ICT PWS Reacquisition 29 Sep 26.pdf

CUI

PERFORMANCE WORK STATEMENT

FOR

INDUSTRIAL CONTROL TECHNICIAN (ICT)

Buckley Space Force Base (BSFB) Date: 30 Sept 2026

Table of Contents

Section Number and Title Page Number

1.0 DESCRIPTION OF SERVICES 3

2.0 SERVICE SUMMARY 5

3.0 GENERAL INFORMATION 8

1.0. DESCRIPTION OF SERVICES:

1.1. The Contractor shall provide all work specified by this Performance Work Statement (PWS). The Contractor shall provide all personnel, personal protective equipment, and other items not provided to perform all tasks and functions for Buckley Space Force Base (BSFB) as defined in this PWS. The Contractor shall provide all managerial oversight, direction, and coordination for all functions and requirements identified in this PWS to ensure effective, efficient, and economical operation of all activities outlined. The contract objective is for the Contractor to perform service consistent with stated thresholds in the following areas:

The Contractors will provide the following services:

1.2. Industrial Control Technician (ICT)

1.2.1. The Contractor shall perform hands-on physical and device-level maintenance, configuration, and cybersecurity hardening of the field-level Operational Technology (OT) infrastructure.

1.2.2. The Contractor shall assist in identifying, analyzing, and prioritizing EMCS/Industrial Control Systems (ICS) requirements in accordance with the Requirements and Optimization process.

1.2.3. The Contractor shall provide formal assessments regarding adherence to Air Force policies and directives, specifically as they apply to the cybersecurity and management of Control Systems (CS).

1.2.4. The Contractor shall conduct and/or participate in the Control System Working Group (CSWG), in support of Space Base Delta 2.

1.2.5. The Contractor shall diagnose and repair electromechanical faults within control cabinets (PLCs, relays, I/O modules) and troubleshoot network connectivity/protocol issues at the device level (BACnet/IP, Modbus TCP/IP).

1.2.6. The Contractor shall apply configurations to implement "least privilege" principles and maintain a secure repository of field device logic backups.

1.2.7. The Contractor shall apply OEM firmware patches to mitigate vulnerabilities and change default passwords.

1.2.8. The Contractor shall ensure all control system enclosures are physically secured with locks and conduct and document quarterly physical security checks.

1.2.9. The Contractor shall physically disable unused USB and Ethernet switch ports on control devices.

1.2.10. The Contractor shall physically inventory OT assets to identify hardware, software, and firmware versions to support authorization to operate (ATO) maintenance.

1.2.11. The Contractor shall operate, maintain, and secure all CE Control Systems, ensuring their availability and integrity for day-to-day operations. This support is critical for the proper function of the CE work management system (NexGen) and the physical infrastructure it manages.

1.2.12. The Contractor shall install, configure, and perform lifecycle maintenance on all CE Control Systems. Maintenance activities shall include timely patch management in accordance with all STIGs and IAVMs, application of antivirus definitions, and performance of regular system backups. All changes must be documented in a system change log.

1.2.13. The Contractor shall possess and maintain Secret clearance.

1.3 Industrial Technician (IT)

1.3.1. The Contractor shall perform hands-on system administration for the servers, workstations, and specialized software applications required for CE operations and facility control monitoring.

1.3.2. The Contractor shall install, configure, update, and troubleshoot CE-specific operational software applications (e.g., NexGen IT, AutoCAD, BUILDER, vendor-specific CS applications).

1.3.3. The Contractor shall physically and logically apply operating system (OS) patches, software updates, and anti-virus definitions to CE systems.

1.3.4. The Contractor shall create, configure, and disable user accounts and manage role-based access permissions within Active Directory and CE software applications.

1.3.5. The Contractor shall execute weekly data backups of all CE CS servers and specialized application databases, and periodically verify data restoration capabilities.

1.3.6. The Contractor shall diagnose and resolve software-level and switch-level network connectivity issues for CE-managed systems.

1.3.7. The Contractor shall perform hands-on System Security Administrator (SSA) duties under the direction of the Government ISSM.

1.3.7.1. STIG Compliance: Applying DISA STIGs to servers, workstations, and network devices.

1.3.7.2. Vulnerability Scanning: Executing automated vulnerability scans (e.g., ACAS, Nessus) and performing technical remediation.

1.3.7.3. The Contractor shall conduct weekly reviews of system and security audit logs.

1.3.7.4. The Contractor shall generate required technical artifacts to maintain the system's

ATO.

1.3.7.5 The Contractor shall possess and maintain Secret clearance.

2.0. SERVICE SUMMARY (SS): The contract service requirements are summarized in performance objectives that relate directly to mission essential items. The performance threshold briefly describes the minimally acceptable levels of service required for each requirement. The SS and the Contractor’s Quality Control Plan provide information on contract requirements, the expected level of Contractor performance and the expected method of Government validation and confirmation of services provided. These thresholds are critical to mission success.

Procedures as set forth in the FAR 52.212-4 (a), Contract Terms and Conditions - Commercial Items, Inspection/Acceptance, will be used to remedy all deficiencies.

Performance Objective PWS Para. Performance

Threshold Assessment Method

SS-1 OT Physical Security & Hardening

1.2.8 & 1.2.9 100% compliance with locking enclosures, documented quarterly checks, and disabled unused ports. Zero unauthorized active ports allowed.

Government physical inspection and verification of quarterly security logs.

SS-2 OT/IT Patch Management & STIGs

1.2.6, 1.2.12, 1.3.5

100% successful execution of weekly backups and logic repository maintenance.

Government inspection of weekly backup logs and direct observation of scheduled restoration drills.

SS-3 Vulnerability Scanning & Remediation

1.3.7.2 100% of scans completed monthly. Identified vulnerabilities must be mitigated within mandated timelines

(CAT I

15 days, CAT II 30 days).

Government review of monthly ACAS/Nessus scan reports and POAM/remediation tracking logs.

SS-4 Security Audit Log Reviews

1.3.7.3 100% compliance with weekly reviews. Any anomalous behavior or indicators of compromise must be escalated within 24 hours of discovery.

Government random weekly quality assurance audits of the contractor's signed log review records.

2.1. DELIVERABLES:

2.1.1. Monthly Status Report (MSR): MSR shall be due on the tenth (5th) workday following the close of the calendar month.

The MSR shall contain the following information:

• Brief description of requirements.

• Summary of accomplishments during the reporting period and significant events regarding the contract.

• Deliverables submitted or progress on deliverable products.

• Any current or anticipated problems.

• Summary of activity planned for the next reporting period.

2.1.2. Organization Conflict of Interest (OCI): The Government requires that a Contractor-provided OCI Mitigation Plan be submitted at the time of proposal. The offeror’s plan will show the Contractor acknowledges:

• There will be restraints on their eligibility to bid on future contracts for which they developed specifications.

• There will be company-sponsored OCI training provided to employees within 30 days after contract award. An overall non-disclosure agreement will be signed by each employee within 30 days after the contract is awarded. This is to address information relating to internal base information not available to the public concerning the organization’s plans or programs, related opinions, clarifications, interpretations and positions. Signed non-disclosure statements will be provided to the CO.

2.1.3. The Contractor shall provide and maintain a Quality Control Plan (QCP) that contains, as a minimum, the items listed below to the CO for acceptance not later than ten (10) business days after award. The CO will notify the Contractor of acceptance or required modifications to the plan. The Contractor shall make appropriate modifications and obtain acceptance of the plan within thirty (30) calendar day from the date of award.

The QCP shall include the following minimum requirements:

• A description of the inspection system to cover all major services and deliverables. The description shall include specifics as to the areas to be inspected on both a scheduled and unscheduled basis, frequency of inspections, and the title of inspectors.

• A description of the methods to be used for identifying and preventing defects in the quality of service performed.

• A description of the records to be kept to document inspections and corrective or preventative actions taken.

• All records of inspections performed shall be retained and made available to the Government upon request throughout the contract performance period, and for the period after contract completion, until final settlement of any claims under this contract.

2.1.4. The Contractor shall assign a Contract Manager (CM) off-site to manage the Contractor personnel assigned to this contract. The Government will contact the CM when issues of non-compliance or underperformance arise.

2.1.5. Quality Assurance: The Government will evaluate the Contractor’s performance of this PWS on a monthly basis. For those tasks listed in the SS, the Contracting Officer’s Representative (COR) will follow the method of surveillance specified.

Government personnel will record all surveillance observations. When an observation indicates defective performance, the COR will require the CM to initial the observation.

The initialing of the observation does not necessarily constitute concurrence with the observation. It acknowledges that the Contractor has been made aware of the non-compliance. Government surveillance of tasks not listed in the SS or by methods other than those listed in the SS (such as provided in the inspection clause) may occur during the performance period of this contract. Such surveillance will be done according to standard inspection procedures or other contract provisions. Any action taken by the Contracting Officer (CO) as a result of surveillance will be in accordance with the terms of the award.

2.1.6. Unsatisfactory Work: Performance by the Contractor to correct defects found by the Government as a result of quality assurance surveillance or by the Contractor as a result of quality control, shall be at the Contractor’s expense and without additional reimbursement by the Government. Unless otherwise negotiated, the Contractor shall correct or replace all non-conforming services or deliverables not later than five (5) workdays after notification of non-conformance.

2.1.7. Initial Business Meeting: Within five (5) business days following the contract award date, Contractor will meet with the CO and COR to review goals and objectives of this contract and to discuss technical requirements. All deliverables shall be delivered to the CO and COR no later than the specified dates stated in the SS 2.0.

3.0. GENERAL INFORMATION:

3.1. COR Designation: After the award, the CO will appoint a COR and issue a COR Designation Letter stating the authority of the COR. The Contractor will receive a copy of the written designation.

3.2. Hours of Operation: Working hours will be between 7:30 A.M. and 4:30 P.M., not to exceed eight (8) hours on any given day, Monday through Friday, with the exception of Government holidays or base closures. Overtime is not approved for this contract.

Contractor positions are considered non-mission essential.

3.2.1. Federal Holidays:

New Year’s Day - 1 January Martin Luther King Day - 3rd Monday in January Washington’s Birthday - 3rd Monday in February Memorial Day - last Monday in May Juneteenth – 19 June Independence Day - 4 July Labor Day - 1st Monday in September Columbus Day - 2nd Monday in October Veteran’s Day - 11 November Thanksgiving Day - 4th Thursday in November Christmas Day - 25 December

3.2.2. In the event of weather, natural disasters, riots or civil disturbances Contractor personnel will conform to customer agency delayed reporting, early release, and base closure requirements. Contractor shall maintain a DD Form 2946 Telework Agreement with the Component-Specific Terms and Conditions. This position is designated as telework eligible. Contractor's Place of Employment is 460 CES facility offices at Buckley SFB, with telework being situational, as approved by COR(s).

Agreement will be reviewed a minimum of annually and re-endorsed every two years.

3.3. Contractor will have access to Privacy Information. Contractor shall adhere to the Privacy Act, Title 5 of the U.S. Code, Section 552a and applicable agency rules and regulations.

3.4. Contractor Identification: Contractor shall wear identification such as: a badge, shirt, or other form of identification that clearly identifies them as Contractors while working at Government facilities (The Common Access Card or other identification card shall not act as this form of identification).

3.5. Place of Performance: Normal work duties shall be performed only at the 460 CES facility offices at BSFB.

3.5.1. The Government will provide rent-free use of buildings including heating, electricity, water, and sewer. There shall be no smoking except in authorized smoking areas. If a hazard is identified, Contractor personnel shall notify the facility manager and COR. No minor alterations or modifications shall be made to the facilities without prior written approval from the facility manager. For major alterations or modifications, Contractor personnel shall notify the facility manager who in turn will contact the Base Civil Engineer. The Contractor shall maintain a file copy of all alteration or modification work requests required for furnished facilities.

Emergency verbal requests and follow-up shall be the responsibility of the facility manager. The Contractor shall adopt workaround plans if maintenance, repair, or remodeling to facilities requires relocation of functional areas. The facility manager and COR will review and approve all workaround plans before activation.

3.5.1.1. The Government will provide a workspace, Government computer, and associated equipment.

3.5.1.2. The Government will provide all data and telephone services, including a Personal Identification Number for long-distance access.

3.5.1.3. The Government will provide all Automated Data Processing Equipment (ADPE).

3.5.2. Security, Fire, and Medical Services. The Government will provide police and fire protection. In the event of a medical emergency, Aurora ambulance service for transporting an injured employee to a local hospital is available on a cost reimbursement basis. From a government land line, dial 911 for emergencies; or dial 720-847-9117 from a cell phone. Dial 720-847-9252 for non-emergency BSFB Security Forces and 720-847-9925 for non-emergency BSFB Fire Dept. NOTE:

Dialing 911 from a cellular phone on BSFB will connect to off base authorities who need to know you are calling from BSFB. Response time may be delayed.

3.5.3. Access to the Space Base Delta 2 Non-secure Internet Protocol Router (NIPR) and Secure Internet Protocol Router (SIPR) network will be included for Contractor personnel requiring a network and email account. Contractor personnel will be required to complete all training and documentation required to gain access to NIPR and SIPR accounts.

3.5.4. The Contractor shall practice utility conservation and operate under conditions that prevent the waste of utilities. Lighting shall be used only in areas where work is actually being performed. Mechanical equipment controls for heating, ventilation, and air conditioning systems shall not be adjusted by Contractor personnel.

3.5.5. The Contractor shall perform Client Support Administration Services (CSA) duties on all Government-furnished ADPE including installation, maintenance, repair, replacement, troubleshooting, and upgrading associated hardware and software.

When ADPE issues arise, the Contractor shall contact the COR and CSA where the facility is located.

3.6. Operations Security (OPSEC) Requirements within Contracts:

3.6.1. PURPOSE: Contractor shall comply with all provisions of Air Force Instruction, AFI 10-701, dated 23 Jul 2019, and applicable AFSPC Supplement. The OPSEC Program will provide the structure to ensure that OPSEC requirements are met for the awarded contract as well as all subcontracts. This plan is to protect critical information related to the development, re-acquisition contract, and subcontracts. While critical information, indicators, threat information, risk assessment, OPSEC Standard Operating Procedures (SOP), and all updates will be provided under separate cover, this plan covers general vulnerabilities and the required countermeasures that will mitigate and lower the risk to the contract development. All required OPSEC training will be provided free to mission partners and Contractors from the Government OPSEC Coordinators

3.6.2. ORGANIZATION: This OPSEC Program and its requirements apply to all contracted and subcontracted elements and personnel supporting the ICT contract.

Personnel will participate in the OPSEC program.

3.6.3. REQUIREMENTS:

3.6.3.1. OPSEC Process.

i. Critical information. A critical information list and updates will be provided under separate cover after contract award to the Contractor Project Manager/OPSEC Officer(s) for dissemination to contracted and subcontracted employees who are supporting the contract, are involved in technical development, and handling critical information.

ii. Threat Assessment. A formal threat assessment and all updates will be provided under separate cover after contract award to the CM/OPSEC Officer(s) for dissemination to subcontractors who are supporting the contract, are involved in technical development, and handle critical information. A general threat assessment will be provided in the SOP.

iii. Vulnerability Analysis. Vulnerabilities (and indicators) of the contract may reveal critical information. A more detailed list will be provided after contract award to CM/OPSEC Officer(s) for dissemination to contracted and subcontracted personnel who support the contract, are involved in technical development, and handle critical information.

iv. Risk Assessment. The 460 CES/CC has determined that certain risks associated with vulnerabilities and indicators are unacceptable and must be mitigated through countermeasures.

v. Countermeasures.

1. Awareness Training. CM/OPSEC Officer shall ensure face-to-face OPSEC awareness training is conducted for their personnel and will ensure that the critical information list, threat information, and list of countermeasures in the form of an OPSEC SOP (provided after contract award) are provided. In addition, they will provide OPSEC program contact information for reporting and feedback.

2. General Countermeasures. In conjunction with OPSEC awareness training, an OPSEC SOP (provided after contract award) will be provided to CM/OPSEC Officer for dissemination to contract and subcontract personnel who support the contract, are involved in technical development, and handle critical information.

3.6.3.2. Roles and Responsibilities.

i. CM/OPSEC Officer(s). The OPSEC Officer(s) is located at the awarded company.

1. The awarded company/contract owner will ensure that the Contractor Project Manager OPSEC/Officer will complete OPSEC training to develop skills, which may include the following:

• Threat assessment.

• Identification of critical information.

• Identification of OPSEC indicators.

• Analysis of OPSEC vulnerabilities.

• Assessment of risk.

• Countermeasures development and implementation.

• Contingency and emergency planning.

• Awareness training development and presentation.

2. Training will be delivered via instructor-led briefing.

3. Will ensure that all awarded employees working in support of the contract, involved in the technical development, and handling critical information receive OPSEC awareness training, threat information, vulnerability information, critical information, vulnerability information, and the OPSEC SOP (Countermeasures). The OPSEC Officer(s) will maintain employee training records which must be made available if they are requested from the 460 CE OPSEC Program Manager.

4. Shall ensure that all awarded company contracts (subcontract level) that support the contract, involved with technical development and the handling of critical information will include OPSEC requirements in accordance with this OPSEC Plan, as well as a requirement for a flow down in all tier one and below subcontracts that support the contract and are involved in the technical development and handling of critical information.

ii. The OPSEC Subcontractor shall comply with ALL OPSEC requirements as the CM/OPSEC Officer.

3.6.4. Schedule. The awarded company, CM/OPSEC Officer(s) and Supervisor/OPSEC rep shall follow this schedule:

1. The CM/OPSEC Officer and Supervisor/OPSEC rep will be identified within 30 days of contract award.

2. The CM/OPSEC Officer(s) will receive OPSEC training within 60 days of contract award, as determined by the 460 CES OPSEC Program Manager. They will receive refresher training every 180 days (six months). Refresher training must be delivered via an instructor-led briefing. New employees on the contract will receive training within 5 days of starting date.

3. The CM/OPSEC Officer(s) shall ensure that personnel working in support of the contract are involved in technical development, and handle critical information will receive face-to-face OPSEC awareness training within 90 days of contract award or within 30 days of the signing of the DD Form 254. Training will be repeated every 365 days (12 months). It is estimated that 100% of all personnel who are working on contracts support the ICT re-acquisition project who are involved in technical development will be handling critical information.

Contract Award •Contract Awarded

30 days •contractor Project Manger/OPSEC Officers and Supervisor/OPSEC rep identified within 30 days

60 days •contractor Project Manger/OPSEC Officers and Supervisor/OPSEC rep trained & successfully complete Awardness Training within 60 days. Refressh every 180 days (6 months)

90 days

•All personnel under OPSEC Plan receive face-to-face OPSEC Awareness training within 90 days of contract award or 30 days of DD Form 254 signing. Refresh every 365 days (12 months). New employees on the contract will receive training within 5 days of starting date

240 days •Refresher training for OPSEC Officers Supervisors every 180 days

365 day •Refresher training for all personnel every 365 days

Contract Completion •Contract Completion

3.6.5. All Contractors (including subcontractors) performing ICT duties will be required to receive OPSEC training provided free of charge to Contractors from the Government OPSEC Coordinators.

3.6.6. The Contractor shall provide and maintain a Department of the Defense DoD SECRET level/T3 Secret Facility Security Clearance from the Defense Security Service (the authorized FCL processing agent) and provide sponsorship for the ICT.

The Contractor shall ensure that the individual hired into positions requiring access to classified information possess and maintain a fully adjudicated security clearance, to the SECRET level (T3), from the DoD and verification of JPAS access. The Contractor shall replace any personnel (within 2 weeks) that are unable to maintain a SECRET/T3 clearance. The purpose of the SECRET/T3 clearance is to allow the ICT unescorted access to the Restricted Area and to the SIPRNET server system. The SECRET level (T3), clearance will also serve as approval in DEERS to grant a CAC card. To obtain further information see Personnel Security Program Management.

DoD 5220.22 V 2 AFI 161404 Industrial Security, AF Information Security Program 16-1404, and DoD Manuel 5200.02 AFM 16-1405.

3.6.7. Antiterrorism/Force Protection: During times of heightened security, entry onto and around the base will be significantly restricted. The Contractor shall make concessions for potential delays caused by security measures. The services under this contract are not essential for performance during crisis or FPCON DELTA. The CO will determine circumstances which constitute a crisis based on direction from Security Forces and base leadership. The COR will ensure that Level I Antiterrorism IAW DoDI 2000.16_AF Sup 10-245 is conducted either through CBT (Force Protection Awareness Training in ADLS).

3.6.8. The Contractor shall comply with all Buckley SFB (BSFB) security requirements. BSFB is a controlled/restricted area and special security procedures are utilized to deter espionage, sabotage, and theft of Air Force resources. The Contractor shall be responsible for security of work areas in cooperation with applicable base agencies. Contractor personnel shall report to an appropriate authority any information or circumstances of which they are aware may pose a threat to the security or well-being of DOD personnel, Contractor personnel, resources, and classified or unclassified defense information. The Contractor shall obtain all necessary cards, passes, buttons, decals, or other items required for access to the area or areas in which work will be performed. Upon completion or termination of the contract, or an individual’s employment on the job, the Contractor shall immediately retrieve the identification media issued above and surrender it to the BSFB, 460 SFS, and Visitor’s Control Center.

3.6.9. Security Officer. The Contractor shall appoint, in writing to the CO, the name of a Security Officer to arrange all needed security support for this PWS. 4.13 Security Arrangements. To gain unescorted access to BSFB, the Contractor will obtain a Defense Biometric Identification System (DBIDS) card. The DBIDS paperwork must be submitted to the COR for Security Forces approval before the card can be issued to the Contractor. The Government will assist the Contractor to coordinate security matters with the 460th Security Forces Squadron (SFS) and other base agencies, as needed. All personnel and vehicles entering the installation are subject to search. All personnel operating vehicles on the installation must have a valid driver’s license, current registration and current insurance on the vehicle they are operating. Proof of these items must be presented if requested by Security Forces personnel.

3.6.10. Replacement of Personnel. The Contractor shall provide replacement personnel if an employee will be out of the office longer than 2 weeks due to illness, vacation, or the need to hire a new worker.

3.6.11. Problem Resolution. The Contractor shall bring problems or potential issues affecting performance to the attention of the COR and CO as soon as possible. Verbal reports will be followed up with written reports when directed. This notification shall not relieve the Contractor of its responsibility to correct problems for which they are responsible. The Contractor will work cooperatively with the Government to resolve issues as they arise.