Draft_PWS_ID07180027_ANG_AFRC_F16_MTT_TSSC_sources_sought.pdf

TASK ORDER # ID07180027

Draft Performance Work Statement (PWS)

FOR THE

Training System Support Center (TSSC) for the

Air National Guard (ANG) and Air Force Reserve Command (AFRC) F-16 Mission Tactics Trainers (MTT)

PREPARED FOR

General Services Administration Greater Southwest Region

PREPARED BY

Air Education Training Command (AETC)

502d Trainer Development Squadron/Trainer Development (502d TDS/TD) Joint Base San Antonio (JBSA) Randolph, Texas

DATE

02 July 2018

1.0 INTRODUCTION

The overall objective of the Air National Guard (ANG) and Air Force Reserve Command (AFRC) F-16 Mission Tactics Trainer support contract is to provide a comprehensive operations, maintenance, and sustainment (OM&S) program to ensure F-16 MTT operators have fully functional, squadron-level, pilot training devices designed to support initial, qualification, and continuation training of full-time and part-time pilots, in both training and operational F-16 units.

The F-16 MTT Training System Support Center (TSSC) contract, through General Services Administration (GSA), consists of all actions and activities required for the OM&S of the ANG and AFRC F-16 MTT systems.

1.1 RELOCATABLE SIMULATION SHELTER (RSS)

A Relocatable Simulation Shelter (RSS) is a self-contained, purpose-built, weatherproof, electrically powered, climate-controlled, and protected environment for the human occupants and simulator training device(s). The RSS includes self-contained environmental control through integral air conditioning/heating units, humidity control, fire detection and suppression, and integral lighting. The RSS is transportable using conventional commercial vehicles, and meets the road size and weight restrictions.

The RSS is considered part of the F-16 MTT device equipment, and as such, the F-16 MTT TSSC shall be responsible for the OM&S of the RSS.

1.2 F-16 MTT LOCATIONS

Table 1 outlines the F-16 MTT locations requiring support, including a notation for those F-16 MTT devices which, as of the date of this PWS, we know will be housed in an RSS.

Table 1a. ANG Training Device Locations

Unit Location No. of Systems RSS

1 TSSC: Mesa, AZ 1

2 149 AW: Kelly Field, TX 2

3 162 AW: Tucson, AZ 2

4 140 AW: Buckley, CO 4

5 162 AW: Tucson, AZ 2

6 113 WG: Andrews AFB, MD 2

7 177 AW: Atlantic City, NJ 2

8 115 AW: Madison, WI 2

9 187 AW: Montgomery, AL 2

10 149 AW: Kelly Field, TX 2

Table 2a. AFRC Training Device Locations

Unit Location No. of Systems RSS

1 TSSC: Mesa, AZ 2

2 Homestead ARB, FL 4

3 Joint Reserve Base Fort Worth, TX

1.2.1 F-16 MTT Connectivity to Combat Air Forces (CAF) Distributed Mission Operation (DMO) Connectivity

The F-16 MTT CAF DMO connects via Air Reserve Component Network (ARCNet). The Distributed Training Operations Center (DTOC) at the 132 FW in Des Moines operates and maintains the ARCNet. The DTOC organizes DMO events for ANG and Air Force Reserve Combat pilots. The requirements to operate on the ARCNet is the same as CAF DMO.

However, connections to the CAF DMO will be made through the DTOC to the Combat Air Force (CAF) Distributed Training Center Network (DTCN).

1.3 SCOPE

This document establishes the requirements for the F-16 MTT TSSC contract with GSA. The requirements defined herein establish the scope of tasks, products, and services that may be exercised through program-specific tasks. The following tasks fall within the scope of this effort:

Paragraph 3.1: Program Management/Systems Engineering. This includes all support, not considered co-located at the unit/base, such as: financial management, personnel management, program security, safety, subcontract management configuration management, cybersecurity support (including security and virus scans), sustainment engineering and planning, and managing technology insertion.

Paragraph 3.2: Contractor Operations and Maintenance Support (COMS). Support includes operations, maintenance, and sustainment (OM&S) activities at operational locations, such as:

Managing a support package, to include replenishment of spares, required to sustain the F-16 MTT devices

Managing program equipment, to include facilities and shelters.

Supporting trade studies, analysis, and technology insertion events.

Interoperability: DMO integration, testing, and sustainment.

Qualification and Test support: test planning, integration and test support, support for

Simulator Certification (SIMCERT).

Contract transition activities including transfer of responsibility from the prior sustainment contract.

Paragraph 3.3: Software Maintenance. Management and maintenance of recurring software licenses and support, maintenance licenses, software/system integration labs (SILs), and software revision updates.

Paragraph 3.4: Spares Management. Identification and procurement of spares for the F-16 MTT program.

Paragraph 3.5: Equipment Management. Identification and procurement of F-16 MTT TSSC equipment, to include the RSS OM&S.

Paragraph 3.6: Representational Support. Support of conferences, demonstrations, exercises, evaluation events.

Paragraph 3.7: Relocation. Support of the relocation of the F-16 MTT TDs, ancillary TD equipment, the RSS, and the TSSC itself, as missions are re-defined.

Paragraph 3.8: Contract Aircrew Training (CAT) and Courseware Development (CWD) and Continuation Training.

Paragraph 3.9: Travel. All travel in support of this effort, the F-16 MTT TSSC tasks.

2.0 REFERENCE DOCUMENTS

Unless otherwise specified, the following documents and the version in effect on the date of the contract award shall form a part of this PWS to the extent specified herein. Not all are explicitly referenced in this PWS. Replaced reference documents shall become part of this PWS, and replace the following reference documents in the tables below.

Table 2. DoD Publications, Specifications and Standards

Document # Revision Date Title

AFI 17-101 02 Feb 17 Risk Management Framework (RMF) for Air Force Information Technology (IT)

AFI 17-130 18 Oct 16 Air Force Cybersecurity Program Management

AFI 17-1303 20-Mar-15 Cybersecurity Workforce Improvement Program

AFI 31-501 27 Jan 05 Personnel Security Program Management

AFI 31-601 29 Jun 05 Industrial Security Program Management

AFI 36-2251 5 Jun 09 Management of Air Force Training Systems

AFI 91-204 12 Feb 14 Safety Investigations and Reports

AFMAN 17-1303 10 Feb 17 Cybersecurity Workforce Improvement Program

AFMPAM 63-128 10 Jul 14 Integrated Life Cycle Management

AFGM2016_16-01 21 Jan 16 Air Force Guidance Memorandum on Implementation of Authoritative Data Sources for Live, Virtual, and Constructive Operational Training (LVC-OT) Systems

Document # Revision Date Title

CNSS Instruction

27 Mar 14 Security Categorization and Control Selection for National Security Systems

DFARS 211.106 18 Nov 13 Purchase Descriptions for Service Contracts

DFARS 252.211-7003 Dec 13 Item Unique Identification and Valuation

DoDI 5200.02 Change 1 09 Sep 14 Personnel Security Program

DoDI 5200.44 Change 1 25 Aug 16 Protection of Mission Critical Functions to Achieve Trusted Systems and Networks

DoD 5220.22-M Change 2 18 May 06 National Industrial Security Program Operating Manual

(NISPOM)

DoDI 5230.24 Change 1 28 Apr 16 Distribution Statements on Technical Documents

DoDI 6055.01 14 Oct 14 DoD Safety and Occupational Health (SOH) Program

DoDI 8500.01 14 Mar 14 Cybersecurity

DoDI 8510.01 Change 1 24 May 16 Risk Management Framework (RMF) for DoD Information Technology (IT)

DoD 8570.01-M Change 4 10 Nov 15 Information Assurance Workforce Improvement Program

MIL-STD-882 E 11 May 12 Military Standard, System Safety Program Requirements

TO 00-35D-54 1 Sep 15 USAF Deficiency Reporting, Investigation, and Resolution

Table 3. Other Reference Publications

ANSI/EIA 632 1 Sep 03 Processes for Engineering a System

ANSI/EIA-836 B 26 Sep 15 Configuration Management Data Exchange and Interoperability

ASTM D3951-10 Standard Practice for Commercial Packaging

Federal Information Processing Standards (FIPS) Publication

Feb 04 Standards for Security Categorization of Federal Information and Information Systems

NIST SP 800-161 1 Apr 15 Supply Chain Risk Management practices for Federal Information Systems and Organizations

ISO/IEC/IEEE

15289:2015

21 May 15 Systems and Software Engineering

NIST 800-18 1 1 Feb 06 Guide for Developing Security Plans for Federal Information Systems

NIST SP 800-53 4 Apr 13 Recommended Security Controls for Federal Information Systems and Organizations

SAE AS5553A A 21 Jan 013 Fraudulent/Counterfeit Electronic Parts;

Avoidance, Detection, Mitigation, and Disposition

2.1.1 Order of Precedence in Contractual Requirements

In the event of a conflict between the text of this document and the references cited herein, the text of this document takes precedence. Nothing in this document, however, supersedes applicable laws and regulations unless a specific exemption has been obtained.

3.0 PERFORMANCE REQUIREMENTS

3.1 PROGRAM MANAGEMENT/SYSTEMS ENGINEERING

3.1.1 Program Management

The Contractor shall establish and implement a program management office function to manage all technical performance, reliability, maintainability, schedule, and data delivery requirements of the contract. The Program Manager shall serve as the main point of contact for this effort.

The Contractor shall plan and manage daily operations and activities associated with providing this requirement to ensure the necessary processes and activities are performed to provide an effective and acceptable system. The Contractor shall employ effective management tools and methods to assure control of cost, schedule, and performance.

The Contractor shall provide technical support to the program office throughout the duration of this effort. This includes post-installation support, which includes, but is not limited to:

development of engineering and technical data, responding to requests for technical assistance, and development of technical alternatives to remedy Government-identified issues. As needed, the Contractor shall conduct, support, or participate in program management and technical reviews, meeting, and conferences to ensure effective and efficient project execution.

The Contractor shall provide a master schedule, to include development, delivery, installation and test schedule, for Government review and approval, within six (6) weeks of award.

The Contractor shall be responsible for storage, staging, and deployment of any equipment and materials provided as part of this project, unless otherwise mutually agreed upon by the Government and the Contractor.

The Contractor shall submit a monthly status report (MSR) summarizing accomplishments, risks, travel, and any comments and/or concerns of note.

CDRL A001, DI-MGMT-80227/T, Progress Report

3.1.1.1 Risk Management

The Contractor shall implement an integrated risk management program. The Contractor shall perform continuous and comprehensive risk analysis efforts to identify, prioritize, and manage all risks. The Contractor shall propose alternatives to mitigate the effects of identified risks, and shall define criteria for initiation of alternatives. The Contractor shall provide the Government access to its risk management plan through the internet or Contractor’s electronic database. The Contractor shall present the risk status at the PMR.

The Contractor shall include Government-identified risks in their risk management program. The Contractor shall use Air Force Pamphlet 63-128, Chapter 12 as a guide to developing the risk management program.

3.1.1.2 Subcontractor Management

The Contractor shall manage and integrate subcontractors into the program in accordance with (IAW) the Program Management Plan (PMP). The Contractor shall ensure the requirements of this contract are consistently applied to all subcontracts and associate contracts. The Contractor shall ensure that subcontractors and vendors have incorporated necessary program elements ensuring compatibility of supplied equipment to any device being modified.

CDRL B0025, DI-MGMT-81797, Program Management Plan

3.1.2 Cost, Schedule, and Performance Control

The Contractor shall provide a contractor-format, cost burn-rate report, on a monthly basis. The cost report should be categorized into the following eight categories:

Program Management

COMS

Software Maintenance

Spares

Equipment

Representational

Relocation

Travel

The Contractor shall reflect total budget for each cost category, amount used as of report date, and burn-rate percentage.

3.1.3 Reviews and Meetings

3.1.3.1 Program Meetings

When practical, meetings may be conducted virtually (i.e., web-based, teleconference, Video Teleconference Communication (VTC), Defense Connect Online, etc.) as long as desired meeting/conference objectives can be achieved. Audio teleconference or VTC shall be available for all scheduled meetings.

When directed by the Government Program Office (GPO), the Contractor shall host, chair, or participate in meetings, including aircraft-associated meetings which impact the F-16 MTT Program, and provide minutes/trip reports for those same meetings. The Contractor shall provide agendas, briefing materials, and minutes for all F-16 MTT meetings that they host/manage. If the Contractor is running the meeting, the Contractor shall provide necessary briefing materials before the presentation begins.

All arrangements for meeting rooms, audio-visual equipment, etc., including room rentals, for Contractor-hosted F-16 MTT meetings, or GPO-requested “Government Only” meetings, shall be the Contractor’s responsibility.

3.1.3.1.1 Post Award Conference

A Post Award Conference (PAC) shall be held within thirty (30) calendar days after becoming 100% responsible for the contract at the TSSC. This conference shall introduce key participants, and identify points of contact. The PCO will lead the discussion so all parties understand the scope of the work. The Contractor shall document the PAC.

3.1.3.1.2 Program Management Review (PMR)

The Contractor shall support and document the results of F-16 MTT Program Management Reviews (PMRs), which will be conducted two (2) times a year. At a minimum, attendees will include the GPO, TSSC representative(s), and NGB/A3M.

3.1.3.1.2.1 PMR Content

The Contractor shall, at a minimum, address the following items at PMRs, though additional items may be added upon GPO direction and the Contractor may discuss other items. The Contractor shall clearly delineate items presented in the PMR that differ significantly from status provided in program Contract Data Requirements Lists (CDRLs).

Program Health. A discussion of the F-16 MTT program health and its current status in meeting device availability requirements.

The Contractor shall summarize program successes, as well as program issues, during the reporting period and discuss how they impact training. The summary shall emphasize benefits and impacts to the Government (i.e., cost, schedule, or technical benefits).

Action Item Status.

Risk Status. A discussion on program risks including current status of each program and project risk, the mitigation plans, and the recovery plans as appropriate. Each risk identified within the program shall be discussed with its current status, including trigger-point (i.e., the watch parameter for this risk that triggers when a risk is realized) information. All risks shall be discussed, even those risks assumed by the Contractor, as all risks can affect program performance as well. Each risk shall have a POC assigned.

Limitations on Subcontracting. The Contractor shall report their, as well as any subcontractors’, level of effort.

Site Status. Facility projects, device interface status and issues, and other site issues including site management and security.

ECP/CCP/DEV/1067s Status. Status on major ECP/CCP/DEV/1067 projects shall be presented. Status includes schedule and performance status and any blocks to completion.

Proposal Status. Proposal and Rough Order of Magnitude (ROM) cost status, as well as Contractor recommendations on training device modifications to maintain or improve training.

Trade Study Status. Status on any trade studies being developed or those already submitted.

Deficiency Report (DR) Status. Status on the program’s overall DR status. This includes in-scope, out-of-scope, and enhancement DRs. The status shall include the initial identification date, the original planned closure date, the current planned closure date, the responsible organization/personnel assigned, the current resolution status, the priority, brief description of the DR, and the impact if not closed.

Quality. Address quality issues.

Diminishing Manufacturing Sources (DMS). Status looking out at least one year.

Cybersecurity status and review: review ATO documentation, security plans, and processes at least annually for currency and applicability

Other issues identified by either the Contractor or the Government.

3.1.3.1.3 Monthly Program Teleconference

The Contractor shall arrange for and host a monthly teleconference to discuss program issues and concerns, including document deliveries, TSSC issues/concerns, Operational Site activities and limitations, Help Desk activities, Cybersecurity/Information Assurance, Logistics issues/concerns, and Program Action Item status.

3.1.3.2 Conferences, Evaluations, and Demonstrations

The Contractor representative shall attend other conferences when requested by the PCO. All conference travel costs shall be reimbursed via a no-fee cost reimbursable Contract Line Item Number (CLIN).

The Contractor shall provide manpower for booth exhibits and demonstrate the versatility and multiple-integration capabilities of products which are essential to the continued modernization of modeling and simulation.

The Contractor shall provide a trip report for every conference attended, no later than thirty (30) days after trip completion.

CDRL B0026, DI-MISC-81943, Trip/Travel Report

3.1.4 Quality Assurance

The Contractor shall provide NGB/A3M, AFRC/A3R and the Contracting Officer’s Representative (COR), and other Government personnel, as requested, access to all quality-related F-16 MTT records and data.

3.1.4.1 Quality Assurance (QA) Plan

The Contractor shall document processes to provide, implement, and maintain a F-16 MTT QA program applicable to all program and project efforts that are equivalent to one certified to ISO 9001:2008, as a means of ensuring that the requisite quality assurance oversight is exercised in fulfilling the requirements of this effort. The Contractor shall provide the program QA Plan as part of the PMP.

3.1.4.2 Quality Control Audits

The PCO designated COR will verify the Contractor’s performance at locations in Table 1. The COR will have access to the Contractor’s records/documentation to confirm contractual requirements are met before verifying and recommending payment for supplies/services rendered. The COR will use the Contract Field Service Report to verify Contractor performance.

The Contractor shall provide assistance during Government quality assurance inspections and audits upon request. The COR will document all discrepancies found during Government inspections, audits and surveillances on Corrective Action Requests (CARs).

3.1.4.2.1 Performance Standards and Performance Requirements Summary (PRS)

Table 5 provides the Services Summary (SS) portion of the F-16 MTT QA Surveillance Plan.

These SS elements shall be used to evaluate the F-16 MTT prime contract holders’ performance and success. The Contractor Performance Assessment Report (CPAR) will be used by the Government as a means to document the Contractor’s successful performance of these performance objectives. The Contractor shall adhere to the Performance Based Service Acquisition (PBSA) metrics set forth in Table 5.

Table 5. Performance Requirements Summary

SS

Performance

Objective Performance Threshold

Method of Surveillance

Remedy

SS-01

CDRL

Submissions Accurate and Complete

CDRLs pass first Government review 95% of the time at initial submission, as defined in the CDRL Re-submittal with correction of documents within 5 work days of notification

100% Inspection Re-performance

SS

Performance

Objective Performance Threshold

Method of Surveillance

Remedy

SS-02

TSSC

Operations

No more than 3 Government identified failures within a software release Correction of the problem/errors within 2 work days of notification

100% Inspection

Re-performance Document in

CPAR

SS-03

Training Device Availability

Deficiency corrected within (48 hrs of being notified of failure)

100% Inspection

Document in

CPAR

SS-04

Fidelity of Training Devices

Meet ARASQ Rev C, Level 1 SIMCERT anytime

SIMCERT

(semi-annually) Customer feedback

Decrement Availability Document in

CPAR

Discrepancy Record

SS-05

Training System Relocation – Minimal Device Damages Sustained

95% of all damages identified to be corrected within 5 calendar days of notification Remaining 5% corrected within 14 calendar days of original notification

Customer Complaint

Re-performance Document in

CPAR

SS-06

Program Security

100% Compliance with DoD and Air Force publications and instructions

Periodic Inspection

CAR

Re-performance Document in

CPAR

SS-07 Transition Follow Transition Plan IAW PWS requirement No deviation

100% Inspection

Re-performance Document in

CPAR

SS-

08*

Maintain, update, and keep master and site libraries current

No missing documents;

Documents current Outdated documents disposed of 99% accuracy correctable to 100% within 5 workdays of findings All baseline related documents include the version number or a reference to the correct baseline.

Annually Re-performance Document in

CPAR

SS-09

Device Modification Discrepancies

Correct modification discrepancies to 100% by modification delivery date

Test Procedures

CAR

Re-performance Document in

CPAR

3.1.5 Data Rights

All documentation, equipment and media, including all source material/files/etc., developed and/or maintained under this contract are the sole property of the Government, without any restrictions or limitations, upon delivery to and acceptance by the Government. The Contractor shall turn over all such materials to the Government at Government direction or at contract completion, expiration, or termination, using applicable CDRLs as guides.

3.1.5.1 Proprietary Data

No proprietary hardware or software shall be included in any modifications or updates to the F- 16 MTT Training System, unless specifically identified by the Contractor and approved by the PCO. At a minimum, the Contractor shall provide Government-use rights for all new hardware or software development and modifications. The Contractor shall maintain existing proprietary hardware or software to ensure current capabilities, and shall replace with Commercial Off-the-Shelf (COTS) when modifications to the system allow.

3.1.5.2 Electronic Data

The Contractor’s electronic data management system shall provide the Government the capability to download, review, comment and approve Contractor-generated data, with an appropriate audit trail.

3.1.5.3 Design Data

For modifications (i.e., ECPs or TSSC tasks), the Contractor shall be responsible for the collection of all design data necessary to comply with the requirements of the contract. The Contractor shall enter into agreements with any required Contractor to obtain the necessary data.

The Contractor and GPO team shall be responsible for generating alternatives if the data is not available.

The Contractor shall maintain the design data and other required data to ensure that F-16 MTT configuration is tracked as changes occur and that training system hardware/software baselines are clearly traceable to specific data or revisions thereto. The data and changes that occur shall be reviewed by the Contractor to determine their impact. The Contractor shall identify the changes, and discuss the impact with the Government for GPO approval at the next Training System Configuration Working Group (TSCWG). The Contractor shall not use proprietary data unless approved by the Government.

3.1.6 Contractor and Government Furnished Items and Responsibilities

3.1.6.1 Contractor Furnished Items and Responsibilities

Unless otherwise stipulated, the Contractor shall furnish or provide all personnel, personnel management and supervision, all related internal supporting business functions (including background and “overhead” personnel), materials, supplies, equipment, and facilities to perform the full range of technical and administrative services required by this contract. The Contractor shall provide appropriate facilities, support, office and technical equipment and supplies, and services for any off-site support related to this contract.

The Contractor shall be required to acquire property in support of the services of this contract.

Contractor Acquired Property (CAP) is defined as property procured by the Contractor, whereby the Government has TITLE after reimbursement for the cost of the CAP. CAP shall be handled in accordance with the instructions in the clause at FAR 52.245-1.

3.1.6.2 Government Furnished Property/Equipment/Information (GFP/E/I)

The Government will provide access to the appropriate Government-owned reference materials, facilities, and equipment necessary in the performance of this effort. As appropriate, the Government will provide the necessary materials and services that include, but are not limited to:

workspace, Government-networked computers or laptops, telephones, secured containers, and SIPRNET terminals at Government facilities, required for contractor personnel performing tasks on this contract.

Any property furnished by the Government during the life of this contract shall be tracked by the Contractor. This includes any hardware, software, or supplies that the Contractor shall acquire, install, maintain and provide at the direction of the Contracting Officer in order to accomplish the specified tasks. At completion of this contract, all Government-Furnished Equipment, including all items purchased through this contract, shall be returned to the Government or incorporated into final deliveries or products.

The Government will provide oversight of the classified security program at Government facilities. As part of the oversight activity, the Government will provide the Contractor access to Government facilities/areas that house the F-16 MTT device, and perform security container custodian responsibilities that include, but are not limited to, granting contractor personnel access to security containers. The Government will authorize the Contractor to facilitate the transfer of classified information to the Government activities, and performance of secure area end-of-day security checks.

In addition, the Government will provide access to all Government facilities as necessary, including sponsorship for access to non-Government facilities, for execution of all contractor tasks.

If additional GFP/GFE is required, the contractor shall forward a request to the Government at least thirty (30) days before the need date. All GFE or GFP shall be returned, or incorporated into the deliverables upon completion of the effort.

3.1.6.3 Handling and Safeguarding of Government Property

The Contractor shall manage Government property IAW Federal Acquisition Regulations (FAR) 45.105. The Contractor shall track and store property, equipment, and information in a secure location IAW the Government Property Clause. The Contractor shall protect Government assets to prevent damage during the time the Contractor has possession.

3.1.6.3.1 Property Damage

When mishaps (Ref AFI 91-204) involving Government property associated with the F-16 MTT program occurs, the Contractor shall report the accident or incident as soon as possible, but no later than 24 hours following the event, to the COR, via email, regardless of the time of day. The

Contractor shall assist in securing the scene and the damaged item(s) until released by the accident investigative authority as designated by the local Safety Office.

If the Government elects to conduct an investigation of the accident, the Contractor shall cooperate fully and shall assist Government personnel until the completion of the investigation.

The Contractor shall include a clause in each of its subcontracts which shall require subcontractor cooperation and assistance in accident reporting and investigation.

3.1.6.3.2 Government Property Disposal/Disposition

By direction of the PCO or COR, the Contractor shall turn over spares, support equipment, and other assets that are no longer serviceable IAW the contract and the current FAR Part 45.6 provisions. If approved by the GPO, the Contractor shall dispose of identified material through the Plant Clearance Automated Reutilization Screening System (PCARSS) process. This includes shipment of material to the disposal site(s) as directed by the Plant Clearance Officer.

If PCARSS is unavailable to the program, the Contractor shall transfer or dispose of items via processes approved by the GPO and/or local base authorities.

The Contractor shall process all items through PCARSS which are no longer required by the program and determined to be excess (e.g. removed as a result of a modification).

The Contractor shall prepare the items for disposal (i.e., removal of classified, sensitive, recyclable or precious materials, etc.), and transport the components to the location determined by the Plant Clearance Officer.

3.1.6.4 Hazardous Materials

The Contractor shall manage Hazardous Materials, including those embedded in the system or used during operation or maintenance, as an element of the Systems Engineering process. The training system shall not generate or use Class I or Class II Ozone Depleting Substances during operation or disposal.

The Contractor shall comply with the host installation hazardous material management (applicable when hazardous materials are used during operations and maintenance activities), hazardous waste disposal (applicable when system operation or maintenance activities generate a hazardous waste), Voluntary Protection Program, and fire safety requirements.

The Contractor shall be responsible for the proper handling, storage, transportation, and disposal of all hazardous waste resulting from performance on this contract IAW AFI 32-7042 and the host base directives and guidelines, if operating on a Government installation.

3.1.7 Environment, Safety, and Occupational Health (ESOH)

The Contractor shall comply with the Occupational Safety Health Act (Public Law 91-596) and specific health and safety requirements identified in this PWS. The Contractor shall comply with the health and safety rules of the local Government installation not directly addressed in this PWS. The Contractor shall comply with DoDI 6055.01, DoD Safety and Occupational Health (SOH) Program.

The Contractor shall take reasonable steps and precautions to prevent accidents and preserve the health and safety of Contractor and Government personnel performing or in any way coming in contact with the performance of the requirements as defined in this PWS. The Contractor shall take additional immediate precautions identified by the government (e.g. PCO, COR, or local Safety Office) for health and safety purposes.

3.1.7.1 System Safety

The Contractor shall establish, document and update a System Safety Program IAW MIL-STD-882E and best commercial practices. At a minimum, the Contractor shall comply with Sections 3 and 4 IAW MIL-STD-882E, and apply other sections as required. The Contractor shall identify and prioritize hazards.

The Government reserves the right to identify additional hazards and report them to the Contractor for resolution. The Contractor shall analyze, eliminate, and minimize hazards.

Designs shall comply with ESOH laws and regulations and AFI 91-203 to minimize threats to the environment and minimize safety and health hazards to all personnel using or maintaining the equipment, whether the system equipment is in an operative or non-operative state, for the life cycle of the system.

The Contractor shall ensure that the system safety designed into the training system devices shall not be degraded or compromised. The Contractor shall assess and summarize all risks assumed during test and operation, identify safety features of the system, and specify procedural controls to be followed. The Contractor shall provide a supporting site safety checklist which establishes steps for the prompt investigation, correction and tracking of safety and health violations and/or uncontrolled hazards in Contractor work areas.

3.1.8 Packaging, Handling, Storage, and Transportation (PHS&T)

The Contractor shall be responsible for packaging, handling, labeling, and shipment of F-16 MTT equipment such as spares, software, and consumables via appropriate modes of transportation. The Contractor shall identify and manage any items requiring special handling and/or movement procedures which may include hazardous, classified/sensitive, oversize/outsize, electrostatic sensitive device items, or precious metals.

The Contractor shall ensure packaging data identifies ESD sensitive items and assemblies as defined in MIL-STD-1686C and hazardous materials per CFR 49.

Shipments of classified/sensitive material or equipment shall be handled, transported, transmitted and protected IAW the National Industrial Security Program Operating Manual, DoD 5220.22-M.

The Contractor shall comply with ASTM D3951-10 and MIL-STD-129R for marking when commercial packaging is specified. The Contractor shall provide PHS&T data to the Government for new and modified items when the packaging data has changed. The Contractor shall provide transportation data for new items or for modified items IAW FAR 52.247-53. The Contractor shall be responsible for the transportation of these items IAW DD Form 1653. The Contractor shall ensure shipped items are protected from the hazards of handling equipment and shall be transportable IAW MIL-STD-1366E.

3.1.9 Program Security

The Contractor shall comply with local base standards for safety and security, and shall maintain security for all facilities they occupy/manage IAW host base security requirements.

The Contractor shall protect For Official Use Only (FOUO) and classified material from unauthorized access. The Contractor shall report all security violations and/or anomalies immediately to the COR and GPO.

The Contractor shall ensure system security plans to support the routine operation and maintenance of F-16 MTT components at the collateral SECRET level IAW CAF DMO security requirements. CAF DMO security requirements are outlined in the Security Standards of the current CAF DMO Standards.

3.1.9.1 Acquisition Systems Protection

3.1.9.1.1 Acquisition Program Security

The Contractor shall ensure security program requirements are integrated into all program areas of this contract as required by the following:

a. DoD Directive (DoDD) 5000.01, The Defense Acquisition System

b. DoD Instruction (DoDI) 5000.02, Operation of the Defense Acquisition System

c. DoDI 5200.39, Critical Program Information (CPI) Identification and Protection within

Research, Development, Test, and Evaluation (RDT&E)

d. DoDI 8500.01, Cybersecurity

e. DoDI 8510.01, Risk Management Framework (RMF) for DoD Information Technology (IT)

f. Committee on National Security Systems Instruction (CNSSI) 1253

g. AFI 17-101 Risk Management (RMF) for Air Force Information Technology (IT)

h. AFI 63-113, Program Protection Planning for Life Cycle Management

i. NIST SP 800-37, Guide for Applying the Risk Management Framework to Federal

Information Systems

j. NIST 800-53r4, Security and Privacy Controls for Federal Information Systems and

Organizations

3.1.9.1.2 System Security

3.1.9.1.2.1 System Security Plan (SSP)

The Contractor shall develop and maintain an overall program System Security Plan (SSP) IAW the OTI AO job aid for RMF implementation. The Security Plan provides an overview of the security requirements for the system, system boundary description, the system identification, common controls identification, security control selections, subsystems security documentation (as required), and external services security documentation (as required). The System Security Plan can also contain, as supporting appendixes or as references, other key security-related documents such as a risk assessment, privacy impact assessment, system interconnection agreements, contingency plan, security configurations, configuration management plan, and incident response plan.

If there is already an existing security plan and ATO, the TSSC will review for updates. The Contractor shall submit a draft System Security Plan to the Government no later than ninety (90) days after contract award. The Contractor shall perform final submission after receiving Government comments on the draft SSP. If no comments are received within thirty (30) days, the draft shall be considered approved as the final System Security Plan.

The Contractor shall develop, maintain, and implement all procedures for cryptographic keying material loading (if applicable), as directed by the Government.

The Contractor shall provide a separate system for classified data management in Contractor facilities with oversight by Defense Security Service (DSS) or other approved authority. On DoD installations, the Contractor shall utilize approved DoD systems for classified data management.

Management of classified/sensitive material/equipment shall be handled, transported, transmitted and protected IAW the National Industrial Security Program Operating Manual (NISPOM), DoD 5220.22-M, and DD Form 254.

Note: If there is a conflict between DD Form 254 and this PWS, the DD Form 254 shall take precedence. If a conflict is found, the Contractor shall immediately contact the PCO.

The SSP must be finalized no later than ninety (90) days before an ATO submission. If the SSP plan is updated, the Contractor will ensure the SSP reflects the current system security plan, configurations and practices.

3.1.9.1.2.2 Vulnerability Management Plan (VMP)

The Vulnerability Management Plan (VMP) outlines the complete cycle of identification, classification, remediation, and mitigation of vulnerabilities. Vulnerability management includes patching, tracking, and testing.

For new programs without existing/prior program documentation, the Contractor shall submit a draft Vulnerability Plan to the Government no later than ninety (90) days after contract award.

The Contractor shall perform final submission after receiving Government comments on the draft VMP. The VMP must be finalized no later than ninety (90) days before an ATO submission. If the VMP process is updated, the Contractor will ensure the VMP reflects the current vulnerability management process.

3.1.9.1.2.3 Other System Security

The Contractor shall develop, maintain, and implement all procedures for cryptographic keying material loading (if applicable), as directed by the Government.

The Contractor shall provide a separate system for classified data management in Contractor facilities, with oversight by DSS or other approved authority. On DoD installations, the Contractor shall utilize approved DoD systems for classified data management. Management of classified/sensitive material/equipment shall be handled, transported, transmitted and protected IAW the National Industrial Security Program Operating Manual (NISPOM), DoD 5220.22-M, and DD Form 254.

Note: If there is a conflict between DD Form 254 and this PWS, the DD Form 254 shall take precedence. If a conflict is found, the Contractor shall immediately contact the PCO.

3.1.9.1.3 Information Security

The Contractor shall execute the training system program IAW DoD 5220.22-M, National Industrial Security Program Operating Manual (NISPOM), DoD Instruction 5200.01, and the DoD Information Security Program. The Contractor shall comply with all security requirements as identified in the DoD Contract Security Classification Specification (DD Form 254). The DD Form 254 takes precedence over requirement stated in this PWS. The Contractor shall protect classified or sensitive materials and data received or generated as a part of the execution of this contract.

3.1.9.2 Industrial Security

The Contractor shall comply with the requirements of the National Industrial Security Program Operating Manual (NISPOM), DoD 5220.22-M and AFI 16-1406 in management of the contract.

3.1.9.3 Physical Security

The Contractor shall be responsible for ensuring that all mandated physical security requirements from the DD 254 and DoD 5220.22-M are met. The Contractor shall enforce local, AF, and DoD instructions on controlled and prohibited items inside the secure area.

3.1.9.3.1 Contractor Facility Physical Security

The Contractor shall provide physical security in all Contractor facilities utilized to perform this contract. The Contractor shall safeguard all Government property and data provided for Contractor use. At the end of each workday, the Contractor shall secure Government equipment, materials, and data.

3.1.9.3.2 Contractor Physical Security of Government Facilities

The Contractor shall be responsible for ensuring all mandated physical security requirements are met. The Contractor shall brief personnel on their responsibilities regarding maintaining physical security, including Open Storage documentation and approval, as required.

The Contractor shall enforce local, USAF, and DoDIs on controlled and prohibited items inside the secure area. At the end of each workday, the Contractor shall secure Government facilities, equipment, and materials local directives. The Contractor shall grant access to other Contractors, as required (e.g., for the performance of modifications, maintenance, and inspections) during times directed by the GPO.

3.1.9.3.2.1 Access Control System

The Contractor shall use the site access control system established and managed by the facility security officer (FSO) for entry control system to the F-16 MTT training/support facilities.

3.1.9.3.2.2 Government Facilities Key and Combination Control

Keys issued to Contractor personnel shall not be used by unauthorized persons or duplicated without authorization. The Contractor shall reimburse costs, such as replacement locks or re-keying locks, which resulted from Contractor negligence.

3.1.9.3.2.3 Contingency Procedures for Government Facilities

The Contractor shall provide security in the event of a security system malfunction at secure training facilities when Contractor personnel are on-site. The Contractor shall comply with base requirements for all real world FPCON levels. When required by real world FPCON levels, the Contractor shall secure the training facilities IAW base directives and control entry into those facilities IAW base plans unless relieved by U.S. military personnel.

The Contractor shall comply with FSO guidance during all exercises.

3.1.9.4 Personnel Security

The Contractor shall ensure the requirements for granting access to classified information are met, as defined in the following:

a. AFI 16-1404, Personnel Security Program Management

b. DD Form 254, DoD Contract Security Classification Specification

c. DoDM 5200.01 Vols 1-4, DoD Information Security Program Manual

d. DoDI 5200.02, DoD Personnel Security Program (PSP)

e. DoD 5220.22-M, National Industrial Security Program Operating Manual (NISPOM)

All Contractor personnel must obtain and maintain a Department of Defense security clearance at the SECRET level as a condition of employment. The Contractor shall obtain and maintain a JPAS account.

3.1.9.4.1 Security Training

3.1.9.4.1.1 Program Protection Awareness Training

The Contractor shall ensure that each Contractor/subcontractor employee completes Program Protection awareness training before performing any contract work and completes required annual refresher training throughout the period of performance. The Contractor/subcontractor shall maintain a listing by name and title of each Contractor/subcontractor employee working under this contract that has completed the required training.

3.1.9.4.1.2 Cybersecurity Contractor Training and Certification

The Contractor shall ensure that personnel accessing information systems have the proper and current cybersecurity certification to perform cybersecurity functions IAW DoD 8570.01-M.

The Contractor shall meet the applicable cybersecurity certification requirements, including:

DoD-approved cybersecurity workforce certifications appropriate for each category and level as listed in the current version of DoD 8570.01-M.

Appropriate operating system certification for cybersecurity technical positions as required by DoD 8570.01-M.

The Contractor/subcontractor shall maintain a listing by name and title of each Contractor/subcontractor employee working under this contract that has completed the required training. Upon request by the Government, the Contractor shall provide documentation supporting the cybersecurity certification status of personnel performing cybersecurity functions.

Contractor personnel who do not have proper and current certifications shall be denied access to DoD information systems for the purpose of performing cybersecurity functions.

3.1.9.5 Operational Security (OPSEC)

The Contractor shall apply Operations Security (OPSEC) principles and practices to reduce program vulnerability from successful adversary collection and exploitation of critical information. The Contractor shall participate/comply with the Base/Operating location’s OPSEC plans.

The Contractor shall provide an analysis of current and future security requirements, as necessary, and implement/maintain OPSEC procedures for all program and project efforts at all levels of necessary classification IAW DoD 5220.22-M and as listed on DD Form 254.

3.1.9.6 Cybersecurity

The F-16 MTT, when connected to CAF DMO, is categorized as: Confidentiality (Moderate), Integrity (Low), Availability (L). Currently no training or maintenance management systems are connected to the F-16 MTT.

The Contractor’s Cybersecurity Program shall be managed through the Risk Management Framework (RMF) consistent with the principles established in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-37 and IAW DoDI 8510.01. The Contractor shall analyze and implement, as necessary, security controls IAW the Information Technology Determination and Categorization (ITDC) for the F-16 MTT data types and CAF DMO network connectivity requirements.

The Contractor shall integrate Cybersecurity into the overarching Systems Engineering process as well as Cybersecurity events and activities included on the F-16 MTT master schedule. The Contractor shall identify, manage, and verify Cybersecurity requirements, including Cybersecurity controls, in the same manner as all other system requirements, to ensure traceability.

Cybersecurity controls shall be evaluated IAW the latest OTI Job Aid for RMF Implementation and baseline priorities as documented in the OTI RMF Portal (https://cs.eis.af.mil/sites/10382/SitePages/Home.aspx). Security controls shall be implemented through Systems Engineering Technical Processes as follows: stakeholder requirements definition, requirements analysis, architecture design, implementation, integration, verification, and validation. The Contractor shall document any cybersecurity related baseline changes and ensure adequate testing to minimize any potential impact to the functional performance of the simulator.

The Contractor shall continue to implement the DoD best practices of Cybersecurity which include confidentiality, integrity, availability, authentication, and non-repudiation. Cybersecurity requirements shall be integrated into the overall Test and Evaluation (T&E) process.

Cybersecurity risks shall be identified and managed as part of the overall program risk management process (consisting of cost/schedule/performance risks).

The Contractor shall support Cybersecurity Impact Evaluations (CIE) package for system modifications and reaccreditation as required for major upgrades affecting the Cybersecurity posture of the system. In the test environment, the Contractor shall analyze and potentially implement and report compliance status for applicable security patches, including commercial patches, for the products installed on the baseline. These results from the test environment shall be implemented in production/sustainment under coordination with the program office and Information System Security Manager (ISSM) in order to maintain concurrency.

The Contractor shall deliver required artifacts via eMASS for ISSM review and submittal to the Authorizing Official (AO) IAW https://cs1.eis.af.mil/sites/lvcao/Expected%20Artifacts/Home.aspx, part of the OTI Authorizing Official Support Site. An additional reference for the RMF process and artifact templates can be found at the RMF Knowledge Service website at https://rmfks.osd.mil/rmf/Pages/default.aspx.

3.1.9.6.1 Information System Security Officers (ISSO)

The Contractor shall appoint qualified personnel to serve as program Information System Security Officers (ISSOs). The ISSOs shall be responsible for performing a comprehensive evaluation of all aspects of the security features of the F-16 MTT Cybersecurity Program and shall ensure that F-16 MTT site implementation meets established security requirements.

Currently, for the F-16 MTT program, there is a Contractor ISSO at the TSSC performing Information Assurance Technical (IAT) Level II (IT Security Engineer) duties. At the typical unit, the COMS shall provide oversight of the cybersecurity.

The Contractor IAT II ISSO should have access to a simulator for testing and remediation of applied security measures before they are deployed and installed on the sites’ simulators.

Ideally, testing and remediation would occur at the TSSC, but the ISSO location could be (most) anywhere that the contract dictates provided that the ISSO can fulfill their duties (and support a classified system).

3.1.9.6.1.1 Certification Requirements

Individuals shall possess a DoD-approved cybersecurity baseline certification commensurate to category and level of the assigned position IAW DoD 8570.01-M, AFI 17-130, AFI 33-210 and AFMAN 17-1303. DoD approved listing can be found at https://iase.disa.mil/iawip/Pages/iabaseline.aspx.

Any ISSM/ISSO/IT administrator…