Performance Work Statement - AFRSS Draft.pdf

AFRISS PWS – 07 MAR 25

AFRISS PWS – 07 March 2025

PERFORMANCE WORK STATEMENT (PWS)

FOR

AIR FORCE RESERVE OFFICERS’ TRAINING CORPS

INSTRUCTOR SUPPORT SERVICES

(AFRISS)

1.0 GENERAL INFORMATION

1.1 General: This is a non-personal services contract to provide Air Force Reserve Officers’ Training Corps Instruction Support Services (AFRISS). Consistent with Federal Acquisition Regulation (FAR) 37.104 guidance, the Government will not exercise relatively continuous supervision or control over Contractor personnel performing the services herein. The Contractor is responsible for the management, supervision, performance and conduct of Contractor personnel.

The intent is to ensure that this service contract does not evolve into a prohibited personal services contract through government assumption of control or supervision of Contractor employees.

1.1.1 Routine, normal communication, coordination and deconfliction of contractor tasks shall not constitute supervision and is recognized as an essential element of the mission partnership established through this non-personal services contract.

1.2 Description of Services/Introduction: The Contractor shall provide all personnel, equipment, supplies, transportation, tools, materials, supervision, and other items necessary to perform the Instructional support services defined in this Performance Work Statement (PWS) except for those items specified as Government furnished property and services. The Contractor shall perform to the standards in this contract.

1.3 Background: Air Force Reserve Officers’ Training Corps (AFROTC) selects, educates, trains, and commissions college students to be officers and leaders of character in the Total Air and Space Force. Additionally, AFROTC instills the values of citizenship, national and community service, personal responsibility, and a sense of accomplishment in college students. Currently there are 145 AFROTC Detachments located at universities across the nation. Mission requirements occasionally result in temporary gaps in the USAF ability to fill all required Instructor positions. The purpose of this contract is to provide qualified Instructors and support services to fill these gaps and prevent disruptions to the cadet’s training curriculum.

1.4 Scope: This PWS supports HQ AFROTC, its four (4) Regional Commands, and 145 subordinate Detachments in achieving objectives related to the training and commissioning of AFROTC Cadets and providing instructional support services to the AFROTC Program as a whole in order to instill in our Cadets the Institutional Competencies and Sub-Competencies as directed by the Secretary of Defense (SECDEF). The Contractor shall provide command-wide specialized support in the functional areas of Aerospace Studies Instruction and Field Training (FT) support to include administrative support, and related functions. The Contractor shall provide command-wide specialized administrative support as outlined in AFROTC Instruction 36-2011. The primary focus for AFROTC programs in the base period of this requirement is identified within Technical Exhibit (TE) 3 which outlines the initial staffing for this requirement. Due to the dispersed locations where Instructors are located, the government mandates the staffing at the Detachments. However, the contractor is encouraged to determine the most efficient and effective method to deliver the services to the AFROTC HQ. Preference is for the Contractor to perform from offsite locations where possible. The Contractor shall assign employees to meet these requirements at levels of their choosing, provided they deliver the services on time and on target at the specified quality standards. The government has no intention of creating a full-time employee requirement for any position other than Instructors at the Detachments. There may be a need in the future to increase, reduce or adjust the locations and numbers contained within TE 3 based on the availability of US Air Force personnel, shifts in cadet operational strengths, and shifts in AFROTC priorities.

1.5 Contractor Program Management:

1.5.1 Program Manager (PM): Prior to start of contract and within three workdays of any change, the Contractor shall identify and provide a PM who possess comprehensive knowledge of principles, policies, and practices of service acquisition and program management, as defined in DoDI 5000.74, AFI 63-138, as well as knowledge of roles and relationships within the DoD and the Air Force. The PM shall possess the knowledge of support activities that assist in assessing what programs are within schedule and cost baselines, be able to recommend viable solutions to problems, and the pursuit of alternative courses of action if needed. The PM must be able to effectively communicate orally and in writing, providing acquisition and program briefings, documents and presentations. The PM shall communicate and coordinate with government regarding routine and ad hoc tasks that may be required from time to time and assign personnel to complete the required tasks. The PM shall approve all required products and deliverables and respond to the COR’s and Contracting Officer’s questions and requests.

The PM shall be responsible for the performance of work at all locations. The PM shall possess the full authority to negotiate, act and commit for the Contractor on all contractual matters related to this contract. The PM shall notify the COR if any requested work is considered to be outside of scope and the COR will obtain Contracting Officer’s determination prior to commencing such activities. The PM shall be available to the COR, either telephonically or virtually, during the normal hours of operation, 7:30 a.m. through 5:00 p.m., Central Time, Monday through Friday, exclusive of any Federal holidays. When the PM is not available, the Contractor shall designate an individual to act for the PM.

1.5.2 If Contractor management personnel become, or are expected to become, unavailable for work under this contract for a continuous period exceeding 30 workdays or expected to devote substantially less effort to the work than indicated in the proposal, the Contractor shall immediately notify the COR in writing. The Contractor shall promptly replace such personnel with personnel of at least equal or higher level of education, experience, skills, training, and qualifications.

1.5.3 Quality Control: Quality control is the process the Contractor uses to verify their own work products and is ALWAYS the Contractor’s responsibility. The Contractor shall have an effective quality control program to ensure services are performed in accordance with the contract’s requirements. The Contractor’s quality control program is the means by which it ensures that work performed complies with the requirement of the contract.

1.5.3.1 The Contractor shall develop and implement a Quality Control Plan (QCP) specific to this contract that addresses processes and procedures implemented to ensure performance meets all contract requirements. Within 30 calendar days of contract award, the Contractor shall submit their comprehensive written QCP to the Contracting Officer for review and acceptance. Any proposed changes to the QCP that go into effect during the contract shall be submitted to the Contracting Officer for review five (5) days prior. The QCP shall contain at a minimum:

• Contract number.

• Description of processes and controls used to verify acceptable performance by contractor employees for assigned tasks, documentation requirements and retention procedures.

• Contractor-developed metrics used to verify performance level of each contract objective.

• Internal processes to correct self-identified performance or quality discrepancies.

• The contract objectives, associated standards, metrics, and quantitative values for each metric shall be reported in the monthly status report that clearly identifies the monthly performance level against each contract objective.

The QCP is NOT to be based on the government’s QASP but shall be an independent document based solely on Contractor’s own internal processes to validate performance meets terms and conditions of the contract prior to submitting invoices for payment.

1.5.4 Quality Assurance: Quality Assurance is the process the government uses to verify the Contractor is following their own Quality Control Plan. The Government will evaluate the Contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). It defines how the performance standards will be inspected, the frequency of surveillance, and the maximum acceptable defect rate(s). The QASP is an independent government document and is not part of the contract. The government may change this document and or processes at any time without notification to the contractor.

1.6 Legal Federal Holidays: The following Federal legal holidays, subject to individual school schedules, are observed under this contract except for support to Field Training or their future equivalents each summer:

Federal Holiday Date

New Year’s Day 1 January

Martin Luther King’s Birthday Third Monday in January

President’s Day Third Monday in February

Memorial Day Last Monday in May (occurs during FT)

Juneteenth 19 June (occurs during FT)

Independence Day 4 July (occurs during FT)

Labor Day First Monday in September

Columbus Day Second Monday in October

Veterans Day 11 November

Thanksgiving Day Fourth Thursday in November

Christmas Day 25 December

1.7 Hours of Operation: The Contractor shall at all times maintain an adequate workforce for the uninterrupted delivery of all services defined within this PWS when the Government facility is not closed for the above reasons. In the event of a Government furlough, the Contractor shall continue to maintain an adequate workforce for the uninterrupted delivery of all services defined within this PWS unless notified otherwise by the contracting officer in writing.

1.7.1 Irregular Hours: The Contractor shall provide support services for the program to each of the designated locations. Support services at the Detachments may on occasion be required at irregular hours including early mornings, evenings, and weekends.

1.7.2 Additional Hours of Operation: During the performance of this contract, Contractor personnel at the Detachments may be required to perform services beyond normal university/college operating hours which shall include weekend working hours during peak periods throughout the year. Work performance may require holiday work and weekend work for Contractor personnel supporting field training preparations/operations and specific location schedules.

1.8 Places of Performance: The Contractor shall perform Instructional support services at the locations listed in TE 3. Due to potential fluctuations in the Air Force’s assignment of military personnel performing AFROTC instructor support and administrative services, changes to the places of performance listed in TE 3 are expected during the performance of this contract. These changes will generally be identified in early spring when the following academic years staffing is solidified by USAF. There may also be a need to increase the number of locations requiring contractor support. The Government will coordinate any upcoming changes with the Contractor in advance. By 15 April of each year, the COR will provide a forecast of contractor places of performance for the following academic year. Such changes will be negotiated and implemented in a modification of the contract.

1.8.1 Remote Service Delivery. For non-instructor services at the AFROTC HQ, the contractor is encouraged to develop procedures to provide required services from remote locations.

Contractor shall not be provided any GFE for this service and is responsible for all equipment necessary for access to government systems. This process is encouraged to prevent any personal services interpretations that may impact contract implementation and to facilitate

Contractor’s oversight and management of their personnel. Remote access proposals shall be submitted to the COR for validation and approval by the Contracting Officer prior to implementation.

1.8.2 If contractor cannot develop approved remote access procedures, the contractor employees shall perform the services at the AFROTC HQ, Maxwell AFB. This may increase the supervision and management workload for the Contractor to ensure non-personal service conditions remain in place.

1.8.3 Contractor Program Manager shall be responsible for all work assignments, supervision and management of their employees at all times, whether on site or remote.

NOTE - Nothing in this PWS is intended to prevent the contractor employees’ routine conversation, coordination, or deconfliction of their daily work activities with government personnel.

1.9 Period of Performance:

Base Period: 21 July 2025 thru 20 June 2030 Option Period 1: 21 June 2026 thru 20 June 2027 Option Period 2: 21 June 2027 thru 20 June 2028 Option Period 3: 21 June 2028 thru 20 June 2029 Option Period 4: 21 June 2029 thru 20 June 2030

1.10 Contracting Officer’s (CO) Authority: The Contracting Officer is the only person authorized to direct changes of any terms and conditions under this contract. In the event that the Contractor enacts any change at the direction of any person other than the Contracting Officer, the change will be considered to have been made without authority and solely at the risk of the Contractor.

1.11 Contracting Officer’s Representative (COR): A COR will be identified and appointed by separate letter. The Contracting Officer will appoint the COR from the requiring activity, located at HQ, AFROTC, Maxwell AFB. The COR will assist in the contract administration. The COR is primarily responsible for monitoring, assessing, recording, and reporting on Contractor compliance with the terms and conditions of the contract. The COR has primary responsibility for completing quality assurance monitoring forms that will be used to document the inspection and evaluation of the Contractor’s performance. The COR will perform acceptance of compliant services on behalf of the contracting officer or reject deficient services. The COR will maintain assessment documentation, notify the CO of any significant performance deficiencies and recommend improvements to the QASP and PWS throughout the life of the acquisition.

1.12 Government Technical Monitor (GTM): Due to the dispersed locations of the dets, the COR requires localized assistance with oversight of instructor performance. Each det with assigned contractor instructors shall designate a government person to assist the COR. The COR shall develop and provide standardized questions for the GTM to answer and return each month to the

COR.

1.12.1 The GTM is not empowered to make any contractual commitments or authorize any changes to the order/contract or in any way obligate additional funds by the government, such authority rests solely with the Contracting Officer.

1.13 Safety: All work performed under this contract shall be conducted in a safe manner and in compliance with Occupational Safety and Health Act (OSHA), Environmental Protection Agency (EPA), State, College, University, and all other nationally recognized safety standards. Safety, in all Government efforts, is the upmost priority. Contractor is solely responsible for compliance with safety regulations and shall immediately report and violations or accidents to the COR. Any safety violations will be addressed in the Contractor’s yearly CPARs report.

1.14 Security Requirements:

1.14.1 Disqualifying Factors: The Contractor shall ensure that no instructors have any record for the following types of offenses which are criteria for automatic disqualification:

a. A sexual offense.

b. Any criminal offense involving a child or youth victim.

c. A felony offense involving illegal or improper use, possession, or distribution of any controlled or psychoactive substances, narcotics, cannabis, alcohol, or other dangerous drug.

d. A civil adjudication or administrative proceeding concerning the death or serious injury to a child, youth or dependent person entrusted to the individual’s care.

e. Any violent crime such as murder, non-negligent manslaughter, forcible rape, robbery, aggravated assault and kidnapping, which involved force or threat of force, as well as robbery, aggravated assault and arson.

f. Removal/termination from their position within the AFRISS program.

g. Detailed record of poor behavior/conduct unbecoming of a contract instructor while performing under the AFRISS program.

1.14.2 Inappropriate Relationships: Under the provisions of DoDI 1304.33, Protecting Against Inappropriate Relations During Recruiting and Entry Level Training, Contractor employees shall be made aware of DoD’s policy regarding inappropriate relations and sign a DD Form 2982 Recruiter/Trainer Prohibited Activities Acknowledgement and DD Form 2983, Recruit/Trainee Prohibited Activities Acknowledgement stipulating their awareness of the prohibited activities.

The Contractor shall provide, prior to any Contractor employee performing duties under this contract, to the COR and the Detachment Commander at the location where the services are performed, a copy of the signed DD Form 2982 & 2983. The DD Form 2983 must be executed annually thereafter. Compliance shall be reported in monthly status report.

1.14.3 Contractor personnel who are hired and later determined to no longer meet suitability standards shall be immediately removed from contract duties. The Contractor shall verbally notify the COR within 24 hours of misconduct which may result in security threat terminations of Contractor personnel or when any suitability issues or unfavorable security information is discovered or known. Contractors shall report all instances that qualify as a reportable event under AFROTC/College standards to the COR within 24 hours of the event. Reporting standards will be posted at each Contractor’s work location. Contractor shall replace personnel removed for cause with fully qualified personnel, ready to perform duties within 30 days of occurrence.

1.14.4 Security of Government/University Equipment, Facilities and Data: The Contractor shall be responsible for safeguarding all Government/University equipment, information and property provided for Contractor use. At the close of each work period, Government/University facilities, equipment, and materials under Contractor’s responsibility shall be secured.

1.14.4.1 Contractor personnel entering government facilities or government-leased facilities shall conform to security regulations during the contract period and shall be subject to security checks as may be deemed necessary to ensure that security violations do not occur.

1.14.4.2 Contractor Notification Responsibilities: The Contractor shall notify the contracting officer within 30 days before on-base performance of the service. The notification shall include:

a. Name, address, and telephone number of Contractor representatives.

b. The contract number and contracting agency.

c. The location(s) of service performance and future performance, if known.

d. The date service performance begins.

e. Any change to information previously provided under this paragraph.

1.14.4.3 Obtaining and Retrieving Identification Media: As prescribed by the DAFFARS 5352.242-9000, Contractor access to Air Force installations, DAFFARS 5352.242-9001, Common Access Cards (CAC) for Contractor Personnel, FAR 52.204-9, Personal Identity Verification of Contractor Personnel, DoDI 5200.46, DoD Investigative and Adjudicative Guidance for Issuing the Common Access Card and DoDM 1000.13, DoD Identification (ID) Cards, ID Card Life-Cycle, the contractor must comply with the requirements set forth in these guidance.

a. The contractor shall obtain base identification and vehicle passes, if required, for all contractor personnel who make frequent visits to or perform work on the Department of the Air Force installation(s) cited in the contract. Contractor personnel are required to wear or prominently display installation identification badges or contractor-furnished, contractor identification badges while visiting or performing work on the installation.

b. The contractor shall submit a written request on company letterhead to the contracting officer listing the following: contract number, location of work site, start and stop dates, and names of employees and subcontractor employees needing access to the base. The letter will also specify the individual(s) authorized to sign for a request for base identification credentials or vehicle passes. The contracting officer will endorse the request and forward it to the issuing base pass and registration office or Security Forces for processing. When reporting to the registration office, the authorized contractor individual(s) should provide a valid driver’s license, current vehicle registration, valid vehicle insurance certificate, and to obtain a vehicle pass.

c. Common Access Cards (CACs). Contractors shall provide a listing of personnel who require a CAC to the contracting officer. The government will provide the contractor instruction on how to complete the Mission Partner Identity, Credential, and Access Management (MP ICAM) application and then notify the contractor when approved.

Contractor personnel shall obtain a CAC from the nearest Real Time Automated Personnel Identification Documentation System (RAPIDS) Issuing Facility (typically the local Military Personnel Flight (MPF)). While visiting or performing work on installation(s)/ location(s), contractor personnel shall wear or prominently display the CAC as required by the governing local policy. In order to be issued a CAC, the contractor must meet the requirements:

A favorably adjudicated National Agency Check with Inquiries (NACI) (now a Tier 1 or T1 background investigation) or equivalent in accordance with revised Federal Investigative Standards is the minimum background investigation required for a final credentialing determination for a CAC.

A CAC may be issued on an interim basis based on a favorable National Agency Check or a Federal Bureau of Investigation (FBI) National Criminal History Check (fingerprint check) adjudicated by appropriate approved automated procedures or by a trained Security or Human Resources (HR) specialist, and successful submission to the investigative service provider (ISP) of a NACI or a personnel security investigation (PSI) equal or greater in scope.

If the contractor does not meet the minimal criteria for CAC issuance, the COR will work with the unit security assistant and 42 ABW/IP office to initiate the process on behalf of the contractor.

d. During performance of the service, within seven (7) working days of any changes to the listing of the contract personnel authorized a CAC, provide an updated listing to the contracting officer who will provide the updated listing to the authorizing government official. Return CACs in accordance with local policy/directives within seven (7) working days of a change in status for contractor personnel who no longer require logical or physical access.

e. When work under this contract requires unescorted entry to controlled or restricted areas, the contractor shall comply with DAFI 31-101, Integrated Defense, and DoD 5200.02_DAFMAN 16-1405, Air Force Personnel Security Program.

f. Upon completion of the contract, termination of the contract, or expiration of the identification passes/CAC, the prime contractor shall ensure that all base identification passes/CACs issued to employees and subcontractor employees are returned to the contracting official representative or the issuing office within seven (7) working days.

Contractor shall report any lost or stolen CACs.

g. All commercial vehicles will be directed to Gate 3 (Kelly St) or Gate 4 (Congressman Dickenson for Gunter) for processing through the Commercial Vehicle Inspection (CVI) Area, when operational. During non-duty hours and holidays, commercial vehicle inspections will be conducted at Gate 1 (Maxwell Blvd) or Gate 4 only. Inspection members will conduct thorough inspections of the interior and exterior of the vehicle for items prohibited from the installation such as explosive devices, weapons and ammunition, drugs, and open or closed alcohol containers.

h. Failure to comply with these requirements may result in withholding of final payment.

1.14.4.3.1 Visit Request: Ensure an initial and annual Visit Request (VAR) has been submitted for all contractors performing unclassified duties as part of this contract via company letterhead to 42 ABW/IP Office (42ABW.IP.Workflow@us.af.mil). If the company doesn’t have the ability to encrypt this information, they can contact 42 ABW/IP Office who will provide them with a secure method to transmit via DoD SAFE.

The VAR shall include the contract number, dates, work location, each contractor employee's full name, date of birth, social security number, and be signed by company Key Management Personnel (KMP). The VAR will also indicate for each contractor if they require a common access card (CAC) or a DBIDS identification card. This information will be used to assist in the vetting and monitoring process for contractors who require a CAC. The VAR shall be updated any time there is a personnel change (added/removed) from the contract.

1.14.4.4 The Contractor’s employees shall comply with applicable installation, campus, facility and area commander installation/campus/facility access and local security policies and procedures. The Contractor shall provide all information required for background checks to meet installation/campus access requirements to be accomplished by installation/campus Security Forces/Police, Director of Emergency Services or Security office. The Contractor shall comply with all personal identity verification requirements as directed by DoD, HQ DAF and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in Contractor security matters or processes.

1.14.4.5 Key Control: The Contractor shall establish and implement methods of making sure all keys/key cards issued to the Contractor by the Government/University are not lost or misplaced and are not used by unauthorized personnel. NOTE: All references to keys include key cards. No keys issued to the Contractor by the Government/University shall be duplicated. The Contractor shall develop procedures covering key control that shall be included in the QCP. Such procedures shall include turn-in of any issued keys by personnel who no longer require access to locked areas. The Contractor shall immediately report any occurrences of lost or duplicate keys/key cards to the GTM.

1.14.4.5.1 In the event keys, other than master keys, are lost or duplicated, the Contractor shall, upon direction of the Contracting Officer, rekey or replace the affected lock or locks; however, the Government, at its option, may replace the affected lock or locks or perform re-keying. When the replacement of locks or re-keying is performed by the Government, the Contractor shall be responsible for the total cost of rekeying or the replacement of the lock or locks. In the event a master key is lost or duplicated, all locks and keys for that system will be replaced by the Government and then the Contractor shall reimburse the Government for the total cost of the replacement.

1.14.4.5.2 The Contractor shall prohibit the use of Government issued keys/key cards by any personnel other than the Contractor's employees. The Contractor shall prohibit the opening of locked areas by Contractor employees to permit entrance of personnel other than Contractor employees engaged in the performance of assigned work in those areas or personnel authorized entrance by the Contracting Officer.

1.14.4.6 Common Access Card (CAC): Employees requiring

access to Government systems in order to perform services under this contract shall obtain a CAC. Proof of employment, background screening, and favorable background check is required before an ID CAC will be issued authorizing access to the Installation and Government computer systems. CACs may not be issued to Contractor employees unless a data record authorizing CAC issuance is resident in the Defense Enrollment Eligibility Reporting System (DEERS). The Mission Partner Identity, Credential and Access Management (MPICAM) was developed as a secure and authorized means of entering Contractor data into DEERS in addition to automating the CAC application and approval process. In order to enter Contractor data into MPICAM, the Contractor's data must be resident in the Defense Information System for Security (DISS). Reference Paragraph

1.14.4.3 for directions on how to obtain a CAC.

1.14.4.6.1 Common Access Card Accountability: CACs issued under this TO shall be turned into the Trusted Agent (TA) at such time the CAC holder is no longer employed under this TO. If the TA is not available due to circumstances or geographical dispersion, the CAC shall be turned into the COR, APAS, or military chain of command.

1.14.4.6.2 Controlled Unclassified Information (CUI): The contractor shall comply with DoDI 5200.48_DAFI 16-1403, Controlled Unclassified Information, DoDM 5200.01v1_DAFMAN 16-1404v1, Information Security Program, and Freedom of Information Act Program. The contractor shall monitor CUI aggregation and compilation based on the potential to generate classified information pursuant to security classification guidance addressing the accumulation of unclassified data or information.

All CUI associated with this contract must be safeguarded to prevent unauthorized public disclosure. CUI such as PII, Security Classification Guides (SCG), and other technical information with Distribution Statements B, C, D, E or F are not authorized for public release and cannot be placed on a publicly accessible web site or web server. All emails containing such information or attachments must be appropriately marked, and digitally signed and encrypted if being transmitted. All transmissions to personal email accounts (AOL, Yahoo, Hotmail, Comcast, etc.) and posting on social media websites (Facebook, Instagram, Twitter, LinkedIn, etc.) are prohibited. Destroy all CUI associated with this contract by any of the following approved methods: A cross-cut shredder (that produce 1mm x 5mm or 0.04in x 0.2in particles or smaller); a certified commercial destruction vendor; a central destruction facility; incineration; chemical decomposition; pulverizing, disintegration (pulverize or disintegrate with a 3/32in or 2.4mm security screen); or methods approved for classified destruction.

1.14.4.6.2.1 General: There are types of information that are not classified but require application of access and distribution controls and protective measures developed for DoD Controlled Unclassified Information for a variety of reasons. The types of CUI identified for the program are identified in DODI 5200.48 and have replaced legacy formats such as For Official Use Only (FOUO), Law Enforcement Sensitive (LES), as well as some of those developed by other Executive Branch agencies of the U.S. Government and technical data described below as well as protective measures for CUI material.

Formats such as FOUO, LES, et al. are legacy formats no longer in use but are protected as if they have CUI markings. Protections and restrictions can be found in DoDI 5200.48, CUI 06 March 2020.

1.14.4.6.2.2 Technical Data Description: Any recorded information related to experimental, developmental, or engineering works that can be used to define an engineering or manufacturing process, or can be used to design, procure, produce, support, maintain, operate, repair, or overhaul program material. The data may be graphic or pictorial delineations in media (e.g., computer software, drawings, photographs, etc.), text in specifications, related performance or design documents, or computer printouts. Examples of technical data include research and engineering data, engineering drawings, and associated lists, specifications, standards, process sheets, manuals, technical reports, catalog-item identifications, related information, and computer software documentation. The DoD Scientific and Technical Information Program (see DoDI 3200.12.).

1.14.4.6.2.3 CUI Markings: Prescribed marking of CUI documents will be in accordance with DoDI 5200.48, CUI 06 March 2020. CUI may also be identified in security classification guides to ensure the information receives appropriate protection.

1.14.4.6.2.4 Access: CUI may be released to an individual who has a valid need for such access within the scope of their assigned duties, furthering the accomplishment of a lawful and authorized government purpose and would not be detrimental to the interests of the DoD or U.S. Government. Information in any media format will be disseminated on a need-to-know basis. This restricts the use or dissemination of CUI data to those with direct affiliation with the given program/project to conduct official business for the DoD, provided that dissemination is consistent with any further controls imposed by a distribution statement. Personnel no longer requiring access to CUI must surrender any information in their possession to the program lead, who will take action to terminate further access.

1.14.4.6.2.5 Storing and Handling: During working hours, take reasonable steps to minimize the risk of access to CUI by unauthorized personnel (e.g., not reading, discussing, leaving CUI information unattended where unauthorized personnel are present or display CUI in public places to include the internet). After working hours, store CUI information in locked desks, file cabinets, bookcases, locked rooms, locked/controlled e-files or similar means to prevent theft of program information.

Computers used to process CUI do not need to be accredited for classified use. Do not process CUI on public computers (e.g., those available to the public in kiosks, hotels, café’s, etc.) or computers that do not have Public Key Infrastructure (PKI) access controls. Personally owned computers are not authorized to process CUI.

Authorized electronic devices provided by the government agency (e.g., laptops, cell phone) used to store CUI must be physically protected and use NIST/NIAP-approved cryptographic products, e.g., DoD approved PKI Certification available at http://iase.disa.mil/pki/eca or http://csrc.nist.gov/cryptval/ , which require encryption passcodes to teleconferences/web conferences where CUI may be discussed.

1.14.4.6.2.6 Dissemination: CUI printed documents, and material may be transmitted through mail channels or hand-carried without formal courier orders.

CUI information may be disseminated to DoD personnel and DoD contractors to conduct official business for the program. If dissemination is required outside of DoD channels contact the program lead, contracting officer, and security manager for approval. Release of technical data will follow the release instructions identified in the distribution statement. Use secure communications whenever available for discussions involving CUI. Send voice and facsimile transmissions only when authorized recipients have acknowledged positive control measures are in place to receive the information.

1.14.4.6.2.7 Destruction: CUI documents shall be disposed of according to provisions of EO 13556, CUI; DoDI 5200.48, CUI 06 March 2020. Component records management directives. Non-record CUI documents may be destroyed by any methods that prevents compromise, e.g., tearing, burning, or shredding of the means approved for the destruction of classified information or by any other means that would make it difficult to recognize or reconstruct the information.

1.14.4.6.2.8 Reporting: Report any loss or unauthorized attempt to gain access to CUI information to the organization’s security manager immediately, but no later than the end of the first duty day. If additional information is required after initial notification, guidance will be provided at that time.

Contractors must complete the DoD Mandatory Controlled Unclassified Information (CUI) training. The CUI training course #IF141.06 at the Defense Security Service Center for Development of Security Excellence (CDSE) Security Awareness Hub at:

DoD Mandatory Controlled Unclassified Information (CUI) Training #IF141.06 – Annually https://securityawareness.usalearning.gov/cui/index.html or via the Air Force myLearning portal.

1.14.4.7 Computer and Network Access Requirements: Contractor personnel that require access to unclassified government computers and operations systems Information Technology (IT) Systems will be designated as Non-sensitive Positions. Contractor http://iase.disa.mil/pki/eca http://csrc.nist.gov/cryptval/ https://securityawareness.usalearning.gov/cui/index.html personnel must have a Tier 1 and the Tier 1 be favorability adjudicated before operating government furnished computer workstations or systems that have access to Air Force e-mail systems. These investigations shall be submitted by the government at no additional cost to the contractor. NOTE: Since the background investigation process can take up to 18 months, contractor personnel may be issued a CAC before the process is completed after a favorable fingerprint return (3-5 working days) and investigation package submitted to the investigative service provider and the investigation is scheduled.

The servicing Information Protection Office (IPO) is responsible for submitting Tier 3 and Tier 5 investigations for contractor personnel in positions designated as “national security positions” but without a requirement for access to classified information. The servicing IPO will submit these investigation requests based on contract requirements, which will be validated through the Office of Personnel Management’s Position Designation Tool (PDT).

These investigations shall be submitted by the Government at no additional cost to the Contractor. The Contractor shall comply with DoDM 5200.02_DAFMAN 16-1405, Air Force Personnel Security Program; and AFI 10-701, Operations Security (OPSEC) instructions, OUSD(I) Memorandum, Clarification of Clearance Requirements for Access to Investigative and Adjudicative Relevant Data, 27 Jun 2019, and DoDI 5200.46, DoD Investigative and Adjudicative Guidance for Issuing the Common Access Card, and Homeland Security Presidential Directive-12 (HSPD-12) requirements.

Contractor personnel that require access to the Air Force network will complete the current DoD IAA CyberAwareness Challenge course located in the Air Force myLearning or https://public.cyber.mil/training/cyber-awareness-challenge/.

1.14.4.8 System Access: When requested by the Government, the Contractor shall provide access to and information regarding the systems that the Contractor operates or maintains on behalf of the Government under this contract. This includes identifying the specific computer systems, programs, websites, SharePoint, modules, and all related access requirements. The government retains the right to direct which systems are authorized or restricted for contractor access or usage in the performance of contractor obligations.

1.14.4.8.1 Requests for waivers to access automated systems shall be forwarded to the COR. Any Contractor personnel operating a government-provided computer shall possess a favorable suitability investigation or an approved waiver pending investigation and have completed all DoD and local computer access training required. AFROTC required courses are listed in section 1.15 of this PWS. Additional local College and University training may be required dependent on location. That training will be identified after assignment. Failure to maintain suitability standards set forth herein will subject Contractor personnel to suspension of access to government automated systems. If a contract employee is suspended from system access, the Contractor remains responsible for the performance of services and shall take appropriate action to ensure no break in performance or delivery of services.

1.14.4.9 Systems Security: The Contractor shall encrypt all Contractor-owned laptops or other portable media storage devices that process or store PII, in accordance with NIST https://public.cyber.mil/training/cyber-awareness-challenge/

FIPS 140-2 (or successor). The Contractor shall require FIPS 140-2 (or successor) encryption of any sensitive PII when transmitted electronically across the internet or other public networks.

1.14.4.10 Data Security: The Contractor, unless otherwise authorized by the Government, shall limit access to PII to those employees and subcontractors who require the information in order to perform their official duties under this contract. The Contractor, Contractor employees, and subcontractors shall physically or electronically protect PII when not in use and/or under the control of an authorized individual. During the course of contract performance, when PII is no longer needed or required to be retained under applicable Government records retention policies, the Contractor shall coordinate with the contracting officer to either turn over the PII to the Government or destroy it through means that will make the PII irretrievable (i.e., permanently unavailable for access by any person). The Contractor shall only use PII obtained under this contract for purposes of the contract and shall not collect or use such information for any other purpose without the prior written approval of the Contracting Officer. At expiration or termination of this contract, the Contractor shall coordinate with the Contracting Officer to either turn over all PII managed under the contract that is in its possession to the Government or successor Contractor, or if the Government so directs, destroy the PII.

1.14.4.11 Data Breach Response and Notification: The Contractor shall adhere to the reporting and response requirements for Personally Identifiable Information (PII) set forth in Memorandum, office of the Secretary of Defense on Safeguarding Against and Responding to the Breach of PII, dated June 5, 2009, ALARACT 050/2009, and any amendments. The Contractor shall immediately notify the COR upon discovery that a suspected or actual breach of PII has occurred. The notification shall include, to the greatest extent possible, the identification of each individual who’s PII has been or possibly has been breached. In addition, the Contractor shall provide the COR with any other available information that must be included in required breach reporting and notifications. The Contractor shall provide this information at the time of the initial notification to the Government or promptly thereafter as information becomes available. The Government will determine whether a breach of PII has occurred, and whether breach notification to affected individuals is required. If breach notification to affected individuals is required, the Government will determine if the Contractor shall make the required notification. If the Contractor is to notify the impacted population, it shall submit the notification letters to the COR for review and approval by the contracting officer.

1.14.4.12 Freedom of Information Act Program (FOIA): The contractor shall comply with DODM 5400.07_AFMAN 33-302, DoD Freedom of Information Act (FOIA) Program, requirements. The regulation sets policy and procedures for the disclosure of records to the public. The contractor shall comply with AFI 33-332, Air Force Privacy and Civil Liberties Program, when collecting and maintaining information protected by the Privacy Act of 1974 authorized by Title 10, United States Code, section 8013. The contractor shall maintain records in AFI 33-322, Records Management and Information Governance Program; and disposed of in accordance with Air Force Records Information Management System (AFRIMS) Records Disposition Schedule (RDS) located at https://www.my.af.mil/gcss-af61a/afrims/afrims/.

https://www.my.af.mil/gcss-af61a/afrims/afrims/ https://www.my.af.mil/gcss-af61a/afrims/afrims/

1.14.4.13 Reporting Requirements: The contractor shall comply with AFI 71-101, Volume- 1, Criminal Investigations, and Volume-2, Protective Service Matters, requirements.

Contractor personnel shall report to 42 Air Base Wing Information Protection Office, any information, or circumstances of which they are aware may pose a threat to the security of DoD personnel, contractor personnel, resources, and classified or unclassified defense information. Contractor employees shall be briefed by their immediate supervisor upon initial on-base assignment and as required thereafter.

1.14.4.14 Physical Security: Areas controlled by contractor employees shall comply with base operations plans/instructions for FPCON procedures, Random Antiterrorism Measures (RAMS) and local search/identification requirements. The contractor shall safeguard all government property, including controlled forms, provided for contractor use.

At the close of each work period, government training equipment, ground aerospace vehicles, facilities, support equipment, and other valuable materials shall be secured.

1.14.4.15 Internal Operating Instructions: The contractor will adhere to the Air Force activity operating instructions (OI) for internal circulation control, protection of resources, and to regulate entry into Air Force controlled areas during normal, simulated, and actual emergency operations.

1.14.4.16 Access Lock Combinations: Access lock combinations will be protected from unauthorized personnel. The Contractor will adhere to the Air Force activity operating instruction (OI) for ensuring lock combinations are not revealed to unauthorized persons and ensure the procedures are implemented. The Contractor is not authorized to record lock combinations without written approval by the COR.

1.14.4.17 Traffic Laws: The contractor and their employees shall comply with base traffic regulations set forth in AFI 31-218, Motor Vehicle Traffic Supervision and DoDM 5200.08v3_AFMAN 31-101v3, Installation Perimeter Access Control. Personnel in violation may be issued a Central Violations Bureau Form 1805 traffic ticket.

1.14.4.18 Random Installation Entry/Exit Checks: Entry/exit vehicle checks are conducted by order of the 42 ABW Commander. These checks are conducted for the purpose of safeguarding the base and protecting government property by discovering and seizing stolen property, classified information, and contraband. Refusal to submit to an installation (entry/exit) vehicle check may result in the loss of base driving privileges, revocation of base registration, or debarment action.

1.14.4.19 Cellular Phone Operation Policy: The use of cellular phones while operating a motorized vehicle is prohibited on Maxwell-Gunter. Although discouraged, drivers are authorized to use devices, i.e., ear bud or ear boom, which allows their cellular phone to be operated hands-free. The device must not cover both ears. This policy applies to everyone driving on Maxwell-Gunter AFB. Personnel in violation may be issued a Central Violations Bureau Form 1805 traffic ticket

1.14.4.20 Wireless Electronic Devices: The contractor will not establish their own Information Technology (IT) systems or networks (Local Area Networks [LAN], Wide Area Network [WAN], Cellular phone/USB Modem as WAN, Wi-Fi as WAN, etc.), or camera system without the direct permission of the Program Manager and governing communications and responsible information systems office.

1.14.4.21 Firearms and Ammunition: Transporting weapons or ammunition, concealed or otherwise, IS NOT permitted by any non-law enforcement personnel on Maxwell AFB/Gunter Annex at any time regardless of state issued concealed weapons permits.

Violations may result in criminal prosecution under the applicable federal laws.

1.14.4.22 Illegal Weapons: The below weapons are considered illegal, unless specifically authorized by competent authority, and are prohibited on any Air Force Base. Violations may result in criminal prosecution under the applicable federal laws.

a. Switchblade knives or knives with any type of automatic blade release.

b. An incendiary/explosive weapon (e.g., grenades, flash bangs).

c. Fireworks

d. Homemade mortars, aka "tennis ball launchers" or similar devices.

1.14.1.23 Security Education and Training: The contractor will be required to participate in the government’s in-house and web-based security training program under the terms of the contract. The government will provide the contractor with access to computer-based training at the Air Force MyLearning web site. Contractor personnel are required to complete the following training and any additional training identified by Government Contracting Agency or Security personnel: Annual Cyber Awareness Training, Force Protection Training, and DoD Mandatory Controlled Unclassified Information (CUI) Training.

1.14.4.24 Operations Security (OPSEC): The Contractor will comply with installation and organizational OPSEC requirements in accordance with AFI 10-701 and applicable supplements. They will also receive a local threat briefing.

1.14.4.25 Communications Security (COMSEC): All communications with DoD organizations are subject to COMSEC review. The Contractor shall be aware that telephone communications, and IT networks are continually subject to intercept by unfriendly intelligence organizations. DoD has authorized the military department to conduct COMSEC monitoring and recording of telephone calls originating from, or terminating at, DoD organizations. Therefore, the Contractor is advised that any time it places a call or receives a call it is subject to COMSEC procedures. The Contractor shall ensure wide and frequent dissemination of the above information to all employees dealing with DoD information.