFI 21-103 Equipment Inventory, Status and Utilization Reporting, attachments 2 and 15 NISTIR 7622 Notional Supply Chain Risk Management Practices for Federal Information Systems AFI 23-101 Material Management

3 PROGRAM MANAGEMENT

3.1 Program Management Plan

The contractor shall prepare and maintain a Program Management Plan (PMP) which will detail the processes and programs by which the contractor will effectively execute the requirements of this PWS. (CDRL A013)

3.2 Meetings

The contractor shall conduct and/or attend meetings in performance of this contract to include, but not limited to, IPT meetings (by teleconference), TIMs, and PMRs, and on-site support between contractor and the Government to resolve complex system issues or deficiencies as detailed in the following paragraphs.

For all in-person PMRs and TIMs, the contractor shall provide the meeting invitation and agenda to the Government via electronic mail (e-mail) at least five (5) business days in advance of scheduled meetings (draft invitation and agenda shall be submitted ten (10) business days in advance for Government approval). The contractor shall also deliver meeting minutes via e-mail to the Government no later than 10 business days after the meeting. (CDRL A009, A010).

3.2.1 Post Award Conference

The PCO and/or Administrative Contracting Officer (ACO) shall hold a Post-Award Conference at a government facility no later than two weeks following contract award. During the Post- Award Conference the Government will, at minimum, explain each deliverable and Government expectations.

3.2.2 Integrated Product Teams (IPTs)

The Contractor shall support twenty-six (26) IPT meetings by teleconference per contract year.

3.2.3 Program Management Reviews (PMRs)

The Contractor shall hold two (2) PMRs per year. The contractor shall present program status, parts obsolescence issues and remedies, future year planning, current modification efforts, technical and programmatic issues at PMRs in Microsoft PowerPoint format. In addition, an accumulation of the monthly status reports shall be briefed at the PMR for the period preceding the PMR (since the last PMR). The PMRs are co-chaired by the Government and Contractor’s Program Managers (PM). The date(s) of PMRs shall be agreed upon by the Government and the Contractor. While PMR locations may vary, the contractor will be prepared to host all PMRs at the contractor’s facility or at a USG CONUS location. Attendees may include Government and third party contractor personnel.

3.2.4 Technical Interchange Meetings (TIMs)

The contractor shall support twenty-six (26) TIMs per year by teleconference. Additionally, the Contractor shall attend one (1) in person TIM per year at a Government facility or host at their facility unless deemed not required by the Government. Attendees at TIMs may include Government and third party contractor personnel. TIMs are used to discuss any technical topics related to the program (e.g. equipment, parts support, and test/IA issues). The date(s) of TIMs shall be agreed upon by the Government and the Contractor.

3.3 Quality Assurance

The Contractor shall deliver for Government approval a QAPP within 30 calendar days of Contract Award and provide updates annually thereafter. The contractor’s quality organization shall have the autonomy and independence to implement the quality plan. The Contractor shall identify, explain and provide corrective action for all quality issues. The Contractor shall address all unresolved quality issues at PMRs and at TIMs. DCMA will oversee all services. (CDRL A011, A016)

3.3.1 Quality Assurance Program Plan (QAPP)

As part of the QAPP, the contractor shall develop, deliver, and maintain a cross-reference matrix of contract requirements to contractor operating instructions/work instructions. The matrix shall be kept current. The contractor shall provide assistance during Government quality assurance inspections and audits upon request. The contractor shall report corrections for all discrepancies found during all inspections, audits and surveillances. The contractor shall provide, implement, and maintain a tracking system to record and track audits, surveillances, inspections, testing schedules, and results. The contractor shall track corrective actions, analyze trends, and maintain quality assurance records and data. Defense Contract Management Agency (DCMA) will oversee Quality Assurance in accordance with origin inspection required by the CDRLs.

(CDRL A011)

3.3.2 Data Accession List (DAL)

The Contractor shall provide a Data Accession List (DAL) monthly including unrestricted electronic access (downloading capability) to all documents relevant to the execution of the program during the AN/FMQ-22 contract period of performance. A DAL is utilized to track and manage all documents created in support of the contract not listed as a direct CDRL. This list could include, but is not limited to, all reports, technical studies and analysis, trade studies, lessons learned, management plans, policies, processes, procedures, meeting/working group minutes and attendee lists, trip reports, technical interchange meeting briefings, white papers, long lead item lists, configuration item lists, data packages, provisioning technical documents, technical documentation, control plan (i.e., corrosion control), IA assessments, and all other program supporting documentation. (CDRL A004)

3.4 Travel

3.4.1 Day-to-day CLS Travel

As part of the day-to-day CLS effort under CLS CLIN X001 the contractor may travel as they deem necessary, with PCO/COR approval, to sustain the AN/FMQ-22. The travel and the associated costs of day-to-day travel are the Contractor’s responsibility. Such CLS travel may include efforts such as getting a Common Access Card (CAC) for the IA or on call support personnel at the closest Real-Time Automated Personnel Identification System (RAPIDS) capable military installation as they begin IA network support, or a Contractor decision to travel to a base for what is regarded as routine helpdesk assistance and is currently handled by telephone. Technical assistance (i.e. complex outage requiring on-site maintenance) or other on-site visits not related to the day to day CLS effort under the Travel CLIN X007 (e.g. unique training requirements) may be required. Travel for OSS&E/CCB test efforts or validation/verification of a TO update may be required as listed in the OSS&E/CCB and TO paragraphs of this PWS, and any related costs shall be part of the CLS CLIN X001. The contractor shall be responsible for ensuring that the proper procedures for contractor personnel access to travel locations are adhered to by the contractor to include but not limited to completion of Letters of Introduction, Visit Requests and other travel documentation necessary for access (e.g. theater/country clearance)

3.4.2 Other Travel

Travel other than specified in paragraph 3.4.1 to Government facilities or other locations may be required when directed by the Government. All Contractor travel requirements (including plans, agenda, itinerary, or dates) shall be pre-approved by the Government (subject to local policy & procedures), and is on a strictly cost reimbursable basis. Costs for travel shall be billed in accordance with the Joint Federal Travel Regulation under Travel CLIN X007.

3.4.3 Trip Reports

The Contractor shall deliver to the PMO reports on all trips taken in conjunction with the performance of the AN/FMQ-22 CLS contract within five (5) business days of trip completion.

The reports will summarize trip dates, purpose of trip, names of travelers, places traveled, personnel visited, activities performed, and results of those activities. (CDRL A015)

3.5 Transition

3.5.1 Transition Plan

The Contractor shall have up to sixty (60) calendar days from date of contract award to transition to full operational sustainment, ensuring an orderly transition from the incumbent(s) without impact on system operations. This transition shall be accomplished in accordance with the Transition Plan, which is incorporated into the contract. The Transition Plan shall include a Staffing Sub-Plan. It shall detail how employees meet the technical requirements of this PWS.

The Staffing Plan shall reflect strategy regarding personnel recruiting and retention. If recruiting includes employees not currently employed by the Contractor, the plan shall support the intent to hire. The Staffing Plan shall describe not only staffing during the transition period, but maintaining staff throughout the contract. As part of the transition, the Contractor shall maintain a staff of core personnel. Core personnel include the personnel working the day-to-day support and engineering issues to maintain the AN/FMQ-22 CLS program.

3.5.2 Ramp-up Phase

At a minimum, the following tasks shall be accomplished within the initial ramp-up phase of the program:

Upon contract award the contractor shall implement the CLS Transition Plan. Transition from incumbent shall be completed no later than 60 calendar days following contract award, as identified in the contractor’s transition plan. The Contractor shall perform and verify a complete inventory of the GFE when the Contractor obtains the GFE from the incumbent’s facility. The contractor will receive all GFE available at time of transition period post award. Contractor is responsible for all efforts and material related to making the property available for use, such as payment of all transportation, installation and/or rehabilitation costs. The inventories shall be reported to the Government:

DCMA, ACO, PCO, and PM. The contractor shall schedule inventories with the Government in advance. Cutover date is date the contractor shall assume all tasks and requirements without reliance on incumbent. Prior to cutover date the contractor shall work with the incumbent in order to provide a seamless transition to the user. (CDRL A013, A006.)

Coordinate REMEDY training for employees that will provide Technical Support detailed in paragraph 6.1.1 no later than 5 calendar days after contract award. Training is conducted in person at Offutt AFB.

Help desk and IA personnel shall request CACs not later than five (5) calendar days after contract award. Once CACs are approved, personnel will need to travel to nearest military base to have them issued. Technical support personnel shall obtain the appropriate DoD approved IA baseline certification IAW DoD Directive 8570.01-M (IA Work Force Improvement Process). Proof of compliance must be provided to the Government not later than thirty (30) calendar days after contract award. The PMO will ensure that contractor personnel are appropriately certified with the IA Technical (IAT) Level II category, IAW DoD 8570.01-M.

3.6 Contractor Manpower Reporting

Contractor shall report all contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract for the United State Air Force via electronic Contractor Manpower Reporting Application (eCMRA) a secure data collection site.

The contractor is required to completely fill in all required data fields at http://www.ecmra.mil.

Reporting inputs will be for the labor executed during the period of performance for each Government fiscal year (FY), which runs 1 October through 30 September. While inputs may be reported any time during the FY, all data shall be reported no later than 31 October of each calendar year. Contractors may direct questions to the CMRA help desk.

Reporting Period: Contractors are required to input data by 31 October of each year.

Uses and Safeguarding of Information: Information from the secure web site is considered to be proprietary in nature when the contract number and contractor identity http://www.ecmra.mil/ are associated with the direct labor hours and direct labor dollars. At no time will any data be released to the public with the contractor name and contract number associated with the data.

User Manuals: Data for Air Force service requirements must be input at the Air Force CMRA link. However, user manuals for government personnel and contractors are available at the Army CMRA link at http://www.ecmra.mil.

4 PROGRAM PROTECTION PLAN (PPP)

4.1 Supply Chain Risk Management (SCRM)

The contractor shall develop, implement and maintain a Supply Chain Risk Management Plan IAW the most current version of the NISTIR 7622. This plan shall address Level I and Level II CC as identified after final approval of CPI/CC list. The contractor shall implement the guidance for handling of counterfeit material IAW procedures contained within AFI 23-101 Section 5J.

(CDRL B002)

5 INFORMATION ASSURANCE (IA)

5.1 Computer Resource Support

The AN/FMQ-22 Contractor shall be responsible for updating, maintaining, modifying, integrating and managing the configuration of software. Software includes operational, maintenance and diagnostic programs for installed equipment, support equipment, software licenses, and training equipment. The Contractor shall be responsible for obtaining, transferring, updating, and maintaining all end user software licenses and maintaining all device drivers. The Contractor shall maintain commercial licenses customarily provided to the public on behalf of the Government, subject to such licenses being consistent with U.S. Federal procurement law in all commercial computer software (including updates) and commercial computer software documentation (including updates) delivered under the contract. The Government shall have all rights specified in the license under which the commercial computer software or commercial computer software documentation was obtained.

5.1.1 Air Force Standard Desktop Configuration (SDC)

The AN/FMQ-22 Laptop is currently the Air Force SDC and Federal Desktop Core Configuration (FDCC). Additionally the laptop spares delivered as GFE are configured with Air Force SDC and FDCC. The Contractor shall test all future releases of required software updates within thirty (30) days of receipt from the PMO. (CDRL A006)

5.2 System Security, Certification and Accreditation (C&A) and Networthiness The AN/FMQ-22 Contractor shall examine and analyze the security safeguards of the AN/FMQ- 22 software and hardware components to ensure that appropriate security measures are implemented for each applicable environment so the AN/FMQ-22 satisfies the system security requirements of the below:

http://www.ecmra.mil/

DoD 8510.01, DoD IA C&A Process, 28 November 2007 Vulnerability Assessment Reports Directory DoDD 8500.1E, IA, 24 October 2002 DoDI 8500.2, IA Implementation, 6 February 2003 AFPD 33-2, IA Program, 3 August 2011 Air Force IT Lean Reengineering and SISSU Process Guidebook, v5.0, 24 October 2008 NIST Publication 800-37 Revision 1, February 2010 Chairman of the Joint Chiefs of Staff Instruction (CJCSI 6510.01F), 9 February 2011

Command and Control (C2) Platform Information Technology (PIT) C&A Process Guide, v1.0, 18 April 2011AFI 33-210_AFGM2.2 Air Force Guidance Memorandum to AFI 33-210, Air Force C&A Program (AFCAP), 20 March 2012

IA Platform Information Technology Guidebook, v1.5, 19 December 2013

The contractor shall maintain cognizance of the above mentioned processes and its requirements and adapt the AN/FMQ-22 security process to follow any updates to the DoD C&A Process and requirements from the C2 PIT Office. (CDRLs A007 & B003)

5.2.1 Security Compliance

The Contractor shall ensure a secure, certifiable and accreditable AN/FMQ-22 is maintained IAW Department of Defense (DoD) Instruction (DoDI) 8510.01 DIACAP, C2 PIT C&A Process Guide, v1.0, IA Platform Information Technology Guidebook, and AFPD 33-2, IA Program. The Contractor shall assist the United States Air Force (USAF) by providing data and documentation which adheres to the Air Force implementation of DIACAP and AFCAP to allow the system to continue to obtain an Authority to Operate (ATO) and Authority to Connect (ATC) to the Air Force Global Information Grid (GIG) and Army networks. Where such capabilities are required in the system, the Contractor shall use only approved IA or IA-Enabled products.

5.2.1.1 IA Product

Product or technology whose primary purpose is to provide security services (e.g., confidentiality, availability, integrity, authentication, access control or non-repudiation of data);

correct known vulnerabilities; and/or provide layered defense against various categories of non-authorized or malicious penetrations of information systems or networks.

Examples include such products as data/network encryptors, firewall, and intrusion detection devices. (DoDI 8500.2 IA Implementation). http://www.niap-ccevs.org/cc-scheme/

5.2.1.2 IA-Enabled Product

Product or technology whose primary role is not security, but which provides security services as an associated feature of its intended operating capabilities.

Examples include such products as security-enabled web browsers, screening routers, operating systems, and security-enabled messaging systems.

http://www.niap-ccevs.org/cc-scheme/

5.2.2 C&A Documentation

The Contractor shall assist the Government by preparing a comprehensive DIACAP C&A package that is required to type-certify and type-accredit AN/FMQ-22 increments and complies with the policy and requirements of the documentation listed in paragraph 5.2 of this document.

The Contractor shall provide the following sections of a Comprehensive DIACAP package:

1. System Identification Profile (SIP)

2. DIACAP Implementation Plan (DIP)

3. System Security Plan (SSP)

4. Hardware List

5. Software List

6. System Topology

7. Artifacts (supporting documentation) as required.

Supporting artifacts shall consist of documentation created as a result of other system and program requirements. The government will deliver the current C&A Documentation to the Contractor after contract award. C&A documents will be updated by the Contractor on a quarterly basis with any known issues or findings from the quarterly scans run by the Contractor and from the Plan of Action & Milestones POA&M sustainment meeting held by the PMO.

(CDRL A007)

All C&A documentation shall be updated as required for re-accreditation.

5.2.3 Authorization to Connect/Interim Authorization to Test/Certificate of Networthiness (CoN)

The Contractor shall support the Government in obtaining a C2 PIT ATO, Air Force ATC, Army ATO, Army CoN and any specific theater clearances required for all AN/FMQ-22 increments.

Such support will be accomplished by preparing required documentation and supporting the Air Force Information Technology Lean/ Security, Interoperability, Supportability, Sustainability, Usability process.

5.2.3.1 Air Force Electronic Mission Assurance Support System (eMASS) Database The Contractor shall assist the IA Manager and IA Analyst with the Air Force eMASS database entries. This includes answering/assigning applicable IA Controls, uploading supporting artifacts and summaries of scan/test results. The Contractor shall support the program manager in a producer role for AN/FMQ-22 assigned IA controls in accordance with the DIACAP process, including direction provided in DOD Directive 8500.01E (IA Policy) and DOD Instructions

8500.2 (IA Implementation), and (DIACAP). This includes all network security driven requirements required by DOD DIACAP/GIG direction.

5.2.4 IA Control Identification

Based on the Mission Assurance Category (MAC) II and Confidentiality Level (CL) Sensitive for the system, the Contractor shall implement all IA controls as detailed by DODI 8500.2 in the

DIP (CDRL A007).

5.2.5 IA Control Implementation

IA control requirements are derived from the DIACAP documentation referenced in paragraph

5.2 of this document. The Contractor shall detail within the DIP the implementation details. The Contractor shall detail how the identified IA controls for the system are met and what documentation supports that implementation. To ensure compliance, the Government will provide guidance and test tools to the Contractor to assist the contractor in ensuring proper configuration and verification of IA controls for the system.

These will include but are not limited to the following:

NSA IA Guidance Documents (latest release)

5.2.6 DIACAP Certification Test and Evaluation (CT&E)

The Contractor shall support two formal CT&E test events as required for re-accreditation purposes. These tests will be conducted in accordance with Government-provided specific testing entry and exit criteria leading to appropriate C&A. The AN/FMQ-22 Contractor will provide inputs to the test plans and procedures, participate in Test Readiness Review (TRR), test events, and will assist the Government in all security related testing in accordance with the documentation listed within paragraph 5.2.

The program office may send representatives from a Government organization, such as the 46th Test Squadron, Eglin AFB, FL, to conduct the applicable security testing of the systems as the certified independent assessor. All CT&E’s will be held at a CONUS location. The Contractor shall be expected to provide representation, if needed, per the request of the Government, in order to answer any questions presented by the independent assessor.

The Contractor shall resolve identified security vulnerabilities/deficiencies identified from the various security test events and assist the program office document in the POA&M with any security weaknesses associated with an IA Control allocated to the system that are detected but not resolved or mitigated. If required by the Government, the Contractor shall conduct certification regression testing which demonstrates that vulnerabilities/deficiencies have been resolved. The Contractor shall be responsible for correcting and re-testing vulnerabilities /deficiencies identified during either Contractor or Government testing.

5.2.7 IA Sustainment

The Contractor shall assess the impact to the security architecture as new increments, builds, requirements or components are added. If changes impact the posture of the security support structure and re-accreditation is required, the Contractor shall prepare updated documentation and submit to the Government. Changes to the security architecture may result in the need for re-accreditation as documented in paragraph 5.2 of this document.

5.2.8 Contractor Response to Security Guidance

As new or updated security guidance and/or policy are released, the Contractor shall test the AN/FMQ-22 baseline against the new guidance and provide the Government with the test results. If security CAT I, CAT II, or CAT III vulnerabilities are identified, the Contractor, as directed by the Government, shall correct those deficiencies and release instructions, installation scripts, and GPO’s to the field to correct those vulnerabilities. If required, the Contractor shall provide updates to the Ports, SSP and other system documentation to reflect system changes.

5.3 Laptop Option CLIN

This option CLIN will only be exercised if fielded AN/FMQ-22s have not been transitioned to the system baseline at the time of CLS contract award and requires the sustainment of the networked laptops (reference paragraph 1.1.1). Therefore, the baseline supported by this Networked Laptop Configuration Option CLIN must meet the IA requirements in paragraph 5.3.

5.3.1 Air Force SDC

The Contractor shall maintain the Air Force SDC and FDCC within the AN/FMQ-22 system as directed by the PMO. The Contractor shall assist with the implementation of the Host Based Security System (HBSS) which includes Host Intrusion Prevention System (HIPS), in support of HBSS. The Contractor shall test all future releases of required software updates, SDC/FDCC and HBSS within 30 days of receipt from the PMO. If HBSS issues arise in the field, these issues will be addressed through the standard help desk procedures.

5.3.2 System Security, C&A and Networthiness

In addition to the requirements listed in paragraph 5.2, the AN/FMQ-22 Contractor shall examine and analyze the security safeguards of the AN/FMQ-22 software and hardware components to ensure that appropriate security measures are implemented for each applicable environment so the AN/FMQ-22 satisfies the system security requirements of the below:

DoD PPSM (Ports, Protocols, and Services Management) Category Assurance List (CAL), 22 November 2013

DODI 8551.1 PPSM, 13 August 2004 DOD PPSM Exception Management Process, 6 August 2013 Air Force PPS Worksheet, Release 8.0.3, 29 January 2014 DISA STIGs (latest release) DISA Security Readiness Review (SRR) scripts (latest release)

The contractor shall maintain cognizance of the above mentioned processes and its requirements and adapt the AN/FMQ-22 security process to follow any updates to the DoD C&A Process and requirements from the C2 PIT Office.

5.3.3 C&A Documentation

In addition to the DIACAP package sections listed in paragraph 5.2.2, the Contractor shall provide the Ports, Protocols, and Services (PPS) input. (CDRL B003)

5.3.4 IA Control Implementation

IA control requirements are derived from the DIACAP documentation referenced in paragraph

5.2 of this document. The Contractor shall detail within the DIP the implementation details. The Contractor shall detail how the identified IA controls for the system are met and what documentation supports that implementation. To ensure compliance, the Government will provide guidance and test tools to the Contractor to assist the contractor in ensuring proper configuration and verification of IA controls for the system.

In addition to the guidance in paragraph 5.2.5 the following guidance and tools should be referenced:

DISA STIGs (latest release)

DISA Security Readiness Review (SRR) scripts (latest release)

DISA Secure Configuration Compliance Validation Initiative (SSCVI) Audit tool with Retina Engine (latest release)

TCNOs

ACAS/Nessus

5.3.5 Air Force Time Compliance Network Orders (TCNOs) and Army IA Vulnerability Alerts

(IAVA)

The Contractor shall participate in the Government’s Computer Emergency Readiness Team (CERT) process Air Force TCNOs and Army IAVA in addition to all TASKORDs, OPORDs and WARNORDs in accordance with AFI 33-138, Enterprise Network Operations Notification and Tracking, Army regulation 25-2, IA and LCMC TCNO Management Plan. The Contractor shall review Orders and IAVAs (including IA Vulnerability Bulletins, and IA Technical Tips), for applicable components within ten (10) days of issue. If the Order is applicable, the Contractor shall test the recommended mitigation within twenty (20) days of determination. The Contractor shall distribute any patches (consistent with LCMC TCNO Management plan) required to close the vulnerability. Patches are to be distributed on a quarterly basis to all applicable systems via electronic means. In situations requiring more frequent updates, the Contractor will test security patches and implement in a manner that will not impact mission operations. Urgent patches need to be tested within three (3) business days of their release and distributed to the field within five

(5) business days. (CDRL B003)

5.3.6 Contractor Response to Security Guidance

In addition to the requirements in paragraph 5.2.8, if required, the Contractor shall provide updates to the PPS and other system documentation to reflect system changes. (CDRL B003)

6 SYSTEM SUSTAINMENT

6.1 On-Call Support Requirements

The Contractor on-call support helpdesk shall be staffed for, and respond to, all technical support calls during CONUS working hours 0800 to 1700 CST, Monday through Friday, except authorized holidays. Contractor shall provide direct phone numbers for the Air Force Weather Agency (AFWA) Fielded Systems Service Center (FSSC) and field users.

The Contractor shall work to isolate the issue to a Line Replaceable Unit (LRU). LRUs are defined in PWS Section 6.3.1. If the LRU must be replaced, the Contractor shall ship a replacement LRU to the site IAW the timelines in paragraph 6.4. Following receipt of the replacement LRU, the site will ship the failed LRU to the Contractor for repair in prepaid shipping container provided by the CLS Contractor.

6.1.1 REMEDY® Usage

The Contractor shall utilize the AFWA REMEDY® trouble ticket management system, via web-based login, to update the maintenance database “call log” for each ticket assigned to the Contractor.

The Contractor is responsible for the management of the parts/LRUs and fault monitoring including a full description of the fix action once an outage has been resolved. The Contractor shall ensure that all contact between the FSSC, the site or the PMO with the Contractor related to a specific trouble ticket is recorded in the AFWA FSSC REMEDY® trouble ticket database system. The updates shall include at a minimum: contact information, date of contact, subject, a reference, description of problem, description of action taken, action taken date, shipment tracking number, root cause of issues. Any significant changes to a ticket status shall be updated in REMEDY® immediately.

6.2 Contractor Performance

The contractor shall sustain the AN/FMQ-22 in its current configuration worldwide, on a monthly basis, with an Ao of 96%.

Ao = (Total MC time)/(Total MC time + Total NMC time)

FMC - Full Mission Capable. The system is capable of doing all of its assigned missions. The formula for FMC rate = FMC hours/Possessed hours. All PMC and NMC hours are excluded in this formula.

PMC – Partially Mission Capable. The system is capable of doing one or more of its assigned missions, but not all. The formula for PMC rate = PMC hours/Possessed hours.

MC - Mission Capable. Includes FMC and PMC time. The formula for MC hours = FMC hours + PMCM hours + PMCB hours + PMCS hours. The MC rate is determined by FMC hours + PMCM hours + PMCB hours + PMCS hours/Possessed hours. All NMC hours are excluded in this formula. IAW AFI 21-103

NMC – Non Mission Capable. IAW AFI 21-103, the AN/FMQ-22 is NMC under any of the following conditions:

• If the data acquisition unit (data logger) is inoperative

• If any sensor necessary to report ceilings, visibility, winds, altimeter setting and/or discontinuity group sensor is inoperable

• If all system meteorological sensors are inoperative such that the system is not providing any usable data

6.2.1 Operational Availability (Ao) Tracking

The Government will track Ao via an automated monthly report generated from REMEDY®. If the monthly Ao is below 96%, the government will factor in acts outside of the Contractor’s control as listed in Table 6-1. After the adjustment, if the Ao remains below 96%, the Government will request that the contractor provide additional justification for the rating.

However, the government is the sole arbiter of applicable acts outside of the Contractor’s control.

Table 6-1: Acts Outside Contractor Control

6.2.2 Mission Capability Definitions

6.2.2.1 IAW AFI 21-103, the critical path is defined as that data most important to the Meteorological Aviation Report (METAR). That data includes: wind speed and direction, cloud cover and heights, visibility, and barometric pressure.

6.2.2.2 If the data acquisition unit (data logger) is inoperative, the system is NMC.

6.2.2.3 If any sensor necessary to report ceilings, visibility, winds, and/or altimeter setting is inoperative, the system is NMC. If any other sensor is inoperable, the system is considered PMC

6.2.2.4 If all system meteorological sensors are inoperative such that the system is not providing any usable data, report system NMC.

6.2.2.5 In all other situations, the system is Fully Mission Capable (FMC).

6.2.2.6 If an automated observing system is operating at PMC or NMC due to an event outside the scope of the CLS provider as identified in this PWS, i.e. a separate contract with the base makes a change that has an effect on data reporting or Airfield Maintenance is unable to make repairs due to other priorities, then the Contractor shall not include those operating hours as part of the availability formula above. The Contractor shall report this as part of the Monthly Status Report. (CDRL A017)

Natural disaster (earthquake, tornado, hurricane and flooding), does not include lightning if system is properly employing lightning ground system.

Acts of war (damage from weapons) Government travel time before troubleshooting begins Government delay in implementing parts replacement/field repairs.

Government loss/destruction of LRU, does not include normal wear & tear/PMI

6.3 Spares

The Contractor shall implement a spares management program to support metrics required in paragraph 6.2. The Government will provide documentation from the Provisioning Conference, which will identify the recommended sparing levels, SMR codes, and a suggested list of PSE.

These documents from the Provisioning Conference are provided for informational purposes only and do not change any of the other requirements stated within the PWS. Contractor is responsible for all efforts and materials related to keeping the spares available for use, including rehabilitation/repair costs. The spares management program shall be documented in the PMP.

The Contractor shall comply with all contractual clauses related to GFE. (CDRL A003, A006)

6.3.1 Peculiar Support Equipment (PSE)

For the AN/FMQ-22 system, the following PSE shall be maintained as part of the AN/FMQ-22 system.

PSE (see pg. 1-1 in TO)

• PWA12 – PWD22 Field Calibrator (provided)

• WS425 Verifier – Zero Speed Verifier (provided)

• Calibrated Temperature and Humidity Reference (PTB330TS or equivalent w/optional

HMP155 Temp/Hum probe.) 1 Calibrated Barometric Pressure Reference (e.g., PTB330TS or equivalent)

• TACPDA (provided), to be replaced by Maintenance laptop)

• Tilting Support (provided)

• Step ladder (minimum 6 feet)

• Work Gloves

• Maintenance Laptop (with Software)

• Maintenance Cable

• Winch

FMQ-22 LRU LIST - based on LRU install/removal procedures in TO

• Data Collection Platform (DCP-520) (radiation shield),

• Obstruction lights

• Air Temperature, and Relative Humidity Sensor QMH102M

• Aspirated Shield MO76B4

• WMT703 Ultrasonic Wind Sensor (new)

• WS425 Ultrasonic Wind Sensor (old)

• PTB330 Pressure Transducer (new)

• PTB220 Pressure Transducer (old)

• HMP155 Humidity and Temperature Sensor (new)

• HMP45 Probe

• QMH102M Temperature and Relative Humidity Sensor (old)

• Present Weather/Visibility Detector (PWD22)

• Lightning Detector (SA20MP)

• Ceilometer (CL31)

• Communications Unit (QCA520)

• Rain Gauge (RG13M)

6.3.2 Item Unique Identification (IUID)

The Contractor shall maintain the IUID labels (markings) on all spares IAW the contract and Government approved IUID marking on existing AN/FMQ-22 system equipment (which utilizes construct 2- serialization within the original part number). The Contractor shall enter marked items into the IUID registry and report to the Government when items entered into the registry, which is located at https://www.bpn.gov/iuid. New spares acquired during the course of this contract costing $5,000 or more, mission essential or special interest items, as identified by the Government and less than $5,000, shall require IUID in the contract. The Contractor shall be responsible for the labeling of these new spares IAW marking on existing AN/FMQ-22 system equipment. The Contractor shall enter these marked items into the IUID registry and report to the Government when items entered into the registry. The contractor shall report all IUID marking activity, validation and verification to the Government. The Contractor shall be responsible for identifying new candidate parts for inclusion in the IUID program. (CDRL A008)

6.3.3 Commercial Warranties

The Contractor shall pass any commercial warranties obtained from the Original Equipment Manufacturer (OEM) and/or vendors on to the Government for all repair components; but as a minimum, the warranty shall not be in contravention to Federal acquisition law (including the prohibition against indemnification by the Federal Government). (CDRL A014)

6.4 Packaging, Handling, Storage, and Transportation (PHS&T)

The Contractor shall use standard commercial packaging in accordance with American Society for Testing and Materials (ASTM) D3951, Standard Practice for Commercial Packaging, for PHS&T of AN/FMQ-22 materials. The Contractor shall ensure compliance with all necessary US and foreign nation Customs and State Department directives/procedures to prevent delays in shipments to and from foreign sites. The contractor may request the assistance of the US Government to ship materials for them via US Government channels if no commercial shipping is available. If Government shipping is approved, the contractor shall hold shipments until the shipping can be provided. If the site is required to return a part to the contractor, they shall reuse the package and shipping materials that the “new” part was provided in and shall be provided with a return pre-paid shipping label. The Contractor shall ship replacement parts upon Remedy notification of part failure within 3 business days to locations in the CONUS and within 4 business days OCONUS.

6.5 Deficiency Reporting (DR) Process

DR will be done in accordance with TO 00-35D-54. As directed by the Government, the Contractor shall research the cause and present potential solutions for AN/FMQ-22 DRs against current SSD or PWS requirements. The contractor shall track DRs in accordance with TO 00- 35D-54, paragraph 1.4.6. The Contractor shall brief all open DRs at the PMRs and in-person

TIMs. The Contractor shall report status of open DRs in the Monthly Status Report. (CDRL A012)

6.6 Configuration Management

The Contractor shall provide configuration management and status accounting of the AN/FMQ- 22 hardware, software, firmware and documentation for all items supported under this contract in accordance with the Configuration Status Accounting Information (CSAI). The Contractor shall provide an ECP and/or a Request for Variance (RV) IAW paragraph 7.2 for any possible modifications, upgrades, and enhancements to the systems. (CDRLs A001, A002, A003)

6.6.1 Configuration Status Accounting Information (CSAI)

The contractor shall maintain and deliver CSAI lists for each site. The list will be broken down to the contractor’s anticipated depot lowest-level of repairing and replacing of equipment and include the OEM of each piece of equipment. If the contractor modifies an OEM’s equipment for use in the AN/FMQ-22 system, the contractor shall identify both the OEM and themselves.

(CDRL A003)

6.7 System Manuals/TOs

The Contractor shall maintain the current COTS Manual/TO in accordance with the process as defined in TO 00-5-3 AF TO Lifecycle Management and CDRL B001 with attachment, TM 86- 01N. The contractor shall be responsible for providing adequate, safe and accurate TOs which conform to Government requirements. The Government will provide the current “Technical Manual, Maintenance and Troubleshooting Guide with Illustrated Parts Breakdown (IPB) AMS AN/FMQ-22” to the Contractor. The contractor shall be responsible to ensure TOs and data are written to a scope and depth of coverage sufficient to support the operations and maintenance concepts and to the Reading Grade Level (RGL) specified in MIL-PRF-32216A, Evaluation of COTS Manuals and Preparation of Supplemental Data. The IPB must contain part numbers discerning parts that have been superseded through obsolescence, upgraded, or used on a specific serial numbered AN/FMQ-22 (s). Upon final verification by the Government, after the Contractor has satisfied all regulation and technical requirements, the Government will submit the TO changes to the TO Manager (TOMA). (CDRL B001)

The Contractor shall not include any copyright or proprietary material that restricts the Government from reproduction or distribution of the manual as required by the distribution statement as identified in CDRL B001. The TO shall include all information necessary for operation, maintenance and servicing (preventive and corrective), preparation for use and installation, or training purposes.