ISSM PWS.pdf

i

PERFORMANCE-BASED WORK STATEMENT (PWS)

INFORMATION SYSTEM SECURITY MANAGER (ISSM

U.S AIR FORCE

2/5/2025 ii

TABLE OF CONTENTS

1 DESCRIPTION OF SERVICES

1.1 Background

2 SCOPE

3 BASIC SERVICES

3.1 Key Responsibilities

3.2 Requested Projects

3.3 Risk Management

3.4 Qualifications

4 SERVICE SUMMARY

5 CDRL SUMMARY

6 ADDITIONAL REQUIREMENTS

6.1 Government Furnished Property (GFP)

6.2 Period of Performance

6.3 Place of Performance

6.4 Monthly Status report

6.5 Personnel Roster

6.6 Manpower Reporting:

6.7 Network Access:

7 SECURITY

7.1 General Security Requirements

7.2 Security Clearance

7.3 Contractor Identification Badges and Access Cards

7.4 Controlled Area Badge Process

7.5 Communications Security (COMSEC)

7.6 Operations Security (OPSEC)

7.7 Security Incidents

8 GENERAL INFORMATION

8.1 Hours of Operation

8.2 Conservation of Utilities

Appendix A – Name of Appendix Appendix B – Name of Appendix Appendix C – SAFETY iii

1 DESCRIPTION OF SERVICES

The purpose of this Performance Work Statement (PWS) is to outline the requirements and expectations for Information System Security Manager (ISSM) labor services, which are necessary to manage the 76 Software Engineering Group SWEG organization’s cybersecurity policies, protocols, and compliance with federal and organizational regulations. The organization requires the ISSM’s expertise to maintain the Authority to Operate (ATO), to oversee its information system security programs, ensuring the confidentiality, integrity, and availability of critical information while enforcing compliance with pertinent regulatory standards. The ISSM shall serve as the primary authority on all security-related processes and shall respond to incidents, assess risks, and work proactively to protect the organization from cyber threats.

1.1 Background

The 76 SWEG operates in an environment where secure management of information systems is crucial to daily operations, long-term goals, and the safeguarding of sensitive data. As cyber threats grow in sophistication, 76 SWEG faces heightened risks from potential data breaches, regulatory pressures, and cybersecurity compliance requirements. In this context, the ISSM is essential for establishing and enforcing cybersecurity protocols that align with industry and regulatory standards. The ISSM is responsible for conducting risk management, establishing and enforcing policies, developing System Security Plans (SSP), and ensuring compliance with federal and industry security frameworks, such as National Institute Standards and Technology (NIST), Federal Information Security Management Act (FISMA), and Risk Management Framework (RMF). Moreover, the ISSM must be well-prepared to address emerging threats by maintaining up-to-date knowledge of cybersecurity developments, coordinating with other departments, and promoting a culture of security awareness across the organization. Through these ISSM labor services, the 76 SWEG aims to strengthen its cybersecurity framework to safeguard its digital assets and comply with evolving security regulations.

2 SCOPE

The contractor shall provide qualified ISSM personnel to execute duties and responsibilities associated with the ISSM role for 76 SWEG, and optionally a Linux system specialist. Each ISSM shall provide services that include, but are not limited to risk management, cybersecurity policy enforcement, system security assessments, compliance reporting, incident response, ATO maintenance, establish and maintain an information security management framework for cloud operations and on-premises network, to ensure the confidentiality, integrity, and availability of data in the cloud environment and on-premises networks. The contractor shall also develop and implement security policies, procedures and best practices, and provide employee training.

3 BASIC SERVICES

3.1 The contractor shall provide four qualified ISSM personnel to 76 SWEG to execute all duties and responsibilities associated with the ISSM role.

3.1.1 If optioned, the Contractor shall provide up to two additional ISSM personnel to

76 SWEG.

3.1.2 ISSM responsibilities are assigned by 76 SWEG Program Management teams where each ISSM supports by overseeing needed cyber security functions.

3.1.3 When required, the ISSM shall compile briefs, slides, and reports at the request of 76 SWEG Program Managers.

3.2 If Optioned, the Contractor shall provide 1 qualified Linux Specialist to 76 SWEG to train, monitor, and maintain Linux networks.

3.3 All contractor support shall be available during daytime office hours- which are set by the 76 SWEG Program Managers (reference paragraph 8.1).

3.4 ISSM Role:

3.4.1 Key Responsibilities

3.4.1.1 The Information System Security Manager (ISSM) is responsible for implementing and overseeing a comprehensive range of information security functions within 76 SWEG. A core component of the role is to conduct regular risk assessments to identify potential vulnerabilities in the organization’s information systems, then analyze these vulnerabilities to develop and implement strategies that mitigate security risks.

3.4.1.2 When tasked by the 76 SWEG Program Manager, the ISSM shall develop, maintain, and enforce cybersecurity policies and procedures that align with federal and organizational standards, ensuring that all policies are current and effective against evolving cyber threats. This includes developing and maintaining System Security Plans (SSP) in compliance with National Institute of Standards and Technology Special Publication (NIST SP) frameworks, which outlines the Risk Management Framework (RMF) standards applicable to the organization.

3.4.1.3 The ISSM shall assist the 76 SWEG in maintaining compliance with federal and industry-specific security frameworks, such as NIST, FISMA, RMF, review and ensure all software/hardware being requested are approved for use within on-prem and network environments, and comply with all applicable government, DoD, Air Force, and local security regulations and policies. The contractor ISSM documents compliance processes through various continuous monitoring and recurring assessments. These cadences are not on a set schedule and are constantly changing to ensure adherence to cyber vulnerabilities.

3.4.1.4 The ISSM shall provide expert knowledge and guidance needed to help 76th SWEG obtain and maintain required Authority(s) to Operate (ATO). The contractor ISSM shall also provide the 76 SWEG personnel with an overview of the RMF Process and its applicability to software development enclaves. The contractor ISSM safeguards cyber security by ensuring the 76 SWEG personnel follow the RMF 7-step process in accordance with DoDI 8510.01 and AFI 17-101.

3.4.1.5 The contractor ISSM may be tasked by the 76 SWEG Program Manager to lead the development and execution of incident response plans, coordinating actions to swiftly detect, investigate, contain, and remediate security incidents. In response to any security event, the contractor ISSM shall oversee detailed reporting, investigation outcomes, and establish preventive actions to avoid future incidents. As part of ensuring the organization’s security posture, the contractor ISSM shall conduct periodic security audits and provide compliance reports, tracking all incidents and known vulnerabilities within the information systems. The role also includes the responsibility of educating and raising awareness among personnel about security protocols and policies, achieved through designing and delivering training programs that highlight both safe practices and emerging security threats. The contractor ISSM shall conduct regular testing and evaluations of security controls to assess their effectiveness, identifying areas for security enhancements, and providing recommendations accordingly.

3.4.1.6 The contractor ISSM shall deliver RMF artifacts for inclusion in RMF packages, develop, manage, and update System Security Plan, Security Control Traceability Matrix and A&A packages for related enclaves, and post updates in the appropriate document repository such as eMASS or other file system. The ISSM shall also assist Government program management in reviewing all cybersecurity documents as required for RMF process. The Contractor ISSM shall provide the draft Security Assessment Plan, Risk Assessment Report, and Cyber Security Strategy for approval, provide analysis and comments on the Security Assessment Report, and ensure the use of the most current RMF templates of the cybersecurity process.

3.4.1.7 Following any security incident, the Contractor ISSM may be requested to assist in Incident Response Documentation that includes a comprehensive account of the incident, details of the investigation, actions taken, and preventive measures implemented to minimize future risk. The contractor ISSM shall also assist in the Annual Compliance Review, giving a thorough analysis of the organization’s adherence to applicable security frameworks, including NIST, FISMA, and RMF, with any identified gaps and suggested improvements.

3.4.1.8 When tasked by 76 SWEG Program Managers, the Contractor ISSM shall identify areas where all Air Force (AF) cybersecurity policies, procedures, and countermeasures have not been implemented and make recommendations for improving cybersecurity policies and processes.

The Contractor ISSM shall also employ best practices when selecting security controls, including software engineering methodologies, system/security engineering principles, secure design, secure architecture, and secure coding techniques.

3.4.1.9 Meeting slides: When tasked by 76 SWEG Program Managers, these documents should be produced with any information required for that specific meeting. All contractor-generated meeting slides shall include the Contractor’s company name and logo on headers and shall use company slide formatting. The Government reserves all ownership and data rights of documents generated under this contract. (CDRL)

3.4.1.10 Papers: When tasked by 76 SWEG Program Managers, the Contractor shall develop documents including point papers, decision papers, white papers, and recommendations from studies, analysis, and RMF artifacts.

These papers should provide detailed information on specific topics, issues, or initiatives and should be produced in a timely manner to support decision-making processes. All Contractor-generated papers and reports shall include the Contractor’s company letterhead. The Government reserves all ownership and data rights of documents generated under this contract.

3.4.2 Risk Management:

3.4.2.1 The Contractor ISSM shall conduct regular risk assessments, analyze potential vulnerabilities, and implement strategies to mitigate security risks.

3.4.2.2 When tasked by the 76 SWEG Program Manager, the Contractor ISSM shall develop, maintain, and enforce information security policies and procedures aligned with federal and organizational standards.

3.4.2.3 The Contractor ISSM shall develop, update, and maintain system security plans in accordance with NIST SP 800-37 and other applicable guidelines, ensuring compliance with relevant security frameworks, such as NIST, FISMA, RMF, and any other applicable security standards.

3.4.2.4 When tasked by the 76 SWEG Program Manager, the Contractor ISSM shall lead the development and execution of incident response plans, including detection, investigation, containment, and remediation of security incidents.

3.4.2.5 When tasked by the 76 SWEG Program Manager, the Contractor ISSM shall conduct periodic security audits, provide compliance reports, and track all incidents and vulnerabilities within the organization’s information systems.

3.4.2.6 When tasked by the 76 SWEG Program Manager, the Contractor ISSM shall design and implement training programs to educate personnel on security policies, potential threats and safe practices, perform testing and evaluation of security controls, and provide recommendations for security enhancements. This training would be on an as needed basis in response to any kind of security incident or new process/policy.

3.4.3 Qualifications

3.4.3.1 Minimum Qualifications

3.4.3.1.1 Each Contractor ISSM shall:

• Possess a minimum of five (5) years of experience in information security management within a government or corporate setting

• Maintain a Top-Secret security clearance

• Meet and maintain access to Special Access Programs (SAP)

• Meet the necessary qualification requirements outlined in DoDM 8140.03

• Familiarity with federal cybersecurity frameworks, including NIST, FISMA, and RMF is essential

• Strong analytical and communication skills are required, as the Contractor ISSM shall be responsible for communicating complex security concepts to both technical and non-technical stakeholders within the organization.

• Have experience in collaborating with stakeholders and interfacing with multiple teams.

3.4.3.2 Desired Qualifications

3.4.3.2.1 The ideal candidate for this role shall have the following:

• Extensive experience in applying security principles to all stages of the system development lifecycle.

• Have experience in conducting information system security control assessments, creating risk assessment reports, and directing risk management practices for an organization.

• Have experience in building an RMF Body of Evidence (BOE) and achieving an Authority to Operate (ATO).

• The Contractor ISSM should demonstrate a high level of proficiency in risk assessment, incident response, and compliance reporting, which are critical to identifying and mitigating cybersecurity threats in a proactive and efficient manner. Strong analytical skills are necessary to assess potential vulnerabilities and devise strategic mitigation measures, while excellent communication skills are essential for conveying complex security concepts to both technical and non-technical stakeholders across the organization. This expertise enables the Contractor ISSM to serve as an effective liaison between technical security teams and leadership, fostering an environment of security awareness and adherence to cybersecurity policies throughout the organization.

• Have experience with managing and utilizing Security Event and Incident Management (SEIM) products, as well as utilizing Cybersecurity analysis tools to detect and report findings.

• Have a master’s degree and 10 years of Information Assurance experience work, or a bachelor’s degree with 18 years of Information Assurance experience work, or 22 years total of Information Assurance experience work.

• The Contractor should be highly proficient with eMASS, having formal RMF training certification, and experience with Air Force operational systems.

• Have experience obtaining ATO for SAP information systems, experience with project management tools and practices, and experience with creating cybersecurity reports and briefing leadership team.

3.4.3.3 The Contractor shall provide at least one ISSM with desired requirements. A statement from the Contractor certifying all ISSM contractors meet the minimum qualifications shall be included in the personnel roster. The personnel roster shall also identify which ISSM meets the desired qualifications.

3.5 Linux Specialist Role (when optioned)

3.5.1 Key Responsibilities:

3.5.1.1 The Linux Specialist shall provide insight and training as a Subject Matter Expert (SME) helping the 76 SWEG meet operational goals and objectives.

3.5.1.2 When tasked by the 76 SWEG Program Manager, the Linux Specialist shall assist with the following:

3.5.1.3 Installing, configuring and maintaining Linux operating systems

3.5.1.4 Performing system maintenance by reviewing error logs

3.5.1.5 Creating system backups

3.5.1.6 System configuration and troubleshooting

3.5.1.7 Monitoring and performance optimization

3.5.1.8 Security management

3.5.1.9 Disaster recovery planning

3.5.1.10 Fine-tuning performance and ensuring Linux infrastructure availability

3.5.1.11 Creating infrastructure monitoring and reporting tools

3.5.1.12 Creating and keeping configuration management solutions up to date

3.5.1.13 Creating test automation frameworks

3.5.1.14 Creating tools to assist teams in making the most of the available infrastructure

3.5.1.15 Working with vendors and other IT personnel for technical design, implementation and problem resolution

3.5.1.16 Coordinating with other departments to ensure on-time delivery of fully tested and compatible devices that meet product requirements

3.5.2 Taskings and assignments shall be made by the 76 SWEG Program Manager.

3.5.3 A registry of all taskings and assignments shall be included and updated in each Monthly Status Report.

3.5.4 Qualifications

3.5.5 The Contractor shall provide a Linux Specialist with the following qualifications:

3.5.5.1 Five Years experience as a Linux Systems Specialist.

3.5.5.2 Red-hat Certified System Administrator or equivalent.

A statement from the Contractor certifying that the Linux Specialist meets all of the above requirements shall be included in the personnel roster.

4 SERVICE SUMMARY

PWS

Paragraph

Performance Objective Performance Threshold

3.1 Required ISSM personnel are

provided and available to support

76 SWEG cyber security functions.

Acceptable when each ISSM personnel is available for 90% of working office hours each month.

3.2 (if optioned) Linux Specialist is provided to support 76 SWEG Program Management teams.

Acceptable when Linux Specialist is available for 90% of working office hours each month.

3.4.1.2, 3.4.1.5, 3.4.1.8, 3.4.2.2, 3.4.2.3, 3.4.2.4, 3.4.2.5, 3.4.2.6

ISSM tasking from 76 SWEG program management teams are accepted and completed

Acceptable when 100% of tasking is acknowledged or accepted each month.

3.4.1.9 ISSM Meeting Slides are completed Acceptable when 95% of Meeting Slides are completed per tasking each month.

3.4.1.10 ISSM Papers are developed Acceptable when 95% of Papers are developed per tasking each month.

3.4.2.2 ISSM Risk Management standards are

met for developed security plans Acceptable when 95% of Risk

Management plans follow NIST SP 800-37 and other standards per tasking.

EMETT, JAMES R CIV USAF AFMC AFSC/SWP-C

Need a list of LINUX minimum qualifications

EMETT, JAMES R CIV USAF AFMC AFSC/SWP-C

@ Angela- is this measurable? Is there a better way to measure this?

3.4.3.1 Contractor validates each ISSM meets

minimum qualifications

Acceptable when 100% of provided ISSM personnel meet all minimum qualifications and are certified by the contractor in the Roster.

3.4.3.3 Contractor validates one ISSM meets

the desired qualifications

Acceptable when at least one of the provided ISSM personnel meets

80% of the desired qualifications and is certified by the contractor in the

Roster.

3.5.1.2 (if optioned) Linux Specialist support function tasking is completed Acceptable when 95% of support function tasking is completed per tasking each month.

3.5.2 (if optioned) Linux Specialist tasking from 76 SWEG program management teams are accepted and completed

Acceptable when 100% of tasking is acknowledged or accepted each month.

3.5.5 (if optioned) Linux Specialist meets minimum qualifications Acceptable when Linux Specialist meets 100% of minimum qualifications.

5 CDRL SUMMARY

Contract information data shall be delivered electronically in accordance to the corresponding requirement for each Data Item listed in Table 5-1 (below). The contractor shall have no more than one error per quarter for all CDRL submittals. The contractor shall submit CDRLs according to the due date indicated and have no more than one CDRL per quarter submitted after the identified due date. Grammatical errors do not count as an error. Substantive mistakes shall be corrected within two working days and corrective action taken to prevent recurrence of inaccurate late CDRLs.

Table 5-1

Exhibit Title PWS Paragraph

Delivery

A001 Meeting Slides 3.4.1.9 Reference CDRL A002 Papers 3.4.1.10 Reference CDRL A003 Monthly Status Report 6.4 Reference CDRL A004 Personnel Roster 6.5 Reference CDRL

6 ADDITIONAL REQUIREMENTS

6.1 Government Furnished Property (GFP)

The organization will provide Government Furnished Equipment (GFE) to contractor personnel to enable them to perform their duties effectively. This equipment will include AFNET NIPRNet workstations or laptops, depending on the environment in which contractors personnel will be working. In addition, contractor personnel will have access to AFNet SIPRNET computers and accounts, as well as eMASS at Tinker Air Force Base. Access to other specialized computers and networks may also be provided, depending on the specific requirements of the environment being supported. The provision of this equipment will ensure that contractor personnel has the necessary tools and resources to carry out their duties and responsibilities effectively.

6.2 Period of Performance

The period of performance shall be for one base year, and four (4) one-year option periods, contingent upon satisfactory performance and ongoing need.

6.3 Place of Performance

6.3.1 Place of performance will be at Tinker Air Force Base, OK. Telework limited by environment. Situational telework only when expressly authorized by the 76 SWEG Program Manager by email with the COR in cc.

6.3.2 Travel: Travel may be required under this contract. Contractor personnel will be notified in advance when travel is required by the 76 SWEG Program Manager.

6.3.3 Prior to incurring any travel expenses, the contractor shall obtain written approval from the COR approving the travel dates, expected duration, origin and destination, purpose, estimated costs as well as names of each traveler. The government allowance for travel and per diem will be used as a guide for acceptable travel costs. Reimbursement for travel will be in accordance with FAR Part 31.205-46. Copies of all travel receipts as well as an itemized breakdown of costs claimed must be attached in WAWF to ensure timely invoice approval.

6.3.4 A travel report for each occurrence of travel performed during the reporting month shall be included in the Monthly Status Report.

6.4 Monthly Status Report

6.4.1 These reports shall provide an update on the status of on-going efforts related to this contract. The Contractor shall update the report each month and provide it to the 76 SWEG Program Manager and the COR. (CDRL)

EMETT, JAMES R CIV USAF AFMC AFSC/SWP-C

What does this mean?

EMETT, JAMES R CIV USAF AFMC AFSC/SWP-C

@ Angela �Thoughts?

6.4.2 One Monthly Status Report is required for each calendar month during the duration of the contract.

6.4.3 The Monthly Status Report shall be delivered in MS Word or PDF format to the 76 SWEG Program Manager, COR, and any other government stakeholders (as dictated in advance by 76 SWEG Program Managers) via email. Each report is due by the 5th calendar day of the following month with the exception of the final monthly status report, which is due 3 business days before the end of the contract period of performance.

6.4.4 The report shall include the following:

6.4.4.1 List of personnel assigned to the contract and shall identify the Contractor Lead with any other relevant contractor points of contact.

6.4.4.2 A list of taskings assigned to the contractor as well as an update on progress.

6.4.4.3 Identified ongoing and upcoming risks that may affect contractor performance.

6.4.4.4 Additional contract related content at the advance request of the 76 SWEG Program Manager or the COR.

6.4.4.5 Reports on travel.

6.4.4.6 Running financial accounting and invoicing history for this contract.

This should include a running burn-down of costs including all travel costs.

6.4.5 The report shall include any relevant metrics or data to support the status update.

6.4.6 The Contractor is encouraged (but not required) to include a listing of Contractor successes.

6.5 Personnel Roster

6.5.1 The Contractor shall submit a Personnel Roster to the COR within fifteen (15) business days after award of contract. If there is any change to the roster, the contractor shall submit an updated roster to the COR within 3 business days of the change.

6.5.2 The roster shall include names, roles, phone numbers, and email for each person assigned to this contract. The roster shall also include a statement certifying that each of the provided personnel fulfilling roles meet requirements listed in Paragraphs 3.4.3 or 3.5.4. (CDRL)

6.5.3 If there is a change in personnel (i.e. contract personnel leaves the company or is reassigned to another contract), the Contractor shall provide a qualified replacement within 15 business days of the contractor leaving this contract. In this case, two roster updates may be required: one for the personnel departing and one for the replacement.

6.6 Manpower Reporting

6.6.1 The Contractor shall report ALL Contractor labor hours (including sub-contractor labor hours) required for performance of services provided under this contract via a secure data collection site. The Contractor is required to completely fill in all required data fields at http://www.SAM.gov

6.6.2 Reporting inputs shall be for the labor executed during the period of performance for each Government fiscal year (FY), which runs 1 October through 30 September. While inputs may be reported any time during the FY, all data shall be reported no later than 31 October of each calendar year. Contractors may direct questions to the Contractor Manpower Reporting Application (CMRA) help desk.

6.6.3 Uses and Safeguarding of Information: Information from the secure web site is considered to be proprietary in nature when the contract number and Contractor identity are associated with the direct labor hours and direct labor dollars. At no time will any data be released to the public with the Contractor name and contract number associated with the data. User Manuals: Data for Air Force service requirements must be input at the ECMRA link. User manuals for Government personnel and Contractors are available at the ECMRA link at http://www.SAM.gov

6.7 Network Access

6.7.1 The Contractor must meet the same security requirements as government employees for access to TAFB's network or Automated Information Systems

(AIS).

6.7.2 For those contractor employees who require government computer access only, a National Agency Check with written Inquiries (NACI) must be accomplished through the government.

6.7.3 Contractor employees shall complete Network User Licensing Computer Based Training (CBT) per AFI 33-115 Volume 2, paragraph 5.4.

6.7.4 Contractor employees requiring a government provided e-mail account shall annually complete the Information Assurance Awareness training. Interim access may be granted by Designated Approving Authorities only after submission of the NACI and favorable finger print determination has been received by the applicable security manager.

6.7.5 Contractors who no longer need network or AIS access shall report within 3 business days to the appropriate security manager and the Functional System Administrator.

6.7.6 The contractor understands that any contractor employee may be summarily and immediately removed from or denied access to any government property, facility, and installation at the sole discretion of competent government authority if that authority determines such action is necessary to protect or preserve government property, safety and security, or to maintain good order and discipline.

7 SECURITY

7.1 General Security Requirements

7.1.1 The contractor shall comply with all Security, Force Protection, and Antiterrorism requirements. The contractor shall comply with local unit in- and out-processing procedures for all contractor personnel to ensure proper security-related briefings and debriefings are accomplished. Specific in- and out-processing checklists may be included at the task order level.

7.1.2 The contractor understands that any contractor employee may be summarily and immediately removed from or denied access to any Government property, facility, and installation at the sole discretion of competent Government authority if that authority determines such action is necessary to protect or preserve Government property, safety, and security, or to maintain good order and discipline.

7.2 Security Clearance

7.2.1 The contractor shall be required to obtain security clearances for all of their employees. In addition, the contractor shall be required to obtain a facility clearance of TOP SECRET. A DD Form 254 will be required for contract.

7.2.2 Contractor personnel performing work under this contract shall have an active TOP SECRET security clearance at time of award and shall maintain this level of security clearance through the entire period of performance.

7.3 Contractor Identification Badges and Access Cards

7.3.1 The contractor shall contact the 76 SWEG Security Office who will assist with submitting a completed AFPC/DP3SA MP-ICAM Form, to receive a CAC at the RAPIDS/DEERS Office.

7.3.2 Contractor employees approved for a CAC will require sponsorship, contract owner will sponsor contract employee onto the installation through Pass and ID (Building 6611) to be issued a base pass to go to the RAPIDS/DEERS Office.

7.3.3 During performance of the contract, the contractor shall be responsible for obtaining required identification for newly-assigned personnel. Upon the termination or completion of the contract, or in the case of an employee who no longer requires access to the work site, the contractor shall be responsible for promptly returning credentials to the Security Forces Pass and Registration Office. All badges need to be returned prior to finale invoice submission.

7.3.4 Lost badges shall be reported to the 76 SWEG Security Officer within one working day of the badge being lost. The contractor shall return all badges to the 76 SWEG Security Manager upon contract completion.

7.4 Controlled Area Badge Process

7.4.1 While in the Restricted Areas, contractor employees shall display the access badge in a holder, furnished by the contractor company, between the shoulders and above the waist and in the front of the body whenever inside an identified controlled area.

7.4.2 Training will be sent to the contractor, by the group SM initially and annually, to their respective email addresses. The Contractor shall complete the training and send an email back to the Group SM that it is complete. Training is scheduled by the Group SM and will be tracked for annual retraining.

7.4.3 Lost Badges or Access Cards shall be reported to the 76 SWEG Security Office within one working day of loss. After receiving a Lost Identification Letter a new Form 2586 will be issued. The contractor must carry all forms to building 6611 to be issued a new badge then return all forms to the 76 SWEG Security Office.

7.5 Communications Security (COMSEC)

7.5.1 All communications with DoD organizations are subject to COMSEC review.

7.5.2 The DoD authorizes the military departments to conduct COMSEC monitoring and recording of telephone calls originating from, or terminating at, DoD organizations.

7.5.3 The contractor shall adhere to COMSEC procedures any time they place a call to, or receive a call from, a DoD organization.

7.5.4 The contractor shall ensure wide and frequent dissemination of the above information to all employees dealing with official DoD information.

7.6 Operations Security (OPSEC)

7.6.1 Contractors who have access to Tinker Air Force Base, 76 SWEG facilities, or critical information shall be trained on OPSEC, human relations, and security education and motivation within 90 days after initial assignment IAW AFI 10- 701 para. 4.1-4.2. Initial training will be provided by Group SM, with recurring annual training. The contractor shall immediately comply with Installation and Group OPSEC programs.

7.6.2 Public release of any information is not authorized and, if requested, will comply with Public Affairs and all other OPSEC measures to ensure the best balance of lawful disclosure for the American public and denial of advantage for U.S.

adversaries.

7.6.3 No photography or videotaping is allowed on the installation without approval from the owning organizations Group Director/Commander on an approved photography letter from 76 SWEG Security Manager.

7.6.4 Critical Items/Information shall not be discussed outside normal contract conditions. A Critical Items/ Information List (CIL) can be provided and should not be considered all inclusive.

7.6.5 Controlled Unclassified Information (CUI) generated by the contract, and its employees, shall ensure protective measures are applied. ALL DoD unclassified information must be reviewed and approved for release before it’s provided to the public IAW DoDD 5230.09, Reference J.

7.6.5.1 Disclosure of information is prohibited for release of unclassified information to the public without approval of the contracting activity.

7.6.5.2 The contractor shall comply with CUI requirements detailed in DoDM 5200.01-V4, DoD Information Security Program: Controlled Unclassified Information (CUI).

7.7 Security Incidents

Should a security incident occur, the contractor shall:

7.7.1 Immediately report to the site location Group Security Manager and COR all available facts related to each instance.

7.7.2 Take such precautions as the Security Manager may reasonably require for security purposes.

7.7.3 Take reasonable and prudent action to establish control of the scene, prevent further violation, and to preserve evidence until released by proper authority.

7.7.4 Cooperate fully and assist Government personnel as the Government conducts an investigation of the violation.

7.7.5 Participation shall last until the investigation is complete.

8 GENERAL INFORMATION

8.1 Hours of Operation

8.1.1 Normal Hours of Operation: The contractor shall perform the services required under this contract during the following hours: Monday through Friday with the core hours at the discretion of the Program Manager – EXCEPT FEDERAL HOLIDAYS and other base closures.

8.1.2 Federal Holidays: Unless otherwise required by the Government, the contractor shall not have access to the Government facilities on the following federal holidays: New Year’s Day, Martin Luther King’s Birthday, Washington’s Birthday, Memorial Day, Independence Day, Juneteenth, Labor Day, Columbus Day, Veterans’ Day, Thanksgiving Day, and Christmas Day. If a holiday falls on Saturday, it is observed on Friday and working hours are Monday through Wednesday for that week. If the holiday falls on a Sunday, it is observed on Monday. Any other circumstances that may prompt base closure, such as Days of National Mourning, may also restrict opportunity to perform the exchanges. In the event of a base closure, exchanges shall be performed on the next business day. There may also be up to six AFMC Goal Days and four Wingman Days per year awarded to Government civilian employees, as well as possible weather related days and Government directed holidays. On these days, the contractor shall not generally be required to work and the Government shall not be billed for work not performed.

8.1.3 Down Days/Weather Days: The 76 SWEG Program Manager, COR or Contracting Officer will notify the contractor when official notice has been given for Energy/Weather Down days. If no telework is authorized, the contractor is not expected to work on any Energy/Weather Down days.

8.1.4 Rescheduling: Down Days/Weather days may be rescheduled if conditions/emergency operations require.

8.2 Conservation of Utilities

The contractor shall instruct their employees in utilities conservation practices. The contractor shall be responsible for operating under conditions which prevent the waste of utilities.

APPENDIX A – NAME OF APPENDIX

APPENDIX B – NAME OF APPENDIX

APPENDIX C – SAFETY

SAFETY, FIRE PROTECTION AND HEALTH

SPECIFICATION

INDUSTRIAL SAFETY REQUIREMENTS

OGDEN AIR LOGISTICS COMPLEX

UNITED STATES AIR FORCE

HILL AIR FORCE BASE, UTAH 84056

Kip Fatigue Testing

20 Oct 2021 Reviewed by:

Kim Zike

OO-ALC/SE

801-775-3957

Control Number: KZ211001

A. Safety Program Requirements

The contractor shall implement a safety program plan that ensures protection of Government personnel and property. (CDRL A004) The program shall consist of, as a minimum:

1. Mishap reporting, as defined in paragraph B1 below.

2. A Safety Plan that addresses, as a minimum, the subjects listed in Section II –Specific Requirements, and shall be used during the performance of the work described in the contract. The Safety Plan shall be approved by OO-ALC/SE (Safety Office) prior to commencement of any work described in this contract.

3. Routine and recurring surveillance to ensure the safety requirements of this contract are enforced.

4. Competent personnel to provide surveillance of the Safety Plan.

5. Identification of segregated work site locations for operations that cannot be co-mingled with general industrial operations and the process for ACO approval of operations and changes at these specific sites.

6. All contractor personnel shall be trained and qualified to perform their duties safely.

EMETT, JAMES R CIV USAF AFMC AFSC/SWP-C

From the ESDS contract:

Safety and Health on Government Installations: While performing work under this contract the Contractor shall comply with all applicable federal, state, and local and the specific Air Force regulations (as applicable) regarding occupational safety and health addressed in the PWS. During the execution of the contract the Contractor shall notify the CO, COR, and Government Contract Administrator (CA) within one (1) business day of any damage to Government property where the dollar value exceeds $500,000.00 and within two (2) work days, for any damage to Government property less than $500,000.00. The Contractor shall notify the (CO) within one (1) business day of any injury to contract personnel which occurs while on a Government installation.

Mishap notifications shall contain, as a minimum, the following information:

• Contract, Contract Number, Name and Title of Person(s) Reporting

• Date, Time and exact location of accident/incident

• Brief Narrative of accident/incident (Events leading to accident/incident)

• Cause of accident/incident, if known

• Estimated cost of accident/incident (material and labor to repair/replace)

• Nomenclature of equipment and personnel involved in accident/incident

• Corrective actions (taken or proposed)

• Other pertinent information

1.26.1 If requested by the designated CO, the Contractor shall immediately secure the mishap scene/damaged property and impound pertinent maintenance and training records, until released by the Procuring Safety Office. Contractors will not dispose of contract data related to a mishap until notified to do so by the CO.

Applicable Regulations and Air Force Instructions:

29 CFR 1910 OSHA Standards for General Industry AFI 91-203 Air Force Consolidated Occupational Safety Instruction AFI 91-207 THE US AIR FORCE TRAFFIC SAFETY PROGRAM 12 Sep 2013

AFI 31-218 AIR FORCE MOTOR VEHICLE TRAFFIC SUPERVISION

1.26.2 While on a government installation the Contractor shall be required to follow applicable installation traffic safety regulations and any applicable safety requirements required by the work center supervisor as it pertains to execution of the contract while in the work center; these may include but are not limited to general personal protective equipment such as safety glasses, hearing protection, and hard hats. The Contractor shall comply with base/shop emergency procedures for fire, tornado etc.

1.27 Communicating Hazards Of Workplace (CHOW): Contractor’s onsite representative communicates all hazards being introduced to the worksite by the Contractor. This is accomplished prior to commencement of work and refreshed daily during performance, IAW Contractor’s Site Safety Plan.

1.28 Safety and Health Plan: The Contractor shall be responsible for compliance with the OSHA Public Law 91-596. The Contractor shall submit a Safety and Health Plan (SHP) and corresponding site safety checklist to the CO and the COR (see Appendix C)

7. The contractor shall include a clause in all subcontracts requiring the subcontractors to comply with the safety provisions of this contract, as applicable.

B. Mishap Notification

1. The contractor shall notify OO-ALC/SE (801-777-3972) or the Hill AFB Command Post (801-777-3007) after normal duty hours, and the designated Government Representative (GR), i.e., the ACO, PCO, or DCMA QAR (Quality Assurance Representative) within one

(1) hour of all mishaps or incidents at or exceeding $2,000 (material + labor) in damage to DOD property entrusted by this contract, even if the government is wholly or partially reimbursed. This notification requirement shall also include physiological mishaps/incidents. A written or email copy of ALL the mishap/incident notification shall be sent within three calendar days to the GR, who will forward it to OO-ALC/SE. For information not available at the time of initial notification, the contractor shall provide the remaining information no later than 20 calendar days after the mishap, unless extended by the ACO.

Mishap notifications shall contain, as a minimum, the following information:

(a) Contract, Contract Number, Name and Title of Person(s) Reporting

(b) Date, Time and exact location of accident/incident

(c) Brief Narrative of accident/incident (Events leading to accident/incident)

(d) Cause of accident/incident, if known

(e) Estimated cost of accident/incident (material and labor to repair/replace)

(f) Nomenclature of equipment and personnel involved in accident/incident

(g) Corrective actions (taken or proposed)

(h) Other pertinent information

2. The contractor shall cooperate with any and all government mishap investigations.

Additionally if requested by government personnel or designated government representative (GR), i.e., the ACO, PCO, or DCMA QAR (Quality Assurance Representative), the contractor shall immediately secure the mishap scene/damaged property and impound pertinent maintenance and training records, until released by safety investigators.

3. The contractor shall provide copies of contractor data related to mishaps, such as contractor analyses, test reports, summaries of investigations, etc. as necessary to support the government investigation.

4. The contractor shall support and comply with the safety investigation and reporting requirements of DAFI 91-204, Chapters 1 – 5.

C. General Safety Requirements:

If the safety plan is modified, the contractor shall submit the proposed modification, in writing, to the Contract Administration Office safety representative.

The contractor is solely responsible for compliance with all federal, state and local laws, the Occupational, Safety and Health Act (OSHA) (Public Law 91-596) and the resulting standards, OSHA Standards 29 CFR 1910 and 1926, as applicable, Air Force Occupational Safety and Health Standards (AFOSH STD), to include AFMAN 91-203, Air Force Occupational Safety, Fire, and Health Standards, DAFI 91-204, Safety Investigations and Reports, Contract Safety, and the protection of their employees.

Additionally, the contractor is responsible for the safety and health of all subcontractor employees.

The contractor shall ensure assigned personnel are adequately trained and qualified for the task being performed. Brief all personnel on the hazards involved with operations and applicable precautions to be taken. Should unidentified hazards arise, cease operations until actions are taken to eliminate or mitigate hazards to safe levels.

Compliance with OSHA and other applicable laws and regulations for the protection of contractor employees is exclusively the obligation of the contractor. Note:

AFOSH STDs are annotated because many of the Air Force Standards exceed the OSHA standard criteria. If a conflict is noted, the most stringent requirement takes precedence.

The government shall assume no liability or responsibility for the contractor's compliance or non-compliance with such requirements. The contractor shall furnish to each of his/her employees a place of employment, which is free from recognized hazards. The contractor shall brief his/her employees on the safety requirements of this contract and on hazards associated with prescribed tasks. The contractor is responsible for compliance with OSHA Public Law and the resultant standards identified within. In addition, the contractor is required to flow down the safety requirements/specification to all subcontractors. This applies to Federal Acquisition Regulation (FAR) 12 commercial acquisitions as well. This contract shall in no way require persons to work in surroundings or under working conditions which are unsafe or dangerous to their health. The contractor must coordinate and perform work so as not to impact the safety of government employees or cause damage to government property. This requires providing personnel with protective equipment and associated safety equipment as may be necessary. The contractor must also protect personnel from hazards generated by the work. If the contractor employs BILINGUAL speaking employees, they must post bilingual signs and have written procedures for specific tasks in applicable languages.

SECTION II – SPECIFIC REQUIREMENTS

The contractor’s prepared Safety Plan shall:

http://www.osha.gov/pls/oshaweb/owasrch.search_form?p_doc_type=STANDARDS&p_toc_level=0

• Provide contact information for on-site personnel

• Include a work hazard analysis of the worksite and operations to be performed to include baseline hazard identification and required control measures

• Identify employee safety and health training requirements and the documentation process

The contractor shall ensure that each element identified below is adequately addressed in detail in the safety and health plan:

PEDESTRIAN CROSSWALKS: All contractor personnel are required to use the closest crosswalk, or traffic controlled intersection when crossing the road. Pedestrians must look both ways to ensure the coast is clear before stepping out into the crosswalk. Pedestrians DO NOT have the right of way unless they are already in the crosswalk. Contractor vehicle operators have the same responsibilities as pedestrians, to share the road and mutually observe and yield to pedestrians.

MOTOR VEHICLES: Contractor shall comply with the standards in: DoD Directive 5525.4, Enforcement of State Traffic Laws on DoD Installations", Nov 2, 1981, Para 3-4;

DODI 6055.4, DoD Traffic Safety Program, 20 Jul 99; AFI 91-207, USAF Traffic Safety Program, 22 May 07; Each applies to all persons at any time on an Air Force Installation and includes all leased, owned, or privatized property including housing areas. In addition:

AFI 13-213, Airfield Management, 29 Jan 08, Paragraphs 1.3.6 and 4.4.2.1 applies to all contractors, sub-contractors, vendors, commercial delivery companies, and all other private business vehicles who operate anywhere on Hill Air Force Base, including the airfield (to include the industrial areas and any buildings or hangars located upon the airfield) in support of their mission.

HOUSEKEEPING: Housekeeping shall be conducted according to the requirements in OSHA Standard 29 CFR 1910.141. CLEAN AS YOU GO will be enforced.