DRAFT TO-0002 - Program Security SOW.pdf

Section C - Descriptions and Specifications

F-35 JOINT PROGRAM OFFICE (F-35 JPO) / SERVICES ACQUISITION TEAM (SAT)

PROGRAM SECURITY SUPPORT SERVICES

SINGLE AWARD - INDEFINITE DELIVERY / INDEFINITE QUANTITY (ID/IQ)

TASK ORDER 0002

STATEMENT of WORK (SOW)

12 AUGUST 2020

1.0 OVERVIEW

The F-35 Lightning II Program (also known as the Joint Strike Fighter Program) is a joint, multi-national program and is the Department of Defense's (DoD) focal point for defining affordable next generation strike aircraft weapon systems among the United States (U.S.) Air Force (USAF), U.S. Navy (USN), U.S. Marine Corps (USMC), and U.S. allies composed of seven (7) cooperative international partners: the United Kingdom, Italy, Netherlands, Canada, Australia, Denmark, and Norway. The program’s objective is to develop and deploy the F-35 Air System (AS), a three (3) variant family of highly common and affordable 5th Generation strike fighter aircraft that meets the operational needs of the USAF, USN, USMC, and cooperative partner international services.

Additional production of the F-35 is made through Foreign Military Sales (FMS). The F-35 Enterprise is defined as, but not limited to: Air Vehicle (AV), AS, AS Ground Support, Support Equipment (SE) Systems, Depot Maintenance, Business, Flight Test, and Training Systems. The F-35 security team has a mature Program Protection Plan (PPP), robust policies and procedures and established SAP facilities throughout the world. Requirements continue to evolve as the program matures and the F-35 security team is responsible for ensuring that any new security challenges are appropriately identified and safeguarded In Accordance With (IAW) DoD regulations and specifications.

2.0 SCOPE

The F-35 Joint Program Office (F-35 JPO) requires program security support services to support its critical mission of developing, deploying and sustaining the next generation strike fighter aircraft. The Program Security Support disciplines consist of Program Management, General Security Support, Information Security Support, Industrial Security Support, Physical Security Support, Personnel Security Support, Counter-Intelligence Support, Special Security Studies, Foreign Disclosure Support, Program Protection Cybersecurity/Security Control Assessment Services and Program Protection Engineering Services. The Program Security Support services encompass the management and control of controlled unclassified information (CUI), DRAFT https://hub.jsf.mil/sites/OCIO/win10

Page | 2 collateral/general service (GENSER) information, Special Access Program (SAP) information, North Atlantic Treaty Organization (NATO) information, Critical Nuclear Weapons Design Information (CNWDI) and Sensitive Compartmented Information (SCI). This is an Indefinite Delivery/Indefinite Quantity (ID/IQ) contract which sets forth the conditions and clauses under which future acquisitions between the parties shall be governed. This Task Order (TO) will be used as a means of providing security services to the F-35 JPO.

3.0 PERFORMANCE REQUIREMENTS

The Contractor shall furnish the necessary personnel, skills, material, and other services as required to perform the following tasks. All tasks shall be performed in accordance with applicable security regulations and policies including, but not limited to, those referenced at Attachment 1.

All documentation created by the Contractor shall be free of grammatical, syntax and format errors prior to submission to Government security leads. The following tasks may be in support of Continental United States (CONUS) and/or Other than Continental United States (OCONUS). The tasks are not assigned to any one specific security business area, and are intended to provide maximum flexibility and support to the enterprise.

3.1 Provide Project Management. The contractor shall provide project management under this task order, including but not limited to the following tasks:

3.1.1 Provide management and oversight of all activities performed by contractor personnel, including subcontractors, to ensure all F-35 Program Security Support services satisfy the requirements identified in this PWS

3.1.2 Gather and provide all data for deliverables as detailed in Section 7.0

3.1.3 Provide management, direction, administration, quality assurance, and leadership of the execution of this TO

3.1.4 Organize, direct, and manage contract operation support functions, involving multiple, complex, and inter-related project tasks

3.1.5 Manage teams of contract support personnel at multiple locations

3.1.6 Maintain and manage the client interface at the senior levels of the client organization and serve as the primary interface and point of contact with Government program authorities and representatives on technical and program/project issues

3.1.7 Meet with Government and contractor personnel to formulate and review task plans and deliverable items

3.1.8 Ensure conformance with program task schedules and costs

3.1.9 Direct efforts of cross-competency team(s) to include contractors at multiple locations

3.1.10 Oversee contractor personnel program/project operations by developing procedures, planning and directing execution of the technical, programming, maintenance and administrative support effort and monitoring and reporting progress

3.2 Provide General Program Security Support. The contractor shall provide general program security support under this task order. This includes performing activities related to general security standard discipline management and support, including but not limited to the

Page | 3 following tasks:

3.2.1 Provide Administrative Security Support.

3.2.1.1 Maintain recall rosters, organizational charts, and contact cards for Security personnel to no less than 95% accuracy within two business days of notification of change; any errors must be corrected within one business day to 100% accuracy

3.2.1.2 Develop, maintain, update, and coordinate Security Operations Manuals (SOM), Standard Operating Procedures (SOP), Security Classification Guides (SCGs) and other Program Security generated documentation and publications

3.2.1.3 Maintain, update, and coordinate Access Management Control Plan (AMCP), Project Security Instruction (PSI), other International Security generated publications

3.2.1.4 Maintain, update, and coordinate Continuity Of Operations Plan (COOP), Occupant Emergency Plan (OEP), Emergency Action Plan (EAP) and all other Collateral Security generated publications

3.2.1.5 Assist in development of F-35 security policies and procedures IAW DoD policies and procedures and submit documentation to Government security leads

3.2.1.6 Distribute security policies and guidance to CONUS and OCONUS locations within five business days of final signature if available for electronic delivery.

3.2.1.7 Schedule, facilitate and attend security meetings, symposia and events

3.2.1.7.1 Secure conference space in accordance with Government-provided specifications and notify Government-provided list of stakeholders no later than (NLT) three business days prior to the meeting

3.2.1.7.2 Disseminate materials NLT one business day prior to start of meeting as long as all materials have been received by Government.

3.2.1.7.3 Schedule meeting and notify Government-provided stakeholders NLT three business days prior to meeting as long as notification has been received by the Government

3.2.1.7.4 Take meeting notes and action items, and disseminate created materials within two business days of meeting

3.2.1.8 Coordinate with Human Resources (HR) to ensure the security portion of onboarding/off-boarding is accomplished. Coordinate onboarding of security directorate new hires NLT one business day prior to onboarding

3.2.1.9 Coordinate, prepare and attend Security Program Management Reviews (PMRs)

3.2.1.9.1 Coordinate with site POC at determined location to facilitate access, including clearance, NLT one week in advance of PMR

3.2.1.9.2 Coordinate with JPO Security team to create agenda, send invitations and track attendance NLT three business days in advance of PMR

3.2.1.9.3 Create welcome packets NLT three business days and incorporate any Government updates NLT one business day prior to PMR

3.2.1.9.4 Take and disseminate notes and action items resulting from PMRs within 10 business days of PMR close

3.2.1.10 Coordinate Security Conference for International Security

Page | 4

3.2.1.10.1 Coordinate with site POC at determined location to facilitate access including clearances, access and foreign disclosure NLT 10 business days prior to start of event

3.2.1.10.2 Coordinate with JPO security team to create agenda, send invitations and track attendance NLT 10 business days prior to start of event

3.2.1.10.3 Create welcome packets NLT five business days and incorporate any Government updates NLT three business days prior to event

3.2.1.10.4 Take and disseminate notes and action items resulting from event within 10 business days of event close

3.2.1.11 Input, track and disseminate assigned tasks NLT one business day of new task creation and provide reports in prescribed JPO management tool

3.2.1.12 Maintain and update security mail groups and calendar on a business daily basis

3.2.1.13 Issue courier cards and provide appropriate courier training within two business days in routine courier situations (emergency courier situations may require completion of tasks within a few business hours)

3.2.1.14 Maintain and update security mail groups and calendar on a business daily basis

3.2.1.15 Monitor, control, and service post office box on a business daily basis

3.2.1.16 Distribute mail and packages to local security offices within same business day of receipt if received before/by noon and within one business day if received after noon

3.2.1.17 Coordinate and staff security policies and procedures for appropriate stakeholder signatures

3.2.1.18 Create and maintain on a business daily basis a central security document and file archive

3.2.1.19 Maintain and update data in all F-35 security database systems (Joint Access Database Environment (JADE), Joint Personnel Adjudication System (JPAS), local databases, SharePoint, etc.) on a business daily basis

3.2.1.20 Provide security customer service support and respond to all security inquiries within one business day

3.2.1.21 Provide technical writing guidance in compliance with appropriate publications and manuals and perform quality checks on all documents and packages being staffed for signature, ensuring incorporation of all corrections in first return of package

3.2.1.22 Participate in meetings and provide documented description of the meeting, results, tasks, action items and suspense dates, and track to completion

3.2.1.23 Provide off-duty phone support on rotational basis to ensure all calls are answered, dispositioned, and Government security leads notified

3.2.2 Provide Security Incident Inquiry Support.

3.2.2.1 Conduct and assist Government security leads with security incident inquiries IAW with established guidance referenced at Attachment 1, as well site specific policies and procedures (e.g. those specific to international sites)

3.2.2.2 Provide recommendations to Government security leads on updates to overall security-related policies and procedures and assist in development of F-35 JPO-specific security policies and procedures

Page | 5

3.2.2.3 Develop and manage a mechanism to provide 100% accountability and disposition of security incidents

3.2.2.4 Analyze security incidents across the organization to identify trends and provide and implement corrective measures

3.2.2.5 Assist the containment and sanitation of any security incident determined by the Government to involve sensitive information. Provide documentation of the security incident and the actions taken to secure the information to Government security leads

3.2.2.6 Coordinate with the F-35 JPO Information System Security Manager (ISSM) to ensure the F-35 JPO Security Incident Guide is available, effective, and up to date

3.2.3 Provide System Engineering and Technical Assistance (SETA) Support.

3.2.3.1 Collaborate with Government security leads and Subject Matter Experts (SMEs) to develop and provide specific security training (e.g. Indoctrinations, Commander Call, International/Country Specific, Anti-Terrorism Force Protection) as identified by Government security leads

3.2.3.2 Track and provide data on a monthly basis to Government security leads on training status for all assigned F-35 JPO personnel

3.2.3.3 Coordinate, through Government and commercial channels, SETA products which shall be posted strategically across all JPO spaces to increase security awareness

3.2.3.4 Develop and disseminate a security newsletter for the enterprise within one month of identification of need by Government security leads. The topics, layout, and length of the newsletter must be approved by Government security leads prior to posting/dissemination

3.2.3.5 Provide attendee roster to Government security leads, including contact information, NLT three (3) business days following training event

3.2.4 Provide CONUS and OCONUS International Security Support.

3.2.4.1 Provide multi-disciplined security guidance and mentorship to F-35 Partner and Foreign Military Sales (FMS) security professionals as coordinated with Government security leads

3.2.4.2 Provide continuous evaluation of F-35 Partner and FMS security posture and provide written updates on security posture within three business days of request to International Security Manager, Program Security Officer, assigned International Security Specialist, and others as designated by Government security leads

3.2.4.3 Assist F-35 Partner and FMS security professionals in developing country-unique security documents to ensure protection of F-35 assets at the appropriate level

3.2.4.4 Assist JPO Security Team with developing and staffing country-unique security documents for Senior JPO leadership such as Country Security Assessment Letters in accordance with military communication tools such as the Tongue and Quill. Country Security Assessment Letters shall be updated at a minimum

Page | 6 the first Friday of every month (to be completed the business day prior if the first Friday is a holiday)

3.2.4.5 Coordinate with cybersecurity and foreign disclosure professionals on all pertinent security matters

3.2.4.6 Provide planning and on-ground support to air shows and fighter competitions in support of F-35 JPO equities (most frequently in support of FMS/partners but also can be part of General Security Support)

3.2.4.7 Submit Country Map for each partner and FMS nation showing F-35 related locations, to include information such as that related to facilities and security personnel, ensuring all information is accurate and complete, no later than the second Friday of every month (to be completed the business day prior if the second Friday is a holiday)

3.2.5 Provide Operational Security (OPSEC) Support.

3.2.5.1 Assist F-35 JPO Government security leads in identifying critical information and developing the Critical Information List, providing guidance on the risk management process, and identifying possible countermeasures

3.2.5.2 Assist JPO leadership to develop and implement OPSEC measures (through the identification of critical information, threats, risks, and countermeasures) to protect unclassified aspects of classified F-35 JPO operations and information and sensitive unclassified information related to the F-35 JPO and its operations

3.2.5.3 Perform risk management and risk analysis, and assist in the development of risk reporting tools such as matrices, registers and handling plans

3.2.6 Provide Program Protection Support.

3.2.6.1 Coordinate with Program SMEs to develop and identify Critical Program information, Critical Components, and Critical Functions along with countermeasures to be employed for documentation within the Program Protection Plan (PPP)

3.2.6.2 Review all facets of the PPP no less than biannually for effectiveness and efficiency, and provide recommended enhancements to Government security leads

3.2.6.3 Conduct site visits to determine the degree of implementation and the effectiveness of the PPP. Provide guidance and recommendations based on best practices to increase the security posture and solicit feedback from the site

3.2.6.4 Assist Government security leads with tasks related to the Observables, Identification, and Containment (OI&C) Working Group

3.2.6.5 Review and evaluate Program Protection Implementation Plans (PPIP) for effectiveness and suggest enhancements

3.2.6.6 Coordinate with the appropriate organization(s) to implement horizontal protection measures for the Critical Program Information of any program the F- 35 JPO will utilize, as identified by Government security leads

3.2.7 Provide Special Access Program (SAP) Security Support.

Page | 7

3.2.7.1 Maintain communication across all F-35 JPO security offices and assist external sites with maintaining an appropriate security posture consistent with headquarters (site specific variations allowed per mission requirements and as approved by Government security leads)

3.2.7.2 Conduct Site Assistance Visits (SAV) at CONUS and OCONUS locations as directed by Government security leads

3.2.8 Provide Visitor Control Support.

3.2.8.1 Process all submitted visit certifications/visit requests within five business days of receipt through the approved systems. Visit certifications shall be completed at least three business days prior to the visit as long as all pertinent data has been provided

3.2.8.2 Manage all facets of the JPO badge and identification system/process with concurrence from the Government security leads

3.2.8.3 Develop and implement a process of introducing and removing equipment and media within secure areas

3.2.8.4 Collect, maintain, and close out all foreign travel reports within five business days of receipt of all pertinent information from traveler

3.2.9 Provide Analytical Security Support.

3.2.9.1 Identify and analyze program obstacles requiring resolution

3.2.9.2 Assess and recommend solutions to optimize security processes for a rapidly growing program, including automation, to ensure consistent security support

3.2.9.3 Develop and support continuous process improvement strategies and change management projects

3.2.9.4 Assist with the development of program lifecycle management including security contract requirements analysis, structured systems analysis and design, feasibility analysis, technology and software assessment, project planning and management, implementation and testing, technical and procedural documentation, user training, and post-implementation support

3.2.9.5 Utilize financial, organizational, analytical, and/or data management/modeling experience to populate and maintain databases

3.2.9.6 Identify emerging security requirements through review and analysis of user needs and develop recommended Courses of Action (COA) for security leadership review

3.2.9.7 Provide Special Security Studies: Special Studies may encompass a wide range of topics from unexpected pop-up requests from the executive leadership team to evaluate a security risk of a site, to process-related requests, to SME support to evaluate a new capability and assessment of the security ramifications of adding it to the program

3.3 Provide Information Security Support. The contractor shall provide Information Security support under this task order. This includes the management and oversight of all activities performed to support the protection of printed, electronic, or any other form of sensitive information from unauthorized access, use, misuse, disclosure, destruction, modification, or

Page | 8 disruption, including but not limited to the following tasks:

3.3.1 Provide Classification Management Support.

3.3.1.1 Coordinate activities for regular, comprehensive updates of Security

Classification Guides (SCG) and assist with identification of and tracking of appropriate SMEs to assist in SCG development, update and distribution

3.3.1.2 Develop a system to streamline the execution of the classification challenge process to increase utility and accuracy of F-35 JPO SCGs. Provide guidance on the process to F-35 JPO and support personnel as directed by Government security leads

3.3.1.3 Provide technical expertise and document in writing with detailed rationale recommendations regarding the classification of information and material, to include the complication of information and/or material to Government security leads

3.3.1.4 Review Public Release requests in coordination with the F-35 JPO Public Affairs team. Information and materials (or the complication thereof) must receive a classification determination prior to submission to the F-35 JPO Public Affairs Office for a Public Release determination

3.3.2 Provide Document Control Support.

3.3.2.1 Perform all document control duties associated with receipt, transmission, inventory, reproduction, disposition, and management of classified information. Records shall be accurate and digitally available at all times

3.3.2.2 Develop a system to provide 100% accountability of incoming and outgoing classified material which is accurate and digitally available at all times

3.3.2.3 Maintain document tracking log for Partner/FMS specific AMCP, PSI, SOP, Memoranda of Understanding (MOU), and other applicable documents

3.3.2.4 Prepare classified packages for transmission through mail, secure fax, or courier

3.3.2.5 Develop courier orders and transportation plans

3.3.2.6 Conduct courier missions as directed by Government security leadership

3.4 Provide Industrial Security Support. The contractor shall provide Industrial Security performed to support the protection of classified information developed by or entrusted to U.S industry operating under the National Industrial Security Program (NISP), including but not limited to the following tasks:

3.4.1 Provide Ship and Site Activation Team Security Support.

3.4.1.1 Brief and coordinate security requirements for USAF, USN, USMC, and international bed down sites and provide accurate data at all 35%, 65% and 95% design reviews

3.4.1.2 Communicate secure facility construction and accreditation technical security standards and provide accurate data at all 35%, 65% and 95% design reviews

3.4.1.3 Maintain and monitor security activities at bed down locations until facilities

Page | 9 receive accreditation

3.4.1.4 Identify security clearance and SAP access requirements at bed down locations

3.4.1.5 Assist the services in defining facility and infrastructure requirement to meet F-

35 bed down for all sites

3.4.1.6 Coordinate and participate in the development of CONUS and OCONUS

Facilities Requirements Documents (FRDs) and document results

3.4.2 Support Security Role in Supply Chain Risk Management (SCRM).

3.4.2.1 Assist F-35 JPO Security with the development and execution of a SCRM program

3.4.2.2 Assist JPO Security with preventing the introduction of parts with malicious intent by a foreign adversary to disrupt, disable, or render ineffective F-35 systems, document any identified vulnerabilities to the supply chain or individual critical components, and report to Government security leads

3.4.2.3 Conduct Critical Program Information (CPI) Assessments and Criticality Analyses to identify mission critical functions and Information and Communications Technology (ICT) critical components of the F-35 system elements

3.4.2.4 Evaluate and track SCRM Program and Implementation Plans of F-35 Program contractors involved in the supply chain

3.4.2.5 Assist in coordinating with external agencies (such as DCSA, DIA, AFOSI) for SCRM related assistance and information gathering/sharing, gather lessons learned and best practices, and provide to Government security leads

3.4.3 Assist with DoD Industrial Security Requirements.

3.4.3.1 Develop and maintain a database of all cleared defense contractors supporting the F-35 JPO and their compliance status, to include facility clearance and approved level of safeguarding. Records shall be accurate and digitally available at all times

3.4.3.2 Assist in coordination as directed by Government security leadership with SMEs at Government agencies such as Defense Counterintelligence and Security Agency (DCSA)

3.4.3.3 Satisfy all prerequisites to obtain and maintain a National Industrial Security System (NISS) account (or supporting system of record)

3.4.4 Provide DD-254 Management Support.

3.4.4.1 Draft DD-254s for prime contractors and/or subcontractors and update/revise existing DD-254s as changes occur. Staff draft DD-254s for Government security signature. Documentation shall be accurate and digitally available at all times

3.4.4.2 Maintain all appropriate supporting documentation for each DD-254 on file

3.4.4.3 Validate each contractor’s facility clearance and storage level

3.4.4.4 Coordinate with F-35 JPO Personnel Security (PERSEC) to validate the DD-

Page | 10

254 status for all contract personnel prior to processing for SAP access

3.4.4.5 Prepare and coordinate National Interest Determinations (NIDs)

3.4.4.6 Provide guidance on the DD-254 process. Ensure that all updates to policy and guidance are disseminated

3.4.4.7 Create, update and maintain the DD-254 database of record

3.5 Provide Physical Security Support. The contractor shall provide Physical Security performed to support the active and passive measures, designed to prevent the unauthorized access to personnel, equipment, materials, and information; and to safeguard them against espionage, sabotage, terrorism, damage, and criminal activity, including but not limited to the following tasks:

3.5.1 Provide Guidance and Documentation to Facilitate DoD/Intelligence Community Directive (ICD) Compliance.

3.5.1.1 Maintain and update Occupant Emergency Plan, Criticality Assessment, and Program Evacuation Plan

3.5.1.2 Update security portion of Continuity of Operations Plan

3.5.2 Manage Secure Area Accreditation (Pre-Construction to De-accreditation).

3.5.2.1 Ensure all accreditation documentation for all F-35 JPO secure spaces is accurate, complete, and digitally available at all times

3.5.2.2 Complete and maintain Fixed Facility Checklists for each location and assist with annual facility inspections

3.5.2.3 Facilitate the coordination, documentation, oversight and other security-related functions of construction and/or modifications pertaining to secure areas and provide updates and results to Government security leads

3.5.3 Provide Anti-Terrorism Force Protection (ATFP).

3.5.3.1 Assist Government security leads with the development and execution of the F- 35 JPO ATFP Plan

3.5.3.2 Identify defensive measures used to reduce the vulnerability of individuals and property to terrorist acts

3.5.3.3 Perform analyses as a basis for developing plans and programs to protect assets

3.5.4 Provide Alarm Services Support.

3.5.4.1 Respond to all notifications from applicable alarm monitoring organizations such as Pentagon Force Protection Services. Response can include, but are not limited to, answering alarm monitoring center phone call and/or physically responding to the event at an F-35 JPO building

3.5.4.2 Coordinate with applicable alarm monitoring organizations to facilitate maintenance and testing in accordance with the schedule provided by Government security leads

Page | 11

3.5.5 Provide Facility Access Control.

3.5.5.1 Manage facility key issuance, inventory, and maintenance processes

3.5.5.2 Manage and support security container availability, storage capacity and type of containers

3.5.5.3 Monitor, administer, and maintain program badge control system

3.5.5.4 Change, issue, and manage combinations on doors and security containers

3.5.5.5 Combinations shall be change within five business days of identification of need

3.6 Provide Personnel Security (PERSEC) Support. The contractor shall provide PERSEC performed to support the established standards, criteria, and guidelines upon which personnel security eligibility determinations are based, including but not limited to the following tasks:

3.6.1 Provide Program Access Request (PAR) Management.

3.6.1.1 Manage the Special Access Program Personnel Security Official (SPO) portion of the PAR process from receipt to submission to Program Security Officer (PSO) within 12 business days. Provide the PAR requestor with approval determination within five business days following Access Approval Authority (AAA) signature

3.6.1.2 Maintain accountability of all created and submitted PARs. The contractor shall provide analysis of submitted and processed PARs to determine inefficiencies and implement corrective actions/enhancements

3.6.1.3 Review each PAR to ensure accuracy and completeness of both the PAR and supporting documentation (e.g. Personnel Security Questionnaire). The contractor shall prioritize PAR processing based on mission need and at the discretion of the Government security leads

3.6.1.4 Create, maintain and disseminate to Government security leads a regular schedule for indoctrination and other access-related briefings IAW established DoD, F-35 JPO, and site specific policies

3.6.1.5 Ensure F-35 JPO personnel and non-F-35 JPO support personnel files are maintained within the established systems of record (e.g. JPAS, JADE, Defense Ready). Documentation shall be accurate and digitally available at all times

3.6.1.6 Coordinate and maintain accuracy of program billet rosters

3.6.2 Provide Personnel Clearance Management.

3.6.2.1 Ensure all personnel are accounted for in the system of record within three business days of in-processing with F-35 JPO Security

3.6.2.2 Execute monthly reports in JPAS (or supporting system of record) and notify the Security Manager, GSSO, and subject(s) requiring a reinvestigation.

Notification of Personnel Request (PR) need shall be made NLT three business days after the report is executed

3.6.2.3 Coordinate with the Government service and contractor PERSEC POC for the initiation of notification of PR processing within five business days of

Page | 12 notification of the need for a PR

3.6.2.4 Satisfy all prerequisites to obtain and maintain a Defense Information System for Security (DISS) account (or supporting system of record) to accurately identify F-35 JPO and support personnel who have been enrolled in the Continuous Evaluation Program (CEP). All personnel enrolled in CEP shall be reflected in supporting systems of record to ensure accurate and timely processing of PERSEC related activities within three business days of notification from DISS

3.6.2.5 Facilitate adverse information reporting for F-35 JPO and support personnel IAW established (and subsequent) DoD, F-35 JPO, and site specific policies, and provide results of reports to Government security leads

3.7 Provide Counter-Intelligence (CI) Support. The contractor shall provide CI support under this task order. This includes the management and oversight of all activities performed to support product development and distribution designed to ensure personnel awareness of their responsibilities to report unusual activities or behaviors and how to identify various threats from foreign intelligence entities, other illicit collectors of U.S. defense information, and/or terrorists, including but not limited to the following tasks:

3.7.1 Monitor Adversarial Program Threats.

3.7.1.1 Collaborate with Air Force Office of Special Investigations (AFOSI), Naval Criminal Investigative Service (NCIS), and Counterintelligence Product Manager to develop and provide threat briefings to program personnel

3.7.1.2 Analyze Intelligence/CI data and develop security products to support all IPTs

3.7.1.3 Facilitate adverse/required reporting actions as required

3.7.2 Provide Insider Threat Support.

3.7.2.1 Assist in developing and implementing an insider threat program to detect malicious threats that come from personnel within the F-35 JPO organization

3.7.2.2 Assist with developing reports for Government leads NLT five (5) business days after identification of need

3.7.3 Develop and Maintain Threat Briefings.

3.7.3.1 Develop and maintain foreign threat briefings for each foreign country participating in the acquisition of F-35 systems. Documentation shall be accurate and digitally available at all times

3.7.4 Provide CI Support to the Development of PPP.

3.7.4.1 Draft CI portions of each PPP and submit documentation to Government security leadership

3.7.4.2 Develop and assist in the implementation of a Counter-Intelligence Support Plan (CISP)

Page | 13

3.7.5 Provide CI Guidance and Recommendations to Government Entities.

3.7.5.1 Provide guidance and recommendations on Intelligence and CI Assessments

3.7.5.2 Assist with forming and leading the F-35 CI/Intelligence Security Working

Group and provide recommendations to F-35 Security leads

3.8 Provide Program Protection Engineering Services. The contractor shall provide Program Protection Engineering support under this task order. This includes supporting the development, integration and enhancements of a protection strategy into existing F-35 JPO program protection architecture to include External Interfaces and Transactions (EI&T), CI, and DoD community coordination as well as Anti-Tamper, Communication Security (COMSEC), and Telecommunications Electronics Materials Protected from Emanating Spurious Transmissions (TEMPEST) engineering support, including but not limited to the following tasks:

3.8.1 Provide Anti-Tamper Security Support.

3.8.1.1 Provide insight into system requirements, design trades, architecture evolution, risk management, hardware and platform-software development, reliability, maintainability, safety certification, security certification, special programs, weight, power, cooling and volume to facilitate a both a balanced Air System Design and Anti Tamper (AT) requirements

3.8.1.2 Create architecture and design documentation and coordinate reviews with JPO program office representatives, DoD SMEs and the AT Executive Agent, and submit documentation to Government security leadership

3.8.2 Provide COMSEC Engineering Services.

3.8.2.1 Perform COMSEC engineering for the F-35 systems cryptographic and key management architecture

3.8.2.2 Provide support for certification and accreditation activities for operational systems when required to include performing full RMF efforts

3.8.2.3 Assist with National Security Agency (NSA) approval of cryptographic changes to the baseline F-35 End Cryptographic Units (ECUs) as well as new developments of F-35 ECUs, includes validating the usage of F-35 keying material to the operational controlling authorities.

3.8.2.4 Facilitate and attend working groups/meetings to assist in developing accreditation packages

3.8.2.5 Consolidate material for accreditation packages and submit documentation to Government security leads

3.8.2.6 Provide SME-level guidance on design of equipment and necessary support, and recommend tasks to Government security leads

3.8.3 Provide TEMPEST Engineering Services.

3.8.3.1 Coordinate and participate in the development of TEMPEST requirements for the F-35 JSF Air System and secure facilities supporting the Air System

3.8.3.2 Coordinate with the Air System Contractor, United States Government entities, Page | 14 and Certified TEMPEST Technical Authorities (CTTAs) to facilitate compliance with F-35 Air System TEMPEST Regulations

4.0 GENERAL INFORMATION

4.1 Period of Performance. The period of performance (PoP) is 12 months.

4.2 Place(s) of Performance. The primary place of performance will be the F-35 JPO located in Arlington, Virginia (VA). Other Government sites may include but are not limited to:

• Naval Air Warfare Center/Aircraft Division (NAWC/AD), Patuxent River, MD

• Edwards AFB, CA

• Naval Air Warfare Center/Weapons Division (NAWC/WD) China Lake, CA

• NAWC/WD, Pt. Mugu, CA

• Wright-Patterson AFB, OH

• Eglin AFB, FL

• Outside Continental United States (OCONUS)

4.2.1 Contractors performing on-site support at the F-35 JPO will be provided access to workspaces, telephones, printers, facsimile machines, copy machines, shredders, computers, and network access including web servers and applicable databases or other applications necessary to carry out assigned tasks.

4.3 Hours of Operations. The contractor shall provide the required services and staffing coverage during normal working hours. Core hours are 0900-1500, Monday through Friday (except on the legal holidays specified in paragraph 3.5.3). Some supported Government offices have flexibility to start as early as 0500 and end as late as 1900, Monday through Friday. Some functional areas may require regular staffing outside of core hours and/or staffing overlap may be required for some functional areas to ensure coverage for extended hours as described by Government security leads. When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the work force are essential.

4.4 Compressed Work Schedule (CWS). CWS is an alternative work schedule to the traditional five 8.5 hour workdays (which includes a 30-minute lunch) that is allowable only as coordinated with Government security leads under this effort. Any additional costs associated with the implementation of the CWS schedule vice the standard schedule are unallowable costs under this contract and will not be reimbursed by the Government. Additionally, the CWS schedule shall not prevent Contractor employees from providing necessary staffing and services coverage when required by the Government. The overall schedule must be provided to the COR/ACOR.

4.4.1 Under a CWS schedule, an employee completes the following schedule within a two-week period of time: eight weekdays are worked at 9.5 hours each (which includes a 30-minute lunch), one weekday is alternately worked as 8.5 hours (which includes a 30-minute lunch) and one weekday is not worked by the employee. The result is 80 hours worked every two weeks, with 44 work hours one week and 36 work hours the other. The Contractor will only allow those employees residing on Government sites (includes contractor spaces within a JPO facility) with

Page | 15 regularly occurring days off to participate in CWS.

4.5 Extended Business Hours. Contractor Staff may be required to work beyond business hours (e.g. weekends and/or holidays). In the event that additional hours must be worked, prior approval must be obtained from the COR. The Government may request a reporting on tasks completed during this period on a case-by-case basis.

4.6 Overtime. Refer to ID/IQ

4.7 Telework. Telework may be permitted on this task order on a case-by-case basis, as coordinated with Government security leads. The Government may request a reporting on tasks completed during this period on a case-by-case basis.

4.8 Meeting Support. In support of the tasking outlined in this task order, the contractor shall have the capability to support meetings at the TOP SECRET classification level at CONUS and OCONUS Government locations.

4.9 IT Operating Environment. Refer to ID/IQ

4.10 Transition/Mobilization. Refer to ID/IQ

4.11 Management of Contractor Personnel. Refer to ID/IQ

4.12 Installation Closure. Refer to ID/IQ

4.13 Holidays. Refer to ID/IQ

4.14 Information Technology. Refer to ID/IQ

4.15 Section 508 Compliance. Refer to ID/IQ

4.16 Government Furnished Property (GFP). Refer to ID/IQ

5.0 SECURITY REQUIREMENTS

5.1 DD-254, Contract Security Classification Specification. Refer to ID/IQ

5.2 Basic Personnel Clearance Requirements. Refer to ID/IQ

5.3 Citizenship Requirements: Refer to ID/IQ

5.4 Command Access Cards (CAC) / Local Badges: Refer to ID/IQ

5.5 SAAR-N: Refer to ID/IQ

5.6 Information Security. Refer to ID/IQ

Page | 16

5.7 Operations Security (OPSEC). Refer to ID/IQ

5.8 Anti-Terrorism Force Protection and Emergency Management: Refer to ID/IQ

6.0 TRAVEL AND OTHER DIRECT COSTS

6.1 Travel: Refer to ID/IQ

6.2 Other Direct Costs (ODC): Refer to ID/IQ

7.0 CONTRACT DELIVERABLES AND APPLICABLE DOCUMENTS

7.1 Contract Status Reporting: The following contract deliverables shall be provided in response to this task order:

Table 7.1. Deliverables

Name No. of Copies

PWS

Reference

Due

Management and Staffing Plan 1 3.1, 7.1.1 Per ID/IQ

Quality Control Plan 1 3.1, 7.1.2 No later than the 10th business day of each month

Kick-Off Meeting & Slides 1 3.1, 7.1.3

No later than 10 business days of task order award notification for Government review.

Monthly Status Report 1 3.1, 7.1.4 Per ID/IQ Monthly Expenditure Report 1 3.1, 7.1.5 Per ID/IQ

Weekly Activity Reports (WAR) 1 3.1, 7.1.6 Per ID/IQ

Hiring Status Report 1 3.1, 7.1.7 Per ID/IQ

Transition-In Plan 1 3.1, 7.1.8 Per ID/IQ

Travel Authorization Request 1 6.1, 7.1.9

No later than 10 calendar days before the first travel date (CONUS) or 15 calendar days (OCONUS) for COR approval

Trip Report 1 3.1, 7.1.10 No later than 5 business days after the last day of travel

Meeting Minutes 1 3.1, 7.1.11 No later than 3 business days after the meeting conclusion

Problem Notification 1 3.1, 7.1.12 Per ID/IQ

Page | 17

Name No. of Copies

PWS

Reference Due

Transition-Out Plan 1 3.1, 7.1.13 Per ID/IQ

Security Process Analysis 1 3.2.9.

7.1.14

No later than 10 business days after the start of each quarter

Special Security Studies 1 3.2.9.

7.1.15

No later than 30 calendar days following request

Training Syllabi and Materials 1 3.2.3,

7.1.16 No later than 10 business days before training is conducted

Site Assistance Visit (SAV) Report

1 3.2.7.2, 7.1.17

No later than 10 business days following completion of SAV

Facility Access Control Annual Inventory and Inspection

1 3.5.5, 7.1.18

No later than 60 calendar days after start of the TO Period of Performance

Program Access Request (PAR) Analysis

1 3.6.1, 7.1.19

No later than the 10th business day of each month

Notes:

1. Submit one copy each electronically in Adobe (PDF) or as a Microsoft Office Suite product to the CO, COR, PM, CS, and acquisition analyst. If copies exceed five (5) megabytes of data, send through AMRDEC SAFE (Safe Access File Exchange) at https://safe.amrdec.army.mil/SAFE/. Submit classified reports only to the GCC point(s) of contact via SIPRNet or JWICS, as appropriate.

2. All deliverables shall be submitted by the established due date. If the due date falls on a weekend or holiday, the deliverable shall be submitted on the next business day. Unless specified otherwise, calendar days will be used. If the submittal is rejected by the Government the Contractor shall resubmit within 15 days.

3. The deliverables listed are not all inclusive and do not relieve the Contractor of responsibility for providing deliverables as required elsewhere in the PWS and the main ID/IQ if applicable.

4. All deliverables must meet professional standards and meet the requirements set forth in contractual documentation. The Contractor shall be responsible for delivering all end items specified unless otherwise directed by the COR/TPOC. Contractor format is acceptable for this effort, unless otherwise stated, as long as all required analysis is completed and provided to the Government.

7.1.1 Management and Staffing Plan. As required per the ID/IQ. Contractor shall include data pertinent to this TO as part of the ID/IQ Management TO deliverable.

7.1.2 Quality Control Plan. The Contractor shall provide a Quality Control Plan in accordance with the timelines captured in Table 7.1. The Contactor shall include metrics pertaining to performance standards as identified throughout this PWS. For example, for PWS Task, 3.2.1.1, “Maintain recall rosters, organizational charts, and contact cards for Security personnel to no less than 95% accuracy within two business days of notification of change; any errors must be corrected https://safe.amrdec.army.mil/SAFE/

Page | 18 within one business day to 100% accuracy” the Contractor shall provide metrics regarding performance for the time period being evaluated. The Contractor shall provide as a minimum:

• All performance standards identified in the PWS

• Metrics associated with each of these standards

• Any deficiencies

• Reason for deficiencies

• Impact of deficiencies on program

• Plan of Action and Milestones (POA&M) to rectify any deficiencies, including plan to ensure no recurrence of non-conformances

7.1.3 Kick-Off Meeting and Slides. The Contractor shall attend the contract Kick-Off Meeting and submit Kick-Off slides in accordance with the timelines captured in Table 7.1. The Contractors slides shall capture (at a minimum) the following data:

• Introduction of key personnel

• Roles and responsibilities

• Communication plan and lines of communication overview

• Schedule showing major tasks and milestones with start/completion dates

• Security requirements/issues/facility access procedures (if applicable)

• Sensitivity and protection of information (if applicable)

• Government Furnished Information (GFI) and Equipment (GFE) (if applicable)

• Initial deliverables (if applicable)

• Current status of transition-in plan (as proposed and approved by the Government)

• Any other information the contractor deems pertinent

7.1.4 Monthly Status Report. As required per the ID/IQ. Contractor shall include data pertinent to this TO as part of the ID/IQ Management TO deliverable.

7.1.5 Monthly Expenditure Report. As required per the ID/IQ. Contractor shall include data pertinent to this TO as part of the ID/IQ Management TO deliverable.

7.1.6 Weekly Activity Report. As required per the ID/IQ. Contractor shall include data pertinent to this TO as part of the ID/IQ Management TO deliverable.

7.1.7 Hiring Status Report. As required per the ID/IQ. Contractor shall include data pertinent to this TO as part of the ID/IQ Management TO deliverable.

7.1.8 Transition-In Plan. As required per the ID/IQ. Contractor shall include data pertinent to this TO as part of the ID/IQ Management TO deliverable.

7.1.9 Travel Authorization Request. The Contractor shall submit a travel authorization request in accordance with the timelines capture in Table 7.1 that includes (at a minimum) the following data for COR approval prior to incurring any costs (the Government may provide a travel authorization request template for use post-award):

• Contract number

• Name of traveler

Page | 19

• Dates

• Origin and destination

• Owning IPT being supported

• Organization to be visited

• Purpose of travel

• Estimated airfare

• Estimated lodging within regulatory limits

• Estimated Per Diem

• Estimate ground transportation

• POV use

• Miscellaneous costs

• Justification as to why teleconferencing or video teleconferencing cannot be used

• Employee signature

• IPT signature

7.1.10 Trip Report. The Contractor shall submit a trip report in accordance with the timelines capture in Table 7.1 that includes (at a minimum) the following data:

• Personnel who traveled

• Dates of travel

• Destination(s)

• Purpose of trip

• Cost of the trip

• Approval authority

• Summary of events, action items, and deliverables

• For all OCONUS trips, Trip Report must include current security posture for the country/countries visited. If the country (countries) are not at an acceptable level, the Trip Report must include recommendations with timelines to augment the security posture

7.1.11 Meeting Minutes. The Contractor shall submit meeting minutes in accordance with the timelines capture in Table 7.1 that capture (as a minimum) the following data:

• Meeting attendees and their contact information

• Meeting date

• Meeting location

• Purpose of meeting

• Summary of events

7.1.12 Problem Notification. As required per the ID/IQ. Contractor shall include data pertinent to this TO as part of the ID/IQ Management TO deliverable.

7.1.13 Transition-Out Plan. As required per the ID/IQ. Contractor shall include data pertinent to this TO as part of the ID/IQ Management TO deliverable.

7.1.14 Security Process Analysis. The Contractor shall submit a report in accordance with the timelines capture in Table 7.1 that capture (as a minimum) the following data:

Page | 20

• Synopsis and analysis of current F-35 JPO security processes

• Identification of programmatic shortfalls and recommendations for improvement including timelines

• Identification of enhanced operational program requirements and analysis of the feasibility and proposed timeline to implement

• Opportunities for process improvement through automation or other innovative means

7.1.15 Security Special Studies. The Contractor shall submit reports in White Paper format in accordance with the timelines capture in Table 7.1 that capture (as a minimum) the following data:

• Detailed analysis on the subject identified by Government security leads for the study

• Courses of Action (COAs) and recommendations based on the analysis

• Proposed timeline and major milestones for COAs and recommendation identified

• Analysis of trade-offs associated with implementing recommended COA

7.1.16 Training Syllabi and Materials. The Contractor shall submit training syllabi and materials in accordance with the timelines capture in Table 7.1 that capture (as a minimum) the following data:

• Instructor(s) information and contact

• Course description and purpose

• Learning goals and expected outcomes

• Any applicable resources (e.g. associated DoD policy or regulations)

• Course policies and expectations

• Materials to be used in the course (e.g. PowerPoint slides)

7.1.17 Site Assistance Visit (SAV) Report. The Contractor shall submit reports in accordance with the timelines capture in Table 7.1 that capture (as a minimum) the following data:

• Description of site visited

• Summary of security findings

• Details on any anomalies

• Action taken on-site for correction

• Recommendations for corrective action with suggested timeline

• Lessons learned and best practices

7.1.18 Facility Access Annual Inventory and Inspection. The Contractor shall complete an inventory and inspection and submit a report in accordance with the timelines capture in Table 7.1 that captures (as a minimum) the following data:

• Total quantity of all items at PWS 3.5.5 delineated by type and facility

• Inspection of all items at PWS 3.5.5 and details on any anomalies

• Recommendations regarding any anomalies (e.g. replacement parts)

7.1.19 Program Access Request (PAR) Analysis. The Contractor shall complete an analysis and…