1. Performance Work Statement (PWS).docx

PERFORMANCE WORK STATEMENT (PWS)

FOR

ENTERPRISE CYBER CAPABILITIES (EC2) CONTRACT

04JAN2022

DESCRIPTION OF SERVICES.

Introduction.

This is a non-personal services contract. The Government will neither supervise contractor employees nor control the method by which the contractor performs the required tasks. The contractor shall manage its employees and guard against any actions that are of the nature of personal services, or give the perception of personal services. The contractor shall notify the Contracting Officer (CO) immediately if they perceive any actions constitute personal services. These services shall not be used to perform any Inherently Governmental Functions.

Background.

Enterprise Cyber Capabilities (EC2) Contract seeks to organically leverage economies of scale and reduce the Air Force’s overall IT footprint. As a Multi-Award Contract (MAC), Indefinite Delivery Indefinite Quantity (IDIQ) contract, EC2 will provide an avenue to conduct services acquisitions from a strategic perspective, leveraging the buying power of the Air Force Cyber enterprise. The broadly defined cyber work will minimize the time needed to painstakingly defined requirements documents through use of Task Orders (TOs) issued against the basic contract. EC2 enables the use of FAR Part 16 ordering procedures to greatly streamline the process for getting requirements on contract. Additionally, an EC2 ordering guide will be developed to ensure task orders are executed in strict accordance with the contract ordering procedures. This will enable requirements to be executed within 60-90 days vs. the current two to three-year time frame for cyber services acquisitions.

Scope.

This effort enables AMIC customers to build, operate, support, defend, extend, and engage in cyberspace, thus ensuring US warfighters maintain the information advantage over our adversaries. Moreover, the impending EC2 vehicle supports and enables the entire cyber framework, including C2, cyber operations, cyber planning, cyber security, cyber analysis, full spectrum testing, TTP development, modeling and simulation, cyber mission essential support, threat assessment support, targeting and analysis support, real time operation and integration activities, software and tool development, vulnerability research, intrusion detection and prevention support, cyber qualification training, and strategic management support.

Please see Appendix E for the definition of cyber and all relating terms.

Period of Performance.

The period of performance shall be for five (5) Base Year with one five-year option.

SPECIFIC TASKS.

The Contractor shall accomplish the following on an order by order basis.

Operate and Maintain (O&M) The Contractor shall provide the technical support, administration, and maintenance necessary to ensure effective and efficient information system performance and security.

Data Administration The contractor shall develop and administer databases and/or data management systems that allow for the storage, query, protection, and utilization of data.

Knowledge Management The contractor shall manage and administer processes and tools that enable the Government to identify, document, and access intellectual capital and information content.

Customer Service and Technical Support The contractor shall addresses problems; install, configure, troubleshoot, and provide maintenance and training in response to customer requirements or inquiries (e.g., tiered-level customer support). Typically provides initial incident information to the Incident Response (IR) Specialty.

Network Services The contractor shall install, configure, test, operate, maintain, and manage networks and their firewalls, including hardware (e.g., hubs, bridges, switches, multiplexers, routers, cables, proxy servers, and protective distributor systems) and software that permit the sharing and transmission of all spectrum transmissions of information to support the security of information and information systems.

Systems Administration The contractor shall install, configure, troubleshoot, and maintain server configurations (hardware and software) to ensure their confidentiality, integrity, and availability. Manage accounts, firewalls, and patches. Responsible for access control, passwords, and account creation and administration.

Systems Analysis The contractor shall study the Government's current computer systems and procedures, and design information systems solutions to help the Government operate more securely, efficiently, and effectively. Brings business and information technology (IT) together by understanding the needs and limitations of both.

Management and Policy The contractor shall provide assistance and support for Governmental leadership, management, direction, or development and advocacy to effectively conduct cybersecurity work.

Cybersecurity Management The contractor shall assist the Government and/or provide recommendations relating to the overall cybersecurity of information systems and networks, including managing information security implications within the organization, specific program, or other area of responsibility (e.g., strategy, personnel, infrastructure, requirements, policy enforcement, emergency planning, security awareness, etc.).

Strategic Planning and Policy The contractor shall assist and provide recommendations for the development of policies and plans that drive changes to Governmental cyberspace initiatives and/or required changes/enhancements.

Program/Project Management, Administration, Financial, and Acquisition The contractor shall assist the Government through the execution of duties governing hardware, software, and information system acquisition programs and other program management policies in accordance with Governmental decisions and oversight. Provide direct support for cyber related acquisitions throughout the total acquisition life cycle.

Training, Education, and Awareness The contractor shall conduct training of personnel within pertinent subject domain. Develop, plan, coordinate, deliver and/or evaluate training courses, methods, and techniques as appropriate.

Protect and Defend The contractor shall identify, analyze, and mitigate threats to internal information systems and/or networks.

Cybersecurity Defense Analysis The contractor shall apply defensive measures and information collected from a variety of sources to identify, analyze, and report events that occur or might occur within the network to protect information, information systems, and networks from threats.

Cybersecurity Defense Infrastructure Support The contractor shall test, implement, deploy, maintain, review, and administer the infrastructure hardware and software that are required to effectively manage the computer network defense service provider network and resources. Monitors network to actively remediate unauthorized activities.

Incident Response The contractor shall respond to crises or urgent situations within the pertinent domain to mitigate immediate and potential threats. Use mitigation, preparedness, and response and recovery approaches, as needed, to maximize survival of life, preservation of property, and information security. Investigate and analyze all relevant response activities in accordance with Government policies and procedures.

Vulnerability Assessment and Management The contractor shall conduct assessments of threats and vulnerabilities; determine deviations from acceptable configurations, enterprise, or local policy; assess the level of risk; and develop and/or recommend appropriate mitigation countermeasures in operational and nonoperational situations.

Analyze The contractor shall perform highly-specialized review and evaluation of incoming cybersecurity information to determine its usefulness for intelligence.

Threat Analysis The contractor shall identify and assess the capabilities and activities of cybersecurity criminals or foreign intelligence entities; produce findings to help initialize or support law enforcement and counterintelligence investigations or activities.

Exploitation Analysis The contractor shall analyze collected information to identify vulnerabilities and potential for exploitation.

All-Source Analysis The contractor shall analyze threat information from multiple sources, disciplines, and agencies across the Intelligence Community. Synthesize and places intelligence information in context; draw insights about the possible implications and advise the Government accordingly.

Targets The contractor shall apply current knowledge of one or more regions, countries, non-state entities, and/or technologies.

Language Analysis The contractor shall apply language, cultural, and technical expertise to support information collection, analysis, and other cybersecurity activities.

Collect and Operate The contractor shall provide specialized denial and deception operations and collection of cybersecurity information that may be used to develop intelligence.

Collection Operations The contractor shall execute collection using appropriate strategies and within the priorities established through the collection management process.

Cyber Operational Planning The contractor shall gather information and assist the Government in the development of detailed Operational Plans and Operational Orders supporting cyber requirements. Assist the Government with the conduct of strategic and operational-level planning across the full range of operations for integrated information and cyberspace operations.

Cyber Operations The contractor shall perform activities to gather evidence on criminal or foreign intelligence entities to mitigate possible or real-time threats, protect against espionage or insider threats, foreign sabotage, international terrorist activities, or to support other intelligence activities.

Investigate The contractor shall investigate cybersecurity events or crimes related to information systems, networks, and digital evidence Cyber Investigation The contractor shall apply tactics, techniques, and procedures (TTP) for a full range of investigative tools and processes to include, but not limited to, interview and interrogation techniques, surveillance, counter surveillance, and surveillance detection, and appropriately balances the benefits of prosecution versus intelligence gathering.

Digital Forensics The contractor shall collect, process, preserve, analyze, and present computer-related evidence in support of network vulnerability mitigation and/or criminal, fraud, counterintelligence, or law enforcement investigations.

Securely Provision The contractor shall conceptualize, design, procure, and/or build secure information systems, with responsibility for aspects of system and/or network development.

Risk Management The contractor shall support the documentation, validation, assessment, and authorization processes necessary to assure that existing and new information systems meet the Government's cybersecurity and risk requirements. Ensure Government approval risk mitigation, and the appropriate levels of compliance/assurance from internal and external perspectives.

Software Development The contractor shall develop and write/code new (or modifies existing) computer applications, software, or specialized utility programs following software assurance best practices.

Systems Architecture The contractor shall develop system concepts and work on the capabilities phases of the systems development life cycle; translate technology and environmental conditions (e.g., law and regulation) into system and security designs and processes.

Technology Research and Development (R&D) The contractor shall conduct technology assessment and integration processes; provide and support a prototype capability and/or evaluate its utility.

Systems Requirements Planning The contractor shall assist the Government with gathering and evaluating functional requirements and translates these requirements into technical solutions. Aid the Government in providing guidance to customers about applicability of information systems to meet business needs.

Test and Evaluation The contractor shall develop and conduct tests of systems to evaluate compliance with specifications and requirements by applying principles and methods for cost-effective planning, evaluating, verifying, and validating of technical, functional, and performance characteristics (including interoperability) of information systems and/or sub-systems.

Systems Development The contractor shall assist the Government during the development phases of the systems development life cycle.

SERVICES SUMMARY (SS).

SS and Quality Assurance Surveillance Plan (QASP) to be provided in subordinate Task Orders (TOs)

GOVERNMENT FURNISHED SUPPLIES AND SERVICES.

Services.

All information pertaining to Government provided services will be provided in subordinate TOs created under this contract.

Facilities.

All information pertaining to Government provided facilities will be provided in subordinate TOs created under this contract. Preliminary locations are identified in Para 5.5 and are subject to change.

Utilities.

All information pertaining to Government provided utilities will be provided in subordinate TOs created under this contract.

Equipment.

All information pertaining to Government provided equipment will be provided in subordinate TOs created under this contract.

Materials.

All information pertaining to Government provided materials will be provided in subordinate TOs created under this contract.

SPECIAL REQUIREMENTS/INSTRUCTIONS.

Contractor Identification in the Government Workplace.

When conversing with Government personnel during business meetings, over the telephone or via electronic mail, the contractor shall identify themselves as such to avoid situations arising where sensitive topics might be better discussed solely between Government employees. The contractor shall identify themselves on any attendance sheet or any coordination documents they may review. Electronic mail signature blocks shall identify their company affiliation. Amplifying information to be provided is subordinate TOs.

Industrial Security.

DD Form 254. Overarching security requirements and contractor access to classified information will be as specified in the DD Form 254, Department of Defense Security Classification attached to the contract. The contractor shall have a final U.S. Government issued TOP SECRET security clearance and be DCID 6/4 eligible with a current SSBI.

Physical Security.

The contractor shall safeguard all Government property provided for contractor use. At the close of each work period, Government facilities, property, and materials shall be secured. Amplifying information to be provided is subordinate TOs.

Key Control. The contractor shall establish and implement methods of ensuring that all keys and key cards issued to the contractor by the Government are not lost or misplaced and are not used by unauthorized persons.

The contractor shall immediately report the occurrences of a lost or duplicate key to the Contracting Officer’s Representative (COR).

In the event keys, other than master keys, are lost or duplicated, the contractor shall, upon written direction of the CO, rekey or replace the affected lock or locks; however, the Government, at its option, may replace the affected lock or locks or perform rekeying. When the replacement of locks or rekeying is performed by the Government, the total cost of rekeying or the replacement of the lock or locks shall be deducted from the monthly payment due the contractor. In the event a master key is lost or duplicated, all locks and keys for that system will be replaced by the Government and the total cost shall be deducted from the monthly payment due the contractor.

The contractor shall prohibit the use of keys issued by the Government by any persons other than the contractor’s employees. The contractor shall prohibit the opening of locked areas by contractor employees to permit entrance of persons other than contractor’s employees engaged in the performance of assigned work in those areas, or personnel authorized entrance by the COR.

Combinations and Codes. The contractor shall establish and implement methods of ensuring that all combinations and codes are not revealed to unauthorized persons. The contractor shall ensure that lock combinations are changed when personnel having access to the combinations no longer have a need to know such combinations.

Access lock combinations are “For Official Use Only” and shall be protected from unauthorized personnel.

Combinations to security containers, secure rooms, or vaults are classified information and shall properly safeguarded. Only the contractor employees with proper security clearance and need-to-know will be given combinations to security containers, secure rooms, or vaults.

Security alarm access codes are “For Official Use Only” and shall be protected from unauthorized personnel. Security alarm access codes will be given to contractor employees who require entry into areas with security alarms. The contractor shall properly safeguard alarm access codes to prevent unauthorized disclosure.

Privacy Act.

Work on this contract requires the contractor to have access to Privacy Information. The contractor shall adhere to the Privacy Act, Title 5 of the US Code, Section 552a and applicable Agency rules and regulations.

Location(s) of Work.

Primary: JBSA-Lackland, Port San Antonio, and San Antonio, TX Alternate:

· Nellis AFB NV and the Nevada Test and Training Range (NTTR).

· Norfolk NAS, VA.

· Ft Kit Carson, CO. Joint Electric Power Range (JEPR)

· Playas, NM. IW Combat Range

· Additional locations, including OCONUS areas, may be required and will be identified in subordinate TOs created under this contract.

Hours of Operation.

Work hours will be provided in subordinate TOs created under this contract.

Recognized Holidays. Unless otherwise specified in subordinate TOs, the contractor is not required to provide service on the following days:

If the holiday falls on Saturday, it is observed on Friday. If the holiday falls on a Sunday, it is observed on Monday.

Conservation of Utilities.

The contractor shall operate under conditions which prevent the waste of utilities which include the following:

Lights shall be used only in areas where and when work is actually being performed.

Mechanical equipment controls for heating, ventilation, and air conditioning systems shall not be adjusted by the contractor unless authorized.

Water faucets or valves shall be turned off after the required use has been accomplished.

Government telephones shall be used only for official Government business.

Records.

The contractor shall create, maintain and dispose of only those Government required records that are specifically cited in this PWS or required by the provisions of a mandatory directive listed in Appendix C - Applicable Publications & Instructions. If requested by the Government, the contractor shall provide the original record, or a reproducible copy of any such record within five (5) workdays of receipt of the request.

Contractor Manpower Data Reporting.

Effective FY2020, the Department of Defense will no longer require contractors to report into the Enterprise-wide Contractor Reporting Application (eCMRA). For FY 2020, contractors shall begin reporting manpower data relating to the performance services contracts into the System for Award Management (www.sam.gov).

The following contracts are subject to Service Contract Reporting (SCR): Any purchase of services by a military department or Defense Agency, in excess of $3 Million, for services in the following Service Acquisition Portfolios:

Logistics management services;

Equipment related services;

Knowledge-based services;

Electronics & comms services.

SAM receives contract information from FPDS-NG. It will only enable reporting for entities with contracts that meet the above stated SCR thresholds.

Contractor shall be an entity registered in SAM, an individual SAM user account with the Entity Administrator, Entity Registration Representative, or Reporter role for that entity, and one or more contracts awarded to that entity which meet the SCR reporting thresholds.

Steps for Submitting a Service Contract Report (SCR).

Go to www.sam.gov and log in.

Select Entity Registrations and then select Service Contract Reporting.

SAM displays your entities which have service contracts and meet the reporting criteria. Select View by entity to see the service contracts for each entity.

Next, select Add for the service contract against which you want to create a Service Contract Report. Each service contract which meets the FAR Subpart 4.1703 reporting thresholds is displayed.

Next, the Complete Service Contract Report page will be displayed. SAM displays the contract details and allows you to report. Contractor is required to enter the following information:

Total Amount Invoiced: Total dollar amount invoiced for services performed during the previous Government fiscal year under the contract (this amount should include the prime and any subcontract amount).

Prime Contractor Hours Expended: Prime contractor direct labor hours expended on the services performed during the previous Government fiscal year. The amount you enter is automatically divided by 2,080 hours to calculate a Full Time Employee (FTE) equivalent, displayed under the Prime Contractor Hours Expended as Prime Contractor FTEs.

Report any required Tier 1 subcontractor information by selecting the Add Tier 1 Subcontract Information button.

When you are ready to submit the report, select Submit. This saves your report and returns you to the Select Service Contract page where you can create other SCRs or edit an existing SCR.

Annual Reporting. Reporting inputs will be for the direct labor executed during the period of performance (PoP) for each Government fiscal year (FY), which runs 1 October through 30 September. While inputs may be reported any time during the FY, all data shall be reported no later than 31 October of each calendar year. The contractor shall provide reporting inputs for the final PoP of this contract no later than 30 calendar days after contract expiration. The contractor may direct technical questions about the SAM Service Contract Reporting tool to the Federal Service Desk FSD at https://www.fsd.gov/fsd-gov/home.do On/Off-Ramp.

The Government reserves the right to reopen competition at any time during any ordering period of this contract. The Government intends to review the need for additional contractors to fulfill anticipated requirements and to keep the competition pool viable. If additional contractors are needed, the Government will utilize the on-ramp procedure. Any additions due to on-ramps will not impact the operations and logistics IDIQ ceiling. The ordering period for new awardees will not exceed the overall maximum term of the original IDIQ contract, including options (i.e., will not extend past the dates established at initial award). The Government will not accept unsolicited submissions.

On-Ramp Procedures. The Government will continually engage with IDIQ awardees, industry external to the IDIQ and requirement owners to determine if/when on-ramp is needed to meet current or emerging requirements. On-going market research will also be performed to determine if/when on-ramp is needed. When on-ramp is used, the Government will advertise the reopening of the competition on beta.Sam.gov. The evaluation and selection of awardees for any on-ramp will utilize the same or similar evaluation and award criteria used for the initial IDIQ contract. Any new awardees will compete with existing or remaining Contractors for task and delivery orders.

Off-Ramp Procedures. The Government reserves the right to utilize off-ramps when it determines a Contractor’s performance is less than Satisfactory, the Contractor is unable to provide adequate support or there is a lack of participation. Adequate support is defined as the Contractor’s ability to fulfill contract requirements. Lack of participation is defined as failure to bid on more than one order within each ordering period. Contractors with less than satisfactory performance may be removed from the IDIQ contract at any time. No Contractor will be removed from the contract without documented and validated less than satisfactory performance by a Contracting Officer. Offerors removed from the IDIQ contract through the off-ramp provision are not eligible for subsequent "on-ramp" consideration.

NOTE: Contractors who desire removal from the contract for any reason not related to poor performance shall provide detailed documentation supporting why their removal is in the best interest of the Government. Documentation shall be submitted to the Operations, Logistics and Training ID/IQ Program Manager for consideration.

Environmental Controls.

Compliance with Laws and Regulations. The contractor shall be knowledgeable of and comply with all applicable Interstate, Federal, State, and Local laws, regulations, and requirements regarding environmental protection. In the event environmental laws or regulations change during the term of this contract, the contractor shall comply as such laws come into effect. If there is an increase or decrease in cost as a result of the change, the contractor shall inform the CO pursuant to notice requirements and negotiate a modification to the contract.

Notification of Environmental Spills. If the contractor spills or releases any substance contained in 40 CFR 302 into the environment, the contractor shall immediately report the incident to the COR. The liability for the spill or release of such substances rests solely with the contractor.

Safety Requirements (If Applicable).

In performing work under this contract, the contractor shall:

Conform to the safety requirements contained in the contract for all activities related to the accomplishment of the work.

Take such additional immediate precautions as the CO may reasonably require for safety and mishap prevention purposes.

Record and report promptly (within one hour) to the CO or COR, all available facts relating to each instance of damage to Government property or injury to either contractor or Government personnel.

In the event of an accident/mishap, take reasonable and prudent action to establish control of the accident/mishap scene, prevent further damage to persons or property, and preserve evidence until released by the accident/mishap investigative authority through the CO.

If the Government elects to conduct an investigation of the accident/mishap, the contractor shall cooperate fully and support Government personnel conducting the investigation.

Contractor Personnel Training.

Contractor personal training is command specific and will be provided in TOs created under this contract.

Special Training, Certifications and Qualifications.

Contractor personnel requiring access to a DoD Information System shall receive initial IA awareness orientation as a condition of access and thereafter shall complete annual IA refresher awareness, IAW by DoD Directive 8570.01, "Information Assurance Training, Certification, and Workforce Management."

Amplifying information pertaining to position Information Assurance Technical (IAT) or Information Assurance Management (IAM) requirements will be provided in subordinate TOs created under this contract.

DoD 8570 Registration.

The contractor shall register all DoD 8570 certifications into the Defense Workforce Certification Application (DWCA) using the following web address: https://www.dmdc.osd.mil/appj/dwc/index.jsp.

DWCA is the authoritative database of DoD Military, Civilian and Contractor personnel who hold active 8570 certifications used by the DoD CIO office to validate, monitor and report on the certification status of certified IA workforce members.

The contractor shall have subject matter experts (SMEs) that possess and maintain 8140/8570 certification(s).

Kick-off Meeting and Periodic Progress Meetings.

The contractor shall attend an initial kick-off meeting five (5) business days after TO award under this contract. The CO, COR, and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor's performance. At these meetings the CO will apprise the contractor of how the Government views the contractor's performance and the contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. The contractor shall provide minutes of these meetings to the Government.

Contractor Travel.

Required contractor employee travel will be provided in TOs created under this contract.

Contractor shall be required to travel to other Government facilities during the performance of this contract in support of specific tasks to include attend meetings, conferences, and to provide training. All travel requirements (including destination, purpose, plans, agenda, itinerary, number and names of personnel, and dates) shall be pre-approved by the COR. Contractor shall submit a trip report upon completion of travel. Costs for travel shall be billed on a strictly cost reimbursable basis IAW, the regulatory implementation of Public Law 99-234, FAR subpart 31.205-46 entitled Travel Costs and the limitation of funds specified in this contract. The Government will establish a CLIN for a set NOT-TO-EXCEED amount.

DELIVERABLES.

Reports and other data required in this PWS shall be submitted IAW the Contract Data Requirements List (CDRL) in Exhibit A of the contract.

OCONUS GOVERNMENT-FURNISHED SERVICES:

OCONUS Medical.

At OCONUS TDY locations, the government will provide emergency services only. All other medical and dental necessities shall be the contractor's responsibility.

OCONUS Meals.

At OCONUS TDY locations, meals are available at Dining Facilities (DFACs); the contractor will be invoiced and is responsible for DFAC reimbursement. Meals at all other OCONUS locations shall be the contractor's responsibility.

OCONUS Base Services.

At OCONUS TDY locations, the government will allow contractor use of/access to laundry facilities, Base Exchange, Post Office, Gym and morale centers.

OCONUS TRAVEL:

Letter of Authorization (LOA).

All OCONUS travel shall require a LOA. As noted in DFARS PGI 225.7402-3(e), a LOA is necessary to enable a contractor employee to process through a deployment processing center; to travel to, from, and within a theater of operations; and to identify any additional authorizations and privileges. The contractor shall use the Synchronized Pre-deployment & Operational Tracker (SPOT) web-based system, at http://www.DoD.mil/bta/products/spot.html, to enter and maintain data with respect to contractor personnel traveling/deployed OCONUS, and to generate LOAs. The contractor shall be responsible for initiating an LOA for each prospective traveler in SPOT. The government will authorize and approve LOAs in lieu of travel orders. All contractor employees shall carry an LOA with them at times while traveling/deployed OCONUS. Contractors will be assigned GS-equivalent grades for the purpose of determining the level of government-provided support to be provided as specified in DFARS PGI 225.74. Nonsupervisory positions will be equivalent to GS-12 and supervisory/management positions will be equivalent to GS-13.

Theater and Country Clearance Requirements.

All contractor personnel traveling overseas shall obtain Theater and Country Clearance authorizations; complete country-specific training, medical and immunizations requirements IAW the current DoD Foreign Clearance Guide (DoD FCG) at https://www.fcg.pentagon.mil/fcg.cfm. Submit clearance requests through Aircraft & Personnel Automated Clearance System (APACS) https://apacs.dtic.mil. The contractor shall ensure employees meet country clearance requirements within specific timeframes.

Country Entry/Work Requirements.

The contractor shall be responsible for obtaining passports, visas, in-country sponsorships, work permits, vehicle operations and any other licenses and host-nation permits and/or requirements necessary for its personnel working under this contract.

Defense Base Act Insurance.

All personnel performing duties OCONUS shall be included in and insured with a policy covering Defense Base Act (DBA) requirements.

Foreign/OCONUS Allowances and Benefit, Travel, and Per Diem.

OCONUS related pay, allowances and benefits shall not exceed the allowance rates and ceilings set forth by the Department of State (DOS) Standardized Regulations (DSSR) and DOS published geographical guidance. In special or unusual situations, actual costs in excess of maximum per diem rates may be allowable provided they do not exceed the higher actual cost amounts authorized by Federal civilian employees in the Joint Travel Regulation (JTR), Federal Travel Regulations (FTR) or the Standardized Regulations and that all four of the conditions in FAR 31.205-46(a)(3) are met. Subject to the constraints of FAR 31.109(c), advance agreement with the Contracting Officer regarding the amounts/rates to be reimbursed. Relocation costs are only reimbursable for initial relocation of FTEs to OCONUS location not for sustainment over the life of contract for replacement FTEs. All trips will be in accordance with regulatory requirements and actual travel shall be coordinated with the Government and pre-approved by the PM in writing. The Contractor shall be required to provide travel receipts to the CO/PM and COR as attachments in iRAPT (formerly known as WAWF).

Ramstein AB Germany.

Upon being qualified as a technical expert (TE) IAW with Article 73 of the Supplementary Agreement to the NATO SOFA in Germany IAW TESA requirements, the contractor shall be entitled to full individual logistical support authorizations (Package A) otherwise limited to American military personnel and civilians employed directly by DoD under the provisions of the NATO SOFA. Meet all host nation personnel, labor, and travel requirements at OCONUS locations. Coordinate Technical Expert Status Accreditation (TESA) applications or similar country-specific requirements with ACC Acquisition Management and Integration Center (AMIC) prior to hiring employees. TESA procedures and information can be found at the DoD Contractor Personnel Office (DOCPER) website (https://www.eur.army.mil/Contractor/). The host country has sole approval authority for all TESA applications.

Status of Forces Agreement.

The contractor shall be permitted the benefits in Article XIV and services of the organizations provided for in Article XV of the Status of Forces Agreement (SOFA) titled Agreement Under Article VI of the Treaty of Mutual Cooperation and Security between the foreign nation and the United States of America, Regarding Facilities and Areas and the Status of United States Armed Forces IAW local base instructions.

APPENDIX A - ACRONYMS AND ABBREVIATIONS LIST

Acronym/Abbreviation Definition

AF Air Force

AFB Air Force Base

CDRL Contract Data Requirements List

CFR Code Federal Regulation

CO Contracting Officer

COR Contracting Officer’s Representative

DOD Department of Defense

FAR Federal Acquisition Regulation

IAT Information Assurance Technical

IAM Information Assurance Management

IAW In accordance with

NDA Non-Disclosure Agreement

OSHA Occupational Safety and Health Act

PBSA Performance Based Service Acquisition

PWS Performance Work Statement

QA Quality Assurance

QASP Quality Assurance Surveillance Plan

SS Services Summary

TO Task Order

USAF United States Air Force

APPENDIX B - ESTIMATED WORKLOAD DATA

Work load estimates are command specific and will be provided in TOs created under this contract.

APPENDIX C - APPLICABLE PUBLICATIONS & INSTRUCTIONS

Compliance with all publications, regulations and operating instructions provided by the Government is required when: They pertain to the procedures for materials expediting herein and where the contractor is authorized by the PWS to accomplish the work specified in the publication, regulation or operating instructions. The publications prescribe USAF policies, use of materials, procedures and processes applicable to the work requirements. The contractor is required to acquire and work on the latest version of the publication.

1. Publications:

1.1. Information systems used by contractor personnel shall be operated in accordance with DOD 5220.22-M National Industrial Security Program Operating Manual (NISPOM). http://www.dtic.mil/whs/directives/corres/pdf/522022p.pdf

1.2. The contractor shall ensure that personnel accessing information systems have the proper and current IA certification when performing IA functions under this PWS in accordance with DoD 8570.01-M, “http://www.dtic.mil/whs/directives/corres/pdf/857001m.pdf” Information Assurance Work force Improvement Program.

APPENDIX D - MAPS ANDOR SITE PLANS

Maps and site plans are command specific and will be provided in TOs created under this contract.

APPENDIX E – KEY WORD DEFINITIONS

Cyber: Refers to both information and communications networks.

Cyber Attack: An attack, via cyberspace, targeting an enterprise’s use of cyberspace for the purpose of disrupting, disabling, destroying, or maliciously controlling a computing environment/infrastructure; or destroying the integrity of the data or stealing controlled information.

Cyber Incident: Actions taken through the use of an information system or network that result in an actual or potentially adverse effect on an information system, network, and/or the information residing therein.

Cyber Resiliency: The ability to anticipate, withstand, recover from, and adapt to adverse conditions, stresses, attacks, or compromises on systems that use or are enabled by cyber resources.

Cyber Risk: The risk of depending on cyber resources, i.e., the risk of depending on a system or system elements which exist in or intermittently have a presence in cyberspace.

Cyber Security: The ability to protect or defend the use of cyberspace from cyber attacks.

Cyberspace: A global domain within the information environment consisting of the interdependent network of information systems infrastructures including the Internet, telecommunications networks, computer systems, and embedded processors and controllers.

Cyber Threat: Any circumstance or event with the potential to adversely impact organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations, or the Nation through an information system via unauthorized access, destruction, disclosure, modification of information, and/or denial of service.

Defensive Cyberspace Operations (DCO): Passive and active cyberspace operations intended to preserve the ability to utilize friendly cyberspace capabilities and protect data, networks, net-centric capabilities, and other designated systems.

Offensive Cyberspace Operations (OCO): Cyberspace operations intended to project power by the application of force in or through cyberspace.