Attachment_1 _FSS_Performance_Work_Statement_Amendment_0002.pdf

FA9101-14-R-0200

Attachment 1

Performance Work Statement (PWS)

AEDC Facility Support Services

(FSS)

Amendment 2

12 December 2014

Vision Statement

1 Introduction

1.1 Mission

1.2 Background

1.3 Scope

2 General Requirements

2.1 Business Relations

2.2 Contract Administration and Management

3 Performance Requirements

3.1 Industrial Security, Test Security, and Security Management Support

3.2 Protective Services

3.3 Operations Center and Command & Control (C2) Element functions

3.4 Fire and Emergency Services Program

3.5 Environmental Management Program

3.6 Safety

3.7 Occupational and Environmental Health (OEH) (Industrial Hygiene)

3.8 Base Supply

3.9 Freight Services

3.10 Vehicle Operations and Maintenance

3.11 Grounds Maintenance

3.12 Solid Waste Management

3.13 Custodial Services

3.14 Interface Management

3.15 General Management

4 Special Requirements

5 Acronyms

6 Deliverables

APPENDICES

APPENDIX A – GROUNDS DESCRIPTION/WORKLOAD ESTIMATES

APPENDIX B – GROUNDS AREA MAPS and SITE PLANS

APPENDIX C – GROUNDS DEFINITIONS

APPENDIX D –SNOW/ICE REMOVAL AREAS

APPENDIX E – AUTHORIZED CHEMICALS

APPENDIX F - ESTIMATED SOLID WASTE WORKLOAD AND FREQUENCIES

APPENDIX G – SOLID WASTE COLLECTION AREA MAPS AND/OR SITE PLANS

APPENDIX H – AIR FORCE CUSTODIAL LEVELS OF SERVICE STANDARDS 175

APPENDIX I – ESTIMATED SQUARE FOOTAGE AND CLEANING LEVEL

APPENDIX J – AEDC FACILITY MAP

APPENDIX K – BARE-GROUND HERBICIDE MAP 2014

APPENDIX L – AEDC ARNOLD AFB VEHICLE FLEET AND VEHICULAR

EQUIPMENT

Performance Work Statement (PWS)

Facility Support Services

Vision Statement

1 Introduction

The Air Force Test Center's (AFTC) Arnold Engineering Development Complex (AEDC) is a national aerospace ground test facility that conducts tests, engineering analyses, and technical evaluations for research, system development, and operational programs of the Air Force (AF) and Department of Defense (DoD), other Government agencies, and industry. Using ground test facilities and computational engineering, AEDC supports propulsion, aerodynamic, reentry, trans-atmospheric, and space-flight systems testing. This testing underpins the technical knowledge required for the development and qualification of key warfighter aerospace weapons. Testing is performed in an environment that simulates operational conditions. AEDC also performs research to develop new technology for advanced test facilities, test techniques, and measurement methodologies associated with ground tests. The purpose of this solicitation is to obtain the technical expertise and services necessary to support AEDC in execution of its mission. The FSS Contractor’s efforts will be integrated with other Contractor efforts known overall as Test Operations and Support. Constrained fiscal environments endanger the continued operation of some test facilities - near term efficiencies will be necessary to allow continued operation of required capabilities at technical levels necessary to sustain the world's most capable Air Force. Strong business arrangements and effective teamwork with other Contractors supporting overall mission and base support operations will be essential and comprehensive associate contract agreements (ACA) will be vital.

1.1 Mission

AEDC exists to test and evaluate weapon, propulsion, aerodynamic and space systems at realistic conditions for the nation through modeling, simulation and ground test facilities.

The mission is essential to developing and fielding weapons systems for the nation's warfighters.

The FSS Contractor will be expected to perform in this mission, while smoothly integrated with the other AEDC Contractors and Government personnel, in a manner that makes AEDC the most effective ground test and evaluation complex in the world – suitable for supporting the best Air Force in the world.

1.2 Background

The AEDC Test Operations and Support Contracts will provide the Contractor workforce necessary to successfully operate and sustain AEDC's test facilities at Arnold AFB, TN, and geographically separated units (GSUs) at White Oak, MD, and Moffett Field, CA. Since its inception, AEDC has been Contractor-operated, and Contractors provide the majority of the workforce. Contractors conduct test operations, base operations, test facility and base infrastructure maintenance and improvement efforts, and many other services critical to operating and sustaining the nation's largest collection of aerospace ground test facilities. This Contractor support includes providing all Air Force Base (AFB) services such as security, fire protection, environmental, safety, and other standard services. Several significant changes from current contracting arrangements will occur with the awarding of the Test Operations and Support contract(s). Enterprise contracting initiatives will result in information technology tasks and the operation of the Precision Measurement Equipment Laboratory (PMEL) being performed under separate contracts. In addition, some portions of base operating support tasks, historically part of the overall contract, will be set aside for small business under a FSS contract.

Finally, Government personnel will accomplish the technical management and engineering analysis for test programs conducted at the Arnold AFB location and remote locations as needed with assistance from the Test Services Contractor.

AEDC must award flexible contract vehicle(s) that allow meeting customer’s needs while:

Ensuring effective and efficient Test Operations and Support;

Preserving intellectual capital for test support and analysis;

Increasing technical work by the Government workforce;

Implementing innovative solutions that immediately begin cost reductions;

Accommodating dynamic changes in workload;

Increasing small business participation;

Rewarding management / technical innovation;

Providing incentives to increase efficiency and productivity in workforce labor practices;

1.3 Scope

This project provides multiple aspects of base operating support functions in support of AEDC’s test mission. Called the FSS contract, it provides supply, vehicle maintenance, freight, operations center & C2 functions, industrial and test security, protective services, and fire and emergency services. The FSS contract also provides support for overall AEDC Safety, Environmental, and Occupational Health programs. Finally, it provides grounds maintenance, solid waste management and custodial services.

2 General Requirements

The effort will be performed primarily at the AEDC site at Arnold AFB in Tennessee.

Performance will also be required at AEDC facilities housed as tenants on sites at Tunnel 9 in White Oak, MD and on the National Aeronautics and Space Administration (NASA) Ames Research Center (ARC) grounds at Moffett Field, CA. Requirements listed in this PWS are assumed to be AEDC Arnold AFB unless specifically noted otherwise.

2.1 Business Relations

The Contractor shall successfully integrate and coordinate all activities needed to execute the requirement. The Contractor shall manage the timeliness, completeness, and quality of problem identification. The Contractor shall provide corrective action plans, proposal submittals, timely identification of issues, and effective management of sub-contractors. The Contractor shall coordinate and cooperate closely with associate Contractors involved in the execution of AEDC’s mission. The Contractor shall seek to ensure satisfaction of all internal and external customers and professional and ethical behavior of all Contractor personnel.

2.2 Contract Administration and Management

The Contractor shall perform all contract management functions required to ensure proactive and sustained contract excellence in providing accurate, safe, secure, timely, and efficient facility support services to meet the Government's established requirements.

2.2.1 Contract Management

The Contractor shall designate and locate at AEDC Arnold AFB a responsible corporate official with no responsibility other than for this contract and empowered to make and implement all decisions regarding the performance of this contract.

2.2.2 Contract Administration

The Contractor shall:

Ensure performance of the business and administrative aspects of the contract;

Report all Full-Time Equivalents (FTEs) in accordance with Section 8108 of Public Law 112-10 of the DoD and Full-Year Continuing Appropriations Act, 2011;

Ensure resources are efficiently and effectively managed and contract status (including Government-furnished resources) is reported to Government representatives.

Recommend Operating Instructions (OI) and changes to existing instructions to assist in managing and executing this contract and to facilitate the efficient operation of AEDC.

Develop, implement, and manage formal associate Contractor agreements with the following Contractors at AEDC Arnold AFB: Test Operations and Sustainment (TOS); Test Services; PMEL; Performance Based Restoration; and Base Communications and Information Technology Services.

2.2.3 Personnel Administration

The Contractor shall:

Maintain a qualified work force to support the Government and ensure AEDC maintains compliance with all applicable regulations. Conduct craft, supervision, and management training programs.

Maintain staffing records identifying company organizational designations, a brief description of the functions, and the number and types of personnel assigned;

Provide and administer an Equal Opportunity Affirmative Action Program that complies with all Federal statutes.

3 Performance Requirements

3.1 Industrial Security, Test Security, and Security Management Support

3.1.1 The Contractor shall establish and maintain an industrial security program compliant with DoD 5220.22-M, National Industrial Security Program Operating Manual (NISPOM), and other mandatory directives listed in the solicitation to protect information and operations critical to the successful accomplishment of AEDC’s mission. Additional mandatory directives are listed in Table 3.1.1 of this

PWS.

At Arnold AFB, the FSS Contractor will be designated as an “On-Base Cleared Facility” per DoD 5220.22-R and will be cleared under the provisions of the National Industrial Security Program (NISP). The Chief of Information Protection has been designated by the Installation Commander to provide security oversight and the Information Protection Office will be the Servicing Security Activity (SSA).

At AEDC White Oak and AEDC Moffett Field Contractors will be designated as Integrated Visitor Groups, and will operate under the direct control/supervision of the AF. The integrated visitor group will be authorized to function in accordance with DoDM 52001 and AF Instruction (AFI) 31-401 per a Visitor Group Security Agreement (VGSA).

The AF maintains control of all classified material and provides day-to-day supervision over the Contractor operation. It differs from the on-base cleared facility because of its close interaction and/or relationship with the AF organization it supports.

As the Prime Security Contractor and an “on-base cleared facility” the FSS Contractor will be responsible for establishing & managing all physical space, listed in Table 3.1.2, required for test operations, establishing standard security practices and procedures for classified and commercial test areas as well as managing the Special Access Programs (SAP) Security Program. In order to fully implement AEDC Information Protection Program objectives, the Contractor will need to work with and perform security support functions in coordination with the Chief of Information Protection, the AEDC Government SAP Security Officer, the AEDC Special Security Officer, AEDC Security

Managers, respective program/project manager(s), and other Contractors preforming work at AEDC.

In addition to requirements identified in the DD Form 254, this effort must ensure compliance with a variety of specialized security directives, regulations and guides including DoD Regulations, AFIs, and related AEDC policies/operating instructions (OIs). Contractor personnel must also have knowledge of the Joint Air Force – Army – Navy (JAFAN) Manuals 6.0, 6/3, 6/4, 6/9, Foreign Disclosure, DoD regulations, pertinent Department of Navy regulations, SAF/AQ Policy Documents, and pertinent Executive Orders. The Contractor personnel must be familiar with protecting Automated Information Systems.

There are certain inherently governmental functions and activities that cannot be outsourced to a Contractor. Inherently governmental activities and functions include those that require either the exercise of substantial discretion in applying U.S.

Government authority, or value judgments when making decisions for the U.S.

Government. Although the Contractor will be tasked to support assigned Government Program Security Manager(s) with respective security program requirements and to assist in providing centralized security services, the Government security manager has the lead and is the decision maker. The Contractor is only providing support in this capacity to perform administrative security functions under the direction of the activity security manager.

Activity security management shall ensure that Contractors who are involved in security administration and support duties are clearly identified in their capacities, roles, and functions, to ensure there is no possible confusion regarding which security personnel may exercise inherently governmental authorities and which may not. The Contractor should contact the contracting officer for clarification in the event of any conflict.

Inherently governmental Security Functions, relating to this section of the PWS, include, but are not limited to:

Approving and issuing security policies and procedures

Making original classification decisions, or rendering classification determinations regarding classified information that is improperly or incompletely marked.

(Correcting improper markings when the appropriate classification is not in question is not considered rendering a classification determination.)

Deciding to downgrade or declassify information. (Adhering to security markings on information or to guidance stated in an appropriate security classification or declassification guide is not considered a downgrading or declassification decision.)

Deciding challenges to classification and any appeals

Making foreign disclosure decisions

Making public release decisions

Committing to expenditure of U.S. Government funds

Conducting investigations of, or determining fault in, security incidents involving U.S. Government or other Contractor personnel. (Contractors may conduct preliminary inquiries to determine if a security incident is a violation or an infraction.)

Giving final approval or executing documents for filing in litigation if documents assert an official position of the DoD, any DoD Component, or any other Federal agency

3.1.1.1 The Contractor shall obtain and maintain a facility clearance at the classification level of Top Secret prior to performing any classified work on the contract.

Performance Standards

a) STD: No Security Violations that result in a loss or compromise of classified Information.

b) STD: Score/Achieve no less than a Commendable rating (750 - 799) on the Defense Security Service’s (DSS) Assessment Rating Matrix and no less than a “Satisfactory” on all other, internal and external security reviews, inspections, audits, and/or vulnerability assessments.

AQL: Score/Achieve no less than a Satisfactory rating (649 –749 points) on the DSS’s Assessment Rating Matrix.

3.1.2 The Contractor shall provide security support sufficient to ensure full compliance with DoD, service, and local directives.

3.1.2.1 The Contractor shall designate a full time Facility Security Officer (FSO) with independent authority to manage and enforce all aspects of the Industrial Security program requirements for the company.

a) STD: The designated FSO, or those otherwise performing security duties shall complete required security training and briefings considered appropriate by the Servicing Security Activity (SSA); obtain and maintain required Defense Security Service (DSS) professional certifications or ASIS International professional certifications.

FSO Requirements are:

Security training through the Defense Security Service (DSS) - FSO Program Management For Possessing Facilities Curriculum (IS030.CU) (Approximately 17 Courses). Additional courses or curriculum may be needed to obtain applicable certifications.

DSS Professional Certifications:

Required Security Professional Education Development Program (SPēD) certifications through DSS.

o Security Fundamentals Professional Certification (SFPC): Provides a recognized and reliable indication of a security practitioner's understanding of foundational concepts, principles, and practices needed to successfully perform functions, implement programs, and pursue missions to protect DoD assets. The SFPC must be conferred prior to the conferral of another core certification.

o Security Asset Protection Professional Certification (SAPPC): Provides a recognized and reliable indication of a security practitioner's ability to apply foundational concepts, principles, and practices needed to successfully perform functions, implement programs, and pursue missions to protect DoD assets.

Obtain the following SPēD certification within 2 years of contract start.

o Security Program Integration Professional Certification (SPIPC): Provides a recognized and reliable indication of a security practitioner's understanding and ability to apply risk management and security program management concepts, principles, and practices.

Obtain the following specialty SPēD certification within 1 year of contract start.

o Physical Security Certification (PSC): Provides the recognition and official record of an individual's demonstrated understanding and application of competencies such as: physical security concepts; installation and physical access control; physical security for conventional arms, ammunitions, and explosives (AA&E); key, combination, and lock control;

site lighting; protective barriers; security systems; standards for storage of classified information; emergency management and emergency response;

and physical security planning and plan implementation.

For more information on training and SPēD Certification: www.dss.mil, http://www.cdse.edu/documents/sped/SPeD_Candidate_Handbook_4-1-14.pdf.

The FSO Tool Kit is available at: http://www.cdse.edu/toolkits/fsos/new-fso.html.

ASIS International Professional Certifications:

Certified Protection Professional (CPP): Demonstrated knowledge and experience in all areas of security management.

Obtain the Physical Security Professional (PSP) certification within 1 year of contract start. PSP: Demonstrated experience in physical security assessment, the application, design and integration of physical security systems, and implementation of physical security measures.

For more information on training and ASIS International Certification:

https://www.asisonline.org/Certification/Board-Certifications/Pages/default.aspx.

b) STD: The FSO must obtain and maintain a Top Secret Personal Clearance

3.1.2.2 The FSO and support staff must be trained in accordance with chapter 3 of The NISPOM, for a possessing facility, and cleared commensurate with and concurrent with the issuance of the Facility Clearance Level in accordance with DoD 5220.22-m Section 2, 1-201.

a) STD: Training must meet NISPOM and DSS requirements and curriculum for FSO Program Management for Possessing Facilities and Local AEDC Training as determined by the SSA.

3.1.2.3 The Contractor shall ensure the FSO or an appointed alternate is physically located at AEDC Arnold AFB in order to monitor and facilitate all security requirements.

Work schedules for security support are non-standard and dependent upon test schedules, inspections schedules, and emergency situations. The core operational hours of the security personnel are from 0730-1630 hours, Monday through Friday, not including opening or closing times which may extend one or more hour(s) before or after the core hours for security support including any visitor control or required customer assistance.

a) STD: FSO shall be available to meet with the Government on urgent security issues within four hours of initial request.

b) STD: No test or programmatic impacts occur as a result of the absence of responsible security personnel.

3.1.3 The Contractor shall request security clearances for personnel when the Contractor determines that access is essential in the performance of tasks or services related to the fulfillment of the contract.

Requests for Contractor security clearances shall be kept to an absolute minimum necessary to perform contract requirements. The Contractor shall ensure that sufficient personnel have the appropriate security clearance to accomplish all tasks specified in this PWS prior to the performance start date. If security clearances are not received prior to the performance start date, the Government (DSS) may issue an interim clearance or supplement the Contractor's workforce to perform tasks requiring security clearances.

Performance Standards

a) STD: Requests shall be submitted within 30 days after receiving a facility clearance or, if the Contractor is already cleared, within 30 days after contract award.

3.1.3.1 The Contractor shall review Joint Personnel Adjudication System (JPAS) daily to obtain relevant security clearance and investigation information pertaining to present and future AEDC personnel and other personnel in whom the AEDC has a security interest.

a) STD: Personnel security investigative requests are accurate to ensure personnel are eligible/qualified and favorably adjudicated prior to engaging in work.

3.1.4 The Contractor shall ensure all subContractors enter into a VGSA with the AEDC Commander, as determined by the SSA in accordance with AFI 31-601. The VGSA must be signed by required parties and must address all security requirements before any classified work begins.

The Agreement will outline responsibilities in the following areas: Contractor security supervision; Standard Practice Procedures (SPP); access, accountability, storage, and transmission of classified material; marking requirements; security education; personnel security clearances; reports; security checks; security guidance; emergency protection;

protection of Government resources; DD Forms 254; periodic security reviews; and other responsibilities, as required.

3.1.5. The Contractor shall prepare written SPP necessary for the implementation of the NISPOM in accordance with DoD 5220.22-M, NISPOM and AFI 31-601, and supplements. SPPs must be submitted and approved for use by the Government (SSA) prior to performance start date of this contract.

If the company elects to change, modify, develop an addendum, annex, supplement, to their SPP, or add an internal OI, for any on-base security operations, it will require Government written approval of those security procedures.

Deliverables:

OT-2014-30069 Standard Practice Procedures

3.1.6 The Contractor shall implement an Insider Threat program designed to identify employees displaying potential espionage indicators in accordance with guidance and standards developed by the Insider Threat Task Force established in section 6 of EO 13587, DoD Instruction (DoDI) 5240.26 and AFI 16-1402.

Reports shall be submitted as required in accordance with DoD 5220.22-M, AFI 31-501 and AFI 31-601, and supplements.

For the purposes of the NISPOM, insider threat refers to the threat of an insider using his or her authorized access, wittingly or unwittingly, to do harm to the security of the United States. This threat can include damage to the U.S. through espionage, terrorism, unauthorized disclosure of national security information, or through the loss or degradation of Government, company, contract or program information, resources or capabilities.

3.1.7 The Contractor shall provide Special Access Program (SAP) security management for all AEDC SAP requirements. The Contractor shall manage, administer, and sustain all aspects of a SAP security program compliant with all applicable DoD, AF, and JAFAN requirements.

The Contractor shall provide SAP security management for test security, physical security, personnel security, information security, operations security, and SAP security education and training.

Performance Standards

a) STD: Receive an average rating of 4.5 on the AEDC Government SAP Security

Office evaluation criteria with no single rating less than 3.0

OT-2014-30104 SCI/SAP Accredited Area Standard Operating Procedure OT-2014- 30105 SCI/SAP Accreditation Package OT-2014-30106 SCI/SAP Test Security Plan

3.1.7.1 The Contractor shall maintain a SAP billet plan for each supported program and ensure initial and annual AEDC Government approval of each plan.

3.1.7.2 The Contractor shall identify, obtain, and maintain U.S. Postal Service procedures approved by the Program Security Officer (PSO).

3.1.7.3 RESERVED

3.1.7.4 The Contractor shall appoint a full-time Contractor Program Security Officer (CPSO) cleared at least equal to the highest level of classified information for which they require access and possess access to all SAPs assigned to the facility(s) for which he/she is responsible. The CPSO shall have the position, responsibility, and authority commensurate with managing and enforcing AEDC SAP security requirements base upon guidance provided by the PSO.

The Contractor shall ensure the CPSO, or an appointed alternate, is physically located at AEDC Arnold AFB in order to monitor and facilitate all SAP security requirements.

Work schedules for SAP security support are non-standard and dependent upon test schedules, inspections schedules, and emergency situations. The core operational hours of the security personnel are from 0730-1630 hours, Monday through Friday, not including opening or closing times which may extend one or more hour(s) before or after the core hours for security support including any visitor control or required customer assistance.

Performance Standards

a) STD: The designated CPSO, or those otherwise performing SAP security duties, shall complete required security training and briefings considered appropriate by the

PSO.

b) STD: The CPSO shall be available to meet with the Government within four hours on all urgent security issues upon request.

c) STD: No test or programmatic impacts occur as a result of the absence of responsible security personnel.

d) STD: Score/Achieve no less than a Satisfactory rating on the PSO Inspection.

3.1.7.5 The Contractor shall provide Top Secret accountability for all Top Secret SAP information utilizing a PSO approved document control accountability system.

3.1.7.6 The Contractor shall appoint a full-time SAP Information System Security Officer (ISSO) cleared at least equal to the highest level of classified information for which they require access and possess access to all SAPs assigned to the facility(s) for which he/she is responsible. The SAP ISSO shall ensure that SAP Information Systems are operated, maintained, and disposed of in accordance with SAP security policies. The SAP ISSO shall develop and maintain a formal information systems security program and implement all information systems security policy, establish and maintain accreditation documentation and procedures for all SAP systems, ensure the development and accuracy of accreditation documentation, and recommend action to the approval authority.

The SAP ISSO shall attend and participate in IT working groups, configuration management meetings, and IT planning meetings to represent SAP Information

Assurance (IA) interests and ensure that administrative, analysis, and instrumentation, data, and controls (ID&C) systems remain compliant with SAP security policies.

3.1.7.6.1 The Contractor shall use the AF Access Database System (AFADS), or any successor, for personnel security management functions for all AF SAPs in accordance with the AFADs Policy Directive dated 22 Jan 2008.

3.1.7.6.2 The Contractor shall provide IA support for all SAP Information Technology requirements to include standalone systems, High Performance Computing systems, analysis systems, and ID&C systems in accordance with JAFAN 6/3, JAFAN 6/3 Implementation Guide, Joint Security Implementation Guide (JSIG), 9 October 2013, DoD Joint SAP Implementation Guide (JSIG, 09 Oct 2013).

Performance Standards

a) STD: Receive an average rating of 4.5 on the AEDC Government SAP IA Office evaluation criteria with no single rating less than 3.0

b) STD: The designated SAP ISSO, or those otherwise preforming SAP IA duties, shall complete required security training and briefings considered appropriate by the PSO.

c) STD: The SAP ISSO shall be available to meet with the Government on all urgent security issues within four hours of initial notification.

d) STD: No test or programmatic impacts occur as a result of the absence of responsible SAP IA personnel

OT-2014-30103 SCI/SAP Certification and Accreditation package

3.1.7.7 The Contractor shall submit Program Access Requests for SAP to the approval authority within 5 working days after receiving AEDC Government approval of the access requirement. The SAP Nomination Process shall be followed for all SAP nominations.

3.1.7.8 The Contractor shall prepare Standard Operating Procedures (SOP) necessary for the implementation of SAP requirements. SOPs shall be developed and coordinated in compliance with JAFAN 6/0.

OT-2014-30104 SCI/SAP Accredited Area Standard Operating Procedure

3.1.8 The Contractor shall process Homeland Security Policy Directive 12 and other “Position of Trust” investigative requests for AEDC government Contractor personnel through the AEDC Government Personnel Security Program Manager in accordance with AFI 31-501.

The Contractor should anticipate processing ~250 investigative requests annually.

Investigative requests and supporting documentation (Standard Form 85) are required for any new AEDC Contractor personnel without a U.S. security clearance or other required background investigation for base/facility access and/or access to unclassified U.S. Government computers.

3.1.9 The Contractor shall provide electronic fingerprint services, required for official Government business, to all Government Contractors at AEDC requiring a background investigation.

The Contractor should anticipate processing ~250 fingerprints annually.

Fingerprinting equipment will be provided as Government Furnished Equipment (GFE).

Performance Standards

a) STD: Zero Rejection Rate. (100% of all fingerprints submitted must be deemed classifiable and acceptable by Office of Personnel Management (OPM), Federal Bureau of Investigation (FBI), etc.)

AQL: No more than a 5% Rejection Rate. (95% of all fingerprints submitted must be deemed classifiable and acceptable by OPM, FBI, etc.)

3.1.10 The Contractor shall provide a copy of all adverse information reports submitted to DSS pursuant to NISPOM 1-300, 301, 302, 303 and 304 to the Installation Commander via the SSA. Incident reports shall also be entered in the JPAS. Reports required to be submitted to the FBI, in accordance with NISPOM

1-301, shall also be reported to the local detachment of The AF Office of Special Investigations. The Contractor shall report all adverse information concerning SAP briefed personnel to the PSO in accordance with JAFAN 6/0. Report all adverse information concerning Sensitive Compartmented Information (SCI) indoctrinated personnel to the AEDC Special Security Officer.

Performance Standards

a) STD: No programmatic impacts from personnel suitability issues

b) STD: Score/Achieve no less than a Satisfactory rating on Inspections

3.1.11 The Contractor shall establish and foster Counterintelligence (CI) focused culture, for all of AEDC in order to detect, deter, and expeditiously report suspicious activities.

3.1.12 The Contractor shall provide security support for all phases of unclassified, classified, and commercial testing and related test activities.

The Contractor shall establish and implement a security program compliant with DoD, service, and local directives and make recommendations for improvements to security test procedures; integrate cost effective and threat based security processes, plans and procedures. Test phases include planning, design, fabrication, installation, execution, removal, reporting, and analysis. The protection/security of test articles or systems and data is required.

3.1.12.1 The Contractor shall control media and information in accordance with the respective classification level and security classification guides.

3.1.12.2 The Contractor shall develop, coordinate, document and implement specific security requirements for all test programs.

3.1.12.3 The Contractor shall develop a Test Security Plan for each test and related activity, as requested by the Government.

The Contractor should anticipate having to develop approximately 125 Test Security Plans annually.

Each Test Security Plan will be reviewed, revised as necessary to remain compliant with current security policy, and coordinated for Government approval. Ensure the integration of US export and technology control laws, DoD/Agency policy and instructions and other applicable guidance into test security plans.

Test Security Plans developed in support of SAP efforts must be approved by the PSO, the customer security representative, and the Government.

Test Security Plans for SCI efforts must be approved by the AEDC Government Project Manager and the AEDC Special Security Office.

The Test Security Plan, including physical security boundaries and facility-specific procedures, shall be briefed to all personnel supporting SAP and/or SCI tests. Training accomplishment shall be documented and maintained in accordance with Records Distribution Schedules.

3.1.12.4 The Contractor shall include a Foreign National Visitor Control Plan (FNVCP), or additional Operations Security (OPSEC) requirements as an annex to the test plan when determined to be necessary or as required. Coordinate the FNVCP and OPSEC requirements with the Government.

Test Security Plans will be used by the test team and identify all security requirements related to specific test efforts. In order to appropriately access requirements, the Contractor has to gather information from various sources (i.e., pre-test planning meetings, DD FM 254s, security classification guides, program/project managers, customers, etc.) in order to develop an applicable Test Security Plan specific to the program or project. The Contractor should anticipate having to develop approximately 125 Test Security Plans annually.

Test Security Plans that require additional security requirements or protection measures above the established baseline or NISPOM must be reviewed and approved by the Government.

Performance Standards

a) STD: No security compromises or test delays resulting from ineffective security.

b) STD: 100% of data will be properly marked, logged, and controlled as per classification level.

OT-2014-30067 Test Security Plan

3.1.12.5 The Contractor shall brief all appropriate test support personnel on the requirements of the Test Security Plan or Program Protection Plan.

3.1.12.5.1 The Contractor shall ensure that each Government, Contractor or subContractor employee completes Program Protection Awareness Training, as required in the respective Program Protection Plan.

Critical Program Information (CPI) Training is specific to the protection of sensitive and CPI. If CPI exists, it will be identified in the Program Protection Plan provided by the Government Program Office. The Government will provide the basic training plan to be tailored for each facility handling/storing/processing identified CPI.

Performance Standards

a) STD: Zero security violations

b) STD: 100% of personnel supporting a test are trained prior to performing any work related to identified CPI

3.1.12.6 The Contractor shall manage security requirements for all physical space required to support test operations and activities.

3.1.12.6.1 The Contractor shall establish, maintain and manage classified space (Closed & Restricted Areas) in accordance with DoD 5220.22M, Chapter 5 Section 3, AFI 31-601, and supplements.

Access shall be limited to authorized persons who have an appropriate security clearance and a need-to-know for the classified material/information within the area.

3.1.12.6.2 The Contractor shall establish, maintain and manage SAP Facilities as required to support mission requirements in compliance with JAFAN 6/0, JAFAN 6/9, and PSO guidance.

Access shall be limited to authorized persons who have an appropriate security clearance, need-to-know, and documented formal access to the information within the area.

3.1.12.6.3 The Contractor shall manage space during commercial tests in accordance with established baseline security requirements provided by the Government, test customer, or as identified in the respective Test Security Plan.

Performance Standards

a) STD: Zero unauthorized entries

b) STD: Zero security incidents which result in a loss or security compromise

OT-2014-30071 Standard Operating Procedures for Test Areas

3.1.12.6.4 The Contractor shall secure and issue program or project access badges and brief holders on requirements and responsibilities when required.

These badges are not to be confused with credentials issued by Visitor Control functions. Comply with DoD 5220.22-M, AFI 31-601, AFI 31-101, and supplements.

Performance Standards

a) STD: Zero unauthorized entries

b) STD: Zero security incidents which result in a loss or security compromise

3.1.12.6.5 The Contractor shall train appointed personnel to manage and enforce all security requirements within their respective NISPOM closed and restricted areas in accordance with DoD 5220.22-M, DoD 5200.01-M Vol. 1-4, AFI 31-601, and supplements.

3.1.12.6.5.1 The Contractor shall conduct and document initial indoctrination and annual training of all personnel that require access to the closed and restricted areas.

3.1.12.6.6 The Contractor shall establish and maintain internal test security/OIs, guard instructions, phone lists, Entry Authorization Lists, and other required controls for all classified, to include information protection requirements for NATO and Critical Nuclear Weapons Design Information categories, and unclassified test programs in accordance with DoD 5220.22-M, AFI 31-401 and AFI 31-601, and supplements.

Assist in the preparation of security instructions and plans for other appropriate functional areas with security concerns, as required or requested. Ensure each area is following guidance contained in applicable NISPOM, AF, program, and other cognizant security agency directives.

3.1.12.6.6.1 The Contractor shall conduct entry and exit inspections in order to deter and detect unauthorized introduction or removal of classified material from closed and restricted areas in accordance with DoD 5220.22-M and DoD 5200.01- M, Vol. 1-4.

Ensure Standard Operating Procedures and/or OIs include Entry/Exit Control procedures for use by owner/users or area custodians of controlled areas established for classified operations include procedures for entry and exit checks.

3.1.12.6.6.2 The Contractor shall test and verify alarms and other physical security equipment used in closed and restricted areas in accordance with DoD 5220.22-M, DoD 5200.01-M, Vol. 1-4, AFI 31-101, AFI 31-401, AFI 31-601, and supplements.

3.1.13 The Contractor shall maintain, control, and issue accountable Security Material in accordance with DoD 5220.22-M, DoD 5200.01-M, Vol. 1-4, AFI 31-401, AFI 31-601, and supplements.

Accountable items include classified storage equipment, containers, vaults, and combination locks used in the AEDC Information Protection/Industrial Security Programs.

3.1.14 The Contractor shall schedule vault and safe inspections and periodic maintenance as required in accordance with TO-00-20F-2 and DoD 5220.22-M.

3.1.15 The Contractor shall retain a copy of all program Security Classification Guides and verify they are current in accordance with DoD 5220.22-M, DoD 5200.01-M, Vol. 1-4, AFI 31-401, AFI 31-601, and supplements.

3.1.16 The Contractor shall establish, maintain, and follow procedures to verify and log all visitors and media that enter or are brought into a closed or restricted area in accordance with DoD 5220.22-M, AFI 31-601, and supplements.

3.1.17 The Contractor shall use the JPAS for transmitting/receiving visit requests and to properly identify the security clearance level of visitors (to include test customers) in accordance with DoD 5220.22-M, DoD 5200.01-M, Vol. 1-4, AFI 31- 501, AFI 31-601, and supplements.

3.1.18 The Contractor shall ensure individuals requiring temporary access to the secure facility/area that require escort are escorted by the respective owner/users of the area in accordance with DoD 5220.22-M, DoD 5200.01-M, Vol. 1-4, AFI 31- 601, and supplements.

Performance Standard

a) STD: Zero security violations or unauthorized access to controlled areas

3.1.18.1 The Contractor shall ensure required security briefings are conducted to visitors and escort officials.

3.1.19 The Contractor shall conduct OPSEC Foreign National Vulnerability Assessments and Audits for visiting foreign guests and/or customers in accordance with DoD 5220.22-M, AFI 31-601, AFI 10-701, and supplements.

3.1.20 The Contractor shall ensure all media (e.g. computer hard drives, hardware) are marked, stored and destroyed in accordance with the DoD 5220.22- M, DoD 5200.01-M, Vol. 1-4, AFI 31-601, and supplements.

3.1.21 The Contractor shall package, pick-up, and transmit classified material in accordance with DoD 5220.22-M, DoD 5200.01-M, Vol. 1-4, AFI 31-601, and supplements.

a) STD: Zero security violations

3.1.22 The Contractor shall provide analytical, technical, and administrative security support services to Information Protection, Industrial Security, and SAP Security programs managed by the Government.

Technical and administrative support from qualified security personnel is required to ensure core programs are successfully executed in accordance with applicable DoD and AFIs. Support will be provided "on-site” to the Government at AEDC Arnold AFB and includes security reviews, evaluations, initial surveys, and assessments. Programs include but are not limited to: Industrial Security, Personnel Security, Information Security, Operations Security, Test Security, and Physical Security for the protection of controlled information.

The Contractor should anticipate supporting 50-55 security reviews, evaluations, initial surveys, and assessments annually; however this may fluctuate depending upon mission needs.

3.1.22.1 The Contractor shall conduct, participate, or support security investigations, preliminary inquiries, and other actions required for resolution of security incidents in accordance with DoD 5220.22-M, JAFAN 6/0, AFI 31-601, and supplements.

Contractors will conduct preliminary inquiries to determine if a security incident is a violation or an infraction within their controlled areas. If government or other Contractors are involved, contact the SSA or SSO.

3.1.22.2 The Contractor shall establish liaison with local CI and law enforcement organizations to determine the status of the local threat to the facility, personnel, and supported programs. Inform the Government of threats or any other information required in accordance with DoD 5220.22-M, AFI 10-701, AFI 31-401, AFI 31-501, AFI 31-601, and supplements.

3.1.22.3 The Contractor shall support Government security managers with conducting and documenting specialized security initiatives, training and briefings in accordance with DoD 5220.22-M, AFI 10-701, AFI 31-401, AFI 31-501, AFI 31-601, and supplements.

a) STD: No more than one validated complaint per quarter

3.1.23 The Contractor shall operate and maintain a classified and controlled material destruction capability for AEDC Arnold AFB.

3.1.23.1 The Contractor shall provide bulk destruction and disposal capability for all classified and controlled unclassified material generated at AEDC Arnold AFB.

3.1.23.2 The Contractor shall provide nine (9) National Security Agency (NSA) approved shredders and strategically position them throughout work centers to support day-to-day operational requirements in accordance with DoD 5220.22-M, DoD 5200.01-M, Vol. 4, AFI 31-601, AFI 10-701, and supplements. The Contractor shall train designated Contractor personnel on use of the equipment.

The Contractor is required to provide NSA approved equipment (NSA/CSS EPL 0202M Annex A to NSA/CSS 02 02, NSA/CSS Evaluated Products List) for the destruction of classified material.

3.1.23.3 The Contractor shall destroy and dispose of all Controlled Unclassified Information (CUI), including all data storage devices/media, at AEDC Arnold AFB identified for destruction.

CUI may be destroyed by any of the means approved for the destruction of classified information or by any other means that would make it difficult to recognize or reconstruct the information. Strip shredding is not permitted.

Recycle bins are not approved for controlled information.

The Contractor should anticipate destroying or disposing of ~80,000 lbs annually;

however this fluctuates depending upon mission needs.

Performance Standards

a) STD: Secure bins for collection of CUI intended for destruction are strategically positioned throughout work centers (approximately 100)

3.1.24 The Contractor shall provide overnight transitory storage capability located in the Base Defense Operations Center (BDOC) approved for safeguarding classified material, up to the secret level, in accordance with DoD 5220.22-M, DoD 5200.01-M, Vol. 3, AFI 31-401, and supplements.

Overnight transitory storage is for use by AEDC visitors and transitory personnel. The Contractor shall advertise this capability at key visitor reception points.

a) STD: Zero validated complaints

3.1.25 The Contractor shall provide security-related technical assistance to the Government and Contractor personnel for briefings and conferences.

The Contractor should anticipate providing security-related technical assistance to government and Contractor personnel for 8 briefings and conferences annually.

a) STD: No more than one validated customer complaint per quarter

3.1.26 The Contractor shall assist the Government to develop security requirements for contractual commitments in accordance with DoD 5220.22-M, AFI 31-601, and supplements.

Examples include coordination of the DD FM 254, DoD Contract Security Classification Specification, VGSAs, and Security Clauses.

3.1.27 The Contractor shall participate in scheduled and ad-hoc security working groups in accordance with DoD 5220.22-M, AFI 10-701, AFI 31-401, AFI 31-501, AFI 31-601, and supplements.

For example, Installation Security Advisory Group, OPSEC Working Groups, Security Working Groups, or other security related working groups or Integrated Product Teams.

The Contractor should anticipate participating in 1-5 scheduled and ad-hoc 1-3 hour long security working groups annually; however this may fluctuate depending upon mission needs.

a) STD: No more than one missed meeting per quarter

b) STD: No more than one validated customer complaint per quarter

3.1.28 The Contractor shall appoint an OPSEC trained person as a Point of Contact (POC) with overall OPSEC responsibilities to maintain awareness of foreign intelligence collection capabilities, limitations, methods, and practices.

Performance Standards

a) STD: Integrated OPSEC Support Staff training completed by contract start date.

OPSEC Analysis and Program Management Course (OPSE-2500): The focus of this course is on the basic skill and knowledge needed to conduct an OPSEC risk analysis (apply the five steps) and to implement an OPSEC program. This course is intended for use by the Department of Defense and other U.S.

Government personnel and Contractors within the National Industrial Security Program.

For course registration and information refer to http://www.cdse.edu/catalog/classroom/OPSE-2500.html and https://www.iad.gov/ioss/.

b) STD: Achieve no less than a Satisfactory rating on all security reviews, inspections, audits, and vulnerability assessments.

3.1.28.1 The Contractor shall develop an OPSEC program plan to address how the Contractor will protect critical and sensitive contracted information in accordance with AFI 10-701 and AAFB OPSEC Plan 10-701.

Upon acceptance by the Government, implement the OPSEC program plan.

DI-MGMT-80934C OPSEC Program Plan

3.1.28.2 The Contractor shall assist the Government to develop, coordinate, and execute OPSEC program requirements.

3.1.29 The Contractor shall assist the Government program manager in the development and implementation of the Commander’s OPSEC policy and Critical Information List in accordance with AFI 10-701 and supplements.

3.1.29.1 The Contractor shall conduct OPSEC training in accordance with AFI 10- 701.

The Contractor shall familiarize new employees for awareness and conduct refresher sessions needed in the areas of OPSEC and CI.

3.1.29.2 The Contractor shall integrate and include OPSEC into all acquisition programs and Contractor support documents in accordance with AFI 10-701.

3.1.29.3 The Contractor shall coordinate with the Government to resolve/mitigate Web Risk Assessment, Telecommunications Monitoring Assessment Program, Vulnerability Assessment, and other OPSEC assessment findings as required in accordance with AFI 10-701.

3.1.29.4 The Contractor shall assist the Government to conduct Staff Assistance Visits with the Government as required or requested in accordance with AFI 10- 701.

The Contractor should anticipate supporting 1-5 Staff Assistance Visits annually;

however this may fluctuate depending upon mission needs.

3.1.30 The Contractor shall conduct and document OPSEC self-assessments and implement required changes.

3.1.31 The Contractor shall integrate OPSEC into all organization planning, operational processes, acquisition programs, and Contractor support documents.

Recognizing that sub-Contractors vary in size, resources, and length of subcontract, OPSEC…