PERFORMANCE WORK STATEMENT (PWS)

for

MAINTENANCE, REPAIR AND OVERHAUL (MRO)

Oracle eBS Applications Database Administrator Support

FA8770-26-MRODBA_SS_RFI

27 May 2026

Version 1.0

Table of Contents

1. Organization

2. Scope of Work

2.1. Required Support

2.1.1. Task Descriptions

2.1.2. Required Skills and Qualifications

2.1.2.1.Additional Desired Skills

2.1.3. Increased Capability and Emerging Requirements

2.1.4. Kick Off Meeting

2.1.5. Transition Meeting

2.1.5.1.Contractor Transition at Contract Start

2.1.5.2.Transition at Contract Conclusion

2.1.6. Collaboration and Technical Interchange Meetings

2.1.7. Monthly Status Reports

2.1.8. System Documentation

2.1.9. Practice, Process, Policy Analysis, and Adoption

2.2. Services Delivery Summary

2.3. Contractor Personnel Requirements

3. General Information

3.1. System Requirements

3.1.1. Personnel Investigations, Clearances, and Computer and Network Access

3.1.2. Common Access Card

3.1.3. Local Security Requirements

3.1.4. Security and Protection of Information

3.1.5. Operations Security

3.1.6. Required Security-Related Training

3.1.7. In-Processing

3.1.8. Out Processing

3.2. Place of Performance

3.3. Hours of Work

3.4. Telecommuting/Telework

3.5. Vacancies and Turnovers

3.6. Travel Requirements

3.7. Privacy Act

3.8. Performance of Services during Crisis Declared by National Command Authority or Overseas Combatant Commander

3.9. Performance of Services during Emergency Conditions Declared by Wright-Patterson AFB Authority 23

3.10. Voluntary Protection Program (VPP)

3.11. Section 508 of the Rehabilitation Act of 1973 – N/A

3.12. Contractor Performance Assessment Report (CPAR) Applicability

3.13. Contractor Officer Responsibility (COR)

3.14. Quality Assurance

3.15. Contractor Liability

4. Government Furnished Property and Services

4.1. Facilities, Supplies, and Services

4.2. Workspace

4.3. Computer Resources

4.4. Access

4.5. Information Sources

4.6. Access Personnel

4.7. Documentation

5. Points of Contact

5.1. Government Points of Contact

5.2. Contractor Point of Contact

6. Contract Data Requirements List (CDRL)

7. Revision History

1. Organization The Maintenance, Repair, and Overhaul (MRO) is a Doctrine, Organization, Training, Materiel, Leadership and Education, Personnel, Facilities – Policy (DOTMLPF-P) transformation and standardization of both the business processes and enabling materiel solution which provides Air Force Sustainment Center (AFSC) with an integrated capability for planning, scheduling, and executing organic depot maintenance to support agile planning, optimized workload assignment, resource allocation, and integrated quality. The MRO materiel solution is a web-enabled system operating wholly within the .mil network. It implements a configured Oracle enterprise Business Suite (eBS) Commercial Off-The-Shelf (COTS) software product with 'complex MRO' and Supply Chain Management (SCM) modules, which integrate and automate key business processes, including procurement, manufacturing, inventory, and order fulfillment to enhance visibility and efficiency being the core module for user interaction. This is supplemented with the integration of other necessary eBS suite modules plus Reports, Interfaces, Conversions and Extensions-Workflows (RICE-W) objects which are deemed necessary to provide the required functionality. MRO operates within a Government-approved environment, and interfaces with various legacy systems to support continuous operations within the depot maintenance environment.

2. Scope of Work The Scope of this Performance Work Statement (PWS) covers all the tasks necessary for the Oracle Applications Database administrators to provide technical direction on and support to the integration of MRO solution components with OCI, Exadata Cloud Services and Cloud 1, ERP Common Services, the System Implementer, and interface trading partners. This includes support relating to the architecture, design, installation, configuration, integration of products and services, performance and operations of the MRO software solution components. These roles shall assist Defense Information Systems Agency (DISA), Enterprise Resource Planning-Common Services (ERP-CS), Cloud 1, Cloud Service Providers, Program Management Office (PMO) architects, System Implementer (SI) and PMO developers to instantiate and maintain multiple instances of the Oracle eBS R12.2.X/Oracle Fusion or later including Oracle ERP Cloud applications, and applicable technology stack components in all Government-approved environments to include, but not limited to: DISA Enclaves, Cloud Environments including Oracle Cloud Infrastructure (OCI), Exadata Clouds Services and Cloud 1 (development, test, training, reporting, data conversion, staging, production and disaster recovery).

2.1. Required Support

The Contractor shall provide dedicated FTEs at time of contract award. Work described in this PWS and as outlined in section 2.1.1 is to begin upon contract award.

2.1.1. Task Descriptions

The Contractor shall deliver the products and services set forth in this PWS in support of the MRO program, managed by the PMO. The Contractor shall accomplish database and application administration in accordance with Oracle best practices, including but not limited to the following activities:

• Provide technical direction on integration of MRO solution components with DISA, OCI, Exadata Cloud Services and Cloud 1, ERP-CS and the System Implementer. As directed and approved by the Government Contracting Officer, the Subject Matter Expert (SME) personnel may be utilized to support other AFLCMC/PEO BES programs/systems (See attachment 1) within the scope of the tasks outlined in this PWS.

• Tracking and monitoring the development, test, training, reporting, production and disaster recovery environments, and support issue resolution

• Implementation and maintenance of application and database security

• Provide assistance with DISA and Oracle Security Technical Implementation

Guides (STIG) and remediation of STIG findings

• Interface with Oracle Support and other stakeholders for technical issue resolution

• Assist development and support staff with analysis of query execution plans and costing

• Security and Compliance: Enforce security policies, audit user activities, and support SOX or IT compliance requirements.

• Workflow Administration: Administer and troubleshoot Oracle Workflow Mailer, background processes, and notification systems.

• Implementation, upgrade, and tuning of large Oracle eBS environments as necessary

• Identify and implement system performance tuning and optimization enhancements. End user account creation, modifications and maintenance within eBS instances

• Troubleshoot problems related to databases, applications, development tools and integrations with other system components and trading partner systems

• Assist with development and implementation of automation procedures

• Proactive patch identification, assessment and application in an Oracle eBS environment

• Coordinate OS database, WebLogic, application and other solution component upgrades

• Perform E-Business Suite application and database administration tasks as required Key Aspects of EBS Application Administration

• System Administration & Security:

• User Management: Creating users, assigning responsibilities, and managing security profiles.

• Function & Data Security: Implementing security to restrict access to menus (forms, HTML pages) and specific data records.

• Concurrent Processing: Managing background requests, reports, and concurrent managers to ensure efficient processing.

• Maintenance & Performance:

• Patching: Applying patches to fix issues or upgrade components.

• System Monitoring/High Availability: Using the Administration dashboard and OAM to monitor system health, performance, and configurations.

• Start/Stop Services: Managing the application tier, including web, forms, and concurrent processing servers.

• Tools for Administration:

• Oracle Applications Manager (OAM): An HTML-based tool for monitoring, diagnosing, and configuring the EBS system.

• Oracle Enterprise Manager (OEM): Used for managing, monitoring, and tuning application performance.

• Architecture & Environment:

• Application Tier: Managing the middle tier that processes business logic, including HTTP, Java, and Forms services.

• Cloning & Backups: Handling environment copies for testing or production.

• Work on the entire lifecycle of an instance from implementation to potential upgrades for new environments as required

• Engage in day-to-day activities such as cloning, patching, performance tuning, capacity planning and monitoring all aspects of eBS system administration, user management, security, backup/disaster recovery, SR management, documentation, etc.

• Work with peers and extended teams to mentor, support and implement new and enhanced solutions to increase team productivity and improve Service Level Agreements (SLAs)

• Responsible for contribution and adherence to standards that ensure integrity and security of the enterprise’s data resources

• Undertake technical evaluation of new and/or prospective implementations and work with vendors where required

• Manage and work around issues or roadblocks in all phases of the SDLC lifecycle of the projects

• Performance tuning, problem determination, analysis and correction of Oracle E- Business Application environments

• Creating, maintaining, and reviewing environment procedure documentation (e.g.

Instance Strategy and Backup and Recovery Strategy)

• 24/7 Emergency response for a 24/7 production environment

• Definition and implementation of high availability solutions using technologies such as Oracle RAC and application clustering, Backup and Disaster Recovery using Data guard, Oracle Recovery Manager (RMAN) configuration and Setup Provides guidance to the PMO on architectural decisions that have impact to/on the performance and scalability of the solution

• Define operational procedures and create/review system documentation (CDRLs and Standard Operating Procedures (SOPs)) and any other documentation the government needs

2.1.2. Required Skills and Qualifications

• Minimum of seven years of Oracle eBS R 12.2.X/Oracle Fusion DBA or four years of PEO/BES eBS DBA experience

• Strong understanding of Oracle Relational Database Management System (RDBMS) architecture including Oracle Real Application Clusters (RAC), 12c and 19c databases and Database as a Service cloud offerings

• Strong understanding of Multi – Tenant Container and pluggable databases

• Ability to collaborate at all skill levels within the DBA team and across internal/external stakeholders

• Five years of experience working in an Oracle-Engineered infrastructure/hardware (Exadata, Private Cloud Appliance (PCA), Zettabyte File System (ZFS)) or three years of PEO/BES infrastructure/hardware experience

• Minimum three years’ experience or strong knowledge with cloud based Oracle eBS application and database administration

• Experience with environment provisioning via Infrastructure as Code using tools such as Terraform

• Experience with techniques to keep the environments secure including data encryption. Moderate to expert programming expertise in PL/SQL and SQL

• Working knowledge of Oracle WebLogic Server Administration

• Working knowledge of Oracle RAC databases, Application

Clustering (AC), Automatic Storage Management (ASM), Disaster Recovery (DR) setups, High availability system and knowledge of F5 load balancers

• Use of Oracle Enterprise Manager (OEM) 12c/13c for monitoring and management of databases

• Working knowledge of Solaris and/or Linux

• Experience in DevSecOps pipeline tools (i.e. Jenkins, BitBucket, and

Ansible) or any other Government approved tools

2.1.2.1. Additional Desired Skills

• Middleware for Oracle Fusion, Oracle Identity and Access Management (OIAM), Oracle Application Express (APEX), Oracle Service Oriented Architecture (SOA), Oracle Advanced Security, Oracle Applications Manager (OAM), Oracle Enterprise Manager and Oracle Wallet

• FlexDeploy and Config Snapshot Applications

• Oracle Apps Database and OCI Certification desirable

2.1.3. Increased Capability and Emerging Requirements

• Increased capability or emerging requirements may develop as the MRO solution evolves which may require expertise for application architecture, infrastructure architecture, and/or IT technical support to satisfy mission requirements. These requirements may include, but are not limited to, the following:

• Provide research and coordination with supporting organizations to ensure the MRO capability initiative is migrated to approved Air Force technology networks

• Provide business operations support for MRO and AF Logistics Complex organizations

• Understand, validate and track the holistic view of the software, hardware, integration, compatibility and alignment with overall MRO solution

• Consider changes to the technology usage to optimize sustainability, cost management and positioning against future technology trends and Air Force direction and provide guidance to the MRO PMO

• Monitor and evaluate software, hardware, network and Cybersecurity design changes and their overall impact to system performance, functionality, security and scalability

• Monitor application and system status and maintain the COTS and RICE object upgradability while minimizing impacts to/on the business processes

• Understanding best practices and execution of DevSecOps pipeline by enabling application security, secure deployment and operations in alignment with mission objectives and the nine phases of the software lifecycle.

• Monitoring and execution of the Continuous Integration, Continuous Delivery and Continuous Deployment (CI/CD) pipeline and have a strong understanding of the differences between Continuous Integration, Continuous Delivery, and Continuous Deployment

2.1.4. Kick Off Meeting

The Contractor shall initiate work on this order by meeting with the PMO Program Manager and support team to ensure that a common understanding of requirements, expectations and ultimate end products exists between all parties. Initial familiarization/orientation will be provided by the PMO. The Contractor shall discuss the overall understanding of the project and review the background information and materials provided by the PMO. This meeting shall be held at a location agreed upon by the PMO and the Contractor.

2.1.5. Transition Meeting

The contractor shall create transition and decommissioning plans that accommodate all the non-authoritative data sources (non-ADS) interfaces and ensure that necessary capabilities are delivered using approved ADSs.

Deliverable: CDRL A003 - Software Transition Plan (STRP)

2.1.5.1. Contractor Transition at Contract Start

Upon government request, the contractor shall submit a non-proprietary transition plan. This Transition Plan shall provide for the orderly start-up of maintenance and transfer of all items related to the development and maintenance of MRO, to include source code, make files and/or other build files, build instructions, configuration management tools and data, documentation, status and documentation of work-in-process and Government Furnished Property (GFP), as required. The transition plan shall include a comprehensive description of the activities and schedule required to transition the MRO sustainment, and technical support functions from the outgoing contractor to the new incoming contractor.

The plan shall include:

• Movement of GFP/Government Furnished Information (GFI), if required

• Resourcing and staffing

• Program Management startup activities

• MRO development, surveillance and operational activities

• Acquiring knowledge and familiarization

• Other topics considered necessary for accomplishing a successful transition The contractor shall execute their transition plan to:

• Allow no disruption of service to business processes after conclusion of Transition Period

• Accomplish a smooth transfer of daily operations, on-going projects, development and test environments, and other assets

• Ensure qualified personnel, with necessary skills, knowledge and clearances are available at contract award to accomplish a successful transition

• Collaborate and communicate with the government and the current contractor during the transition period

• Identify and manage any risks associated with the transition— particularly risks associated with human resources and GFP environment transfer, if required

Complete transition of personnel shall be completed no later than 30 calendar days after contract transition period start date.

Deliverable: CDRL A002 - Technical Report-Study/Services – Incoming Phase In Plan (IPIP)

2.1.5.2. Transition at Contract Conclusion

Upon government request, the contractor shall be required to develop a non-proprietary plan for the transition of MRO sustainment, maintenance, operations, and development responsibilities to the follow-on contractor. The transition plan shall provide a plan for the orderly transfer of all items related to the maintenance of MRO, to include source code, make files and/or other build files, build instructions, configuration management tools and data, database models, documentation, status and documentation of work-in-process and GFP, if required, to the follow-on contractor. The Transition Plan shall cover a 30-day period to include assisting the follow-on contractor in learning the MRO surveillance and operations for minimal downtime to MRO.

The contractor shall be required to answer functional and technical questions to enable the follow-on contractor to maintain and sustain MRO and interfaces. The follow-on contractor shall have the responsibility to perform these activities, but the incumbent contractor shall continue to provide support to the follow-on contractor and to government personnel during the transition period. The contractor’s transition plan shall include a comprehensive description of the activities and schedule required to transition MRO development, maintenance, sustainment, and technical support functions from the outgoing contractor to the selected contractor.

The plan shall include: Resourcing and staffing

• Program Management shut down activities

• MRO development, surveillance and operational activities

• Knowledge sharing and orientation

• Movement of GFP/GFI, if required

• Other topics or activities necessary to accomplish a smooth transition

The contractor shall execute their transition plan to:

• Allow no disruption of service to business processes

• Accomplish a smooth transfer of daily operations, on-going projects, development/test environments, and other assets

• Collaborate and communicate with the government during the transition period

• Identify and manage any risks associated with the transition— particularly risks associated with human resources and GFP environment transfer, if required

Deliverable: CDRL A004 - Phase-Out Transition Plan (POTP)

2.1.6. Collaboration and Technical Interchange Meetings

The contractor shall participate in Technical Interchange Meetings, e.g., with source systems needed to support planning, data collection, and/or data loading. The contractor shall also participate in MRO Program Increment planning events as a technical interchange for discussing the data required for use during each MRO Program Increment.

2.1.7. Monthly Status Reports

The Contractor shall provide a monthly status report electronically during the period of performance. The report shall include the status of all functional areas addressed in this PWS and shall include status of work, schedules, deliverables, current and cumulative task funding status (direct labor and travel funding status to be reported separately as required), risks and risk mitigation techniques, outstanding issues, and proposed resolution approaches and actions to resolve any outstanding issues. The report shall identify milestones and deliverables completed and progress towards major milestones and deliverables (showing planned data deliveries down to the organizational unit level). The report shall identify activities and deliverables planned but not completed including the government’s acknowledgement and approval of the incomplete work. The contractor shall include metrics that demonstrate remaining work is achievable within required timelines.

The monthly status report shall be submitted simultaneously with the monthly invoice. The Contractor shall ensure the accuracy of the monthly status report which must include:

• Master task order schedule to identify status of all scheduled tasks, explanation of deviations from the baseline schedule, and forecast schedule impacts

• Project metrics, analysis of trends, and corrective action plans

• Planned accomplishments for the next reporting period

• Resource levels and explanation of resource changes

• Issues requiring resolution

• Status of all assigned action items

• Current task order risks and risks mitigation plans and activities

• Short overview of data delivered during reporting period

Deliverable: CDRL A001 - Monthly Status Report (MSR)

2.1.8. System Documentation

The Contractor shall provide technical studies and updates to system documentation as required. Existing Government word processing tools (MS Office Suite of tools) shall be used for documentation. This is a continuous effort, which shall be accomplished in concert with the efforts to update and enhance system operations. The Contractor shall update system documentation as necessary to reflect solutions used to satisfy the Change Requests (CRs), Discrepancy Reports (DRs) and Action Items (AIs). Results of these efforts shall be documented in the monthly status report CDRL A001.

Deliverable: CDRL A001 - Monthly Status Report (MSR)

The Contractor shall provide ad hoc Technical Report(s) or Studies as requested by the Government, at no additional charge, if the information requested is currently available or easily modified from existing data. The Contractor shall make every reasonable effort to provide additional or non-customary reports or data as requested by the Government, regarding its Operations and Infrastructure of MRO. The Government will provide one week notification for any ad hoc report and study requests and will work with the contractor to agree on a delivery date of said report or study. Reports shall be provided in a Government defined format and within the Microsoft software suite where applicable or to an agreed upon format based on its intended use.

2.1.9. Practice, Process, Policy Analysis, and Adoption

Best practice support shall include, but is not limited to, best practice research, benchmarking studies, COTS and enterprise system industry best practices, and recommendations to support all aspects of data management capability design, development and implementation. The Contractor shall evaluate, analyze, and document any proposed best practices to assess their impact on the mission area and the enterprise and recommend data management practices, processes, and policies to the Government.

2.2. Services Delivery Summary

Performance Objective PWS Para. Performance

Standard Performance Threshold

Surveillance Method Incentive/ Remedy

(SS-1) 2.1.1, 2.1.5, The contractor 100% compliance 100% Failure to meet 3 Ensure 2.1.5.1, shall provide the with no deviation Inspection and delivery dates will documentation 2.1.5.2, 2.1.6, applicable from performance review upon result in the remedies is delivered 2.1.7, 2.1.8, documents by the standard receipt of set forth in FAR clause on time in 3.6, 3.7 due date and time report 52.246-4, Inspection of accordance specified in Services – Fixed Price with the Exhibit A. and a negative applicable comment in CPAR.

CDRL

Re-performance and redelivery is required.

(SS-2) 2.1.1, 2.1.5, Deliverables shall 100% compliance 100% Unacceptable Provide 2.1.5.1, meet the with no deviation Inspection and performance will result accurate 2.1.5.2, 2.1.6, requirements of the from performance review upon in the remedies set Technical and 2.1.7, 2.1.8, content stated in standard receipt of forth in FAR clause Planning 3.6, 3.7 the CDRL. report 52.246-4, Inspection of documentation Documents are Services – Fixed Price and Execution written with and a negative results clarity, accuracy, comment in CPAR.

and without grammatical errors or misspellings. Re-performance and The technical redelivery is required.

documents must thoroughly capture results of the analysis to include background details, analytical methodology employed, summary, and any recommendations or suggestions.

2.3. Contractor Personnel Requirements

The Contractor shall provide continuous staffing with sufficient experience, training and expertise in the areas of MRO systems, including business analysts and report writing personnel. The Contractor shall meet all requirements specified in DoD Manual 8140.03, Cyberspace Workforce Qualification and Management Program, for their designated Work Role and Proficiency Level (e.g. IAT-II). DoDM 8140.03 requirements include and are not limited to:

The Contractor shall provide continuous staffing with sufficient experience, training and expertise in the areas of MRO systems, including business analysts and report writing personnel. The Contractor shall meet all requirements specified in DoD Manual 8140.03, Cyberspace Workforce Qualification and Management Program, for their designated Work Role and Proficiency Level (e.g. IAT-II). DoDM 8140.03 requirements include and are not limited to:

1) Continuous Education Cybersecurity (CS) Baseline Certification

2) Initial On the Job Training (OJT) Evaluation

3) Continuous Education Computing Environment/Operating System (CE/OS) Certificate

4) Background Investigation

5) Signed Privileged User Agreement Statement

Personnel shall be capable of demonstrating the functionality of MRO systems from a tactical perspective as well as from a strategic perspective. The Contractor shall use proven engineering techniques to perform the tasks required by this delivery order and shall employ commercial best practices and innovative solutions where not in conflict with Government requirements. All Contractor personnel shall have experience using the suite of Microsoft Office products, including Word, Excel, PowerPoint and Access. The Task Leader shall provide other contractor personnel assigned to this task with required management direction and support to include required preparation and delivery of contract deliverables, and other actions as deemed necessary by the Task Leader. The Task Leader shall also assign and direct tasks to the various contractor personnel assigned to this contract, as required by the Government.

3. General Information

3.1. System Requirements

Any information, records, or data the Contractor may have access to may be highly sensitive. The Contractor shall not divulge any information about Government files, source selection activities and processes, or any other sensitive information to anyone not authorized access to such information. The Contractor may be required to sign a non-disclosure agreement (SF Form 312) to access sensitive or classified information. It shall be the Contractor's responsibility to ensure that their personnel have the proper authorities. The contractor shall ensure the MRO system complies with security regulations stated in this PWS.

The contractors shall comply with the Defense Acquisition Regulations (DFARS) 252.239-7001 and all cybersecurity requirements stipulated in the contract.

Contractors shall submit to the Contracting Office (CO) and Government Program Manager a list of personnel who require a Common Access Card (CAC) and Government-Furnished Equipment. The contractor shall identify each person by full legal name, their proposed assigned position, duty location, security clearance required by the contract, the company for which they work, full contract number (including task order, if applicable), and the contract end date. The prime contractor shall include the information for all subcontractors. If applicable, the personnel list shall also identify persons who need SIPRNET and/or Privileged Access. For privileged access, the list shall explicitly specify which Information Technology (IT) Level – I or II – is needed.

3.1.1. Personnel Investigations, Clearances, and Computer and Network Access

The Contractors performing work under this contract must comply with all applicable security requirements. Contractor personnel shall have the appropriate security background investigation or security clearance (i.e., eligibility) prior to the performance of duties in support of this contract.

Contractor Personnel must have, at a minimum, a favorable Tier 5 Investigation prior to network access and issuance of a Common Access Card (CAC Contractors necessary to perform database/application work within all Government-approved environments to include, but not limited to: DISA, OCI, Exadata Cloud Services and Cloud 1 shall be required to have IT Level I access. IT Level I access requires a favorably adjudicated Tier 5 Investigation. See AFI 61-1405, Personnel

Security Program Management, Wright-Patterson AFB Supplement 1 for more information regarding security investigation and clearance requirements.

3.1.2. Common Access Card

IAW DoDI 5200.46, DoD Investigative and Adjudicative Guidance for Issuing the Common Access Card, Enclosure 4, Paragraph 3, Application of the Standards; DoDI 5200.02, Personnel Security Program; Homeland Security Presidential Directive (HSPD)- 12; and AFMC Guidance for the Credentialing of Un-cleared Contractors, 13 November 2018, Attachment, Paragraph 5a eligible contractor personnel requiring physical access to a DoD or AF facility or installation as their normal work location; the Air Force Network (AFNet); a DoD Automated Information System (AIS); Controlled Unclassified

Information (CUI), or any equipment not involving access to classified information shall obtain Common Access Cards (CAC).

Interim issuance of a CAC to a contractor requires the completion of a Federal Bureau of Investigation (FBI) fingerprint check with favorable results and the successful submission of Tier l (equivalent or higher) background investigation to the Defense Counterintelligence and Security Agency (DCSA).

A final CAC determination requires at least a favorably adjudicated Tier 1 (equivalent or higher. See section 3.1.1 for this contract) investigation based on the basic and supplemental HSPD-12 credentialing standards as outlined in DODI 5200.46, Enclosures 3 and 4.

Once the request for a CAC has been approved, the employee shall go to a Military installation or to any local Defense Enrollment Eligibility Reporting System (DEERS) office to obtain their CAC. Contractor badges shall be worn and displayed at all times. In addition, the Contractor employee shall identify themselves as Contractor employees in e-mails, telephone usage, correspondence, and meetings, etc.

Contractors must maintain the satisfactory minimum requirements for justification of the issuance of a CAC throughout the period of performance.

Contractor personnel shall, within seven calendar days, return all identification badges and/or CAC to the AFLCMC/GBC (WP) Security Office upon termination, separation, or expiration of this contract.

3.1.3. Local Security Requirements

The Contractor shall be responsible for assuring that all employees comply with all security requirements imposed by the local commander at all times while their employees are on the installation and shall follow instructions of the local organizational commander pertaining to security. Local Security requirements can be found on Appendix A.

3.1.4. Security and Protection of Information

• Controlled Unclassified Information (CUI) o Controlled Unclassified Information is any information that law, regulation, or government-wide policy requires to have safeguarding or disseminating controls. CUI excludes information classified by:

o Executive Order 13526, Classified National Security Information, December 29, 2009 o The Atomic Energy Act of 1954, as amended, or o A specific program or project Security Classification Guide

• The National Archives and Records Administration (NARA) CUI Registry (http://www.archives.gov/cui/registry/category-list.html) identifies approved CUI categories and subcategories; provides general descriptions for each; identifies the basis for controls; and sets procedures for the use of CUI.

• The contractor shall comply with DoDI 5200.48, Controlled Unclassified Information; DoDM 5200.01/AFI 16-1404 Air Force Information Security Program, Volumes 1, 2, and 3 ; and Air Force Guidance Memorandum 2020-16- 01, Air Force Guidance Memorandum for CUI, 23 July 2020.

• The contractor shall consult the applicable security classification guide to determine if the aggregation of controlled and uncontrolled unclassified information creates a classified document, e-mail, or other communication.

• The contractor shall comply with DoDM 5400.07/Air Force Manual 33‑302, DoD Freedom of Information Act (FOIA) Program, requirements.

• The contractor shall protect CUI and unclassified DoD information not approved for public release on non-DoD Information Systems IAW DoDI 8582.01, Security of Non-DoD Information Systems Processing Unclassified Nonpublic DoD Information.

• Unless specific categories of CUI require more stringent controls, the contractor shall protect non-DoD Information Systems using guidelines set forth in NIST Special Publication 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations.

• Covered Defense Information [Required for all solicitations and contracts. This includes solicitations and contracts that use FAR part 12 procedures for the acquisition of commercial items]

• The Contractor shall comply with DFARS 252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting (Dec 2019). This subpart applies to contracts and subcontracts requiring contractors and subcontractors to safeguard covered defense information that resides in or transits through covered contractor information systems. Safeguarding is done by applying specified network security controls. This DFARS subpart also requires reporting of cyber incidents. The subpart does not abrogate any existing contractor physical, personnel, or general administrative security operations governing the protection of unclassified DoD information, nor does it impact requirements of the National Industrial Security Program.

3.1.5. Operations Security

All contractors whose normal work location is in a DoD/AF facility or on a DoD/AF installation shall comply with Operations Security (OPSEC) requirements and training as set forth in DoD Directive 5205.02, DoD Operations Security Program, and AFI 10-701, Operations Security.

http://www.archives.gov/cui/registry/category

3.1.6. Required Security-Related Training

• Cyber Awareness Challenge Training. All contractors that need a DoD or AF network account shall successfully complete Cyber Awareness Challenge and annual re-certification Cyber Awareness Training. Initial training shall be completed prior to the creation of the network account.

This is an annual requirement. Subsequent training must be completed on or before the one-year anniversary of the most recent training completion date. If training is not completed before the one-year anniversary, access to the network account is automatically suspended and not reinstated until proof of training completion is provided.

• Force Protection and Anti-Terrorism Training. All contractors whose duty location is in a DoD/AF facility or on a DoD/AF installation successfully complete Force Protection Training. Initial training shall be completed within 30 calendar days of the creation of their Air Force network account. This is an annual requirement. Subsequent training must be completed on or before the one-year anniversary of the most recent training completion date.

• Controlled Unclassified Information Training. All contractors employed under this contract shall successfully complete Controlled Unclassified Information (CUI) Training within 30 calendar days of the creation of their Air Force network account.

This is an annual requirement. Subsequent training must be completed on or before the one-year anniversary of the most recent training completion date.

3.1.7. In-Processing

• All contractors performing work under this contract shall in-process with AFLCMC/GBC. The government program manager or other government point-of-contact will create an in-processing checklist and instruct the incoming contract on actions that must be completed.

• For classified contracts (i.e., contracts that have a DD254, Contract Security Classification Specification), the prime contractor’s Facility Security Officer (FSO) shall submit to Security Management Organization (SMO) Code WE1MFHYN6, via the Defense Information System for Security (DISS), a Visit Request that identifies all contractors that require access to classified information or systems.

• The identity of contractors that do not require access to classified information or systems may be submitted on company letterhead stationery (e-mailed pdf document is acceptable). The letter shall include each person’s full, legal name; Social Security Number, and employer (to indicate if the person is with the prime- or sub-contractor).

• The letter shall be addressed To

• AFLCMC/GBC (WP) Security Office

• 1900 Founders Drive

• Kettering, OH, 45420

• aflcmc.gb.wp-security@us.af.mil

• For unclassified contracts, the prime contractor’s FSO, contract manager, or contract task lead shall submit to the AFLCMC/GBC (WP) Security Office a visit request that identifies the persons who shall perform work under this contract. The letter may be submitted on company letterhead stationery (e-mailed pdf document is acceptable). The letter shall include each person’s full, legal name; Social Security Number, and employer (to indicate if the person is with the prime- or sub-contractor). The letter shall be addressed as shown above.

3.1.8. Out Processing

• All contractors performing work under this contract shall out-process with AFLCMC/GBC.

• Contractors moving to another Air Force contract may request transfer of CAC sponsorship to the Trusted Associate Sponsorship System (TASS) trusted agent (TA) associated with the new contract.

• Contractors ending their association with the Air Force shall surrender their CAC to the AFLCMC/GBC (WP) Security Office. This may be done in person or, if the contractor is not in the Wright-Patterson AFB vicinity, by mail (e.g., US Postal Service, FedEx, UPS, DHL, etc.).

3.2. Place of Performance

Work is to be performed at a Government approved facility in the Dayton OH area or remotely. Alternate worksites/telework, whether permanently or temporary, may be designated with Contracting Officer (CO) approval. If an alternate worksite/telework is approved, the labor rates for Government facility still apply.

3.3. Hours of Work

Contractor personnel are expected to perform their work within an average work week of 40 hours. The average workday consist of an 8 window in which those 8 hours may be scheduled is between 6:00am and 6:00pm Monday through Friday.

The Government may approve the Contractor to work after hours Monday through Friday and/or on weekends or holidays as necessary to support the requirements of this PWS. Weekend/holiday work must be pre-approved by Government Contracting Officer (CO) prior to commencement of weekend work.

The Contractor may be required to provide on-call, emergency operational assistance, and problem resolution support for all Air Force Logistical Complex locations, domestic and international, and should be cognizant of any time differentials for updates and maintenance outages. Routine maintenance/upgrades requiring a system outage shall be scheduled on a weekend to minimize outages during normal business hours at any installation.

On an exception basis, high priority outages may occur during work week, or longer duration outages may necessitate an outage extending into normal working business hours at some installations. The contractor must be available 24/7 to support any Tier-1 related service desk issues unless otherwise directed by the Government and Tier 2 and 3 will provide support during core business hours.

Incident Priority Matrix

Escalation Time Matrix

Support outlined in the Incident Priority Matrix shall be identified in advance to the Contractor and shall be funded by a separate “Surge Requirements Labor” Contract Line Item Number

(CLIN).

The Contractor shall observe Federal Government recognized holidays. Additional days may be declared as a Government holiday by Federal Statute, Executive Order or by the President's Proclamation during the performance of this contract. The Government will not require services be performed on these holidays; however, contractors should follow their company policy. The Government shall not be billed for such holidays, except when services are required and approved in advance by the Government and are actually performed on a holiday. If any of the above falls on a Saturday, then Friday shall be observed as a holiday.

Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

Urgency→

Impact↓

One User, One Installation

Multiple Users, One Installation

Multiple Users, Multiple

Installations

All Users, All Installations

Little to No Mission Impact

P5 P5 P4 P4

Moderate Mission Impact

P4 P2, P3 P2, P3 P2,P3

Major Mission Impact

P4 P2, P3 P2, P3 P1

Work Stoppage

P1 P1 P1 P1

Priority Tier Level

Priority 5 (P5)

Priority 4 (P4)

Priority 3 (P3)

Priority 2 (P2)

Priority 1 (P1)

Tier-1 24 hours 8 hours 2 hours 30 minutes 10 minutes Tier-2 48 hours 16 hours 4 hours 1 hour 20 minutes Tier-3 5 workdays 3 workdays 2 workdays 4 hours 1 hour

Recognized Holidays:

New Year’s Day Martin Luther King Jr’s Birthday Columbus Day President’s Day Veteran’s Day Memorial Day Thanksgiving Day Juneteenth Day Independence Day Labor Day Christmas Day

3.4. Telecommuting/Telework

Telecommuting/telework is defined as authorization for an employee that generally works at the United States Government (USG) location, to work at an alternate location (i.e., at the employee’s home or Contractor location) either permanently or temporarily. Contractor off-site location is defined as the permanent place of performance for specific employees, (i.e., not at the USG location). Long-term is defined at six or more months in duration.

Telecommuting/telework will be approved on a case-by-case basis by the COR/TPOC. Telecommuting/telework is generally Customer-specific, and all telework approved equipment must be authorized by the Government for use.

The Contractor shall maintain availability during core hours via e-mail and phone. All telecommuting/telework expenses for Internet, telephone connectivity, and other equipment services shall be borne by the Contractor. The Contractor shall provide a written request with appropriate rationale for the COR prior to any telecommuting.

Classified work is not authorized under telecommuting or the alternate worksite.

Authorized telecommuting or alternate worksite locations does not abrogate the Contractor’s requirement for complying with the protection of information IAW DoD and USAF regulations, Security and Protection of Information sections of this PWS, contract clauses or DD Form 254.

At alternate duty locations, the Contractor shall be available at all times during core hours via e-mail and phone. Operating costs associated with the Contractor using an alternate worksite shall not be assumed by the Government.

3.5. Vacancies and Turnovers

The Contractor shall track all vacancy and turnover data and provide a monthly Vacancy and Turnover Report (CDRL A005) to the Government.

A vacancy shall be defined as any open position resulting from either a new position added to the task order or a turnover. A turnover is determined to have occurred any time an encumbered position becomes vacant. A newly added position that has not yet been filled is not considered a turnover. In general, the Contractor shall be responsible for filling all new positions within 20 business days of performance start. Upon notification of a pending vacancy (i.e., turnover), the Contractor shall provide written documentation to the CO, PM, and the COR at least two weeks in advance of the vacancy, or sooner when possible.

In the event of no-notice departure, the Contractor shall immediately (same day) notify the CO, PM, and COR in writing. This written notification shall include the date and time the position will be vacant, anticipated replacement date, management plan, and corrective action, if required, to ensure the Customer mission is not impacted or degraded.

Additionally, the Contractor shall fill the vacancy within 20 business days. If the vacancy cannot be filled within the required 20 business days, the Contractor must provide written notification to the CO and the COR indicating the date the Contractor shall have the vacancy filled, and management plan and corrective action the Contractor shall take to ensure the Customer mission is not impacted or degraded. For hard-to-fill positions with complex requirements, the Contractor may request a waiver from the CO extending the time allowed to fill a position. Waivers will be granted at the discretion of the CO based on complexity of requirement and Customer need and must be acceptable to the Customer. Furthermore, the Government reserves the right to request concessions for any vacancy.

In some cases, the Customer may request a position not be filled. Any direction in regard to a Do Not Fill shall come only from the CO and shall be in writing. If a “Do Not Fill” is directed, the Contractor shall continue to report the vacancy, however, there will be no impact to Contractor performance ratings. Contractors shall have 30 business days to fill a vacancy from the time a Do Not Fill is reversed, in writing, by the CO.

Deliverable: CDRL A005 - Technical Report-Study/Services – Vacancy and Turnover Report (VTR)

3.6. Travel Requirements

Travel may be required to various locations within CONUS to support the MRO program. All travel requirements (including destinations, plans, agenda, itinerary, dates) will be approved in advance by the COR or ACOR and will be performed in accordance with the Joint Travel Regulation (JTR). Local travel within 25 mile radius of Wright Patterson Air Force Base will not be reimbursed.

The contractor shall identify and estimate potential travel at least one month prior to Program Increment (PI) planning events and propose travel necessary to satisfy the requirements under each CLIN.

The Contractor shall complete a Travel Authorization Request (TAR) and submit the document to the COR and ACOR for approval no later than five (5) business days before travel begins. Travel authorized by the COR or ACOR will be within the continental United States and destinations will be coordinated between the Contractor and the COR or ACOR. The Contractor’s TAR shall be in writing and will contain the dates, locations, and estimated costs of the travel. Changes to TAR/itinerary, especially for cost increases, shall be made in writing and via verbal communications to the COR or ACOR within 24 standard hours.

Contractor shall await COR or ACOR approval and travel voucher invoices must be submitted to WAWF no later than the next billing cycle after completion of the travel event.

3.7. Privacy Act

Work on this project may require that personnel have access to Privacy Act Information. As required, Contractor personnel shall adhere to the Privacy Act, U.S. Code, Title 5, Part 1, Chapter 5, Subchapter II, Section 552a and applicable agency rules and regulations.

3.8. Performance of Services during Crisis Declared by National Command Authority or Overseas Combatant Commander

This requirement has been determined not to be essential and does not require continued support during a crisis as defined in DODI 3020.37, E2.1.1 and E2.1.3.

3.9. Performance of Services during Emergency Conditions Declared by Wright- Patterson AFB Authority

In the event an emergency is declared for Wright-Patterson AFB necessitating the implementation of an alternate work schedule (other than a standard 8-hour day, Monday-Friday work week), services provided under this contract may require implementation of an alternate work schedule, not to exceed a 40-hour work week unless approved by the Government. The Contracting Officer (CO) will make notification to the Contractor point of contact. A modified work schedule will be adopted for the duration of the declared emergency, and the Contractor shall comply with the provisions of that alternate work schedule.

3.10. Voluntary Protection Program (VPP)

The Contractor shall ensure its personnel have a comprehensive understanding of VPP as well as full compliance with OSHA requirements. Contractors, whether regularly involved in routine site operations or engaged in temporary projects must follow the safety and health rules of the installation or VPP site. Detailed information on VPP is available on the OSHA website at:

http://www.osha.gov/dcsp/vpp/index.html.

The Contractor shall provide their Total Case Incidence Report (TCIR), their Days Away Restricted and/or Transfer Case Incident rate (DART) rates and their OSHA Form 300A annually to the CO for consolidation and submission as part of the installation's annual VPP Safety and Health management report. TCIR and DART rates are due by the 15th of January of each year.

The Contractor is responsible for compliance with the OSHA (Public Law 91- 596). The Contractor shall submit a Safety and Health Plan and corresponding site safety checklist to the Contracting Officer not later than 10 workdays after contract award. Subsequent submissions shall be required for proposed updates and submission for Government approval.