PWS 9_30_2024 Sources Sought 10-31.pdf

i

PERFORMANCE-BASED WORK STATEMENT (PWS)

Launch and Early Orbit, Anomaly Resolution and Disposal

Operations (LADO) Basic Sustainment

U.S AIR FORCE

309 SWEG

7/30/2024 ii

TABLE OF CONTENTS

1 DESCRIPTION OF SERVICES

1.1 Background

2 SCOPE

3 BASIC SERVICES

3.1 Software Engineering Tasks

3.2 Hardware Tasks

3.3 Systems Engineering Tasks

3.4 Test Engineering Tasks

3.5 Documentation

3.6 Project Management

3.7 Reports and Meetings

4 SERVICE SUMMARY

5 CDRL SUMMARY

6 ADDITIONAL REQUIREMENTS

6.1 Government Furnished Property (GFP)

6.2 Quality Control Plan

6.3 Quality Assurance

6.4 CONTRACT ADMINISTRATION

6.5 Configuration Management

6.6 Problem Resolution

6.7 Security Requirements

6.8 Cybersecurity/Software Assurance

6.9 Subcontract Management

6.10 Travel / Temporary Duty (TDY)

6.11 Manpower Reporting:

6.12 Base Access

6.16 Network Access:

6.17 Security Requirements

7 SECURITY:

8 CONFLICTS OF INTEREST

9 GENERAL INFORMATION

9.1 Hours of Operation

iii

9.2 Conservation of Utilities

10 ENVIRONMENTAL CONTROLS

10.1 Hazardous Work Environment

10.2 Notification of Environmental Spills

10.3 Safety Program

11 GOVERNMENT OBSERVATIONS

12 FOREIGN OBJECT DAMAGE (FOD) AND TOOL CONTROL

13 ENVIRONMENTAL:

Appendix A – Acroynms

Appendix B – Name of Appendix

Appendix C – SAFETY

1 DESCRIPTION OF SERVICES

1.1.1 This Performance-Based Work Statement (PWS) outlines the tasks and duties required of the contractor to support the OO-ALC 517th SWES. The intent of this PWS is to obtain engineering services for activities needed in support of Launch and early orbit, Anomaly

Resolution, and Disposal Operations (LADO) sustainment. The period of performance of this contract shall be a 12 month base period with four (4) individual 1 year options and one (1) six

(6) month option to extend services.

1.1.2 Primary Performance Locations

Primary Place of Performance

Schriever SFB, Colorado

Peterson SFB, Colorado

Vandenberg SFB, California

1.1 Background

GPS is a space-based radio navigation, time distribution and Nuclear Detonation (NUDET)

Detection System (NDS). Its mission is to provide precise, continuous, all weather, three dimensional (3-D) position, velocity, timing and NUDET information to properly equipped air, land, sea and space-based users. GPS serves both military and civilian users.

GPS consists of three segments: Space Segment (SS) which nominally consists of 31 operational satellites in 6 orbital planes with up to 6 satellites appropriately spaced in each plane; User Segment which consists of the NUDET Detection users and Navigation users;

and the Control Segment (CS) which consists of the LADO (Launch and early orbit, Anomaly resolution and Disposal Operations) system and the OCS (for operational orbit support).

LADO consists of three major functions: 1) Telemetry, Tracking and Commanding (TT&C),

2) Mission Planning, and 3) LADO Simulation. The TT&C provides the commanding of the satellite(s), sending and receiving telemetry as well as tracking data. Mission Planning is responsible for the planning and execution of satellite maneuvers during launch and early orbit (LEO), anomaly resolution and disposal activities. The LADO Simulator provides a simulation of telemetry, commanding and selected subsystems functionality for the different block type satellites forming the GPS constellation. It also provides simulation of specified maneuvers and anomalies, as well as ground facilities utilized for the LADO mission.

1.2 Compliance Documentation

There are no additional compliance requirements outside of the basic IDIQ PWS for this task order.

2 SCOPE

The Contractor shall support all LADO products that contribute to LADO systems that are both currently in place, and any mission unique systems built into LADO. The software list includes, but is not limited to the following products:

2.1 The contractor shall provide software upgrades, changes, and modifications to the

TT&C, Core Applications, Simulation software and applicable hardware devices.

2.2 LADO Hardware and Software Licenses

2.2.1 The contractor shall supply user licenses for all applicable LADO software, as referenced in PARA 2.

2.2.2 The contractor shall maintain Freeflyer (or equivalent) and Veritas Backup Exec Server licenses and their service agreements, as required. If the above licenses are permitted by the

Government to be replaced with another Government approved software, the contractor shall provide and maintain the replacement licenses and respective maintenance support, as required.

2.2.3 The contractor shall provide software changes and modifications to the TT&C, Core

Applications, Ace Premier Simulation and Software and applicable hardware devices as it relates directly to the KS-252 integration.

2.3 Cryptographic Upgrades

2.3.1 The contractor shall ensure LADO software supports the cryptographic upgrades within the system. This includes integration of the cryptographic equipment into the LADO system.

2.3.2 The contractor shall provide software changes and modifications to the TT&C, Core

Applications, Ace Premier Simulation software and applicable hardware devices as it relates directly to cryptographic integration (including firmware updates).

3 BASIC SERVICES

3.1 Software Engineering Tasks

3.1.1 The contractor shall write software that requires knowledge in the core product programming language(s) to correct errors, add new launch, anomaly resolution and orbital operations capabilities, and upgrade interfaces to improve performance. The core programming language is C++. Documentation of changes must be made according to the established processes as specified SMC-

S-012 and may include the Software User’s Manual (SUM).

3.1.2 The contractor shall complete software builds within agreed upon completion date(s) established during release planning, and integrated into the Global

Positioning System (GPS) Enterprise/Master Schedule. All errors identified shall be documented within the Government approved database and corrected within the assigned software build phase. (Service Summary)

3.1.3 The contractor shall prepare all Space and Missile Center Sustainment

Programing Office prioritized (up to 50) Issues annually, to include a detailed engineering analysis, engineering design, risk assessment, and test methodology.

The Contractor shall maintain, in the government approved database, Issues throughout the release cycle. The contractor shall design, code and test software modifications. (Service Summary)

3.1.4 The contractor shall provide training to the system end users (operators) on new software releases that significantly affect the form or utility of the TT&C, Core

Application, and Simulation software at least seven days prior to the

Modification Control Board (MCB). The Contractor shall provide training to the system end users (operators) on general topics in Telemetry, Tracking, and

Commanding (TT&C) and Simulator operations by in classroom briefings or over-the-shoulder activities. (Service Summary)

3.1.5 The contractor shall provide subject matter expert support for TT&C, Core

Application, and Simulation software in support of standalone exercises, and spacecraft readiness rehearsals, and launch and early orbit activities.

The contractor shall install or assist in its installation of licenses on the test bed and operational computers. The contractor shall install licenses within 12 hours at Peterson and

Schriever SFB, and install licenses within 7 business days at Vandenberg SFB.

3.1.6 The contractor shall provide 24/7 on-site support for surge periods or on-call support up to 3 times per year.

3.1.7 The contractor shall ensure the LADO system is supported by the most current operating system mandated by DoD policy.

3.1.8 The contractor shall participate in the Decision Review Board (DRB) by being present and answer questions. Contractor shall participate as requested by

Government Program Manager.

3.2 Hardware Tasks

3.2.1 The contractor shall supply LADO hardware/software components and assist in the installation and maintenance of these at the test laboratory at Peterson SFB, Schriever SFB, and at the Alternate Master Control Station (AMCS). The hardware includes:

• SIU Black (Simulator Interface Unit- Command)

• SIU Red (Simulator Interface Unit-Telemetry)

• CCT (Command, Control and Tracking)

• CTK (Command, Telemetry and KG Controller)

3.2.2 The contractor

shall maintain LRU/FEPs, to include replacement of defective

LRU and FEP. The contractor shall repair or replace the defective units on the operational systems (during real-world or Mission Operations Transfer) within

12 hours at Schriever SFB and Vandenberg SFB. The contractor shall repair or replace the defective units on the non-operational systems within 5 business days at Peterson SFB, Schriever SFB and Vandenberg SFB.

3.2.3 The contractor shall provide meeting documentation and participate in the Spe Design

Review (CDR) Board and the Preliminary Design Review (PDR) Board. (CDRL A/B/C001)

3.3 Systems Engineering Tasks

3.3.1 The contractor will receive requests to change or modify the way the system operates through GitLab Issues (hereafter called Issue(s)) in the government approved database.

3.3.1.1 The contractor shall analyze system requirements and decompose into the correct subsystem functionality.

3.3.1.2 After the Government identifies an Issue and the Government determines it is necessary to be fixed, the contractor shall prepare an engineering analysis of the reported problem by the date established in concurrence with the Government This analysis includes: the affected requirements, a cost estimate justification, qualification requirements, test plan, and cost attributes. The Release Content Meeting (RCM) uses these engineering analysis to determine whether to include this Issue in a future software release.

3.3.2 The contractor shall identify candidate Issues for inclusion into a software release, and provide an engineering assessment to the 517th.

3.3.3 The contractor shall prepare a design and enter it in the government approved database describing the specific approach for resolving the Issues associated with a release, and conduct design reviews either through a meeting or email. The

517th GPS Project Director will review the design. This is executed in conformance with SMC-S-012, Software Development for Space Systems. This task supports the software builds specified in paragraph 3.1.2.

3.3.4 The contractor shall participate in special studies (up to 4 times per year) and provide recommendations to the 517th to improve system performance, reliability, usability, and maintainability. (Service Summary). (CDRL A/B/C002)

3.4 Test Engineering Tasks

3.4.1 The contractor shall receive testing tasks according to paragraph 5.8 in

SMC-S-012. The contractor shall perform unit integration and testing to ensure that it works together as intended. The activity of unit integration and testing may require the use of all verification methods (i.e., Inspection (I), Analysis (A), Demonstration (D), and Test (T)).

3.4.1.1 The contractor shall perform unit testing on TT&C, Core Application, and Simulation software in accordance with SMC-S- 012, Software

Development for Space Systems. This task supports the software builds specified in paragraph 3.1.2. (Service Summary)

3.4.1.2 The contractor shall perform integration/regression testing on software changes for each new release, and provide a report. The Contractor shall maintain the software baseline configuration with on-call support for off-hour system deliveries and installations. The contractor shall provide support during normal work hours (8 hours a day/5 days a week

0700-1530, Mon-Fri). Additionally, the contractor shall provide on-call support for off-hour system deliveries and installations. (Service

Summary )

3.4.1.3 The contractor shall conduct pre-delivery integration testing to verify compatibility of software changes with existing software baseline in, accordance with SMC-S-012, Software Development for Space

Systems. This task supports the software builds specified in paragraph

3.1.2. (Service Summary)

3.4.1.4 The contractor shall analyze the test data collected during testing to determine if the specifications and requirements were met in accordance with SMC-S-012, Software Development for Space

Systems. This task supports the software builds specified in paragraph 3.1.2. The contractor shall document all system non-conformances using the project defect tracking process in a government approved database at least one week prior to the PRB meeting.

3.4.1.5 The contractor shall provide the 517th with installation instructions for each delivery on or before the Modification Control Board (MCB) approval to install the software for operational use.

3.4.1.6 The contractor shall provide installation and test support to Level 1 at the completion of Level 2 testing. Level 1 performs operational testing on each new release.

3.5 Documentation

3.5.1 The contractor shall support the Government (517th SWES) in creating AFTO

22/252s to report and correct deficiencies in published TOs or to provide TO updates as a result of hardware or software changes. Each AFTO 22/252 must include all requested changes for that particular maintenance action.

3.5.2 The contractor shall provide the following documentation in support of releases as required by the 517th:

3.5.2.1 Software User Manual (Redlined version) (CDRL A/B/C/D/E/F/G 014)

3.5.2.2 Release Installation Instructions

3.5.2.3 TOs/Drawings (Redlined version)

3.5.2.4 Technical Reports (CDRL A/B/C/D/E/F/G 009)

3.5.2.5 Cybersecurity Artifacts

3.6 Project Management

3.6.1 The contractor shall provide project management support for TT&C, Core

Application, and Simulation software for the Software Engineering, Systems

Engineering, Test Engineering, Documentation and Database

Management tasks. The following are tasks included: Staff tasking and performance management, developing and maintaining an operating budget, Developing and maintaining a project schedule, and providing status reporting to customer and upper management. Identifying and managing project risk items.

Status is provided during weekly status meetings and in monthly status reports.

3.6.2 The contractor shall provide task status during the weekly status meetings and included in the monthly status reports. The weekly status meetings and the monthly status reports shall include, but not limited, to:

a) Current task status

b) Planned task completion date

c) Actual task completion date

d) Estimated hours to complete each task in the software release

e) Actual hours to complete each task in the software release

f) Issues and concerns regarding software release

g) Explanation for late tasks

3.7 Reports and Meetings

3.7.1 Weekly Status Meeting

3.7.1.1 The contractor shall provide status to the 517th during weekly team meetings. Weekly status must include the Contractor’s performance in comparison to the planned delivery schedule for each product delivery in a software release. This comparison shall include, but not limited to, status of actual percent (%) complete, planned percent complete as of the reporting date, and issues/concerns with associated recommendations (any risks that would cause a change in schedule or cost, associated recommendations to mitigate issue). The weekly status reporting will include a task completion list detailing the status of development tasks and test execution activities as well as the high level status of project completion. If schedules are behind, an explanation must be included.

3.7.1.2 The contractor shall also identify and report any official/unofficial problem reports that are written and corrected during the software development cycle. This includes problem reports documented during peer review and test results.

3.7.2 Monthly Status Report

3.7.2.1 The contractor shall provide a Monthly Status Report to 517th GPS

Project Director and the Contract Officer Representative (COR) by the

10th day of the following month. Reports will show the status and progress of the project(s) being worked and significant Contractor achievements or roadblocks. The report will identify breakdown of government funds usage for the month and remaining project funds. All data deliverables will be referenced in the monthly status reports

(CDRL A/B/C/D/E/F/G 001).

3.7.2.2 The contractor’s monthly status report shall include software release development/testing objectives and thresholds (e.g. planned completion and actual completion) in regards to meeting the projected software release delivery date to the 517th.

3.7.3 Meetings

3.7.3.1 The contractor shall participate in meetings when changes to the hardware/software baseline are required or as t he events schedule indicates. These meetings include: (Service Summary)

• Weekly Status Meetings

• Release Content Meeting (RCM)

• Critical Design Review

• Preliminary Design Review

• Modification Control Board

• Engineering Review Board (ERB)

• Release Planning

• Rehearsal Support

• Program Management Review

• Technical Interchange Meetings

4 SERVICE SUMMARY

Service

Summary

Number

Performance

Requirement

Performance

Threshold

A001

3.7.2.1

Contractor's

Progress, Status and Management

Report

Due by the 10th calendar day of each month

3.3.4

Government

Furnished Property

Inventory Report

Due 120 days ARO, and any required updates to GFP

6.2

Quality Assurance Program Plan

Due 14 days ARO

Appendix

C

Software Quality

Assurance Report

5 Air Force -

Technical Manual

Contract Requirements

(TMCR)

Reference individual

Task Order PWS for specific delivery instructions.

6 Manuals, Technical - Time Compliance

Technical Orders

Reference individual

Task Order PWS for specific delivery instructions.

7 Product Drawing And Associated

List

Reference individual Task Order PWS for specific delivery instructions.

8 COTS Manuals Reference individual Task Order PWS for specific delivery instructions.

9 Technical Reports- Study/Services

Reference individual Task Order PWS for specific delivery instructions.

10 Security Test Plan Reference individual

Task Order PWS for specific delivery instructions.

11 Test Procedure Reference individual Task Order PWS for

12 Software Development Plan

Reference individual Task Order PWS for

13 Database Design

Description

Reference individual

Task Order PWS for specific delivery instructions.

14 Software User

Manual

Reference individual

Task Order PWS for specific delivery instructions.

15 Engineering

Change Proposal

(ECP)

Reference individual

Task Order PWS for specific delivery instructions.

16 Computer

Software Product End Item

Reference individual

Task Order PWS for specific delivery instructions.

17 Software Test Plan Reference individual Task Order PWS for specific delivery instructions.

18 Configuration Management Plan

Due 90 days ARO, and as required from the Government requests

19 Phase-Out Transition Plan

Reference individual Task Order PWS for

5 CDRL SUMMARY

Contract information data shall be delivered electronically in accordance to the corresponding requirement for each Data Item listed in Table 5-1 (below). The contractor shall have no more than one error per quarter for all CDRL submittals. The contractor shall submit CDRLs according to the due date indicated and have no more than one CDRL per quarter submitted after the identified due date. Grammatical errors do not count as an error. Substantive mistakes shall be corrected within two working days and corrective action taken to prevent recurrence of inaccurate late CDRLs.

Table 5-1

CDRL Number Title PWS Paragraph

A/B/C/D/E/F/G 001 Contractor's Progress, Status and Management Report

3.7.2.1

A/B/C/D/E/F/G 002 Equipment Inventory

Records

6.1

A/B/C/D/E/F/G 003 Quality Control Plan 6.2

A/B/C/D/E/F/G 004 Software Quality Assurance

Report

A/B/C/D/E/F/G 005 Air Force -Technical Manual

Contract Requirements

(TMCR)

A/B/C/D/E/F/G 006 Manuals, Technical - Time

Compliance Technical

Orders

A/B/C/D/E/F/G 007 Product Drawing And

Associated List

A/B/C/D/E/F/G 008 Commercial Off-The Shelf

Manuals

A/B/C/D/E/F/G 009 Technical Report - Study

Services

3.5.2.4

A/B/C/D/E/F/G 010 Security Test Plan

A/B/C/D/E/F/G 011 Test Procedures

A/B/C/D/E/F/G 012 Software Development Plan

A/B/C/D/E/F/G 013 Database Design Description

A/B/C/D/E/F/G 014 Software User Manual 3.5.2.1

A/B/C/D/E/F/G 015 Engineering Change

Proposal

A/B/C/D/E/F/G 016 Computer Software Product

End Items

A/B/C/D/E/F/G 017 Software Test Plan (STP)

A/B/C/D/E/F/G 018 Configuration Management

Plan

6.5.2

A/B/C/D/E/F/G 019 Transition/Phase-Out Plan

6 ADDITIONAL REQUIREMENTS

6.1 Government Furnished Property (GFP)

Government furnished property will be issued to the contractor for repair when repairs are needed. The contractor shall safeguard all GFP placed into the contractor’s care. GFP shall be shipped to the OEM facility and returned to the 517th SWES by the contractor, at the contractor’s expense. (See attached excel spreadsheet). The contractor shall provide an equipment inventory record within 120 calendar days after contract award (CDRL A/B/C/D/E/F/G 002)

6.2 Quality Control Plan

The contractor shall establish a complete Quality Control Plan (QCP) to ensure the requirements of this contract are provided as specified (CDRL A/B/C/D/E/F/G 003). The contractor's quality management program shall comply with the minimum quality management systems elements specified in the American National Standards Institute (ANSI), American Standards

Organization (ASO), and International Standard Organization (ISO) family of standards. The report shall be submitted to the 517th SWES Engineer, NLT 30 days post contract award.

6.3 Quality Assurance

6.3.1 The 517th SWES Engineer or alternate(s), will perform assessments of the contractor’s performance. Subsequent to contract award, specific name and contact information of the 517th SWES Engineer(s), with a letter defining duties and authority will be furnished to the contractor.

6.3.2 The 517th SWES Engineer or alternate(s) will inform the task manager in person when discrepancies occur and will request corrective action. The 517th SWES

Engineer or alternate(s) will make a notation of the discrepancy on the assessment checklist with the date and time the discrepancy was noted and will request the task manager (or authorized representative) to initial the entry on the checklist.

6.3.3 The government may inspect each task as completed or increase the number of quality control inspections if deemed appropriate because of repeated failures discovered during quality control inspections or because of repeated customer complaints.

6.3.4 Any matter concerning a change to the scope, prices, terms or conditions of this contract shall be referred to the CO.

6.4 CONTRACT ADMINISTRATION

6.4.1 The contractor shall ensure professional and technically qualified personnel to perform assigned tasking. The Contractor shall provide total task management and supervise contractor personnel. The Contractor’s Technical Lead shall serve as the primary point of contact for all technical aspects of the required work. This person shall also be a prime provider of the required technical services. No personal services shall be performed. The Contractor shall have current working knowledge/experience of the GPS LADO system to include TT&C development and testing procedures.

6.5 Configuration Management

6.5.1 The contractor shall allow the Government access to all software/hardware engineering processes and procedures needed to perform the work on this contract.

6.5.2 The contractor shall perform configuration management to include the identification, control, accounting and auditing of the functional and physical characteristics of LADO systems and the maintenance of the systems documentation. The contractor shall assess current system configuration when reviewing documents, attending reviews, planning meetings or working groups or any other meeting/council and relay significant findings to the Government

(CDRL A/B/C/D/E/F/G 018).

6.5.3 Provide technical support to 517 SWES personnel during reviews and system safety related meetings at Peterson SFB. Assess current system configuration when reviewing documents, attending reviews, planning meetings or working groups or any other meeting/council and relay significant findings to the

Government.

6.6 Problem Resolution

6.6.1 The contractor shall bring problems, or potential issues, affecting performance to the attention of the COR and the 517th GPS Project Director as soon as possible.

Verbal reports will be followed up with written reports when directed. This notification shall not relieve the contractor of its responsibility to correct problems for which they are responsible. The contractor will work cooperatively with the COR and/or CO to resolve issues as they arise.

6.7 Security Requirements

6.7.1 517th GPS Project Director will assist contractor in processing the necessary

DoD forms to obtain base or area badges for access to Government facilities.

6.7.2 DD Form 254: Overarching security requirements and Contractor access to classified information shall be as specified in the basic DD Form 254, which will be further identified in the contract DD Form 254, tailored as required. All

Contractor personnel with access to unclassified information systems, including e-mail, shall have at a minimum a favorable National Agency Check Local

Agency Checks and Credit Check (NACLC).

6.7.3 Visitor Group Security Agreement: The Contractor shall sign a Contractor

Visitor Group Security Agreement to protect classified information involved in performance under this contract. The Agreement will outline responsibilities in the following areas: Contractor security supervision; Standard Practice

Procedures; access, accountability, storage, and transmission of classified material; marking requirements; security education; personnel security clearances; reports; security checks; security guidance; emergency protection;

protection of Government resources; DD Forms 254; periodic security reviews;

and other responsibilities, as required.

6.7.4 The Contractor shall be required to comply with local procedures for handling classified materials in the following facilities where classified information is processed or stored:

Facility Location Work Facility Security

Classification

MCS Schriever SFB CO LADO Sustainment SECRET

AMCS Vandenberg SFB CA LADO Sustainment SECRET

6.7.5 If required, the contractor may contact the government security manager for a

Common Access Card (CAC). The Government security manager will direct contractor to appropriate location and registration processes.

6.7.6 If needed, the contractor shall also obtain a Building ID and access card from the appropriate government security manager.

6.7.7 When the period of performance is complete and/or Contractor leaves work, on this project, they shall have 5 working days to terminate all their network user account(s) and to return all access cards and base identification badges.

6.7.8 The 517 SWES or SMC/SL shall provide special base access, computer security training and security training to the contractor employees by the appropriate government agency as needed. This training must be preapproved by the 517

SWES project director. Special base access, computer security training and security training will be provided to the contractor employees by the appropriate

6.7.9 Individuals performing work under this contract shall comply with applicable program security requirements as stated below. This contract will support the following levels of security: Unclassified and Secret (S).

6.7.10 All personnel shall have a Secret clearance or higher and be United States citizens. Contractors shall obtain security clearances prior to performing services under the contract. The contractor shall comply with the Contract Security

Classification Specification (DD Form 254) for this contract which encompass all security requirements. All personnel shall comply with Operations Security

(OPSEC) requirements as set forth in DoD Directive 5205.02, Operations

Security Program and AFI 10-701, Operations Security. In accordance with DoD

5200.2-R, Personnel Security Program (Jan 87), DoD military, civilian, consultants and contractor personnel using unclassified automated information systems, including e-mail, shall have, at a minimum, a completed favorable

National Agency Check plus Written Inquiries (NACI).

6.7.11 The contractor shall obtaining the appropriate (PSI) for its employees prior to assigning them to work this contract. For the contract PSI cost shall be the responsibility of the contractor. Acquisition planning must consider Anti-

Terrorism (AT) measures when the effort to be contracted could affect the security of operating forces (particularly in-transit forces), information systems and communications systems IAW DoD Instructions 2000.16 Anti-Terrorism

Standards.

6.8 Cybersecurity/Software Assurance

6.8.1 The contractor shall provide cybersecurity support to the Government sustainment cybersecurity team for continued Assessment and Authorization of all LADO systems (MCS, AMCS, LADO Lab) IAW Department of Defense current cybersecurity guidance

6.8.2 In coordination with the Government, the contractor shall design, develop and implement secure applications and configurations through applying applicable

DoD STIGs, checklists, vendor security guidance, industry best practices, and applicable vendor product security patches. The contractor shall ensure applications are in compliance with DoDI 8500.01 Cybersecurity (current version) and DODI 8551.1 Ports, Protocols, and Services Management (PPSM)

(current version) and free of all of the Common Weakness Enumeration/System

Administration, Networking, and Security Institute (CWE/SANS). The contractor shall leverage, to the maximum extent possible, automated tools to identify and remediate vulnerabilities or weaknesses in the application design/coding, such as those described in the CWE/SANS TOP 25 Most

Dangerous Software Errors http://www.sans.org/top25-software-errors/.

6.8.3 The contractor shall assist the Government cybersecurity personnel with the following activities related to the contractor’s hardware/software:

6.8.3.1 Provide required cybersecurity artifacts for all assigned cybersecurity controls for inclusion in the Government assessment and authorization packages for all LADO systems.

6.8.4 This support requires qualified and certified personnel (IAW DOD 8570.01-M).

6.8.5 The contractor shall provide support to assure software functions as intended and is free of vulnerabilities, either intentionally or unintentionally designed or inserted as part of the software. Utilizing current government policy and/or operating procedures the contractor may be required to assist in the investigation and application of risk mitigation procedures and to exploit vulnerabilities at the system and sub-system level. Activities include, but are not limited to, improvements in software assurance through the development of tools and techniques; strengthening software partitioning and modularity capabilities; and theoretical and practical application of enhanced vulnerability discovery. The contractor shall demonstrate that the contractor has visibility into its supply chain for critical components, understands how supply chain risk can be introduced through those components, and has implemented or plans to implement countermeasures to mitigate such risks. The contractor shall plan for and implement countermeasures that mitigate the risk of foreign intelligence or foreign influence, technology exploitation, supply chain and battlefield threats and vulnerabilities that result in Level I (Catastrophic) and Level II (Critical) protection failures of the system per MIL-STD-882 mission criticality definitions

6.9 Subcontract Management

6.9.1 The contractor shall be responsible for any subcontract management necessary to integrate work performed on this requirement and shall be responsible and accountable for subcontractor performance on this requirement. The Contractor shall ensure there are no Organizational Conflict of Interest (OCI) considerations associated with management of the work distribution across prime and subcontractors. Cross teaming is permitted provided the teaming arrangement does not create any OCI.

6.10 Travel / Temporary Duty (TDY)

6.10.1 Travel within El Paso County including other contractor’s facilities, Schriever

Space Force Base, and Petersen Space Force Base, will be considered the local area.

6.10.2 No Government reimbursement will be given for travel within the local area.

6.10.3 Travel to other government facilities, or other facilities outside the local area, shall be pre-approved by the Contract Officer. Costs for travel shall be billed in accordance with the regulatory implementation of Public Law 99-234 and FAR

31.205-46, Travel Costs.

6.11 Manpower Reporting:

6.11.1 The Contractor shall report ALL Contractor labor hours (including sub-contractor labor hours) required for performance of services provided under this contract via a secure data collection site. The Contractor is required to completely fill in all required data fields at http://www.SAM.gov

6.11.2 Reporting inputs will be for the labor executed during the period of performance for each Government fiscal year (FY), which runs 1 October through 30

September. While inputs may be reported any time during the FY, all data shall be reported no later than 31 October of each calendar year. Contractors may direct questions to the Contractor Manpower Reporting Application (CMRA) help desk.

6.11.3 Uses and Safeguarding of Information: Information from the secure web site is considered to be proprietary in nature when the contract number and Contractor identity are associated with the direct labor hours and direct labor dollars. At no time will any data be released to the public with the Contractor name and contract number associated with the data. User Manuals: Data for Air Force service requirements must be input at the ECMRA link. User manuals for

Government personnel and Contractors are available at the ECMRA link at http://www.SAM.gov

6.12 Base Access

6.12.1 Contractor will schedule all visits and coordinate Base entry by contacting Mitch

Smolcha, Mitchel.Smolcha@us.af.mil, (801) 586-4543, or Rhodora Niel, Rhodora.Niel@us.af.mil, (801) 586-4526. The contractor shall be escorted at all times.

6.12.2 Contractor personnel performing work under this contract must have an active secret security clearance at time of award, and must maintain this level of security clearance through the entire period of performance.

6.13 Display of Identification

6.13.1 When contractor employees are inside a secure work area within an AFB, they shall wear visible Government-provided identification either as a part of, or attached to their outer clothing. The identification shall clearly identify the individual as being a contractor employee.

6.14 Obtaining Identification

6.14.1 During performance of the contract, the contractor shall be responsible for obtaining required identification for newly assigned personnel. Upon the termination or completion of the contract, or in the case of an employee who no longer requires access to the work site, the contractor shall be responsible for promptly returning credentials to the Security Forces Pass and Registration

Office. Lost badges shall be reported to the Maintenance TPMoup Security

Officer within one (1) working day of the badge being lost.

6.15 Removal of Contractor Personnel

6.15.1 The contractor understands that any contractor employee may be summarily and immediately removed from or denied access to any Government property, facility, and installation at the sole discretion of competent Government authority if that authority determines such action is necessary to protect or preserve

Government property, safety, and security, or to maintain good order and discipline.

6.16 Network Access:

6.16.1 The Contractor must meet the same security requirements as government employees for access to AF networks or Automated Information Systems (AIS).

6.16.2 For those contractor employees who require government computer access only, a

National Agency Check with written Inquiries (NACI) must be accomplished through the government.

6.16.3 Contractor employees shall complete Network User Licensing Computer Based

Training (CBT) per AFI 33-115 Volume 2, paragraph 5.4.

6.16.4 Contractor employees requiring a government provided e-mail account shall annually complete the Information Assurance Awareness training. Interim access may be granted by Designated Approving Authorities only after submission of the NACI and favorable finger print determination has been received by the applicable security manager.

6.16.5 Contractors who no longer need network or AIS access shall report within 3 business days to the appropriate security manager and the Functional System

Administrator.

6.16.6 The contractor understands that any contractor employee may be summarily and immediately removed from or denied access to any government property, facility, and installation at the sole discretion of competent government authority if that authority determines such action is necessary to protect or preserve government property, safety and security, or to maintain good order and discipline.

6.17 Security Requirements

6.17.1 The contractor shall comply with all Security, Force Protection, and

Antiterrorism requirements enforced at each installation. The contractor shall comply with local unit in and out processing procedures for all contractor personnel to ensure proper security-related briefings and debriefings are accomplished.

6.17.2 Contractor Identification Badges and Access Cards

6.17.2.1 The Contractor shall utilize the Defense Biometric Identification System

(DBIDS) Badge/Controlled/Restricted Authorization Badge

(CAB/RAB) in accordance with Hill AFB Instruction 36-812 and Hill

Installation Defense Plan.

6.17.2.2 DBIDS Cards

6.17.2.3 Contractor submits a completed Air Force Materiel Command (AFMC)

Form 496, Application for AFMC Identification Card, to the

Contracting Officer Representative (COR). The COR completes and forwards Form 496 to the Security Manager (SM) for signature and processing. The SM will notify the COR after Form 496 is approved with instructions for obtaining a DBIDS. Contractors shall return completed Form 496 to issuing SM to begin the in-processing.

Contractor employees with issues associated with their information on their Form 496 will be disapproved for DBIDS and will not be granted access to the installation.

NOTE: Escort authority will not be authorized, and Force

Protection “Bravo” is the minimum established by Security Forces

Squadron (SFS). Contractors with a current DBIDS have authority to sponsor (not escort) onto the installation and must follow installation procedures for doing so. Contractors who do not require access to DoD IT systems will be issued a DBIDS only.

6.17.2.3.1 Contractor employees approved for DBIDS will require sponsorship onto the installation to Pass and ID (building 430) to be issued a DBIDS. Employees going to SFS without being sponsored are considered to be on the installation illegally.

6.17.2.3.2 Common issues with a denied Form 496: derogatory

background, such as felony criminal charge/s (current or past), foreign national, missing information on form, failed to receive

DBIDS within allotted time frame after approval.

6.17.2.3.3 If denied access the employee will return all government issued credentials and will vacate the installation immediately. A separate notification will be provided by the 75 ABW/CC if an appeal is requested for access.

6.17.2.4 Controlled Area Badge Process

Employees without a current DBIDS, or denied access to the installation, will not be issued a CAB until all issues are resolved.

The contractor shall provide, through the COR, written justification with employee full name, Height, Weight, Eye Color, Hair Color, contract number with expiration date and areas needing access to the issuing SM to initiate a request for a badge.

Controlled area badge (CAB) requests shall be completed by the group

SM, who shall complete an AF Form 2586, Unescorted Entry

Authorization Certificate, for each employee requiring entry into controlled/restricted areas. The contractor employee shall carry the AF

Form 2586 to Security Forces (building 430). The AF Form 2586 will be returned to the issuing SM for accountability.

NOTE: CABs will not be issued for the inconvenience of having to be escorted.

6.17.2.4.1 While in the Controlled Areas, contractor employees shall display the CAB in a badge holder, furnished by the contractor company, between the shoulders and above the waist and in the front of the body whenever inside an identified controlled area.

NOTE: When outside controlled areas the CAB will be placed out of sight.

6.17.2.4.2 Security Education and Motivation training shall be completed, initially and annually thereafter in order to obtain, and maintain, a CAB. Employees who fail to meet training requirements will have their credentials removed and installation access revoked.

6.17.2.4.3 Training can be expected to last one and one half to two hours long, initially and annually. Training is scheduled with the

Group SM and requires a passing score to receive approval for a CAB.

6.17.2.5 Vindicator Access Card

As required, the contractor employee is issued a vindicator access card from the appropriate Building Facility/SM. Access to controlled areas will not be granted without a CAB badge and proper authorization for required areas.

NOTE: CORs shall provide DBIDS expiration date, CAB number and expiration date, vindicator card number, four digit pin number and areas requested for access to the group SM prior to gaining access to a controlled area.

6.17.2.6 Lost Badges or Access Cards shall be reported to the Maintenance

Support Group (MXSG) Security Office within one working day of loss.

After receiving a Lost Identification Letter a new Form 2586 will be issued. The contractor must carry all forms to building 430 to be issued a new badge then return all forms to the MXSG Security Office. Due to unforeseen circumstances employees may be required to call (801) 586-

5199 to schedule an appointment.

The contractor shall create an Incident/Mishap report when a contract employee loses a Controlled Area Badge (Line badge). The

Incident/Mishap Report (CDRL A010) must be submitted no later than one (1) business day.

6.17.2.7 Returning of credentials shall be done within two (2) working days when the Period of Performance (POP) has ended or the requirement is considered complete. During performance of the contract and at the completion or termination of the contract, the contractor shall be responsible for prompt return of credentials to the appropriate security manager for any employee who no longer requires access to the work site, and for obtaining required identification of newly assigned personnel.

6.17.3 Security Incidents

Should a security incident occur, the contractor shall:

6.17.3.1 Immediately report to the site location Group Security Manager all available facts related to each instance.

6.17.3.2 Take such precautions as the Security Manager may reasonably require for security purposes.

6.17.3.3 Take reasonable and prudent action to establish control of the scene, prevent further violation, and to preserve evidence until released by proper authority.

6.17.3.4 Cooperate fully and assist Government personnel as the Government conducts an investigation of the violation.

6.17.3.5 Participation shall last until the investigation is complete.

6.17.4 Keys, Building Access Cards, and Building Badge Control

6.17.4.1 The Contractor shall establish and implement methods of making sure that all keys, vindicator cards, and building badges issued to the

Contractor by the Government are not lost, misplaced, or used by unauthorized persons.

6.17.4.2 The Contractor shall not duplicate any keys issued by the Government.

6.17.4.3 The Contractor shall immediately report the occurrence of a lost key to the appropriate building Facility Manager, and vindicator cards and building badges to the appropriate Security Managers.

6.17.4.4 The Contractor shall prohibit the opening of locked areas by the

Contractor employees to permit entrance of persons other than the

Contractor’s employees engaged in the performance of assigned work in those areas, or personnel authorized entrance by the Security Managers.

6.17.5 Communications Security

6.17.5.1 All communications with DoD organizations are subject to

Communications Security (COMSEC) review.

6.17.5.2 The DoD authorizes the military departments to conduct COMSEC monitoring and recording of telephone calls originating from, or terminating at, DoD organizations.

6.17.5.3 The Government advises the Contractor that at any time they place a call to, or receive a call from, a DoD organization, they are subject to

COMSEC procedures.

6.17.5.4 The Contractor assumes the responsibility for ensuring wide and frequent dissemination of the above information to all employees dealing with official DoD information.

6.17.6 Operations Security (OPSEC)

6.17.6.1 Contractors who have access to Ogden Air Logistics Complex (OO-

ALC) facilities or critical information shall have OPSEC training IAW

AFI 10-701, Operations Security (OPSEC), (Complete reference in

Appendix E). Initial training will be provided by Group SM and lasts approximately one hour, with recurring annual training lasting approximately one half hour. Contractors shall immediately comply with Installation and Group OPSEC programs.

6.17.6.2 Public release of any information is not authorized and, if requested, will comply with Public Affairs and all other OPSEC measures to ensure the best balance of lawful disclosure for the American public and denial of advantage for our adversaries.

6.17.6.3 No photography, or videotaping, is allowed on the installation without approval from the owning organizations Group Director/Commander on an approved photography letter from Public Affairs. This includes the use of personal cell phones with picture and video capability.

6.17.6.4 Critical Items/Information shall not be discussed outside normal contract conditions. A Critical Items/ Information List (CIL) can be provided and should not be considered all inclusive.

6.17.7 Controlled Unclassified Information (CUI) generated by the contract, and its employees, shall ensure protective measures are applied. ALL DoD unclassified information MUST BE REVIEWED AND APPROVED FOR RELEASE before it’s provided to the public in accordance with DoDD 5230.09, Reference J.

6.17.7.1 Disclosure of information is prohibited for release of unclassified information to the public without approval of the contracting activity.

6.17.7.2 Contractors will comply with CUI requirements detailed in DoDM

5200.01-V4, DoD Information Security Program: Controlled

Unclassified Information (CUI).

7 SECURITY:

7.1 Contractor employees who have access to Hill Air Force Base, government facilities or critical information shall be trained on Operations Security (OPSEC), human relations, and security education and motivation within 90 days after initial assignment of the contract IAW AFI 10-701 Para. 4.1-4.2.

7.2 During performance of the contract and at the termination or completion of the contract, the contractor shall be responsible for obtaining required identification for newly assigned personnel, and for prompt return of credentials to the 517th SWES Security Manager, 801-

586-4480, for any employee who no longer requires access to the work site. Lost badges shall be reported to the Maintenance Group Security Officer within one working day of loss.

7.3 If a security violation occurs, the contractor shall immediately report to the SWES

Security Manager all available facts relating to each instance. The contractor shall take such precautions as the Security Manager may reasonably require for security purposes.

The contractor shall take reasonable and prudent action to establish control of the scene, prevent further violation, and to preserve evidence until released by proper authority. The contractor shall cooperate fully and assist government personnel as the government conducts an investigation of the violation. Participation shall last until the investigation is completed.

7.3.1 Contractor Training

7.3.1.1 The Contractor shall ensure employees complete required block training before performing any services. The Contractor will not be penalized for hours spent attending these required courses. The Contractor shall also ensure that annual training is completed before expiration date and that new mandatory training is completed within time frames designated by the Air Force.

7.3.1.1.1 Contractor obtaining a CAC or DBIDS shall complete the following trainings.

7.3.1.1.1.1 Operations Security (OPSEC) Awareness –

Frequency: Initially upon assignment (within 30-days) and annually thereafter IAW AFI 10-701, Operations Security

(OPSEC). Presentation/Means: Unit Security

Manager or TSS Course #MHPSEC9800301BR, mylearning/TFAT DoD 8570.01-M Information

Assurance Workforce Improvement Program, 19

December 2005; Information Systems Security Line of Business, 22 February 2007

7.3.1.1.1.2 Controlled Unclassified Information (CUI)

Frequency: Initially upon assignment (within 30-days) and annually thereafter. Presentation/Means: Unit Security

Manager, TSS Course MLMW2289, mylearning/TFAT. Source: IAW DoDI 5200.48_AFI

16-1403 Paras 2.10d & 3.6B. Controlled Unclassified

Information (CUI).

7.3.1.1.1.3 Unit Indoctrination and Orientation Training –

Frequency: within 30 calendar days of assignment. Presentation/Means: Unit Security

Manager or 309 SWEG IPO Annual security refresher orientation Course # TBD (NOTE: for cleared personnel, initial/ Annual Training for cleared personal, TSS Course #MHPSEC9802900BR is required before access to classified information is granted).

7.3.1.1.1.4 Counter-Insider Threat (C-InT) Training - This

training covers procedures for C-InT awareness and reporting. Frequency: Initially upon assignment

(within first 30-days) and annually thereafter. Presentation/Means: Unit Security

Manager or TSS Course MLMW2216, mylearning/TFAT. Source: AFI 16-1402, Counter-

Insider Threat Program Management, PARA 3.3;

DoD Manual 5200.01. Volume 3 Enclosure

5_DAFMAN 16-1404, Volume 3 Para 3…