Attachment_01_-_SAOSS_PWS.pdf

SMC Specialized Acquisitions & Operations Security Support SMC/SY

FA8819-18-R-0010

SAOSS PWS - 1 of 77

Performance Work Statement

Specialized Acquisitions & Operations Security Support (SAOSS)

18 January 2018

Prepared by:

Reginald King, Program Manager

Richard White, Contracting Officer

SMC/SY

DISTRIBUTION STATEMENT C: Distribution authorized to the Department of Defense and their contractors due to administrative and operational use, 24 February 2014. Other requests shall be referred to SMC/SYS

WARNING — This document contains technical data whose export is restricted by the Arms Export Control Act (Title

22, U.S.C. 2751 et seq.) or The Export Administration Act of 1979, as amended, Title 50, U.S.C., App. 2401 et seq.

Violations of these export laws are subject to severe criminal penalties. Dissemination in accordance with provisions of

DoD Directive 5230.25.

DESTRUCTION NOTICE — For classified documents, follow the procedures in DoD 5220.22-M, National Industrial

Security Program (NISPOM), Section 7, or DoD Directive 5200.01. For unclassified, limited documents, destroy by any method that will prevent disclosure of contents or reconstruction of the document.

SAOSS PWS - 2 of 77

REVISION HISTORY

Revision Date Description

SAOSS PWS - 3 of 77

TABLE OF CONTENTS

Paragraph Title Page

1.0 Introduction

1.1 Purpose

1.2 Scope

2.0 Description of Services

2.1 Basic Security Functions:

2.1.1 Information Technology (IT) Security

2.1.2 Administrative Security

2.1.3 Physical Security

2.1.4 Communications Security (COMSEC)

2.2 Advanced Security Functions:

2.2.1 Acquisition Security

2.3 Specialized Security Support

2.4 Transition

2.5 Performance Requirements

3.0 Security Support Management

3.1 Contractor Management

3.2 Program Management Reviews

3.3 Critical Positions

4.0 Security Business Process Improvement

5.0 Contractor Badging and Identification

6.0 Performance Measurement

6.1 Performance Measurement Criteria

7.0 Service Delivery Summary (SDS)

8.0 Government Support

8.1 Government Facilities

8.2 Non-Government Facilities

9.0 Environmental Safety and Occupational Health

9.1 Ozone Depleting Compounds

9.2 Pollution Prevention

9.3 Safety

10.0 Government Furnished Property

11.0 Contract Data Requirements List (CDRL)

12.0 Special Considerations

12.1 Data Rights

12.2 Quality Control and Assurance Program

12.3 Government Program Management

12.4 Government Contract Management

ATTACHMENT I – GOVERNMENT SCHEDULE

ATTACHMENT II – ACRONYM LIST

ATTACHMENT III – APPLICABLE DIRECTIVES/REGULATIONS

ATTACHMENT IV – POSITION DESCRIPTIONS

ATTACHMENT V – POSITION ASSIGNMENTS

ATTACHMENT VI – “CRITICAL” POSITION ASSIGNMENTS

ATTACHMENT VII – INCREASE IN PERSONNEL

SAOSS PWS - 4 of 77

1.0 Introduction

1.1 Purpose

1.1.1 The objective of the Air Force (AF) Space and Missile Systems Center (SMC) Specialized

Acquisition & Operations Security Support (SAOSS) contract is to provide security services that support

Air Force Space Command (AFSPC) mission areas, with a primary focus on acquisition efforts and a secondary focus on certain AFSPC operational units that have security requirements for SCI and Special

Access Programs (SAP). This is accomplished through active and integrated security operations, processes, mechanisms and management. This support shall provide multi-disciplinary security support, including specialized analytical/program protection support, while being responsive and flexible to dynamic SAP security situations.

1.1.2 In addition, the contractor shall provide a proactive management structure that shall assist in evaluating and implementing opportunities for security process improvement. These improvements shall seek to improve overall program security while realizing efficiencies, without security degradations.

1.2 Scope

1.2.1 The contractor shall provide full-time support across a wide spectrum of security disciplines. This support shall provide multi-disciplinary security support, including specialized analytical/program protection support, while being responsive and flexible to dynamic SAP security situations.

1.2.2 Individuals supporting this task may be required to perform a combination of the duties below along with those detailed in ATTACHMENT IV. These duties are not necessarily all-inclusive (i.e., the government may require future security support that may not follow directly from a combination of the following functions). All individuals supporting this task shall possess a Top Secret (TS) clearance and

Single Scope Background Investigation (SSBI) current within the last six (6) years (with exception as identified in the PWS) and be eligible for Sensitive Compartmented Information (SCI). Depending on the position, additional security screening may also be required (e.g., polygraph examination, etc.). Loss or suspension of clearance may be grounds for immediate removal from the contract, pending the decision of the CO as advised by security oversight authorities.

1.2.3 Baseline positions shall be provided as outlined in ATTACHMENT V (encompassing an area within approximately a 50 mile radius). All personnel shall be full-time unless otherwise noted.

1.2.4 In addition to their function specific job description, all baseline positions may be required to perform any or all of the following duties in support of their position and the Programs/Units to which they are assigned:

1. Attend meetings as required in support of Program/Unit activities.

2. Prepare/present briefings, graphics, and visuals for/to leadership as required in support of

Program/Unit activities

3. Prepare security paperwork (e.g., Visit Certifications, Program Access Requests (PARs), and SAP indoctrination agreements, SAP Nomination Process (SAPNP) Questionnaire, etc.).

4. Assist in access control and perform escort duties for visitors in support of Program/Unit activities

5. Answer telephones and other modes of administrative communications in the performance of duties supporting Program/Unit activities.

6. Perform self-inspections; identify security discrepancies, and report security incidents.

SAOSS PWS - 5 of 77

7. Support security inspections; identify security discrepancies, assist in report preparation.

8. Perform courier responsibilities for classified information within the local area.

9. Control program media and information within SCI or SAP guidelines.

10. Use updated Security Classification Guide (SCG), or other source documents, to perform classification reviews on all SAP documentation ensuring proper derivative classification on all

SAP documents encountered during performance of duties.

11. Populate and update security databases (e.g., suspense tracking, personnel access, facility, POA&Ms, etc.) in the performance of duties assigned.

12. Possess working knowledge of Windows operating system and Office applications.

1.2.5 Contract performance periods shall be in accordance with the anticipated government schedule defined in Attachment I.

1.2.6 Any contractor employee may be summarily and immediately removed from or denied access to any government property, facility, and/or installation if the Government determines such action is necessary to protect or preserve government property, safety and security, or to maintain good order and discipline.

1.2.7 Performance shall be at the list designated government facilities and any other Temporary Duty

(TDY) locations including other government facilities, contractor facilities and overseas locations as required. Normal hours of operations are flexible. Core duty hours are 0900 to 1500, Monday through

Friday, with two-hour flexibility before or after core hours. However, individual work schedules shall be coordinated with the client representative to satisfy overall mission requirements. (**Unless specified by requesting organization) Any deviation from local policies and standard operating procedures will require documented approval from the Contracting Officer Representative.

Legal Holidays

The following Federal holidays are observed under this contract:

Holidays Dates

New Year's Day 1 January

Martin Luther King's Birthday Third Monday in January

President's Day Third Monday in February

Memorial Day Last Monday in May

Independence Day 4 July

Labor Day First Monday in September

Columbus Day Second Monday in October

Veteran's Day 11 November

Thanksgiving Day Fourth Thursday in November

Christmas Day 25 December

The Contractor’s employees are not required to perform services on legal holidays and/or the day of USG observation if legal holiday falls on the weekend.

1.2.8 The Government will neither formally supervise Contractor employees nor control the method by which the Contractor performs the required tasks. Under no circumstances shall the Government assign tasks to or prepare work schedules for individual Contractor employees. The Contractor shall manage its employees and to guard against any actions that are of the nature of personal services or give the perception of personal services. If the Contractor believes that any actions constitute or are perceived to constitute personal services, the Contractor shall notify the CO immediately.

SAOSS PWS - 6 of 77

1.2.9 The Contractor shall not perform any task of a policy, decision making or management nature, i.e., inherently Governmental functions. All decisions relative to programs supported by the Contractor shall be the sole responsibility of the Government. The Contractor shall not counsel, mentor, make judgment and/or discretionary decisions or perform any other activities related to supervision of Government personnel. During performance of this PWS, any Contractor personnel shall immediately stop work and notify the Government Contracting Officer (CO) and the Contracting Officer Representative (COR) in writing regarding any situation where there is a belief, or a reason to believe, work has been tasked to be perform which is an inherently governmental function as defined by FAR Subpart 7.5.

1.2.10 The Contractor will be highly visible to the entire acquisition community as a result of providing assistance to the Government. The Contractor shall present an unblemished appearance in regards to ethics, discretion, and protection of information, including the guidelines for electronic mail use listed in

AFI 33-119 and Internet use of AFI 33-129 AFOSISUP,

2.0 Description of Services

2.1 Basic Security Functions:

2.1.1 Information Technology (IT) Security

2.1.1.1 Information Technology Security services shall include Information Assurance and

Technical Security for Information Systems (IS), IT Network Administration and

Support, and Information Systems Security Manager (ISSM)/Information Systems

Security Officer (ISSO) support.

2.1.1.2 The contractor shall perform duties related to IT Network/System Administrator functions as defined in ATTACHMENT IV.

2.1.1.3 The contractor shall perform duties related to ISSM/ISSO support functions as defined in ATTACHMENT IV.

2.1.2 Administrative Security

2.1.2.1 Administrative Security includes, but is not limited to, personnel security, security administration, and document/media control.

2.1.2.2 The contractor shall perform duties related to Security Administration/Document

Control functions as defined in ATTACHMENT IV.

2.1.2.3 The contractor shall perform duties related to Personnel Security Specialist functions as defined in ATTACHMENT IV.

2.1.3 Physical Security

2.1.3.1 The contractor shall perform duties related to Physical Security/Information Assurance

Specialist functions as defined in ATTACHMENT IV.

SAOSS PWS - 7 of 77

2.1.4 Communications Security (COMSEC)

2.1.4.1 The contractor shall perform duties related to Communications Security Manager

2.2 Advanced Security Functions:

2.2.1 Acquisition Security

2.2.1.1 Acquisition Security includes Program Protection, System Security Engineering, Cybersecurity accreditation for mission systems, security reviews, and security education & training.

2.2.1.2 The contractor shall perform duties related to Cybersecurity System Security Engineer

2.2.1.3 The contractor shall perform duties related to Acquisition Security Analyst functions as defined in ATTACHMENT IV.

2.2.1.4 The contractor shall perform duties related to security education & training as defined in ATTACHMENT IV.

2.2.2 Security Services for Operational Units

2.2.2.1 Security services for AFSPC operational units includes both activity security representative functions (facility management, personnel security, OPSEC, security reviews) and

IT/Cybersecurity functions that directly support Air Force operational missions.

2.2.2.2 The contractor shall perform duties related to Activity Security Representative functions as defined in ATTACHMENT IV.

2.2.2.3 The contractor shall perform duties related to Information Technology/Assurance Specialist

2.2.2.4 The contractor shall perform duties related to SCI Security Specialist functions as defined in

ATTACHMENT IV.

2.3 Specialized Security Support

The contractor shall provide specialized analysis and associated products for security support on an as need basis. Support includes, but is not limited to SAP support to deployed units, program protection analysis for

CI/litigation support or other specific needs, graphic/visual aid support for items such as security education and training products, and other security related activities requiring specialized skills.

2.4 Transition

The contractor shall submit a transition plan and provide the necessary support. This plan and support shall address outgoing contractor support in accordance with CDRL A003. The plan shall be executable with little or no degradation of service delivery within the time allotted and includes a corresponding schedule and criteria for completion of transition events. The plan shall identify key transition issues, risks, and mitigation strategies, and propose effective recommendations for optimizing the transition.

SAOSS PWS - 8 of 77

2.5 Performance Requirements

The contractor shall meet all performance requirements identified in PWS paragraph 6.1.

2.6 Additional Support

The contractor shall support additional requirements when notified by the contracting officer as defined in

PWS Attachment VII.

3.0 Security Support Management

3.1 Contractor Management

3.1.1 Due to the number of locations that require security oversight support, the contractor shall provide an active management team which enables consistent guidance across the enterprise. As part of the semiannual Program Management Reviews (see Para 3.2 below), the contractor shall provide security business process improvements to enable better services while realizing efficiencies.

Contractor management shall also demonstrate an ability to retain personnel, especially in highly skilled positions.

3.1.2 The Contractor shall participate in organizational, system, process and information knowledge transfer from the Government program office team (Government, FFRDC, SE&I and A&AS members), to include overlap with existing Contractors, as applicable. The Contractor shall be available to attend a kick-off meeting with the CO, PM, COR(s), and organization representatives within two (2) weeks of contract award. The CO will coordinate the date, time, and location via e-mail notification with the Contractor, PM and COR.

3.1.3 The Contractor shall facilitate organizational, system and process knowledge and information transfer from the Contractor to any new Contractors or Government entities performing portions of this contract during the close out of this contract.

3.1.4 The Contractor shall provide for all management and support of personnel. The Contractor shall maintain a stable workforce while minimizing the impact of any turnover and/or disruptions to the

Government and/or mission. The Contractor shall ensure continuation of services during personnel absences due to sickness, leave, and voluntary or involuntary termination from employment such that there is no negative impact to the Government mission. Upon notification of a pending vacancy, the

Contractor shall provide written documentation to the PCO and the COR within one (1) business day.

In the case of a no-notice departure, the Contractor shall immediately inform the COR. This written notification shall include the date and time the position will be vacant, anticipated replacement date, and management correction action, if needed, to ensure task mission remains on schedule toward completion. Additionally, the Contractor shall fill the vacancy within 30 business days. If the vacancy cannot be filled within the required 30 business days, the Contractor must provide written notification to PCO.

3.1.5 The Contractor shall remove personnel at PCO’s request. The PCO may request removal

(permanent or temporary) of personnel for security, safety, or health reasons, upon discovery of fraudulent credentials/qualifications, or when Contractor personnel behave in an unprofessional manner that would be considered unacceptable by a reasonable person.

SAOSS PWS - 9 of 77

3.1.6 The Contractor shall employ fully qualified employees with the required knowledge and expertise as described in this PWS. However, if Government-unique training is identified to perform their duties, then written approval must be obtained from PCO prior to attending the training.

3.1.7 The Contractor shall demonstrate effectiveness in forecasting, managing, and controlling contract costs. The Contractor shall provide total accountability, accuracy, disclosure, control, forecasting, estimating, and overall management of all cost-based control activities, including monthly status report, Man hour and Expenditure Report, Trip reports, certificates of service, invoices, proposals, and limitation of funds. (CDRL A001)

3.1.8 The Contractor shall furnish all management, labor, tools, supplies, and materials (except as provided by the Government) necessary to perform the requirements contained herein, and; the contractor shall establish processes and assign appropriate resources to effectively administer the requirement. The Contractor shall respond to Government requests for contractual actions in a timely fashion. The Contractor shall have a single point of contact between the Government and Contractor personnel assigned to support this effort. The Contractor shall assign work effort and maintain proper and accurate time keeping records of personnel assigned to work on the requirement.

3.1.9 Contractors may be required to travel using commercial air, Government air, and other conventional modes. Travel arrangements will be based on individual tasks, and the cost of travel will be directly reimbursed from task funding. All travel (Outside Continental United States and

Continental United States (OCONUS & CONUS)) requires prior coordination by the COR.

Additionally, all OCONUS travel must be approved in advance by the PCO or COR designated by the PCO. Minimal local travel may be required. In no case will the total travel for each task exceed the travel dollars estimated/funded in the individual tasks/subtasks. Travel to other government facilities or other Contractor facilities may be required. All travel requirements (including plans, agenda, itinerary, dates) shall be pre-approved by the COR or PCO; and is on a strictly cost reimbursable basis. Costs for travel shall be billed in accordance with the regulatory implementation of Public Law 99-234, Federal Civilian Employee and Contractor Travel Expense Act of 1985 and

FAR 31.205-46 Travel Costs and Joint Travel Regulations. The Contractor shall provide a report of current and projected travel expenditures for Government tracking. (CDRL A002)

3.1.9.1 For any international travel, the Contractor shall use the Synchronized Pre-deployment and

Operational Tracker (SPOT) web-based system, to enter and maintain the data for all travel outside the United States.

3.1.9.2 The Contractor shall enter the required information about their Contractor personnel prior to travel and shall continue to use the SPOT web-based system at https://spot.dmdc.mil to maintain accurate, up-to-date information throughout the travel period for all Contractor personnel. Changes to status of individual Contractor personnel relating to their in-theater arrival date and their duty location, to include closing out travel with their proper status shall be annotated within the SPOT database IAW the timelines established in the SPOT Business Rules at http://www.acq.osd.mil/log/PS/ctr_mgt_accountability.html.

3.1.10 The contractor shall report ALL contractor labor hours (including subcontractor labor hours) required for performance of services provided under this contract via the secure data collection 33 site (i.e. Contract Manpower Reporting Application). The contractor shall completely fill in all required data fields using the following web address: http://www.ecmra.mil/. Reporting inputs will be for the labor executed during the period of performance during each government fiscal year (FY), SAOSS PWS - 10 of 77 which runs October 1 through September 30. While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year. Contractors may direct questions to the eCMRA help desk.

3.2 Program Management Reviews

The contractor program manager shall conduct semiannual Program Management Reviews (PMR) with the

Government. The reviews shall provide a forum to work any other program/contractual issues with the government reviews and shall include an update on the contractor’s program management plan, to include financial (obligations & expenditures) status on all Contract Line Item Numbers (CLIN), Other Direct

Charges (ODCs), current staffing status, Combating Trafficking in Persons (CTIP) program status, risk assessment and Quality Assurance Surveillance Plan (QASP) compliance. Reviews shall include an update on any special taskings executed in other sections of this document. The reviews shall also include any recommendations for security process improvements or other efficiencies, “lessons learned,” etc. These reviews will assist the Government with determining positions requiring an increase or decrease in the current staffing support. The agenda, date, and location of the Reviews will be mutually agreed to by the Government and the Contractor no later than seven (7) days prior to the Review. The Contractor shall capture action and activities with meeting minutes and deliver to the Government within five (5) business days of the Review. (See CDRL

A003 in Exhibit A.)

3.3 Critical Positions

The government has identified the contractor program manager and other specific positions as minimum required critical personnel in ATTACHMENT VI. Position qualification requirements for these positions are specified in ATTACHMENT IV. In the event an individual assigned to this effort from the Contractor

Program Office moves or terminates their employment, the contractor shall notify the Contracting Officer

(CO) in writing as soon as possible after the contractor becomes aware of the situation. In the event an individual designated to a critical position is reassigned, the contractor shall notify the CO, in writing, of such action at least 30 days prior to the effective date of this action. The notification shall include the name of the individual leaving, effective date of departure, and the name and resume of the replacement individual to be assigned to the key position. The Government shall be afforded the opportunity to review the resume of the replacement individual and provide to the contractor, for his consideration, any concerns regarding qualifications, security matters, or any other apprehension which could affect performance under this contract. The sole intent is to provide the Government the opportunity to review and comment on proposed changes of personnel assigned to positions designated as key. This does not, in any way, impinge on the contractor’s authority to hire or assign personnel as it deems fit, nor does it diminish contractor responsibility to fill the key positions with qualified personnel.

4.0 Security Business Process Improvement

Using established security process performance metrics, the contractor shall establish an on-going effort to monitor performance for continuous improvement. The contractor shall conduct an internal baseline assessment. The contractor shall recommend security business process/ organizational improvements at the

PMRs if the recommendations deviate from common standard practices or impact contract cost and/or performance. Such improvements may include standardization/improvement of existing processes, creation of new processes to address identified deficiencies, and streamlining of organizations/responsibilities to implement those processes. These recommendations may include realignment of baseline resources/personnel to support improvements. Process recommendations shall be based on either anticipated efficiencies gained and/or process improvement per established performance metrics (e.g., reduction in adjudication timelines, reduction in accreditation timelines, reduction in cost/schedule for acquisition programs, etc.). The contractor shall recommend reinvestment of any anticipated savings into other deficient security areas.

SAOSS PWS - 11 of 77

5.0 Contractor Badging and Identification

5.1 All contractor and subcontractor personnel shall clearly be identified as such at ALL times and from a distance. Contractor identification shall include conversations, mail, e-mail, teleconferences, video teleconferences, faxes, and/or other electronic communication whether with government personnel, other contractor personnel, or with the public when supporting this contract where their status as contractor employees might not otherwise be apparent or where they might be mistaken for civil service employees. As a minimum, contractor personnel shall clearly identify themselves using the label “Contractor” in e-mail addresses in accordance with Federal Acquisition Regulation (FAR) 37.114, Special Acquisition

Requirements; opening ALL phone conversations with a statement materially the same as, [office name], I am [employee name], a [prime Contractor’s company name] employee” including the employing

Contractor’s name in the letterhead and/or signature block of any written correspondence; and any other means necessary. Contractor-supplied badges shall be worn by contractor personnel, will be visible at all times, and at a minimum, will state: CONTRACTOR, the employee’s full name, employing company’s name, and position (i.e., CONTRACTOR, Jane A. Doe, XYZ Company, Job Title). Air Force issued identification badges and any Contractor badges shall be worn above the waistline during the individual’s duty hours.

6.0 Performance Measurement

6.1 Performance Measurement Criteria

6.1.1 The government will measure contractor performance throughout the duration of the contract.

The government will provide a QASP to the contractor at contract kickoff. Included in the PWS and the QASP are performance objectives used to measure contractor performance. The contractor may recommend additions/deletions to these objectives as well as particular incentives for inclusion in both the PWS and the QASP. The following are the performance measurement criteria pertaining to this effort (not listed by order of importance):

1. Initial Staffing. Upon start of transition, contractor management shall have the proposed team necessary to implement the contract staffed with qualified personnel at 100% (including adequate security support). Initial critical positions will be identified by the Government and must be fully staffed on day 1 of the contract. Initial staffing shall be reported to the CO.

2. Complete Staffing. By 30 days after contract award, the contractor shall have 100% of all positions filled with qualified personnel as provided in ATTACHMENT IV.

3. Personnel Training. Within 30 calendar days of hire, contractor management shall ensure personnel are 100% trained per position requirements (with exception for training provided by the government on a less than quarterly basis, and positions identified by government regulation (e.g.

DoDM 8570.01-M) as requiring training within 6 months). Further, after personnel are initially trained, the contractor shall ensure all personnel receive additional training necessary to remain professionally current. Training status for all personnel shall be reported to the QAPC monthly.

4. Critical Position Turnover Rate. Contractor management shall have less than 15% annual turnover in government-identified critical positions identified in ATTACHMENT VI.

5. Timely Hiring. If the government identifies a new contractually binding requirement or a position is vacated, the contractor shall fill that position with a qualified individual within 30 calendar days.

6. Overall Position Turnover Rate. Contractor shall have less than 18% annual turnover for all positions on contract including critical positions.

SAOSS PWS - 12 of 77

7. Security Training Program. Within 60 calendar days after contract award, contractor shall ensure security education and training program is established in an effort to reduce security issues. .

8. CDRL Submittals. Submit required CDRLs on schedule 95% of the time.

9. Security Incidents. Contractor shall have no more than one security infractions per 20 positions annually. Contractor shall have zero (0) security violations annually. Security incidents are as defined by security regulations referenced in Attachment III and as adjudicated by security oversight authorities.

10. CTIP. It is DoD policy to oppose prostitution, forced labor, and related activities as defined by

FAR 22.17 and DoDI 2200.01. The contractor shall notify all employees (including subcontractors) of prohibited activities and the actions that may be taken against them for violations. The contractor shall provide CTIP briefings and any internal CTIP policies or procedures upon contract award. The contractor shall allow CORs to perform audits and interviews with contractor employees to ensure CTIP compliance and monitoring. The contractor shall also monitor all employees for violations. CTIP training, program status, and violations or suspected violations shall be presented at the quarterly PMRs. The contractor shall not exceed zero (0) CTIP violations annually.

11. Quality & Schedule Impacts. A) No more than two (2) verified formal customer complaints/contract discrepancy reports per year. The Contractor must resolve customer complaints within ten (10) working days of receipt. B) No more than one (1) late document per month, and no more than two (2) sets of corrections required on any product. All corrections must be submitted within one (1) working day of revised suspense.

6.2 Methods of Surveillance That May Be Used:

100% Surveillance: The Government will inspect and evaluate 100% of the contractor’s results and overall performance to determine acceptability.

Periodic Surveillance: The Government will inspect and evaluate the contractor’s results and overall performance every month to determine contractor’s overall performance.

Customer Comment: A customer is defined as supported government organizations/units. Any customer that observes unacceptable services, either incomplete or not performed, for any of the above performance objectives should immediately contact the Government Program Manager (GPM) via e-mail. A meeting with the contractor will follow to address the complaints and review the proper procedures within the PWS.

If a deficiency is observed, a Customer Complaint Record (in memo format acceptable) should be annotated and forwarded to the GPM and PCO on the day of the infraction. If the deficiency requires immediate correction, a phone call may be necessary. When a complaint is received, the GPM validates the complaint by checking the PWS. The GPM must evaluate the complaints on a case-by-case basis. If any Government action or lack of action caused unacceptable performance, the complaint is not valid. If further action is required, the GPM will follow up with necessary corrective actions. At the end of each month, the

Customer Complaints are attached to the Certificate of Services and forwarded to the PCO. All validated complaints will be counted to determine if performance is acceptable or unacceptable.

Third Party Audits: contractor evaluation by a third party organization that is independent of the Government (i.e. DFAS, DCAA, DCMA) and the contractor. All documentation supplied to, and produced by, the third party should be made available to the government by the third party.

SAOSS PWS - 13 of 77

Trend Analysis: Data gathered from all other evaluation sources and methods to build a database upon which to monitor the contractors’ on-going performance over time. Data may be used to analyze contract conformance.

7.0 Service Delivery Summary (SDS)

Performance Objectives PWS Paragraph Performance Threshold

Initial contractor management team and critical positions (para 3.3) staffed with qualified personnel

6.1.1 (1) 100% staffing upon Day 1.

All positions filled with qualified personnel as defined by position descriptions

6.1.1 (2) 100% filled by 30 days after contract award.

Personnel trained per position requirements 6.1.1 (3) 100% trained within 30 calendar days after being hired (with exceptions)

Critical Position Turnover Rate. Reduced annual personnel turnover for sustained critical positions (para 3.3).

6.1.1 (4) <15% annual turnover for positions identified as critical. Measured annually concurrent with contract year.

Timely Hiring. Rapid response to new position requirements

6.1.1 (5) All identified new positions filled with qualified personnel within 30 calendar days. Measured annually concurrent with contract year.

Turnover Rate. Reduced overall personnel turnover for all positions

6.1.1 (6) <18% annual turnover for all required positions including critical

Security education and training program established

6.1.1 (7) 60 calendar days after contract award program must be established and approved

Timely CDRL submittals 6.1.1 (8) 95% of all CDRLs must be submitted by the time indicated on DD Form

Security. Reduced security incidents 6.1.1 (9) No more than 1 security incidents per

20 positions annually, w/zero security violations. Measured annually concurrent with contract year.

CTIP. Valid program reducing violations. 6.1.1 (10) Zero violations annually.

Quality & Schedule. Quality products delivered on-schedule.

6.1.1 (11) No more than 2 complaints annually;

No more than 1 late document monthly; no more than 2 sets of corrections required

SAOSS PWS - 14 of 77

8.0 Government Support

8.1 Government Facilities

The Government will provide office space, automated data processing (ADP) equipment, communications equipment, and consumable office supplies for personnel working or performing within a government-run facility.

8.2 Non-Government Facilities

In the event that government or government-leased facilities are not available at a given location, the contractor or subcontractor may be asked to enter into an appropriate agreement for the applicable portion of the contract requiring personnel to perform their duties in non-government facilities. Should this situation occur the employee shall still be co-located with Government personnel and the Government will provide, maintain, and track: ADP equipment, communications equipment, and consumable office supplies. All costs associated with the appropriate agreement(s) shall be included in the negotiated other direct costs of this contract. Contractors shall obtain CO approval prior to entering into any facility agreement for services provided under this contract. The contractor is not relieved of any contract requirements or entitled to any adjustments to the contract terms because of a failure to resolve a disagreement with a facilities provider.

9.0 Environmental Safety and Occupational Health

9.1 Ozone Depleting Compounds

In the performance of these services the contractor shall not at any time generate or use Class I or Class II

Ozone Depleting Compounds (ODC). Other controlled substances that shall not be generated or used include: carbon tetrachloride, methyl chloroform, and methyl bromide. For the purposes of this requirement, the following are the Class I ODCs and controlled substances that shall not be as any part of this service or process:

Halons: 1011, 1202, 1211, 1301, and 2402

Chlorofluorocarbons (CFC): CFC-11, CFC-12, CFC-13, CFC-111, CFC-112, CFC-113, CFC-114, CFC-115, CFC-211, CFC-212, CFC-213, CFC-214, CFC-215, CFC-216, and

CFC-217, and the blends R-500, R-501, R-502 and R-503

9.2 Pollution Prevention.

Contractor shall comply with DoD Instruction 4715.4, Pollution Prevention, dated 6 Jul 98 in all aspects of this service.

9.3 Safety

9.3.1 The contractor shall take such additional immediate precautions as the contracting officer may reasonably require for safety and mishap prevention purposes.

9.3.2 Record and report promptly (within one (1) hour) to the contracting officer or designated government representative, all available facts relating to each instance of damage to government property or injury to either contractor or government personnel.

9.3.3 In the event of an accident/mishap, take reasonable and prudent action to establish control of the accident/mishap scene, prevent further damage to persons or property, and preserve evidence until released by the accident/mishap investigative authority through the contracting officer.

SAOSS PWS - 15 of 77

9.3.4 If the government elects to conduct an investigation of the accident/mishap, the contractor shall cooperate fully and assist government personnel in the conduct of investigation until the investigation is completed.

10.0 Government Furnished Property.

It is the Government’s intent that all work on this contract will be performed in government-operated facilities. If contractor proposes the use of off-site facilities, then subject to Government approval and accreditation (see Para 8.2 above) the following government furnished property may be provided to facilitate secure interface with Government communications and information technology infrastructure:

1. Secure telephone equipment (STE)

2. Data encryption devices (e.g., TACLANE, etc.)

11.0 Contract Data Requirements List (CDRL)

The contractor shall be responsible for providing three (3) CDRLs (*001-*003) under this contract. The DD

Form 1423 for the individual CDRLs and additional instructions can be found in Exhibit A of the contract.

All CDRLs shall be provided electronically using standard Microsoft ® Office electronic format.

12.0 Special Considerations

12.1 Data Rights

All work products produced by the contractor and/or subcontractors under this contract shall be provided to the government with Unlimited Rights at no additional cost. The government shall be able to use, modify, reproduce, release or disclose administrative and technical data or computer software in whole or in part, in any manner, and for any purpose whatsoever, and to have or authorize others to do so.

12.2 Quality Control and Assurance Program

12.2.1 In compliance with the FAR clause 52.246-5 entitled “Inspection of Services”, the Contractor shall provide a complete Contractor Quality Control Program to ensure the requirements of this contract are provided as specified 90 calendar days after start of transition. The contracting officer shall notify the Contractor of acceptance or required modifications (at no additional costs to the government) and obtain acceptance of the plan by the contracting officer before the start of the first operational performance period.

12.2.2 The government will periodically evaluate contractor performance by appointing a representative(s) to monitor performance to ensure services are received. The government representative will evaluate the Contractor’s performance through intermittent on-site inspections of the Contractor’s quality control program and receipt of complaints from government personnel. The government may inspect each task as completed or increase the number of quality control inspections if deemed appropriate because of repeated customer complaints. Likewise, the government may decrease the number of quality control inspections if merited by performance. The government will also investigate complaints received from customers. The contractor shall be responsible for initially validating customer complaints. However, the government representative shall make final determination of the validity of customer complaint(s) in cases of disagreement with customer(s).

SAOSS PWS - 16 of 77

12.2.3 The overall program management responsibilities for this effort resides with the following office:

SMC/SY

Attn: Mr. Reginald King, SMC/SYS

483 North Aviation Boulevard

El Segundo, CA 90245-2808

(310) 415-1578

12.2.4 The contractor will be notified at time of award of the primary Quality Assurance Program

Coordinator assigned to this effort.

12.3 Government Program Management

The Government personnel responsible for individual sites will provide access to all technical data required to perform approved taskings. Only the Government Program Manager(s) and local Government oversight personnel (for supported AFSPC organizations/units not located at LAAFB) have authority to review and approve contract deliverables in coordination with the Government Contracting Officer. A Contracting

Officer Representative (COR) may be appointed by the CO to be responsible for monitoring, evaluating, and reporting Contractor performance on this contract. The COR will interface with the Contractor, Government

PM, and the PCO.

12.4 Government Contract Management

Responsibility for contracting activities rests solely with the Government Contracting Officer. No conversation, recommendations, or direction, whether given directly by, or implied by Government personnel, affecting scope, schedule, or price of the program covered by this PWS, shall be acted upon by the contractor unless specifically approved by the Government Contracting Officer located at the below address:

SMC/SYK

Attn: Mr. Richard White

483 North Aviation Boulevard

El Segundo, CA 90245-2808

(310) 415-1508

SAOSS PWS - 17 of 77

ATTACHMENT I – GOVERNMENT SCHEDULE

Contract

Award

Transition Basic

Contract

Option 1 Option 2 Option 3 Option 4

May 2018 May 2018 May 2018

– May

May 2019

– May

May 2020

– May

May 2021

– May

May 2022

– May

Option 5 Option 6 Option 7 Option 8 Option 9 Extension

May 2023 –

May 2024

May 2024 –

May 2025

May 2025

– May

May 2026

– May

May 2027

– May

May 2028 – Nov 2028

SAOSS PWS - 18 of 77

ATTACHMENT II – ACRONYM LIST

AF Air Force

AFB Air Force Base

AFI Air Force Instruction

AFOSI/PJ Air Force Office of Special Investigations, Office of Special Projects

AFPAM Air Force Pamphlet

AFSPC Air Force Space Command

ADP Automated Data Processing

AIS Automated Information Systems

CDRL Contract Data Requirements List

CLIN Contract Line Item Number

CNSSI Committee on National Security Systems Instruction

CO Contracting Officer

COMSEC Communications Security

CONUS Continental United States

COR Contracting Officer Representative

CSA Cognizant Security Authority

CTIP Combating Trafficking in Persons

DoD Department of Defense

FAR Federal Acquisition Regulation

GFP Government Furnished Property

IA Information Assurance

ICD Intelligence Community Directive

ISSM Information Security System Manager

ISSO Information System Security Officer

IT Information Technology

JFTR Joint Federal Travel Regulation

JSIG Joint Security Implementation Guide

LAAFB Los Angeles Air Force Base

NISPOM National Industrial Security Program Operating Manual

NISPOMSUP National Industrial Security Program Operating Manual Supplement

NIST National Institute of Standards and Technology

NSDD National Security Decision Directive

OCONUS Outside the Continental United States

ODC Ozone Depleting Compounds

OPSEC Operations Security

OSHA Occupational Safety and Health Administration

PAR Program Access Request

PCA Polygraph and Credibility Assessment

PERSEC Personnel Security

PM Program Manager

PMR Program Management Review

PPP Program Protection Plan/Program Protection Planning

PSP Personnel Security Program

PWS Performance-Based Work Statement

QASP Quality Assurance Surveillance Plan

RDT&E Research and Development Test & Evaluation

SAOSS PWS - 19 of 77

SAP Special Access Program

SAPCO SAP Central Office

SAPNP Special Access Program Nomination Process

SCG Security Classification Guide

SCI Sensitive Compartmented Information

SDS Service Delivery Summary

SSBI Single Scope Background Investigation

SSE System Security Engineering

STE Secure Telephone Equipment

TS Top Secret

VAFB Vandenberg Air Force Base

SAOSS PWS - 20 of 77

ATTACHMENT III – APPLICABLE DIRECTIVES/REGULATIONS

DoD Regulations

DoD Instruction 2200.01, Combating Trafficking in Persons (CTIP), 15 Sep 10

DoD Instruction 4715.4, Pollution Prevention, 6 July 98

DoD Directive 5000.01, The Defense Acquisition System, 12 May 03

DoD Instruction 5000.02, Operation of the Defense Acquisition System, 25 Nov 13

DoD Directive 5200.01, DoD Information Security Program, 24 Feb 12

DoD Instruction 5200.01, DoD Information Security Program and Protection of Sensitive Compartmented

Information, 13 Jun 11

DoD Directive 5200.02, DoD Personnel Security Program (PSP), 21 Mar 14

DoD Directive 5200.39, Security, Intelligence, and Counterintelligence Support to Acquisition Program

Protection, 28 Dec 10

DoD Directive 5205.07, Special Access Program (SAP) Policy, 1 Jul 10

DoD Directive 5205.07, Vol. 4, SAP Security Manual: Marking, 10 Oct 13

DoD Directive 5205.10, DoD Treaty Inspection Readiness Program (DTIRP), 20 Feb 09

DoD Directive 5205.2E, DoD Operations Security Program (OPSEC), 20 Jun 12

DoD Directive 5205.02-M, DoD Operations Security (OPSEC) Program Manual, 3 Nov 08

DoD Instruction 5205.11, Management, Administration, and Oversight of DoD Special Access Programs

(SAP), 6 Feb 13

DoD Instruction 5210.91, Polygraph and Credibility Assessment (PCA) Procedures, 12 Aug 10

DoD Directive 5220.22, DoD Industrial Security Program, 18 Mar 11

DoD Directive 5220.22-M, National Industrial Security Program Operating Manual (NISPOM), 28 Feb 06, including Change 1, 01 Apr 04

DoD Directive 8500.01, Cybersecurity, 14 Mar 14

DoD Instruction 8523.01, Communications Security (COMSEC), 22 Apr 08

DoD Instruction 8570.01-M, Information Assurance Workforce Improvement Program, 11/10/2015

DoD Joint Security Implementation Guide (JSIG), 9 Oct 13

SAOSS PWS - 21 of 77

Air Force Directives/Instructions/Pamphlets

AFPD 16-7 Special Access Programs, 19 Feb 14

AFI 16-701, Special Access Programs, 18 Feb 14

AFI 31-401, Information Security Program Management, 23 Jan 08, including AFGM 1, 29 Feb 12

AFPD 31-5, Personnel Security Program Policy, 1 Aug 95

AFI 31-501, Personnel Security Program Management, 27 Jan 05

AFPD 31-6, Industrial Security, 1 Apr 00

AFI 31-601, Industrial Security Program Management, 29 Jun 05

AFI 24-301, Vehicle Operations, 17 Aug 12

NISPOMSUP Overprint Implementer, 25 Nov 98

Other Directives (Including legacy regulations)

Executive Order 13526, Classified National Security Information, 29 Dec 09

ICD 503, Intelligence Community Information Technology Systems Security Risk Management, Certification and Accreditation, 15 Sep 08

ICD 705, Sensitive Compartmented Information Facilities, 26 May 10

JAFAN Manual 6/9, Physical Security Standards for Special Access Program Facilities, 20 Dec 05

Joint Pub 3-54, Joint Doctrine for Operations Security, 13 Jan 03

National Security Decision Directive (NSDD) 298, National Operations Security Program, 22 Jan 1988

NIST Special Publication 800-53, Revision 4, Recommended Security Controls for Federal Information

Systems and Organizations, 30 Apr 13

NTISSI 7000, TEMPEST Countermeasures for Facilities, 29 Nov 93

Special Access Program Nomination Process (SAPNP) Implementation Guidance Memorandum, 25 Sep 13

SAOSS PWS - 22 of 77

ATTACHMENT IV – POSITION DESCRIPTIONS

IV.1 Acquisition Security Analyst I

The Acquisition Security Analyst will assist the Government Program Manager with the development and implementation of comprehensive program protection methodologies to protect advanced technology programs throughout the system’s life cycle.

Performance shall include:

Duties as outlined in PWS para 1.2

In-depth lifecycle program analysis to identify critical program information (CPI), Critical System

Resources (CSR), and their associated vulnerabilities

Assist with the identification and implementation of countermeasures

Develop and implement a risk management based program protection plan and strategy

Provide technical advice and security support to collateral and SAP programs and emerging mission areas

Provide security recommendations to the PM, GSSO, and cognizant security authorities as it relates to the Air Force acquisition and sustainment process

Maintain a working relationship with the PM, Contracting Officer and contractor security officers to ensure a standardized and correct format/process is utilized for all DD Form 254 efforts throughout the acquisition and sustainment lifecycle, in coordination with Program Security Officers

Directly support customer program protection/security officers in the development, execution and implementation of Program Protection Planning (PPP)

Assess threat and risk, develop risk management actions and implement long term courses of actions

Assist in the development and writing of operations security (OPSEC) plans, transition plans, emergency action plans, transportation plans, security CONOPS, and any other security documents as needed for the customer

Review program documentation for public release, to include ensuring Controlled Unclassified

Information (CUI) has proper markings, classifications and distribution statements per Air Force doctrine

Prepare and produce analytical products from numerous resources, to include various databases, to ensure a real-time, tailored product is provided

Provide classification guidance and assistance for all security programs to include collateral and SAP programs

Write, review, and/or edit Security Classification Guides (SCG), Exposure Contingency Plans (ECP), Managed Access Plans (MAP), Security Operating Procedures (SOPs), System Test Plans (STP)

Assist government system security engineers performing close out actions…