Attachment_1_-_FSS_PWS_Draft_Release_21_August_14.pdf

FA9101-14-R-0200

Attachment 1

Performance Work Statement (PWS)

AEDC Facility Support Services

(FSS)

21 August 2014

Vision Statement

1 Introduction

1.1 Mission

1.2 Background

1.3 Scope

2 General Requirements

2.1 Business Relations

2.2 Contract Administration and Management

2.3 Contractor Personnel, Disciplines, and Specialties

3 Performance Requirements

3.1 Industrial Security, Test Security and Security Management Support

3.2 Security Forces (SF)

3.3 Operations Center and Command & Control (C2) Element functions

3.4 Fire and Emergency Services Program

3.5 Environmental Management Program

3.6 Safety

3.7 Occupational and Environmental Health (OEH) (Industrial Hygiene)

3.8 Base Supply

3.9 Freight Services

3.10 Vehicle Maintenance and Operations

3.11 Grounds Maintenance, Solid Waste Management, and Custodial Services ... 94

3.12 Interface Management

3.13 General Management

APPENDICES

APPENDIX A – GROUNDS MAINTENANCE PWS

APPENDIX B - INTEGRATED SOLID WASTE MANAGEMENT PWS

APPENDIX C - CUSTODIAL SERVICES PWS

Performance Work Statement (PWS) Facility Support Services

Vision Statement

1 Introduction The Air Force Test Center's (AFTC) Arnold Engineering Development Complex (AEDC) is a national aerospace ground test facility that conducts tests, engineering analyses, and technical evaluations for research, system development, and operational programs of the Air Force (AF) and Department of Defense (DoD), other Government agencies, and industry. Using ground test facilities and computational engineering, AEDC supports propulsion, aerodynamic, reentry, trans-atmospheric, and space-flight systems testing. This testing underpins the technical knowledge required for the development and qualification of key warfighter aerospace weapons. Testing is performed in an environment that simulates operational conditions. AEDC also performs research to develop new technology for advanced test facilities, test techniques, and measurement methodologies associated with ground tests. The purpose of this solicitation is to obtain the technical expertise and services necessary to support AEDC in execution of its mission. The FSS Contractor efforts will be integrated with other Contractor efforts known overall as Test Operations and Support. Innovative business arrangements and initiatives are necessary. Constrained fiscal environments endanger the continued operation of some test facilities - near term efficiencies will be necessary to allow continued operation of required capabilities at technical levels necessary to sustain the world's most capable Air Force. Effective teamwork with other contractors supporting overall mission and base support operations will be essential.

1.1 Mission

AEDC exists to test and evaluate weapon, propulsion, aerodynamic and space systems at realistic conditions for the nation through modeling, simulation and ground test facilities.

The mission is essential to developing and fielding weapons systems for the nation's warfighters.

The FSS Contractor will be expected to perform in this mission, while smoothly integrated with the other AEDC contractors and Government personnel, in a manner that makes AEDC the most effective ground test and evaluation complex in the world – suitable for supporting the best Air Force in the world.

1.2 Background

The AEDC Test Operations and Support Contracts will provide the contractor workforce necessary to successfully operate and sustain AEDC's test facilities at Arnold AFB, TN, and geographically separated units (GSUs) at White Oak, MD, and Moffett Field, CA. Since its inception, AEDC has been contractor-operated, and contractors provide the majority of the workforce. Contractors conduct test operations, base operations, test facility and base infrastructure maintenance and improvement efforts, and many other services critical to operating and sustaining the nation's largest collection of aerospace ground test facilities as well as an Air Force Base (AFB). Several significant changes from current contracting arrangements will occur with the awarding of the Test Operations and Support contract(s). Enterprise contracting initiatives will result in information technology tasks and the operation of the Precision Measurement Equipment Laboratory (PMEL) being performed under separate contracts. In addition, some portions of base operating support tasks, historically part of the overall contract, will be set aside for small business under a FSS contract. Finally, Government personnel will accomplish the technical management and engineering analysis for test programs conducted at the Arnold AFB location and remote locations as needed with assistance from the Test Services Contractor.

AEDC must award flexible contract vehicle(s) that allow meeting customer’s needs while:

• Ensuring effective and efficient Test Operations and Support;

• Preserving intellectual capital for test support and analysis;

• Increasing technical work by the Government workforce;

• Implementing innovative solutions that immediately begin cost reductions;

• Accommodating dynamic changes in workload;

• Increasing small business participation;

• Rewarding management / technical innovation;

• Providing incentives to increase efficiency and productivity in workforce labor practices;

1.3 Scope

This project provides multiple aspects of base operating support functions in support of AEDC’s test mission. Called the FSS contract, it provides supply, vehicle maintenance, industrial and test security, physical security, and fire and emergency services. It provides support for overall AEDC Safety, Environmental, and Occupational Health programs. Finally, it provides grounds maintenance, solid waste management and custodial services.

2 General Requirements The effort will be performed primarily at the AEDC site at Arnold AFB in Tennessee.

Performance will also be required at AEDC facilities housed as tenants on sites in White Oak, MD and on the National Aeronautics and Space Administration (NASA) Ames Research Center (ARC) grounds at Moffett Field, CA. Requirements listed in this PWS are assumed to be AEDC Arnold AFB unless specifically noted otherwise.

2.1 Business Relations

The Contractor shall successfully integrate and coordinate all activity needed to execute the requirement. The Contractor shall manage the timeliness, completeness, and quality of problem identification. The Contractor shall provide corrective action plans, proposal submittals, timely identification of issues, and effective management of subcontractors.

The Contractor shall coordinate and cooperate closely with associate contractors involved in the execution of AEDC’s mission. The Contractor shall seek to ensure satisfaction of all internal and external customers and professional and ethical behavior of all Contractor personnel.

2.2 Contract Administration and Management

The Contractor shall perform all contract management functions required to ensure proactive and sustained contract excellence in providing accurate, safe, secure, timely, and efficient contract facility support services to meet the Government's established requirements.

2.2.1 Contract Management

The Contractor shall designate and locate at AEDC a responsible corporate official with no responsibility other than for this contract and empowered to make and implement all decisions regarding the performance of this contract.

2.2.2 Contract Administration

The Contractor shall:

• Ensure performance of the business and administrative aspects of the contract;

• Report all Full-Time Equivalents (FTEs) in accordance with Section 8108 of Public Law 112-10 of the DoD and Full-Year Continuing Appropriations Act, 2011;

• Ensure resources are efficiently and effectively managed and contract status (including Government-furnished resources) is reported to Government representatives.

• Recommend Complex Instructions and changes to existing instructions to assist in managing and executing this contract and to facilitate the efficient operation of

AEDC;

• Develop, implement, and manage formal associate contractor agreements with the following contractors at AEDC Arnold AFB: Test Operations and Sustainment (TOS); Test Services; PMEL; Performance Based Restoration; and Base Communications and Information Technology Services.

2.2.3 Personnel Administration

• Maintain a qualified work force able to perform the broad spectrum of functions necessary to operate, support, maintain, and improve AEDC;

• Maintain staffing records identifying company organizational designations, a brief description of the functions, and the number and types of personnel assigned;

• Provide and administer an Equal Opportunity Affirmative Action Program that complies with all Federal statutes.

2.3 Contractor Personnel, Disciplines, and Specialties

• Conduct craft, supervision, and management training programs;

• Coordinate joint training programs for all Contractor and Government personnel.

3 Performance Requirements

3.1 Industrial Security, Test Security and Security Management Support

3.1.1 The Contractor shall establish and maintain an industrial security program compliant with DoD 5220.22-M, National Industrial Security Program Operating Manual (NISPOM), and other mandatory directives listed in the solicitation to protect information and operations critical to the successful accomplishment of AEDC’s mission. Additional mandatory directives are listed in Table 3.1.1 of this

PWS.

At Arnold AFB, the FSS Contractor will be designated as an “On-Base Cleared Facility” per DoD 5220.22-R and will be cleared under the provisions of the National Industrial Security Program (NISP). The Chief, Information Protection, has been designated by the Installation Commander to provide security oversight and the Information Protection Office will be the Servicing Security Activity (SSA).

At AEDC White Oak and AEDC Moffett Field contractors will be designated as Integrated Visitor Groups, and will operate under the direct control/supervision of the AF. The integrated visitor group will be authorized to function in accordance with DoDM 52001 and AF Instruction (AFI) 31-401 per a Visitor Group Security Agreement (VGSA).

The AF maintains control of all classified material and provides day-to-day supervision over the contractor operation. It differs from the on-base cleared facility because of its close interaction and/or relationship with the AF organization it supports.

As the Prime Security Contractor and an “on-base cleared facility” the FSS Contractor will be responsible for establishing & managing all physical space, listed in Table 3.1.2, required for test operations, establishing standard security practices and procedures for classified and commercial test areas as well as managing the Special Access Programs (SAP) Security Program. In order to fully implement AEDC Information Protection Program objectives, the Contractor will need to work with and perform security support functions in coordination with the Chief, Information Protection, the AEDC Government SAP Security Officer, the AEDC Special Security Officer, AEDC Security Managers, respective program/project manager(s), and other contractors preforming work at

AEDC.

In addition to requirements identified in the DD Form 254, this effort must ensure compliance with a variety of specialized security directives, regulations and guides including DoD Regulations, AFIs, and related AEDC policies/operating instructions (OIs). Contractor personnel must also have knowledge of the Joint Air Force – Army – Navy (JAFAN) Manuals 6.0, 6/3, 6/4, 6/9, Foreign Disclosure, DoD regulations, pertinent Department of Navy regulations, SAF/AQ Policy Documents, and pertinent Executive Orders. The Contractor personnel must be familiar with protecting Automated Information Systems.

There are certain inherently governmental functions and activities that cannot be outsourced to a contractor. Inherently governmental activities and functions include those that require either the exercise of substantial discretion in applying U.S.

Government authority, or value judgments when making decisions for the U.S.

Government. Although the Contractor will be tasked to support assigned Government Program Security Manager(s) with respective security program requirements and to assist in providing centralized security services, the Government security manager has the lead and is the decision maker. The Contractor is only providing support in this capacity to perform administrative security functions under the direction of the activity security manager.

Activity security management shall ensure that contractors who are involved in security administration and support duties are clearly identified in their capacities, roles, and functions, to ensure there is no possible confusion regarding which security personnel may exercise inherently governmental authorities and which may not. The Contractor should contact the contracting officer for clarification in the event of any conflict.

Inherently governmental Security Functions, relating to this section of the PWS, include, but are not limited to:

• Approving and issuing security policies and procedures

• Making original classification decisions, or rendering classification determinations regarding classified information that is improperly or incompletely marked.

(Correcting improper markings when the appropriate classification is not in question is not considered rendering a classification determination.)

• Deciding to downgrade or declassify information. (Adhering to security markings on information or to guidance stated in an appropriate security classification or declassification guide is not considered a downgrading or declassification decision.)

• Deciding challenges to classification and any appeals

• Making foreign disclosure decisions

• Making public release decisions

• Committing to expenditure of U.S. Government funds

• Conducting investigations of, or determining fault in, security incidents involving U.S. Government or other contractor personnel. (Contractors may conduct preliminary inquiries to determine if a security incident is a violation or an infraction.)

• Giving final approval or executing documents for filing in litigation if documents assert an official position of the DoD, any DoD Component, or any other Federal agency

3.1.1.1 The Contractor shall obtain and maintain a facility clearance at the classification level of Top Secret prior to performing any classified work on the contract.

Performance Standards

a) STD: No Security Violations that result in a loss or compromise of classified Information.

b) STD: Score/Achieve no less than a Commendable rating (750 - 799) on the Defense Security Service’s (DSS) Assessment Rating Matrix and no less than a “Satisfactory” on all other, internal and external security reviews, inspections, audits, and/or vulnerability assessments.

AQL: Score/Achieve no less than a Satisfactory rating (649 –749 points) on the DSS’s Assessment Rating Matrix.

3.1.2 The Contractor shall provide security support sufficient to ensure full compliance with DoD, service, and local directives.

3.1.2.1 The Contractor shall designate a full time Facility Security Officer (FSO) with independent authority to manage and enforce all aspects of the Industrial Security program requirements for the company.

a) STD: The designated FSO, or those otherwise performing security duties shall complete required security training and briefings considered appropriate by the Servicing Security Activity (SSA); obtain and maintain required professional certifications

b) STD: The FSO must obtain and maintain a Top Secret Personal Clearance

3.1.2.2 The FSO and support staff must be trained in accordance with chapter 3 of The NISPOM, for a possessing facility, and cleared commensurate with and concurrent with the issuance of the Facility Clearance Level in accordance with DoD 5220.22-m Section 2, 1-201.

a) STD: Training must meet NISPOM and DSS requirements and curriculum for FSO Program Management for Possessing Facilities and Local AEDC Training as determined by the SSA.

3.1.2.3 The Contractor shall ensure the FSO or an appointed alternate is physically located on base in order to monitor and facilitate all security requirements.

Work schedules for security support are non-standard and dependent upon test schedules, inspections schedules, and emergency situations. The core operational hours of the security personnel are from 0730-1630 hours, Monday through Friday, not including opening or closing times which may extend one or more hour(s) before or after the core hours for security support including any visitor control or required customer assistance.

a) STD: FSO shall be available to meet with the Government on urgent security issues within four hours of initial request.

b) STD: No test or programmatic impacts occur as a result of the absence of responsible Security personnel.

3.1.3 The Contractor shall request security clearances for personnel when the Contractor determines that access is essential in the performance of tasks or services related to the fulfillment of the contract.

Due to costs involved with security investigations, requests for Contractor security clearances shall be kept to an absolute minimum necessary to perform contract requirements. The Contractor shall ensure that sufficient personnel have the appropriate security clearance to accomplish all tasks specified in this PWS prior to the performance start date. If security clearances are not received prior to the performance start date, the Government (DSS) may issue an interim clearance or supplement the Contractor's workforce to perform tasks requiring security clearances.

Performance Standards

a) STD: Requests shall be submitted within 30 days after receiving a facility clearance or, if the Contractor is already cleared, within 30 days after contract award.

3.1.3.1 The Contractor shall review Joint Personnel Adjudication System (JPAS) daily to obtain relevant security clearance and investigation information pertaining to present and future AEDC personnel and other personnel in whom the AEDC has a security interest.

Performance Standards

a) STD: Personnel security investigative requests are accurate to ensure personnel are eligible/qualified and favorably adjudicated prior to engaging in work.

3.1.4 The Contractor shall ensure all subcontractors enter into a VGSA with the AEDC Commander, as determined by the SSA in accordance with AFI 31-601. The VGSA must be signed by required parties and must address all security requirements before any classified work begins.

The Agreement will outline responsibilities in the following areas: Contractor security supervision; Standard Practice Procedures (SPP); access, accountability, storage, and transmission of classified material; marking requirements; security education; personnel security clearances; reports; security checks; security guidance; emergency protection;

protection of Government resources; DD Forms 254; periodic security reviews; and other responsibilities, as required.

3.1.5. The Contractor shall prepare written SPP necessary for the implementation of the NISPOM in accordance with DoD 5220.22-M, NISPOM and AFI 31-601, and supplements. SPPs must be submitted and approved for use by the Government (SSA) prior to performance start date of this contract.

If the company elects to change, modify, develop an addendum, annex, supplement, to their SPP, or add an internal OI, for any on-base security operations, it will require Government written approval of those security procedures.

Deliverables:

OT-2014-30069 Standard Practice Procedures

3.1.6 The Contractor shall implement an Insider Threat program designed to identify employees displaying potential espionage indicators in accordance with guidance and standards developed by the Insider Threat Task Force established in section 6 of EO 13587, DoD Instruction (DoDI) 5240.26 and AFI 16-1402.

Reports shall be submitted as required in accordance with DoD 5220.22-M, AFI 31-501 and AFI 31-601, and supplements.

For the purposes of the NISPOM, insider threat refers to the threat of an insider using his or her authorized access, wittingly or unwittingly, to do harm to the security of the United States. This threat can include damage to the U.S. through espionage, terrorism, unauthorized disclosure of national security information, or through the loss or degradation of Government, company, contract or program information, resources or capabilities.

3.1.7 The Contractor shall provide SAP security management for all AEDC SAP requirements. The Contractor shall manage, administer, and sustain all aspects of a SAP security program compliant with all applicable DoD, AF, and JAFAN requirements.

The Contractor shall provide SAP security management for test security, physical security, personnel security, information security, operations security, and SAP security education and training.

Performance Standards

a) STD: Receive an average rating of 4.5 on the AEDC Government SAP Security

Office evaluation criteria with no single rating less than 3.0

OT-2014-30104 SCI/SAP Accredited Area Standard Operating Procedure OT-2014- 30105 SCI/SAP Accreditation Package OT-2014-30106 SCI/SAP Test Security Plan

3.1.7.1 The Contractor shall maintain a SAP billet plan for each supported program and ensure initial and annual AEDC Government approval of each plan.

3.1.7.2 The Contractor shall identify, obtain, and maintain U.S. Postal Service procedures approved by the Program Security Officer (PSO).

3.1.7.3 The Contractor shall provide fully equipped mid-size sport utility vehicle or van. Ensure vehicle procedures are approved by the PSO in accordance with AFI 31-201, paragraphs 3.7 – 3.11 and TO 36-1-191.

3.1.7.4 Contractor Program Security Officer (CPSO). The Contractor shall appoint a full-time CPSO cleared at least equal to the highest level of classified information for which they require access and possess access to all SAPs assigned to the facility(s) for which he/she is responsible. The CPSO shall have the position, responsibility, and authority commensurate with managing and enforcing AEDC SAP security requirements base upon guidance provided by the

PSO.

The Contractor shall ensure the CPSO, or an appointed alternate, is physically located on base in order to monitor and facilitate all SAP security requirements.

Work schedules for SAP security support are non-standard and dependent upon test schedules, inspections schedules, and emergency situations. The core operational hours of the security personnel are from 0730-1630 hours, Monday through Friday, not including opening or closing times which may extend one or more hour(s) before or after the core hours for security support including any visitor control or required customer assistance.

Performance Standards

a) STD: The designated CPSO, or those otherwise performing SAP security duties, shall complete required security training and briefings considered appropriate by the

PSO.

b) STD: The CPSO shall be available to meet with the Government within four hours on all urgent security issues upon request.

c) STD: No test or programmatic impacts occur as a result of the absence of responsible security personnel.

d) STD: Score/Achieve no less than a Satisfactory rating on the PSO Inspection.

3.1.7.5 The Contractor shall provide Top Secret accountability for all Top Secret SAP information utilizing a PSO approved document control accountability system.

3.1.7.6 SAP Information System Security Officer (ISSO). The Contractor shall appoint a full-time SAP ISSO cleared at least equal to the highest level of classified information for which they require access and possess access to all SAPs assigned to the facility(s) for which he/she is responsible. The SAP ISSO shall ensure that SAP Information Systems are operated, maintained, and disposed of in accordance with SAP security policies. The SAP ISSO shall develop and maintain a formal information systems security program and implement all information systems security policy, establish and maintain accreditation documentation and procedures for all SAP systems, ensure the development and accuracy of accreditation documentation, and recommend action to the approval authority. The SAP ISSO shall attend and participate in IT working groups, configuration management meetings, and IT planning meetings to represent SAP Information Assurance (IA) interests and ensure that administrative, analysis, and instrumentation, data, and controls (ID&C) systems remain compliant with SAP security policies.

3.1.7.6.1 The Contractor shall use the AF Access Database System (AFADS) for personnel security management functions for all AF SAPs in accordance with the AFADs Policy Directive dated 22 Jan 2008.

3.1.7.6.2 The Contractor shall provide IA support for all SAP Information Technology requirements to include standalone systems, High Performance Computing systems, analysis systems, and ID&C systems in accordance with JAFAN 6/3, JAFAN 6/3 Implementation Guide, Joint Security Implementation Guide (JSIG), 9 October 2013, DoD Joint SAP Implementation Guide (JSIG, 09 Oct 2013).

Performance Standards

a) STD: Receive an average rating of 4.5 on the AEDC Government SAP IA Office evaluation criteria with no single rating less than 3.0

b) STD: The designated SAP ISSO, or those otherwise preforming SAP IA duties, shall complete required security training and briefings considered appropriate by the PSO.

c) STD: The SAP ISSO shall be available to meet with the Government on all urgent security issues within four hours of initial notification.

d) STD: No test or programmatic impacts occur as a result of the absence of responsible SAP IA personnel

OT-2014-30103 SCI/SAP Certification and Accreditation package

3.1.7.7 The Contractor shall submit Program Access Requests for SAP to the approval authority within 5 working days after receiving AEDC Government approval of the access requirement. The SAP Nomination Process shall be followed for all SAP nominations.

3.1.7.8 The Contractor shall prepare Standard Operating Procedures (SOP) necessary for the implementation of SAP requirements. SOPs shall be developed and coordinated in compliance with JAFAN 6/0.

Deliverables:

OT-2014-30104 SCI/SAP Accredited Area Standard Operating Procedure

3.1.8 The Contractor shall process all Homeland Security Policy Directive 12 and other “Position of Trust” investigative requests through the AEDC Government Personnel Security Program Manager in accordance with AFI 31-501. Assist other AEDC customers with required submissions as required.

Investigative requests and supporting documentation (Standard Form 85) are required for any new AEDC contractor personnel without a U.S. security clearance or other required background investigation for base/facility access and/or access to unclassified U.S. Government computers.

3.1.9 The Contractor shall provide electronic fingerprint services, required for official Government business, to all U.S. Government employees, contractors, visitors or tenants at AEDC requiring a background investigation.

Fingerprinting equipment will be provided as Government Furnished Equipment (GFE).

Performance Standards

a) STD: Zero Rejection Rate. (100% of all fingerprints submitted must be deemed classifiable and acceptable by Office of Personnel Management (OPM), Federal Bureau of Investigation (FBI), etc.)

AQL: No more than a 5% Rejection Rate. (95% of all fingerprints submitted must be deemed classifiable and acceptable by OPM, FBI, etc.)

3.1.10 The Contractor shall provide a copy of all adverse information reports submitted to DSS pursuant to NISPOM 1-300, 301, 302, 303 and 304 to the Installation Commander via the SSA. Incident reports shall also be entered in the JPAS. Reports required to be submitted to the FBI, in accordance with NISPOM 1-301, shall also be reported to the local detachment of The AF Office of Special Investigations. The contractor shall report all adverse information concerning SAP briefed personnel to the PSO in accordance with JAFAN 6/0. Report all adverse information concerning Sensitive Compartmented Information (SCI) indoctrinated personnel to the AEDC Special Security Officer.

Performance Standards

a) STD: No programmatic impacts from personnel suitability issues

b) STD: Score/Achieve no less than a Satisfactory rating on Inspections.

3.1.11 The Contractor shall establish and foster Counterintelligence (CI) focused culture, for all of AEDC in order to detect, deter, and expeditiously report suspicious activities.

3.1.12 The Contractor shall provide security support for all phases of unclassified, classified, and commercial testing and related test activities.

The Contractor shall establish and implement a security program compliant with DoD, service, and local directives and make recommendations for improvements to security test procedures; integrate cost effective and threat based security processes, plans and procedures. Test phases include planning, design, fabrication, installation, execution, removal, reporting, and analysis. The protection/security of test articles or systems and data is required.

3.1.12.1 The Contractor shall control media and information in accordance with the respective classification level and security classification guides.

3.1.12.2 The Contractor shall develop, coordinate, document and implement specific security requirements for all test programs.

3.1.12.3 The Contractor shall develop a Test Security Plan for each test and related activity, as requested by the Government.

The Contractor should anticipate having to develop about 125 Test Security Plans annually.

Each Test Security Plan will be reviewed, revised as necessary to remain compliant with current security policy, and coordinated for Government approval. Ensure the integration of US export and technology control laws, DoD/Agency policy and instructions and other applicable guidance into test security plans.

Test Security Plans developed in support of SAP efforts must be approved by the PSO, the customer security representative, and the Government.

Test Security Plans for SCI efforts must be approved by the AEDC Government Project

Manager and the AEDC Special Security Office.

The Test Security Plan, including physical security boundaries and facility-specific procedures, shall be briefed to all personnel supporting SAP and/or SCI tests. Training accomplishment shall be documented and maintained in accordance with Records Distribution Schedules.

3.1.12.4 The Contractor shall include a Foreign National Visitor Control Plan (FNVCP), or additional Operations Security (OPSEC) requirements as an annex to the test plan when determined to be necessary or as required. Coordinate the FNVCP and OPSEC requirements with the Government.

Test Security Plans will be used by the test team and identify all security requirements related to specific test efforts. In order to appropriately access requirements, the Contractor has to gather information from various sources (i.e., pre-test planning meetings, DD FM 254s, security classification guides, program/project managers, customers, etc.) in order to develop an applicable Test Security Plan specific to the program or project. The Contractor should anticipate having to develop approximately 125 Test Security Plans annually.

Test Security Plans that require additional security requirements or protection measures above the established baseline or NISPOM must be reviewed and approved by the Government.

Performance Standards

a) STD: No security compromises or test delays resulting from ineffective security.

b) STD: 100% of data will be properly marked, logged, and controlled as per classification level.

OT-2014-30067 Test Security Plan

3.1.12.5 The Contractor shall brief all test support personnel on the requirements of the Test Security Plan or Program Protection Plan.

3.1.12.5.1 The Contractor shall ensure that each Government, contractor or subcontractor employee completes Program Protection Awareness Training, as required in the respective Program Protection Plan.

Critical Program Information (CPI) Training is specific to the protection of sensitive and CPI. If CPI exists, it will be identified in the Program Protection Plan provided by the Government Program Office. The Government will provide the basic training plan to be tailored for each facility handling/storing/processing identified CPI.

Performance Standards

a) STD: Zero security violations

b) STD: 100% of personnel supporting a test are trained prior to performing any work related to identified CPI

3.1.12.6 The Contractor shall manage security requirements for all physical space required to support test operations and activities.

3.1.12.6.1 The Contractor shall establish, maintain and manage classified space (Closed & Restricted Areas) in accordance with DoD 5220.22M, Chapter 5 Section 3, AFI 31-601, and supplements.

Access shall be limited to authorized persons who have an appropriate security clearance and a need-to-know for the classified material/information within the area.

3.1.12.6.2 The Contractor shall establish, maintain and manage SAP Facilities as required to support mission requirements in compliance with JAFAN 6/0, JAFAN 6/9, and PSO guidance.

Access shall be limited to authorized persons who have an appropriate security clearance, need-to-know, and documented formal access to the information within the area.

3.1.12.6.3 The Contractor shall manage space during commercial tests in accordance with established baseline security requirements provided by the Government, test customer, or as identified in the respective Test Security Plan.

Performance Standards

a) STD: Zero unauthorized entries

b) STD: Zero security incidents which result in a loss or security compromise

OT-2014-30071 Standard Operating Procedures for Test Areas

3.1.12.6.4 The Contractor shall secure and issue program or project access badges and brief holders on requirements and responsibilities when required.

These badges are not to be confused with credentials issued by Visitor Control functions. Comply with DoD 5220.22-M, AFI 31-601, AFI 31-101, and supplements.

Performance Standards

a) STD: Zero unauthorized entries

b) STD: Zero security incidents which result in a loss or security compromise

3.1.12.6.5 The Contractor shall train appointed personnel to manage and enforce all security requirements within their respective NISPOM closed and restricted areas in accordance with DoD 5220.22-M, DoD 5200.01-M Vol. 1-4, AFI 31-601, and supplements.

3.1.12.6.5.1 The Contractor shall conduct and document initial indoctrination and annual training of all personnel that require access to the closed and restricted areas.

3.1.12.6.6 The Contractor shall establish and maintain internal test security/OIs, guard instructions, phone lists, Entry Authorization Lists, and other required controls for all classified, to include information protection requirements for NATO and Critical Nuclear Weapons Design Information categories, and unclassified test programs in accordance with DoD 5220.22-M, AFI 31-401 and AFI 31-601, and supplements.

Assist in the preparation of security instructions and plans for other appropriate functional areas with security concerns, as required or requested. Ensure each area is following guidance contained in applicable NISPOM, AF, program, and other cognizant security agency directives.

3.1.12.6.6.1 The Contractor shall conduct entry and exit inspections in order to deter and detect unauthorized introduction or removal of classified material from closed and restricted areas in accordance with DoD 5220.22-M and DoD 5200.01- M, Vol. 1-4.

Ensure Standard Operating Procedures and/or OIs include Entry/Exit Control procedures for use by owner/users or area custodians of controlled areas established for classified operations include procedures for entry and exit checks.

Performance Standard

a) STD: Conduct inspections at least once per month per area

3.1.12.6.6.2 The Contractor shall test and verify alarms and other physical security equipment used in closed and restricted areas in accordance with DoD 5220.22-M, DoD 5200.01-M, Vol. 1-4, AFI 31-101, AFI 31-401, AFI 31-601, and

3.1.13 The Contractor shall maintain, control, and issue accountable Security Material in accordance with DoD 5220.22-M, DoD 5200.01-M, Vol. 1-4, AFI 31-401, AFI 31-601, and supplements.

Accountable items include classified storage equipment, containers, vaults, and combination locks used in the AEDC Information Protection/Industrial Security Programs.

3.1.14 The Contractor shall schedule vault and safe inspections and periodic maintenance as required in accordance with TO-00-20F-2 and DoD 5220.22-M.

3.1.15 The Contractor shall retain a copy of all program Security Classification Guides and verify they are current in accordance with DoD 5220.22-M, DoD 5200.01-M, Vol. 1-4, AFI 31-401, AFI 31-601, and supplements.

3.1.16 The Contractor shall establish, maintain, and follow procedures to verify and log all visitors and media that enter or are brought into a closed or restricted area in accordance with DoD 5220.22-M, AFI 31-601, and supplements.

3.1.17 The Contractor shall use the JPAS for transmitting/receiving visit requests and to properly identify the security clearance level of visitors (to include test customers) in accordance with DoD 5220.22-M, DoD 5200.01-M, Vol. 1-4, AFI 31- 501, AFI 31-601, and supplements.

3.1.18 The Contractor shall ensure individuals requiring temporary access to the secure facility/area that require escort are escorted by the respective owner/users of the area in accordance with DoD 5220.22-M, DoD 5200.01-M, Vol. 1-4, AFI 31- 601, and supplements.

Performance Standard

a) STD: Zero security violations or unauthorized access to controlled areas

3.1.18.1 The Contractor shall ensure required security briefings are conducted to visitors and escort officials.

3.1.19 The Contractor shall conduct OPSEC Foreign National Vulnerability Assessments and Audits for visiting foreign guests and/or customers in accordance with DoD 5220.22-M, AFI 31-601, AFI 10-701, and supplements.

3.1.20 The Contractor shall ensure all media (e.g. computer hard drives, hardware) are marked, stored and destroyed in accordance with the DoD 5220.22- M, DoD 5200.01-M, Vol. 1-4, AFI 31-601, and supplements.

3.1.21 The Contractor shall package, pick-up, and transmit classified material in accordance with DoD 5220.22-M, DoD 5200.01-M, Vol. 1-4, AFI 31-601, and supplements.

a) STD: Zero security violations

3.1.22 The Contractor shall provide analytical, technical, and administrative security support services to Information Protection, Industrial Security, and SAP Security programs managed by the Government.

Technical and administrative support from qualified security personnel is required to ensure core programs are successfully executed in accordance with applicable DoD and AFIs. Support will be provided "on-site” to the Government at AEDC Arnold AFB and includes security reviews, evaluations, initial surveys, and assessments. Programs include but are not limited to: Industrial Security, Personnel Security, Information Security, Operations Security, Test Security, and Physical Security for the protection of controlled information.

3.1.22.1 The Contractor shall conduct, participate, or support security investigations, preliminary inquiries, and other actions required for resolution of security incidents in accordance with DoD 5220.22-M, JAFAN 6/0, AFI 31-601, and

3.1.22.2 The Contractor shall establish liaison with local CI and law enforcement organizations to determine the status of the local threat to the facility, personnel, and supported programs. Inform the Government of threats or any other information required in accordance with DoD 5220.22-M, AFI 10-701, AFI 31-401, AFI 31-501, AFI 31-601, and supplements.

3.1.22.3 The Contractor shall support Government security managers with conducting and documenting specialized security initiatives, training and briefings in accordance with DoD 5220.22-M, AFI 10-701, AFI 31-401, AFI 31-501, AFI 31-601, and supplements.

a) STD: No more than one validated complaint per quarter

3.1.23 The Contractor shall operate and maintain a classified and controlled material destruction capability for AEDC Arnold AFB.

3.1.23.1 The Contractor shall provide bulk destruction and disposal capability for all classified and controlled unclassified material generated at AEDC Arnold AFB.

3.1.23.2 The Contractor shall provide nine (9) National Security Agency (NSA) approved shredders and strategically position them throughout work centers to support day-to-day operational requirements in accordance with DoD 5220.22-M, DoD 5200.01-M, Vol. 4, AFI 31-601, AFI 10-701, and supplements. Train designated Contractor personnel on use of the equipment.

The Contractor is required to provide NSA approved equipment (NSA/CSS EPL 0202M Annex A to NSA/CSS 02 02, NSA/CSS Evaluated Products List) for the destruction of classified.

3.1.23.3 The Contractor shall destroy and dispose of all Controlled Unclassified Information (CUI), including all data storage devices/media, at AEDC Arnold AFB.

CUI may be destroyed by any of the means approved for the destruction of classified information or by any other means that would make it difficult to recognize or reconstruct the information. Strip shredding is not permitted.

Recycle bins are not approved for controlled information.

Performance Standards

a) STD: Secure bins for collection of CUI intended for destruction are strategically positioned throughout work centers (approximately 100)

3.1.24 The Contractor shall provide overnight transitory storage capability located in the Base Defense Operations Center (BDOC) approved for safeguarding classified material, up to the secret level, in accordance with DoD 5220.22-M, DoD 5200.01-M, Vol. 3, AFI 31-401, and supplements.

Overnight transitory storage is for use by AEDC visitors and transitory personnel.

Advertise this capability at key visitor reception points.

a) STD: Zero validated complaints

3.1.25 The Contractor shall provide security-related technical assistance to the Government and Contractor personnel for briefings and conferences.

a) STD: No more than one validated customer compliant per quarter

3.1.26 The Contractor shall assist the Government to develop security requirements for contractual commitments in accordance with DoD 5220.22-M, AFI 31-601, and supplements.

Examples include coordination of the DD FM 254, DoD Contract Security Classification Specification, VGSAs, and Security Clauses.

3.1.27 The Contractor shall participate in scheduled and ad-hoc security working groups in accordance with DoD 5220.22-M, AFI 10-701, AFI 31-401, AFI 31-501, AFI 31-601, and supplements.

For example, Installation Security Advisory Group, OPSEC Working Groups, Security Working Groups, or other security related working groups or Integrated Product Teams.

Performance Standards

a) STD: No more than one missed meeting per quarter

b) STD: No more than one validated customer compliant per quarter

3.1.28 The Contractor shall appoint an OPSEC trained person as a Point of Contact (POC) with overall OPSEC responsibilities to maintain awareness of foreign intelligence collection capabilities, limitations, methods, and practices.

Performance Standards

a) STD: Integrated OPSEC Support Staff (Course #2500) training completed by contract start date.

b) STD: Achieve no less than a Satisfactory rating on all security reviews, inspections, audits, and vulnerability assessments.

3.1.28.1 The Contractor shall develop an OPSEC program plan to address how the Contractor will protect critical and sensitive contracted information in accordance with AFI 10-701 and AAFB OPSEC Plan 10-701.

Upon acceptance by the Government, implement the OPSEC program plan.

DI-MGMT-80934C OPSEC Program Plan

3.1.28.2 The Contractor shall assist the Government to develop, coordinate, and execute OPSEC program requirements.

3.1.29 The Contractor shall assist the Government program manager in the development and implementation of the Commander’s OPSEC policy and Critical Information List in accordance with AFI 10-701 and supplements.

3.1.29.1 The Contractor shall conduct OPSEC training in accordance with AFI 10- 701.

The Contractor shall familiarize new employees for awareness and conduct refresher sessions needed in the areas of OPSEC and CI.

3.1.29.2 The Contractor shall integrate and include OPSEC into all acquisition programs and Contractor support documents in accordance with AFI 10-701.

3.1.29.3 The Contractor shall coordinate with the Government to resolve/mitigate Web Risk Assessment, Telecommunications Monitoring Assessment Program, Vulnerability Assessment, and other OPSEC assessment findings as required in accordance with AFI 10-701.

3.1.29.4 The Contractor shall assist the Government to conduct Staff Assistance Visits with the Government as required or requested in accordance with AFI 10- 701.

3.1.30 The Contractor shall conduct and document OPSEC self-assessments and implement required changes.

3.1.31 The Contractor shall integrate OPSEC into all organization planning, operational processes, acquisition programs, and Contractor support documents.

Recognizing that sub-contractors vary in size, resources, and length of subcontract, OPSEC programs implemented for subcontractors should be designed to afford at least a minimum level of OPSEC protection and understanding for all subcontracts with increasing levels of OPSEC protection and understanding for more sensitive subcontracts.

3.1.32 The Contractor shall comply with the OPSEC measures imposed by any program supported.

Organizations and personnel supporting customers may have OPSEC requirements associated with their activities and support. The following standard expectations are included in all work:

• Specific event-oriented activities are supported when directed by the supported program, or comply with the program's OPSEC Plan/Annex.

• OPSEC Awareness Education and Duty-Related Training as deemed necessary by the Government or program supported are provided to personnel assigned

• OPSEC protective measures (countermeasures) are applied as directed by

Government or program sponsors.

a) STD: No more than one validated compliant per quarter

Table 3.1.1

Document

Title

Mandatory (M) or

Guidance (G) E.O. 12829 National Industrial Security Program M

E.O. 13526 Classified National Security Information

M

E.O. 13556 Controlled Unclassified Information M

E.O. 13467

Reforming Process relating to Suitability for Government Employment, Fitness for Contractor Employees, and Eligibility for Access to Classified National security Information

E.O. 13587

Structural Reforms To Improve the Security of Classified Networks and the Responsible Sharing and Safeguarding of Classified Information

ICD 503

Intelligence Community Information Systems Security Risk Management, Certification, and Accreditation

M

ICD 700 Protection of National Intelligence M

ICD 701 Security Policy Directive for Unauthorized Disclosures of Classified Information M

ICD 702 Technical Surveillance Countermeasures M

ICD 704

Personnel Security Standards and Procedures Governing Eligibility for Access to Sensitive Compartmented Information and Other Controlled Access Program Information

ICD 704.1

Personnel Security Investigation Standards and Procedures Governing Eligibility for Access to Sensitive Compartmented Information and Other Controlled Assess Program Information

M

ICD 704.2

Personnel Security Adjudicative Guidelines for Determining Eligibility for Access to Sensitive Compartmented Information and Other Controlled Access Program Information

M

ICD 704.3

Denial and Revocation of Access to Sensitive Compartmented Information, Other Controlled Access Program Information, and Appeals Processes

M

ICD 704.4 Reciprocity of Personnel Security Clearance and Access Determinations M

ICD 705 Sensitive Compartmented Information Facilities M

ICS 705-1

Physical and Technical Security Standards for Sensitive Compartmented Information Facilities

M

ICS 705-2

Standards for the Accreditation and Reciprocal Use of Sensitive Compartmented Information

M

ICD 705

Technical Specifications for Construction and Management of Sensitive Compartmented Information Facilities, Version 1.2, 23 April

ICD 710 Classification and Control Marking System M

CNSSI 5006 NEED Title (Replaced TSG 6) M

CNSSAM

TEMPEST/1/13 (U) Red/black Installation Guidance M

JAFAN 6/0 Special Access Program Security Manual M

JAFAN 6/3 Protecting Special Access Program Information Within Information Systems

M

JAFAN 6/3 Implementation Guide G

JAFAN 6/9 Physical Security Standards for Special Access Program Facilities

Joint Pub 3-

Joint Doctrine for Operations Security G

Joint Pub 3-

Joint Doctrine for Operations Security G

JSIG Joint Security Implementation Guide (JSIG), 9 October 2013

DJSIG

Department of Defense Intelligence

Information System (DoDIIS) – Joint Security Implementation Guide (DJSIG), August 2011

Department of Defense Joint Special Access Program (SAP) Implementation Guide (JSIG, 09 Oct 2013

DoDD

3000.09 Autonomy in Weapon Systems G

DoDD

5000.01 The Defense Acquisition System G

DoDD 5100.55

United States Security Authority for North Atlantic Treaty Organization Affairs M

DoDD

5200.02 DoD Personnel Security Program M

DoDD

5205.07 Special Access Program (SAP) Policy M

5230.09

Clearance of DoD Information for Public Release

5230.11

Disclosure of Classified Military Information to Foreign Governments and International Organizations

M

DoDD 5230.25

Withholding of Unclassified Technical Data from Public Disclosure G

DoDD O- 5240.02

Counterintelligence G

DoDD 5240.06

Counterintelligence Awareness and Reporting (CIAR)

G

DoDD 5530.03

International Agreements G

DoDD 8500.01E

Information Assurance (IA) G

DoDM 5200.45 Instructions for Developing Security Classification Guides

G

DoDI 2040.02 International Transfers of Technology, Articles, and Services G

DoDI 3020.46 The Military Critical Technologies List

(MCTL) G

DoDI 3200.12 DoD Scientific and Technical G

Information Program (STIP)

DoDI 3200.20 Scientific and Engineering Integrity G

DoDI 4140.01 DoD Supply Chain Materiel Management Policy G

DoDI 5000.02

(Interim)

Operation of the Defense Acquisition System G

DoDI…