01. REVISED Performance Work Statement (PWS).docx

Attachment 1 – FA877322R0005 Solicitation

PERFORMANCE WORK STATEMENT (PWS)

FOR

Enterprise Cyber Capabilities (EC2)

AMIC/PMSO

San Antonio, TX

23 October 2022

DESCRIPTION OF SERVICES.

Introduction.

This is a non-personal services contract. The Government will neither supervise contractor employees nor control the method by which the contractor performs the required tasks. The contractor shall manage its employees and guard against any actions that are of the nature of personal services or give the perception of personal services. The contractor shall notify the Contracting Officer (CO) immediately if they perceive any actions constitute personal services. These services shall not be used to perform any Inherently Governmental Functions.

Background.

The Enterprise Cyber Capabilities (EC2) seeks to leverage economies of scale and reduce the Air Force’s overall information technology footprint. This multiple award Indefinite Delivery Indefinite Quantity (IDIQ) contract will enable AMIC mission partners to build, operate, support, defend, and engage in cyberspace, thus ensuring US warfighters maintain the information advantage over our adversaries.

Scope.

The North American Industry Classification (NAICS) for this contract and subsequent Task Orders is 541330 Engineering Services (Exception 1) Military and Aerospace Equipment and Military Weapons. The scope also allows for ancillary services and costs necessary to complete a total solution through a cyber service objective. Task Orders awarded under this contract will consist of cyber services that can be commercial and non-commercial, and classified or non-classified. The scope of this effort contemplates the rapidly-evolving nature of cyberspace issues and challenges, including ensuring comprehensive support to a variety of mission partners/ organizations to meet mission requirements throughout the duration of this contract. Services will be performed in the Continental United States (CONUS) and outside the Continental United States (OCONUS).

Period of Performance.

The period of performance shall be for one (1) five (5) Year Base period with one (1) five (5) year option period.

SPECIFIC TASKS.

The contractor shall perform tasks IAW the performance objectives detailed within the Categories and Specialty Areas provided below and in the PWS Supplement. The Categories and Specialty Areas (SA) are defined further by the identified applicable Knowledge, Skills, and Abilities (KSAs), Tasks and Capability Indicators as described in the PWS Supplement. For example, 2.1 is a Category, whereas 2.1.1 is a SA. The “Categories” area is a high-level grouping of common cybersecurity functions that the Government views as critical for successful contract performance. Specialty Areas are distinct areas of cybersecurity work. The Categories/Specialty Areas described below along with information provided in the PWS Supplement will be included in the respective task orders, as applicable.

Operate and Maintain (O&M).

The Contractor shall provide the technical support, administration, and maintenance necessary to ensure effective and efficient information system performance and security.

Data Administration The contractor shall develop and administer databases and/or data management systems that allow for the storage, query, protection, and utilization of data.

Knowledge Management The contractor shall manage and administer processes and tools that enable the Government to identify, document, and access intellectual capital and information content.

Customer Service and Technical Support The contractor shall address problems; install, configure, troubleshoot, and provide maintenance and training in response to customer requirements or inquiries (e.g., tiered-level customer support). Typically provides initial incident information to the Incident Response (IR) Specialty.

Network Services The contractor shall install, configure, test, operate, maintain, and manage networks and their firewalls, including hardware (e.g., hubs, bridges, switches, multiplexers, routers, cables, proxy servers, and protective distributor systems) and software that permit the sharing and transmission of all spectrum transmissions of information to support the security of information and information systems.

Systems Administration The contractor shall install, configure, troubleshoot, and maintain server configurations (hardware and software) to ensure their confidentiality, integrity, and availability. Manage accounts, firewalls, and patches. Responsible for access control, passwords, and account creation and administration.

Systems Analysis The contractor shall study the Government's current computer systems and procedures, and design information systems solutions to help the Government operate more securely, efficiently, and effectively. The contractor shall bring business and information technology (IT) together by understanding the needs and limitations of both.

Management and Policy.

The contractor shall provide assistance and support for Governmental leadership, management, direction, or development and advocacy to effectively conduct cybersecurity work.

Cybersecurity Management The contractor shall assist the Government and/or provide recommendations relating to the overall cybersecurity of information systems and networks, including managing information security implications within the organization, specific program, or other area of responsibility (e.g., strategy, personnel, infrastructure, requirements, policy enforcement, emergency planning, security awareness, etc.).

Strategic Planning and Policy The contractor shall assist and provide recommendations for the development of policies and plans that drive changes to Governmental cyberspace initiatives and/or required changes/enhancements.

Project/Program Management, Administration, Financial, and Acquisition The contractor shall execute the duties governing hardware, software, and information system acquisition programs and other program management policies in accordance with Governmental decisions and oversight. Provide direct support for cyber related acquisitions throughout the total acquisition life cycle.

Training, Education, and Awareness The contractor shall conduct training of personnel within pertinent subject domain. Develop, plan, coordinate, deliver and/or evaluate training courses, methods, and techniques as appropriate.

Protect and Defend.

The contractor shall identify, analyze, and mitigate threats to internal information systems and/or networks.

Cybersecurity Defense Analysis The contractor shall apply defensive measures and information collected from a variety of sources to identify, analyze, and report events that occur or might occur within the network to protect information, information systems, and networks from threats.

Cybersecurity Defense Infrastructure Support The contractor shall test, implement, deploy, maintain, review, and administer the infrastructure hardware and software that are required to effectively manage the computer network defense service provider network and resources. Monitors the network to actively remediate unauthorized activities.

Incident Response The contractor shall respond to crises or urgent situations within the pertinent domain to mitigate immediate and potential threats. Use mitigation, preparedness, and response and recovery approaches, as needed, to maximize survival of life, preservation of property, and information security. Investigate and analyze all relevant response activities in accordance with Government policies and procedures.

Vulnerability Assessment and Management The contractor shall conduct assessments of threats and vulnerabilities; determine deviations from acceptable configurations, enterprise, or local policy; assess the level of risk; and develop and/or recommend appropriate mitigation countermeasures in operational and nonoperational situations.

Analyze.

The contractor shall perform highly specialized review and evaluation of incoming cybersecurity information to determine its usefulness for intelligence Threat Analysis The contractor shall identify and assess the capabilities and activities of cybersecurity criminals or foreign intelligence entities; produce findings to help initialize or support law enforcement and counterintelligence investigations or activities.

Exploitation Analysis The contractor shall analyze collected information to identify vulnerabilities and potential for exploitation.

All-Source Analysis The contractor shall analyze threat information from multiple sources, disciplines, and agencies across the Intelligence Community. Synthesize and places intelligence information in context; draw insights about the possible implications and advise the Government accordingly.

Targets The contractor shall apply current knowledge of one or more regions, countries, non-state entities, and/or technologies.

Language Analysis The contractor shall apply language, cultural, and technical expertise to support information collection, analysis, and other cybersecurity activities.

Collect and Operate.

The contractor shall provide specialized denial and deception operations and collection of cybersecurity information that may be used to develop intelligence.

Collection Operations The contractor shall execute collection using appropriate strategies and within the priorities established through the collection management process.

Cyber Operational Planning The contractor shall gather information and develop detailed Operational Plans and Operational Orders supporting cyber requirements. The contractor shall conduct strategic and operational-level planning across the full range of operations for integrated information and cyberspace operations.

Cyber Operations The contractor shall perform activities to gather evidence on criminal or foreign intelligence entities to mitigate possible or real-time threats, protect against espionage or insider threats, foreign sabotage, international terrorist activities, or to support other intelligence activities.

Investigate.

The contractor shall investigate cybersecurity events or crimes related to information systems, networks, and digital evidence.

Cyber Investigation The contractor shall apply tactics, techniques, and procedures (TTP) for a full range of investigative tools and processes to include, but not limited to, interview and interrogation techniques, surveillance, counter surveillance, and surveillance detection, and appropriately balances the benefits of prosecution versus intelligence gathering.

Digital Forensics The contractor shall collect, process, preserve, analyze, and present computer-related evidence in support of network vulnerability mitigation and/or criminal, fraud, counterintelligence, or law enforcement investigations.

Securely Provision.

The contractor shall conceptualize, design, procure, and/or build secure information systems, with responsibility for aspects of system and/or network development.

Risk Management The contractor shall support the documentation, validation, assessment, and authorization processes necessary to assure that existing and new information systems meet the Government's cybersecurity and risk requirements. Ensure Government approval risk mitigation, and the appropriate levels of compliance/assurance from internal and external perspectives.

Software Development The contractor shall develop and write/code new (or modifyies existing) computer applications, software, or specialized utility programs following software assurance best practices.

Systems Architecture The contractor shall develop system concepts and work on the capabilities phases of the systems development life cycle; translate technology and environmental conditions (e.g., law and regulation) into system and security designs and processes.

Technology Research and Development (R&D) The contractor shall conduct technology assessment and integration processes; provide and support a prototype capability and/or evaluate its utility.

Systems Requirements Planning The contractor shall assist the Government with gathering and evaluating functional requirements and translates these requirements into technical solutions. The contractor shall provide guidance to customers regarding applicability of information systems to meet business needs.

Test and Evaluation The contractor shall develop and conduct tests of systems to evaluate compliance with specifications and requirements by applying principles and methods for cost-effective planning, evaluating, verifying, and validating of technical, functional, and performance characteristics (including interoperability) of information systems and/or sub-systems.

Systems Development The contractor shall collaborate and support the Government during the development phases of the systems development life cycle.

PARTICIPATION AND PERFORMANCE RATINGS.

Participation.

The contractor shall provide information provided in Contract Data Requirements List (CDRL) A002 annually to the EC2 IDIQ Workflow email address (currently being developed). The IDIQ awardee shall submit a minimum of at least one (1) proposal every five (5) years effective beginning on date of award of EC2 IDIQ.

Performance Ratings.

Performance ratings will be assessed utilizing the annual Contractor Performance Assessment Reports (CPARs) for all Task Orders meeting the thresholds. Compliance with the Contractor Performance Assessment Reporting System (CPARS) will be conducted at the Task Order Level. Only those contractors that are awarded Task Orders during the period of the IDIQ contract will be evaluated for performance.

SERVICES SUMMARY (SS).

The contract service requirements are summarized in performance objectives that relate directly to mission essential services. The performance threshold briefly describes the minimally acceptable levels of service required for each requirement. The SS provides information on contract requirements and the expected level of contractor performance to be successful. These thresholds are critical to mission success. Procedures as set forth in the applicable Inspection clause in the contract will be used to remedy all deficiencies. The Government retains the right to inspect any item included in the contract.

SS # 1.

The contractor shall successfully meet the terms and conditions of all awarded Task Orders.

3.2

That all terms and conditions of the Task Order are met as outlined in the individual Task Order(s). This accomplishment will be assessed based on the annual CPARs ratings. The contractor shall have no more than 2 instances of less than satisfactory performance for any category (within the annual CPARS ratings as the term is defined in FAR Subpart 42.15 – Contractor Performance Information and DOD CPARS Guidance April 022) within a five (5) year period beginning 1 year after date of award of first Task Order.

SS # 2

Maintain a minimum level of participation.

3.1

IDIQ awardee shall submit a minimum of at least one (1) proposal every five (5) years. Effective beginning on date of award of EC2 IDIQ.

GOVERNMENT FURNISHED SUPPLIES AND SERVICES.

Services.

Each Task Order PWS will define services to be provided by the Government for the contractor’s use in performance of tasks for that Task Order.

Facilities.

No facilities will be provided to awardees of the IDIQ contract. Each Task Order PWS will identify those facilities and/or workspace the Government will provide to include desk space, telephones, computers, and other items necessary to maintain an office environment.

Utilities.

Each Task Order PWS will define utilities to be provided by the Government for the contractor’s use in performance of tasks for that Task Order.

Equipment.

No equipment will be provided to awardees of the IDIQ contract. Each Task Order PWS will identify what equipment will be provided for the contractor and/or what the contractor will have access to, i.e., scanners, fax machines, printers, shipping crates, lighting and sound, etc.

Materials.

No materials will be provided to awardees of the IDIQ contract. Each Task Order PWS will identify what materials the Government will provide to the contractor in accordance with organizational Standard Operating Procedures and Policies.

SPECIAL REQUIREMENTS/INSTRUCTIONS.

Contractor Identification in the Government Workplace.

IAW FAR 37.114, All contractor personnel attending meetings, answering Government telephones, and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public or Congress that they are Government officials, unless, in the judgment of the agency, no harm can come from failing to identify themselves. They must also ensure that all documents or reports produced by contractors are suitably marked as contractor products or that contractor participation is appropriately disclosed. The contractor shall identify themselves on any attendance sheet or any coordination documents they may review. Electronic mail signature blocks shall identify their company affiliation.

Industrial Security.

DD Form 254. Overarching security requirements and contractor access to classified information will be as specified in the DD Form 254, Department of Defense Security Classification attached to the Task Order award documents. The contractor employees shall have a final U.S. Government issued security clearance at the level required by each Task Order PWS.

Physical Security.

The contractor shall safeguard all Government property provided for contractor use. At the close of each work period, Government facilities, property, and materials shall be secured. Any other physical security safeguards will be defined in each Task Order PWS.

Privacy Act.

Work on this contract requires the contractor to have access to Privacy Information. The contractor shall adhere to the Privacy Act, Title 5 of the US Code, Section 552a and applicable Agency rules and regulations.

Location(s) of Work.

The work to be performed under this contract shall be performed at locations identified in each Task Order PWS.

Hours of Operation.

Hours of operation and Recognized Holidays will be defined in each Task Order PWS.

Records.

The contractor shall create, maintain and dispose of only those Government required records that are specifically cited in and IAW each Task Order PWS.

Contractor Manpower Data Reporting.

IAW DFARS 204.1703(S-70)(2) Service contractor reporting of information is not required for indefinite-delivery contracts for the basic requirement. It is required for each order issued under the contract that meets the requirements of DFARS 204.1703(a).

Environmental Controls.

Compliance with Laws and Regulations. The contractor shall be knowledgeable of and comply with all applicable Interstate, Federal, State, and Local laws, regulations, and requirements regarding environmental protection. In the event environmental laws or regulations change during the term of this contract, the contractor shall comply as such laws come into effect.

Notification of Environmental Spills. If the contractor spills or releases any substance contained in 40 CFR 302 into the environment, the contractor shall immediately report the incident to the COR. The liability for the spill or release of such substances rests solely with the contractor.

Safety Requirements.

In performing work under this contract and in subsequent Task Orders, the contractor shall:

Conform to the safety requirements contained in the contract for all activities related to the accomplishment of the work.

Take such additional immediate precautions as the CO may reasonably require for safety and mishap prevention purposes.

Record and report promptly (within one hour) to the CO or COR, all available facts relating to each instance of damage to Government property or injury to either contractor or Government personnel.

In the event of an accident/mishap, take reasonable and prudent action to establish control of the accident/mishap scene, prevent further damage to persons or property, and preserve evidence until released by the accident/mishap investigative authority through the CO.

If the Government elects to conduct an investigation of the accident/mishap, the contractor shall cooperate fully and support Government personnel conducting the investigation.

Contractor Personnel Training.

Each Task Order PWS will define required contractor personnel training. Each Task Order PWS will specify training records that must be maintained by the contractor.

Special Training, Certifications and Qualifications.

Contractor personnel requiring access to a DoD Information System shall receive initial Information Assurance (IA) awareness orientation as a condition of access and thereafter shall complete annual IA refresher training, IAW DoD Directive 8570.01, "Information Assurance Training, Certification, and Workforce Management."

Periodic Reports/Kick-off Meeting.

The contractor shall attend a virtual initial kick-off meeting within 30 days after IDIQ contract award. The CO, COR, and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor's performance. At these meetings the CO will apprise the contractor of how the Government views the contractor's performance and the contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. The contractor shall provide minutes of these meetings to the Government. (CDRL #A001) The contractor shall submit an annual status report detailing number of Fair Opportunity Proposal Requests responded to with a formal proposal. (CDRL #A002)

DELIVERABLES.

Reports and other data required in this PWS shall be submitted IAW the Contract Data Requirements List (CDRL) in Exhibit A of the contract.

APPENDIX A - ACRONYMS AND ABBREVIATIONS LIST

Acronym/Abbreviation Definition

AF Air Force

AFB Air Force Base

CDRL Contract Data Requirements List

CFR Code Federal Regulation

CO Contracting Officer

COR Contracting Officer’s Representative

DOD Department of Defense

FAR Federal Acquisition Regulation

IAW In accordance with

NDA Non-Disclosure Agreement

OSHA Occupational Safety and Health Act

PBSA Performance Based Service Acquisition

PWS Performance Work Statement

QA Quality Assurance

QASP Quality Assurance Surveillance Plan

SS Services Summary

TO Task Order

USAF United States Air Force