30 Jan 2020 Security Support Services PWS - IDIQ.docx

Section C - Descriptions and Specifications

F-35 JOINT PROGRAM OFFICE (F-35 JPO) / SERVICES ACQUISITION TEAM (SAT)

PROGRAM SECURITY SUPPORT SERVICES

SINGLE AWARD - INDEFINITE DELIVERY / INDEFINITE QUANTITY (ID/IQ)

PERFORMANCE WORK STATEMENT (PWS)

12 DECEMBER 2019

1.0 OVERVIEW

The F-35 Joint Program Office (JPO) is the Department of Defense’s (DoD) focal point for defining affordable next generation strike aircraft weapon systems for the Navy, Air Force, Marines, and our allies. The F-35 is the next generation strike fighter bringing cutting-edge technologies to the battle-space of the future. The F-35s advanced airframe, autonomic logistics, avionics, propulsion systems, stealth, and firepower will ensure that the F-35 is the most affordable, lethal, supportable and survivable aircraft ever to be used by so many warfighters around the world. The JPO SAT supports the program office IPT’s with program management, contracting services, and quality assurance in order to provide the best, most efficient contract strategies in support of the JSF vision, mission, goals and objectives.

The F-35 Lightning II Program (also known as the Joint Strike Fighter Program) is a joint, multi-national program and is the Department of Defense's (DoD) focal point for defining affordable next generation strike aircraft weapon systems among the United States (U.S.) Air Force (USAF), U.S. Navy (USN), U.S. Marine Corps (USMC), and U.S. allies composed of seven (7) cooperative international partners: the United Kingdom, Italy, Netherlands, Canada, Australia, Denmark, and Norway. The program’s objective is to develop and deploy the F-35 Air System (AS), a three (3) variant family of highly common and affordable 5th Generation strike fighter aircraft that meets the operational needs of the USAF, USN, USMC, and cooperative partner international services. Additional production of the F-35 is made through Foreign Military Sales (FMS). The F-35 Enterprise is defined as, but not limited to: Air Vehicle (AV), Systems (AS), AS Ground Support, Support Equipment (SE) Systems, Depot Maintenance, Business, Flight Test, and Training Systems. The F-35 security team has a mature Program Protection Plan (PPP), robust policies and procedures and established Special Access Program (SAP) facilities throughout the world. However, requirements continue to evolve as the program matures and the F-35 security team is responsible for ensuring that any new security challenges are appropriately identified and safeguarded in accordance with (IAW) DoD regulations and specifications.

2.0 SCOPE

The F-35 Joint Program Office (F-35 JPO) requires program security support services to support its critical mission of developing, deploying and sustaining the next generation strike fighter aircraft. The program security support disciplines consist of Program Management, General Security Support, Information Security Support, Industrial Security Support, Physical Security Support, Personnel Security Support, Counter-Intelligence Support, Special Security Studies, Foreign Disclosure Support, Program Protection Cybersecurity/Security Control Assessment Services and Program Protection Engineering Services. The program security support services encompass the management and control of controlled unclassified information (CUI), collateral/general service (GENSER) information, Special Access Program (SAP) information, North Atlantic Treaty Organization (NATO) information, Critical Nuclear Weapons Design Information (CNWDI) and Sensitive Compartmented Information (SCI). This is an Indefinite Delivery/Indefinite Quantity contract which sets forth the conditions and clauses under which future acquisitions between the parties shall be governed. This contract will be used as a means of providing security services to the F-35 JPO.

3.0 PERFORMANCE REQUIREMENTS

The Contractor shall furnish the necessary personnel, skills, material, and other services as required to perform tasks outlined in this PWS. Paragraphs 3.2 – 3.14 captures some of security support services that may be requested via a task order at, or after, award of the ID/IQ.

3.1 Provide Program Management Support. The Contractor shall provide program management support under this contract, including project management and financial management. This includes the management and oversight of all activities performed by contractor personnel, including subcontractors, to ensure all F-35 program security support services satisfy the requirements identified in each individual task order that may be issued under this contract.

3.2 Provide General Program Security Support. The contractor shall provide general security support under this contract. This includes performing activities related to general security standard discipline management and support. Unless otherwise specified, contractor should note all tasks may pertain to both US and International Security Support. The following subtasks are not assigned to any one specific security business area and are intended to provide maximum flexibility and support to the enterprise:

3.2.1 Provide Administrative Security Support. This requirement may capture support such as:

· Maintain recall rosters, organizational charts, and contact cards for Security personnel

· Maintain, update, and coordinate Security Operations Manuals (SOM), Standard Operating Procedures (SOP), Access Management Control Plan (AMCP), Project Security Instruction (PSI), Continuity Of Operations Plan (COOP), Occupant Emergency Plan (OEP), Emergency Action Plan (EAP) and other security-generated publications

· Schedule and support security meetings

· Coordinate with Human Resources (HR) regarding security onboarding/off-boarding

· Coordinate onboarding of security new hires

· Coordinate and prepare Security Program Management Reviews (PMRs)

· Coordinate Security Conference for International Security

· Maintain and update security mail groups and calendar

· Issue courier cards and provide appropriate courier training

· Monitor, control, and service post office box

· Distribute mail and packages to local security offices

· Distribute policy and guidance to CONUS and OCONUS locations as required

· Maintain a central security document and file archive

· Maintain, update, and coordinate F-35 security database systems (e.g. Joint Access Database Environment (JADE), Joint Personnel Adjudication System (JPAS), local databases, SharePoint, central archive, etc.)

· Provide centralized security customer service support

· Provide technical writing support in compliance with appropriate guidance

· Assist in development, coordination, and distribution of security policies and procedures

3.2.2 Provide Security Incident Inquiry Support. This requirement may capture support such as:

· Conduct and assist with security incident inquiries

· Track and provide trend analysis on reported security incidents

· Provide incident matrix to the Director of Security (DS) and Government SAP Security Officer (GSSO)

· Recommend classification determinations prior to inquiry initiation

· Monitor inquiry progress, provide status updates to the GSSO, and draft appropriate reports before, during, and after inquiry

· Participate in containment and clean-up actions and document results

· Maintain the Security Incident Guide in coordination with the Information System Security Manager (ISSM)

· Ensure personnel are notified of the initial incident in accordance with (IAW) policy

3.2.3 Provide Security Education, Training and Awareness (SETA) Support. This requirement may capture support such as:

· Collaborate with Subject Matter Experts (SMEs) and develop specific security training and indoctrination briefings

· Serve as primary point of contact for all F-35 JPO security education and training products

· Develop or coordinate the acquisition of security awareness and training products

· Develop and provide security awareness newsletter to the enterprise

· Develop and provide Commanders Call security briefing

· Coordinate with HR regarding security briefing at new hire orientation; conduct security briefing at new hire orientation; ensure new hire orientation security briefing slide deck is accurate

· Develop security education training plans, maintain, track, and conduct comprehensive security training

· Track and provide data on training status for F-35 JPO personnel

· Assist international country security managers with developing country-specific security training

3.2.4 Provide CONUS and OCONUS International Security Support. This requirement may capture support such as:

· Provide multi-disciplined security guidance and mentorship to F-35 Partner and Foreign Military Sales (FMS) security professionals

· Provide continuous evaluation of F-35 Partner and FMS security posture and provide written updates to International Security Manager, Program Security Officer, and assigned International Security Specialist

· Assist F-35 Partner and FMS security professionals in developing country-unique security documents to ensure protection of F-35 assets at the appropriate level

· Develop and provide training to F-35 Partner and FMS security professionals to facilitate building, implementing and managing a comprehensive F-35 security program

· Assist F-35 Partner and FMS security professionals in ensuring security policies and procedures are in compliance with Special Access Program (SAP), Classified Military Information (CMI), and Controlled Unclassified Information (CUI) in accordance with U.S Government security requirements

· Provide general, physical, and cybersecurity support and training to F-35 Partner and FMS security professionals

· Provide security support at air shows, fighter competitions and other collaborative events

· Provide country map data

3.2.5 Provide Operational Security (OPSEC) Support. This requirement may capture support such as:

· Assist in development of OPSEC measures for specific programs

· Aid in the development, management and execution of the F-35 JPO OPSEC program

· Perform risk management assessments and provide analysis

3.2.6 Provide Program Protection Support. This requirement may capture support such as:

· Perform risk management and risk analysis

· Develop, manage and execute Program Protection Plans (PPP)

· Conduct PPP reviews as required by policy and integrate identified changes

· Identify Critical Program Information (CPI), mission critical functions, and mission critical components

· Develop enhanced protection measures

· Assist the Government in establishing and chairing an Observables, Identification, and Containment (OI&C) Working Group

· Coordinate and facilitate the review of the F-35 CPIs

3.2.7 Provide Special Access Program (SAP) Security Support. This requirement may capture support such as:

· Manage International Partner/FMS conference space

· Track Partner/FMS required inventories, self-inspections, training, and other applicable documents

· Maintain and update Cooperative Program Personnel (CPP) SOP

· Maintain and update Technology Assessment/Control Plan (TA/CP)

· Coordinate with geographically separated GSSOs and international country security managers to facilitate and record SAP security requirements

· Generate new international security documents as additional FMS participants join the program

· Conduct formal and/or informal inspections and/or assessments at international and U.S. SAP facilities

· Author detailed trip reports and maintain records of communications with GSSOs and foreign partners and FMS participants

· Support Government Security Managers at Executive Committee (EXCOM) and Tri-Service briefings

· Conduct collateral and SAP security self-inspections and staff assistance visits

· Track corrective actions

· Provide support to F-35 JPO by arming and disarming secure rooms as needed

3.2.8 Provide Sensitive Compartmented Information (SCI) Security Support. This requirement may capture support such as:

· Maintain and update SCI SOP

· Coordinate with international country security managers to facilitate meeting and recording security requirements

· Conduct formal and/or informal inspections at SCI Facilities (SCIFs)

· Conduct SCI security self-inspections and staff assistance visits

· Provide support to F-35 JPO by arming and disarming secure rooms as needed

3.2.9 Provide Visitor Control Support. This requirement may capture support such as:

· Transmit SAP, SCI, and collateral visit certifications for F-35 JPO personnel

· Issue, maintain, distribute, track, and inventory F-35 JPO visitor badges

· Process incoming and outgoing visit requests

· Create and process country clearance requests through the approved visit system

· Monitor and control incoming and outgoing U.S. Government property

· Collect, maintain, and close out foreign travel reports

3.2.10 Provide Analytical Security Support. This requirement may capture support such as:

· Assess and optimize security processes, including automation, for a rapidly growing program to ensure consistent security support, and produce products resulting from this analysis

· Identify program requirements through review and analysis of user needs and produce products resulting from this analysis

· Identify emerging threats and produce products resulting from this analysis

· Conduct special security studies and produce products resulting from these studies

3.2.11 Provide Security Escort Support. This requirement may capture support such as:

· Escort and monitor the facilities engineering, vendor, and maintenance personnel working within F-35 JPO occupied spaces

· Provide escorts for facility-related projects

3.3 Provide Information Security Support. The contractor shall provide Information Security support under this contract. This includes the management and oversight of all activities performed to support the protection of printed, electronic, or any other form of sensitive information from unauthorized access, use, misuse, disclosure, destruction, modification, or disruption. The following subtasks are not assigned to any one specific security business area and are intended to provide maximum flexibility and support to the enterprise:

3.3.1 Provide Classification Management Support. This requirement may capture support such as:

· Maintain collateral and SAP Security Classification Guides (SCG)

· Coordinate with program Subject Matter Experts (SMEs) to develop SCGs

· Develop, manage and execute the classification challenge process

· Coordinate SCG reviews and changes, update SCGs as required, and distribute as appropriate

· Conduct document classification reviews as required

· Assist with classification determinations as needed

· Review Public Release requests in coordination with F-35 JPO Public Affairs team

3.3.2 Provide Document Control Support. This requirement may capture support such as:

· Perform all document control duties associated with receipt, transmission, inventory, reproduction, disposition, and management of classified information

· Administer receipt and dispatch system for all collateral and SAP information, and SCI as required

· Prepare classified packages for transmission through mail, secure fax, or courier

· Maintain document tracking log for Partner/FMS specific AMCP, PSI, SOP, Memoranda of Understanding (MOU), and other applicable documents

3.4 Provide Industrial Security Support. The contractor shall provide Industrial Security support under this contract. This includes the management and oversight of all activities performed to support the protection of classified information developed by or entrusted to U.S industry operating under the National Industrial Security Program (NISP). The following subtasks are not assigned to any one specific security business area and are intended to provide maximum flexibility and support to the enterprise:

3.4.1 Provide Ship and Site Activation Team Security Support. This requirement may capture support such as:

· Brief and coordinate SAP and collateral security requirements for USAF, USN, USMC, and international bed down sites

· Communicate secure facility construction and accreditation technical security standards

· Maintain and monitor security activities at bed down locations until facilities receive accreditation

· Identify security clearance and SAP access requirements at bed down locations

· Assist the services in defining facility and infrastructure requirement to meet F-35 bed down for all sites

· Coordinate and participate in the development of CONUS and OCONUS Facilities Requirements Documents (FRDs) and document results

3.4.2 Provide Security Role in Supply Chain Risk Management (SCRM).

· Assist F-35 JPO Security with the development and execution of a SCRM program

· Assist JPO Security with preventing the introduction of parts with malicious intent by a foreign adversary to disrupt, disable, or render ineffective F-35 systems

· Conduct Critical Program Information (CPI) Assessments and Criticality Analyses

· Evaluate and track SCRM Program and Implementation Plans

· Assist in coordinating with external agencies

3.4.3 Assist with DoD Industrial Security Requirements Compliance.

· Develop and maintain a database of cleared defense contractors supporting the F-35 JPO and their compliance status

· Assist in coordination with SMEs at Government agencies

3.4.4 Provide DD-254 Management Support. This requirement may capture support such as:

· Draft DD-254s for prime contractors and update/revise existing DD-254s as changes occur; review sub-contract DD-254s to ensure accuracy

· Maintain appropriate supporting documentation for each DD-254 on file

· Validate facility clearance and storage level

· Validate DD-254 on file for Program Access Requests to support PERSEC inquiries

· Prepare and coordinate National Interest Determinations (NIDs)

· Provide DD-254 guidance and contracting strategies

· Update and maintain the DD-254 database of record

3.5 Provide Physical Security Support. The contractor shall provide Physical Security support under this contract. This includes the management and oversight of activities performed to support the active and passive measures, designed to prevent the unauthorized access to personnel, equipment, materials, and information; and to safeguard them against espionage, sabotage, terrorism, damage, and criminal activity. The following subtasks are not assigned to any one specific security business area and are intended to provide maximum flexibility and support to the enterprise:

3.5.1 Provide Guidance and Documentation to Facilitate DoD/Intelligence Community Directive (ICD) Compliance. This requirement may capture support such as:

· Maintain and update Occupant Emergency Plan, Criticality Assessment; and Program Evacuation Plan

· Update security portion of Continuity of Operations Plan

3.5.2 Provide Support for Secure Area Accreditation (Pre-Construction to De-accreditation). This requirement may capture support such as:

· Maintain and track F-35 JPO sponsored facility accreditation letters

· Complete and maintain Fixed Facility Checklists and assist with annual facility inspections

· Coordinate with appropriate offices for construction or alterations

· Participate in pre-construction meetings and document results

· Document and maintain construction progress and activities

3.5.3 Provide Anti-Terrorism Force Protection (ATFP). This requirement may capture support such as:

· Coordinate and maintain program ATFP Plan

· Manage, track, and provide required ATFP training for F-35 JPO personnel

3.5.4 Provide Alarm Maintenance. This requirement may capture support such as:

· Provide alarm response and situation-dictated response action

· Schedule alarm maintenance

· Coordinate semi-annual alarm testing

3.5.5 Provide Facility Access Control. This requirement may capture support such as:

· Manage facility key issuance, inventory, and maintenance processes

· Manage and support security container availability and requirements

· Monitor, administer, and maintain program badge control system

· Change, issue, and manage combinations on doors and security containers

3.6 Provide Personnel Security (PERSEC) Support. The contractor shall provide PERSEC support under this contract. This includes the management and oversight of activities performed to support the established standards, criteria, and guidelines upon which personnel security eligibility determinations are based. The following subtasks are not assigned to any one specific security business area and are intended to provide maximum flexibility and support to the enterprise:

3.6.1 Provide Program Access Request (PAR) Management Support. This requirement may capture support such as:

· Electronically create, track, update, and provide trend analysis for PARs

· Perform Security Officer review of PARs and prioritize PARs when necessary

· Schedule and perform SAP indoctrination briefings with approved personnel

· Maintain Personnel files IAW current policy

· Electronically process, track, update, and provide trend analysis for Partner/FMS PARs

· Coordinate and maintain accuracy of program billet rosters

3.6.2 Provide Personnel Clearance (PCL) Management Support. This requirement may capture support such as:

· Execute reports to identify personnel requiring Periodic Reinvestigation (PR)

· Coordinate PR initiation with employee’s Service PERSEC POC and provide guidance

· Coordinate and manage the Continuous Evaluation (CE) program

· Facilitate adverse/required reporting actions as required

3.7 Provide Counter-Intelligence (CI) Product Support. The contractor shall provide Counter-Intelligence Product support under this contract. This includes the management and oversight of all activities performed to support product development and distribution designed to ensure personnel awareness of their responsibilities to report unusual activities or behaviors and how to identify various threats from foreign intelligence entities, other illicit collectors of U.S. defense information, and/or terrorists. The following subtasks are not assigned to any one specific security business area and are intended to provide maximum flexibility and support to the enterprise:

3.7.1 Provide Adversarial Program Threats Support. This requirement may capture support such as:

· Collaborate with agencies such as Air Force Office of Special Investigations (AFOSI) and Naval Criminal Investigative Service (NCIS), and Counterintelligence Product Manager to develop and provide threat briefings to program personnel

· Analyze Intelligence/CI data and develop security products to support all IPTs

3.7.2 Provide Insider Threat Support. This requirement may capture support such as:

· Aide in the development, management, and execution of the Insider Threat Program supporting F-35 JPO

· Prepare documentation as required in support of Insider Threat Program

· Participate in and document results of Insider Threat working groups

3.7.3 Conduct Foreign Travel Briefings. This requirement may capture support such as:

· Develop and maintain foreign threat briefings for each country

3.7.4 Provide Counterintelligence (CI) Support to the Development of PPP. This requirement may capture support such as:

· Draft CI portions of PPPs and staff for coordination with stakeholders

3.7.5 Provide CI Guidance and Recommendations to Government Entities. This requirement may capture support such as:

· Provide guidance and recommendations on Intelligence and CI Assessments

· Assist with F-35 CI/Intelligence Security Working Groups

3.7.6 Provide Assessment and Authorization (A&A)/RMF/IT User Policy CI Integration Support.

3.8 Provide Foreign Disclosure Support. The contractor shall provide Foreign Disclosure Support in reviewing and documenting the release of information to international partners and customers. The contractor shall provide technical and analytical support for the Foreign Disclosure Office (FDO) in developing, updating, administering and evaluating F-35 policies and procedures directly affecting the release of highly technical and sensitive information to F-35 foreign partners and participants. The contractor shall assist the Government in interpreting disclosure policy and ensuring the appropriate Delegation of Disclosure Letter (DDL), Technical Assistance Agreement (TAA), Information Exchange Guide (IEG), National Disclosure Policy and/or export license are upheld. The following subtasks are not assigned to any one specific security business area and are intended to provide maximum flexibility and support to the enterprise:

3.8.1 Provide Foreign Disclosure Analysis Support.

3.8.2 Provide Foreign Disclosure Auditing Support.

3.8.3 Provide Foreign Disclosure Visit Support.

3.8.4 Provide Foreign Disclosure Training Support.

3.9 Provide Export Integration Support. The contractor shall assist the Government in facilitating export-related policy activities and support the F-35 Export Compliance Office including preparation and coordination of presentations for committee review, interacting with applicable interagency partners such as Department of State for export licenses, and interpreting/maintaining export-related documentation.

3.10 Provide Program Protection Cybersecurity/Security Control Assessment Services. The contractor shall provide Cybersecurity Services throughout the cybersecurity lifecycle process for Information Systems (IS), Platform Information Technology (PIT), Information Technology (IT) Services, and IT products that are or will be assessed or assessed and authorized by Authorizing Officials (AOs) within the F-35 Enterprise. The contractor shall perform all six steps RMF/JSIG processes, with a focus on Steps 4 and 5, Assessing Security Controls and Authorizing the System. The contractor shall perform research of known threats and threat vectors on variety of classified systems.

3.11 Provide Program Protection Cybersecurity (CS) Specialist Services. The following subtasks are not assigned to any one specific security business area and are intended to provide maximum flexibility and support to the enterprise:

3.11.1 Provide Cybersecurity Compliance Assessments. This requirement may capture support such as:

· Perform cybersecurity compliance assessments in alignment with Security with Staff Assistance Visits (SAVs) and Operational Assessment (OA) both CONUS and OCONUS. Provide written accounts of OA or SAV cybersecurity compliance assessments to event lead(s), and maintain knowledge and share site/files for lessons learned. Maintain and update Cybersecurity SAV and OA Checklists, database entries and required files. Schedule OA/SAV meetings and provide updates to Government entities.

3.11.2 Provide CS Specialist Services to F-35 Partners and FMS Security Professionals. This requirement may capture support such as:

· Provide Cybersecurity Specialist support to perform on-site cybersecurity compliance and oversight for Partner and/or FMS sites. Provide a full range of Information Assurance/Cybersecurity services which include but are not limited to: planning, developing, implementing, and maintaining programs, policies, and procedures to protect the integrity and confidentiality of systems, networks, and data; monitor the compliance of Partner/FMS participants with Authority to Operate (ATO) requirements for authorized F-35 information systems through on-site visits and email communication; develop, administer, and conduct cybersecurity training; train Partner/FMS personnel in cyber positions on cybersecurity best practices, procedures, industry standards, processes, and protocols; and participate in periodic meetings with Government entities to facilitate compliance activities being met, properly captured and reported.

3.12 Provide Program Protection Engineering Services. The following subtasks are not assigned to any one specific security business area and are intended to provide maximum flexibility and support to the enterprise:

3.12.1 Provide Anti-Tamper Security Support. This requirement may capture support such as:

· Provide insight into system requirements, design trades, architecture evolution, risk management, hardware and platform-software development, reliability, maintainability, safety certification, security certification, special programs, weight, power, cooling and volume to ensure a balanced Air System Design to facilitate meeting Anti Tamper (AT) requirements. Document architecture and design and coordinate reviews with Government entities.

3.12.2 Provide COMSEC Engineering Services. This requirement may capture support such as:

· Perform COMSEC engineering for the F-35 systems cryptographic and key management architecture. Support certification and accreditation activities for operational systems including performing full Risk Management Framework (RMF) efforts. Assist with National Security Agency (NSA) approval of cryptographic changes to the baseline F-35 End Cryptographic Units (ECUs) as well as new developments of F-35 ECUs, includes validating the usage of F-35 keying material to the operational controlling authorities.

3.12.3 Provide TEMPEST Engineering Services. This requirement may capture support such as:

· Coordinate and participate in the development of TEMPEST requirements for the F-35 Joint Strike Fighter (JSF) Air System (AS) and secure facilities supporting the Air System. Coordinate with the Air System Contractor, other Government entities, and Certified TEMPEST Technical Authorities (CTTAs) to ensure the F-35 AS is compliant with TEMPEST Regulations.

3.12.4 Provide Cyber Systems Engineering and Technical Assistance (SETA). This requirement may capture support such as:

· Provide systems engineering and technical cyber subject matter expertise to protect the air system and supporting networks and systems (Collateral and SAP/SAR) against sophisticated cyber threats. Provide expert input to the process of cyber requirements decomposition as part of the F-35 JPO Block 4 Continuous Capability Development and Delivery (C2D2) processes. Provide support to the F-35 JPO Cybersecurity Test and Evaluation Phases to include Analysis and Planning, Cyber Table Top Exercises, Developmental Testing, and Operational Testing. Develop and incorporate requirements for special purpose cyber capabilities and coordinate with external partners to identify and integrate approved technologies

4.0 GENERAL INFORMATION

4.1 Period of Performance. The period of performance (PoP) consists of a five (5) year ordering period with performance not to exceed two (2) years following the last day of the ordering period.

4.2 Place(s) of Performance. The primary place of performance will be the F-35 JPO located in Arlington, Virginia (VA). Other Government sites, which will be provided in the individual task orders, may include but are not limited to:

· Naval Air Warfare Center/Aircraft Division (NAWC/AD), Patuxent River, MD

· Edwards AFB, CA

· Naval Air Warfare Center/Weapons Division (NAWC/WD) China Lake, CA

· NAWC/WD, Pt. Mugu, CA

· Wright-Patterson AFB, OH

· Eglin AFB, FL

· OCONUS Locations

4.2.1 Contractors performing on-site support at the F-35 JPO will be provided access to workspaces, telephones, printers, facsimile machines, copy machines, shredders, computers, and network access including web servers and applicable databases or other applications necessary to carry out assigned tasks unless otherwise stated in the respective task order.

4.3 Hours of Operations. The contractor shall provide the required services and staffing coverage during normal working hours. Core hours are 0900-1500, Monday through Friday (except on the legal holidays specified in paragraph 3.5.3). Some supported Government offices have flexibility to start as early as 0500/0530 and end as late as 1900, Monday through Friday. This contract may include non-standard work hours at the task order level, including weekends and/or holidays. When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the work force are essential.

4.4 Compressed Work Schedule (CWS). CWS is an alternative work schedule to the traditional five 8.5 hour workdays (which includes a 30-minute lunch) that is allowable under this effort. Any additional costs associated with the implementation of the CWS schedule vice the standard schedule are unallowable costs under this contract and will not be reimbursed by the Government. Additionally, the CWS schedule shall not prevent Contractor employees from providing necessary staffing and services coverage when required by the Government. The overall schedule must be provided to the Contracting Officer Representative (COR) / Alternative Contracting Officer Representative (ACOR).

4.4.1 This contract may include tasks or labor categories for which a CWS is not eligible at the task order level.

4.4.2 Under a CWS schedule, an employee completes the following schedule within a two-week period of time: eight weekdays are worked at 9.5 hours each (which includes a 30-minute lunch), one weekday is alternately worked as 8.5 hours (which includes a 30-minute lunch) and one weekday is not worked by the employee. The result is 80 hours worked every two weeks, with 44 work hours one week and 36 work hours the other. The Contractor will only allow those employees residing on Government sites (includes contractor spaces within a JPO facility) with regularly occurring days off to participate in CWS.

4.5 Extended Core Business Hours. Contractor Staff may be required to work beyond Normal Core Business Hours. In the event that additional hours must be worked, prior approval must be obtained from the COR.

4.6 Overtime. Overtime as defined in this contract refers to hours worked by a contractor employee in excess of the employee’s normal work week. When support requirements outside of normal working hours occur, the contractor shall ensure qualified personnel are available to support the requirements through the use of overtime. Overtime may be authorized under this contract to the extent specified in individual task orders, provided COR approval is obtained in advance of each occurrence. The COR may provide concurrence for overtime on a task, event, program, project, or general function basis. The total cost for overtime over the life of the contract cannot exceed the amount specified in clause 52.222-2 Payment for Overtime Premiums unless first approved in writing by the Chief of the Contracting Office.

4.7 Telework. Permanent and situational telework may be permitted under this contract, at the task order level, in accordance with the Contractor’s corporate policy. The telework schedule must not impede the effort being performed and must be coordinated with Government security leads.

4.8 Meeting Support. In support of the tasking outlined in this PWS, the contractor shall have the capability to host and conduct meetings at the classification levels captured in the respective task orders at CONUS and OCONUS locations.

4.9 IT Operating Environment. The contractor shall maintain the capability to prepare documents and software packages compatible with the Government IT environment through the security classification of collateral secret. The current operating environment required for this contract includes the most recent suite of Microsoft Office and Adobe business products. Other specialized operating environment requirements may be required at the task order level.

4.9.1 The contractor shall maintain the ability to interface with and transfer data to and from requiring office software applications and their upgraded versions. The contractor shall maintain state-of the-art virus software and ensure that all media are virus free when delivered. The contractor shall be capable of Internet and LAN communications with the F-35 JPO. Contractor personnel shall be capable of maintaining real-time communications, both voice and data transfer capabilities, with the F-35 JPO during working hours whether at contractor work site or on travel.

4.9.2 The contractor shall have the capability to communicate both orally and in writing at a professional level in accordance with established service writing policy, such as the Tongue and Quill.

4.9.3 The contractor shall travel to/from government and industry facilities for technical discussions and system evaluations, including international facilities. The contractor shall maintain requisite skillsets to utilize automated tools based upon their respective area of assignment. The contractor shall be provided up to Top Secret SAP/SCI systems as required for execution of assigned duties as captured in the respective task orders.

4.10 Transition/Mobilization. The Contractor shall fully cooperate with incoming and outgoing personnel for assumption and relinquishing of contractual responsibilities and submit a transition plan detailing tasks for assuming and relinquishing contractual responsibilities as captured in the respective task orders.

4.11 Management of Contractor Personnel. The Government will neither supervise contractor employees nor control the method by which the contractor performs the required tasks. Under no circumstances shall the Government assign tasks to, or prepare work schedules for, individual contractor employees. The contractor shall manage its employees and guard against any actions that are of the nature of personal services, or give the perception of personal services. Provisions stated herein shall be clearly and effectively communicated to all subcontractors providing support under this contract by the Prime Contractor.

4.12 Installation Closure. When Federal facilities are closed by the Government, or when Federal employees are officially excused from work due to a holiday or a special event, severe weather, a security threat, or any other Government facility related problem that prevents Federal personnel from working at the Government facility, contractor personnel assigned to work at that facility in support of such Federal employees shall follow their parent company’s policies. At the task order level, telework may be approved by the COR if allowed by company policy.

4.12.1 While generally contractor personnel may not perform work on-site at a Government facility without Federal personnel present, in very limited circumstances, work being performed by contractor personnel may be deemed mission essential and performance of such mission essential work may be authorized to continue at the Government facility despite the facility being otherwise closed for normal operations. The circumstances permitting work being performed by contractor personnel to be deemed mission essential are extremely limited and generally only apply to performance of efforts related to public health, safety, or matters related to national security. The contracting officer must concur with any determination that work being performed by contractor personnel is mission essential.

4.13 Holidays. The Government observes the holiday’s captured below. With the exception of the events in section 4.7.1, the Contractor is permitted to observe the following holidays in accordance with corporate policy:

· New Year’s Day, January 1

· Martin Luther King’s Birthday, the third Monday in January

· President’s Birthday, the third Monday in February

· Memorial Day, the last Monday in May

· Independence Day, July 4

· Labor Day, the first Monday in September

· Columbus Day, the second Monday in October

· Veteran’s Day, November 11

· Thanksgiving Day, the fourth Thursday in November

· Christmas Day, December 25

4.14 Information Technology. The Contractor shall not purchase any IT equipment in support of this contract without COR approval vetted through the F-35 OCIO. Prior to any IT purchase, the Contractor shall complete the Consent to Purchase Request Template, per Attachment (TBD), for Technical Point of Contact (TPOC) review and COR approval. The Government will provide all necessary reference documents not generally available to the Contractor as required. Throughout the life of the contract, if any instruction or document is replaced or superseded, the replacement or superseding instruction or document shall be applicable to the requirements defined in this PWS.

4.15 Section 508 Compliance. All Electronic and Information Technology (EIT) products and services proposed shall fully comply with Section 508 of the Rehabilitation Act of 1973, per the 1998 Amendments, 29 United States Code (U.S.C.) 794d, and 36 Code of Federal Regulations (CFR) 1194. The contractor shall identify all EIT products and services proposed, identify the technical standards applicable to all products and services proposed, and state the degree of compliance with the applicable standards. Additionally, the contractor must clearly indicate where the information pertaining to Section 508 compliance can be found (e.g., vendor’s website or other exact web page location). The contractor shall ensure that the list is easily accessible by typical users beginning at time of award and shall inform the COR and TPOC of the information location.

4.16 Government Furnished Property (GFP). Contractors performing on-site support at the F-35 JPO will be provided access to workspaces, telephones, printers, facsimile machines, copy machines, shredders, computers, and network access including web servers and applicable databases or other applications necessary to carry out assigned tasks unless otherwise stated in the respective task order.

4.16.1 The Contractor shall establish a Property Management System that shall be in place prior to managing Government property. The Contractor shall develop, implement and maintain processes, systems, procedures, records, and methodologies, e.g., a system of internal controls, to efficiently and effectively manage (control, use, preserve, protect, repair, replace, and maintain) any Government property in the Contractor’s possession or use. The Contractor may employ customary commercial practices, voluntary consensus standards, or industry-leading practices and standards that provide effective and efficient Government property management necessary and appropriate for performance of this contract. The system shall satisfy the requirements of FAR Clause 52.245-1, Government Property.

4.16.2 The Contractor shall develop and maintain accountable property records that reflect the current status, location, and condition of each asset until authorized disposition of the property occurs. The property records shall provide a complete trail of all transactions suitable for audit and will be the authoritative source for validating the existence and completeness of an asset.

5.0 SECURITY REQUIREMENTS

5.1 DD-254, Contract Security Classification Specification. The contractor shall comply with security requirements specified in the DD-254 attached to this contract or a respective task order. Information or data that the contractor accesses shall be handled at the appropriate classification level, unclassified information shall be handled as “For Official Use Only”. Distribution is authorized to the Requiring Office’s Organization and supported Activity only. Other requests for deliverables under this contract shall be referred to the TPOC/COR of this contract for approval.

5.2 Basic Personnel Clearance Requirements. All contractor personnel shall maintain a minimum security clearance eligibility of Secret throughout contract performance. Individual task orders may require additional security clearance requirements, depending on the nature of the task to be performed.

5.2.1 All personnel must have required security clearance at day one of task order Period of Performance (PoP) unless otherwise indicated in the specific task order. All positions designated to have a SECRET clearance are required to have a SECRET clearance for performance in that position. Personnel may have an INTERIM SECRET clearance at time of award unless a Special Access Required (SAR) is required. Positions designated as SAR must have a final TOP SECRET clearance and be eligible for access under the SAP Nomination Process prior to onboarding. The contractor is responsible for ensuring that all personnel receive the requisite investigation and are favorably adjudicated in accordance with DoDM 5220.22, National Industrial Security Program Operating Manual (NISPOM). Contractor employees who fail to meet security clearance requirements may not access classified information or perform sensitive duties. In such cases, the contractor employee may not perform on the contract. There may be task orders under this IDIQ requiring security clearances at the time of contract award, up to the Top Secret (TS) Sensitive Compartmented Information (SCI) level.

5.2.2 The contractor shall possess and maintain Facility Security Clearance commensurate with the contract DD Form 254 (DD-254), Contract Security Specification for each task order associated with this contract.

5.2.3 Contractor employees who fail to meet security clearance requirements may not access classified information or perform sensitive duties. In such cases, the Contractor employee may not perform on the contract. Contractor employees shall cooperate with Government investigative agencies conducting criminal or administrative investigations.

5.3 Citizenship Requirements: Only U.S. citizens may perform under this contract. If the Contractor cannot find qualified U.S. citizens to perform the work, the Contractor shall submit a citizenship waiver request with justification to the Government Security Office. The waiver request should include

· The individual's name, date and place of birth, position title, and current citizenship

· A statement that a qualified U.S. citizen cannot be hired in sufficient time to meet the contractual requirements

· A statement of the unusual expertise possessed by the applicant

· Statement that access will be limited to a specific government contract (specify contract number)

· A statement that the Contractor has obtained an export license for the information required to perform the contract

5.4 Command Access Cards (CAC) / Local Badges: Contractor CACs and facility specific identification badges will be issued by the Government to on-site contractor personnel and shall be visible at all times above the waist while personnel are at the Government site. The contractor shall furnish all requested information required to facilitate issuance of identification badges. All CACs and identification badges issued to contractor employees shall be returned to the Government Security Department issuing the credential following completion of the contract, relocation or termination of an employee, or upon request from the COR. The Government will provide the contractor access to Government facilities, as required, for performance of tasks under this contract. Contractor personnel shall comply with all applicable security procedures and regulations for these facilities.

5.5 SAAR-N: All contractor personnel requiring access to Government Information Technology (IT) systems shall have an approved System Authorization Access Request (SAAR-N) Form OPNAV 5239/14 (Rev Sep 2011) on file, and complete required Annual Information Awareness Training. New employees must submit their SAAR forms within thirty (30) days of their first day of work. SAAR-N forms shall be submitted to the Contracting Officer’s Representative (COR), TPOC, or to the assigned government Trusted Associate Sponsorship System (TASS) Trusted Associate.

5.5.1 Instructions for completing and processing the SAAR-N forms are available at: http://www.cnrc.navy.mil/publications/Forms/OPNAV_5239_14_SAAR_N.pdf

5.6 Information Security. The Contractor shall comply with DoD, DHS, U.S. Navy, and U.S. Air Force security instructions specific to each location/facility. Compromise and/or Electronic Spillage of Classified or Controlled Unclassified Information: All instances of loss, compromise and electronic spillage of classified or controlled unclassified information shall be reported to the COR, TPOC and Government Security Office within 24 hours of the incident occurring. All reportable information IAW DoDI 5200.02 and DoDM 5205.07-V1 shall be reported to COR/TPOC within one business day of the incident.

5.6.1 If the work is performed at the contractor’s facility, the contractor shall implement and maintain security procedures and controls to prevent unauthorized disclosure of classified information and controlled unclassified information (CUI) and to control distribution of CUI in accordance with DoD 5220.22-M (NISPOM) and other relevant agency regulations and policies.

5.6.2 Marking. All information generated by the Contractor shall be properly marked. For Official Use Only information generated and/or provided under this contract shall be marked in accordance with DoDM 5200.01 volumes 1 thru 4. Technical information shall also be marked with appropriate Distribution Statements and Export Control warnings in accordance with DoDD 5230.24 and program Security Classification Guidance.

5.6.3 Public Release. No information pertaining to this contract shall be released for public dissemination, including posting to any social media sites such as Facebook or Twitter, unless it has been approved for public release by the appropriate U.S. government authority. Proposed public releases shall be submitted for approval prior to release through (insert Organization and/or servicing Public Affairs contact information).

5.7 Operations Security (OPSEC): The contractor shall comply with activity OPSEC program instructions, guidance and contribute to organization-level OPSEC efforts. The contractor will include OPSEC as part of its ongoing security awareness program and take all required activity OPSEC training. The contractor will protect identified critical information, sensitive unclassified information and activities, which, if divulged, could further compromise classified or sensitive information or operations, or degrade the planning and execution of operations performed by the RO and contractor in support of the mission. The Contractor shall be responsive to the Supporting OPSEC Manager on a non-interference basis.

5.7.1 While performing at F-35 JPO sites, the contractor shall: (1) comply with facility OPSEC…