PWS_CDM Professional Services _BASIC_20220408.docx

BASIC

PERFORMANCE WORK STATEMENT (PWS)

for

CDM Professional Services

24 March 2022

CDM Professional Services _BASIC PWS_ FA7146-XX-X-XXXX

SAF/AA CDM

THIS PAGE INTENTIONALLY LEFT BLANK

1.0 REQUIREMENTS

1.1. BACKGROUND

The United States Air Force (USAF) Concepts, Development, and Management (CDM) Program Office conducts the planning and acquisition of cost-effective, critical capabilities in order to support the war-fighting mission of the combatant commanders. In order to meet current and projected workload requirements, the CDM Program Office requires support capabilities in the areas of program management, project management/acquisition support, financial management support, systems engineering, Information Technology (IT) support, administrative support, security support, and intelligence support.

1.2. SCOPE

The scope of the Task Order (TO) provides the United States Air Force (USAF), specifically the CDM Program Office and its end user organizations, with a broad range of professional services to include program management, contracts management, financial management, engineering, information assurance, administrative support, and security management support capabilities. Additionally, IT support services are ancillary to these professional services. This effort is intended to support execution of effective and responsive integrated program management of research, development, test, evaluation, production, modernization and life cycle acquisition, and sustainment activities. All tasks and subtasks under the section are not Inherently Governmental Functions as defined in FAR 7.5, and shall not be construed as such.

1.3. TASKS

1.3.1 PROJECT MANAGEMENT/ACQUISITION SUPPORT. The contractor shall provide project management and acquisition support services as described below to support CDM acquisition program management requirements. The contractor shall apply its acquisition program management knowledge and experience to organize and manage resources and personnel needed to efficiently and effectively accomplish USAF and CDM acquisition objectives consistent with Department of Defense Instruction (DoDI) 5000.02 policies and procedures. The contractor shall reside in assigned CDM Program Office space.

1.3.2 ACQUISITION PROJECT SUPPORT – CYBER.

Contractor personnel shall provide services described below to support CDM project management requirements for its cyber capabilities portfolio. Contractor personnel shall apply their knowledge and experience in technology development, cyber operations, DoD and IC operations, and project management to support Government program managers in the execution of highly technical cyber capability development and integration efforts.

1.3.3 RESOURCE PLANNING, PROGRAMMING, EXECUTION, AND ANALYSIS SUPPORT.

The contractor shall provide task definition and planning, data research, collection and analysis, review, presentation, and documentation in support of Full Operational Capability (FOC). Contractor personnel shall formulate inputs for the annual POM/Future Year Defense Program (FYDP), President’s Budget (PB), and Budget Estimate Submissions (BES) processes; and, analyze their potential effects on program budgets and cost estimates.

1.3.4 INFORMATION TECHNOLOGY SUPPORT

The contractor shall provide support consisting of Cybersecurity, Systems Administration, Systems Engineering, Telecommunications Engineering, Visualization/Web development.

1.3.5 ADMINISTRATIVE SUPPORT

The contractor shall provide day-to-day administrative tasks in support of the daily program office operations. The contractor shall interact with lateral organizations and external agencies, as required, to accomplish the program mission. The contractor shall interface with personnel providing facilities management services, personnel management services, security services, computer support, public affairs support, and building management support to facilitate uninterrupted, day-to-day operations of CDM and related units. The following subtasks are in support of CDM’s enterprise-wide operations, covered under this TO.

1.3.6 SECURITY MANAGEMENT SUPPORT.

Contractor personnel shall support program activities within Sensitive Compartmented Information Facilities (SCIFs) or Special Access Program Facilities (SAPFs) while implementing the DoDM 5105.21M Volumes 1-3, DoDM 5205.07 Volumes 1-4 and Air Force Instructions, as appropriate, as the baseline for daily security administration.

1.3.7 INTELLIGENCE SUPPORT.

The contractor shall to provide intelligence analysis and strategic assessments. The contractor shall conduct intelligence research, prepare and present intelligence briefings, prepare intelligence assessments and studies, and prepare concise written reports.

1.3.8 CONSULTING SUPPORT.

The contractor shall provide expertise in support of CDM mission functions. Support shall include:

a. Management or strategy consulting including research, evaluations, studies, analyses, scenarios/simulations, reports, business policy and regulation development assistance, strategy formulation, and expert witness support.

b. Prepare and/or present studies and papers in academic or professional events/forums.

c. Facilitation and related support including mission validation and analysis, reporting, and stakeholder briefings.

2 ADMINISTRATION AND MANAGEMENT

2.1 REQUIRED REPORTS. The Contractor shall provide Required Reports (RR) in a format mutually agreed upon by the Government and the Contractor. All RRs will be reviewed for timeliness, accuracy, and format. If a RR due date falls on a weekend or holiday, the Contractor shall submit the RR on the last work day prior to the due date. Required Reports are labeled throughout the PWS as well as in Attachment 01-REQUIRED REPORTS.

2.1.1 DATA RIGHTS. The contractor shall mark all Required Reports listed in Attachment 01 to indicate authorship by contractor (i.e., non-Government) personnel; provided, however, that no deliverable shall contain any proprietary markings inconsistent with the Government’s data rights set forth in this TO. The Government reserves the right to treat non-conforming markings in accordance with Defense Federal Acquisition Regulation Supplement (DFARS) 252.227- 7013, 252.227-7014 and 252.227-7015.

The Government Rights in Data for all RR’S listed in Attachment 01 is Defense Federal Regulation Supplement (DFARs) 252.227-7013, 252.227.7014, and 252.227.7015.Data Rights Clause - Abbreviations in the Gov’t Rights column of the table below shall be interpreted as follows:

UR: Unlimited Rights, per DFARs 252.227-7013, and 252.227-7014 URS: Unrestricted Rights per DFARS 252.227-7015 For software or documents that may be either proprietary COTS or custom, Restricted Rights Data may apply to proprietary COTS software or documents and UR rights apply to custom software or documents. The Government asserts UR rights to open source COTS software. The Government does not assert any rights to management software tools if the contractor does not plan to charge the Government directly for that tool and does not propose that the Government will own or use that tool.

2.1.2 INTELLECTUAL PROPOERTY RIGHTS. The existence of any patent, patent application, or other intellectual property right that encumbers any deliverable must be disclosed in writing on the cover letter that accompanies the delivery. If no such disclosures are provided, the data rights provisions in DFARS 252.227-7015 apply.

2.1.3 REQUIRED REPORTS MEDIA. The contractor shall deliver all electronic versions by electronic mail (email) and removable electronic media, as well as placing in the CDM designated repository. The following are the required electronic formats, whose versions must be compatible with the latest, commonly available version on the market.

2.1.4 WRITTEN ACCEPTANCE/REJECTION BY THE GOVERNMENT. The COR will provide written notification of acceptance or rejection of all final deliverables within 15 workdays (unless specified otherwise). All notifications of rejection will be accompanied with an explanation of the specific deficiencies causing the rejection.

2.1.5 PLACE(S) OF DELIVERY. Required Reports shall be delivered to the COR whom the Contracting Officer will designate before the Kick-Off meeting and as needed over the period of performance.

2.1.6 NOTICE REGARDING LATE DELIVERY. The contractor shall notify the COR as soon as it becomes apparent to the contractor that a scheduled delivery will be late. The contractor shall include in the report the rationale for late delivery, the expected date for the delivery, and the project impact of the late delivery. The COR will review the new schedule and provide guidance to the contractor. Such notification in no way limits any Government contractual rights or remedies including, but not limited to, termination.

2.1.7 NON-CONFORMING PRODUCTS OR SERVICES. Non-conforming products or services will be rejected. Deficiencies shall be corrected, by the contractor, within ten workdays of the rejection notice. If the deficiencies cannot be corrected within ten workdays, the contractor shall immediately notify the COR of the reason for the delay and provide a proposed corrective action plan within ten workdays.

If the contractor does not provide products or services that conform to the requirements of this TO, the Government will withhold the fixed price until the non-conforming products or services are remediated.

2.1.8 NON-PERSONAL SERVICES. The contractor shall manage its employees and guard against any actions that are of the nature of personal services or give the perception of personal services. If the contractor believes that any actions constitute or are perceived to constitute personal services, or are outside the scope of the TO, the contractor shall notify the COR and CO immediately.

2.1.9 INHERENTLY GOVERNMENTAL FUNCTIONS. The contractor shall not perform any inherently governmental functions as defined by FAR Subpart 7.5. All program decisions shall be the sole responsibility of the Government. The contractor shall not counsel, mentor, make judgments and/or discretionary decisions or perform any other activities related to supervision of Government personnel. If the contractor believes that any actions constitute or are perceived to constitute inherently governmental functions, the contractor shall notify the CO immediately.

2.2 ORGANIZATIONAL CONFLICT OF INTERERST (OCI). If a contractor has performed, is currently performing work, or anticipates performing work that creates or represents an actual or potential OCI, the contractor shall immediately disclose this actual or potential OCI to the CO in accordance with FAR Subpart 9.5. The nature of the OCI may involve the prime contractor, subcontractors of any tier, or teaming partners.

The contractor is required to complete and sign an OCI Statement. The contractor must represent either that (1) It is not aware of any facts which create any actual or potential OCI relating to the award of this contract, or (2) It has included information in its proposal, providing all current information bearing on the existence of any actual or potential OCI and has included a mitigation plan in accordance with paragraph (c) below.

If a contractor with an actual or potential OCI believes the conflict can be avoided, neutralized, or mitigated, the contractor shall submit a mitigation plan to the Government for review.

In addition to the mitigation plan, the CO may require further information from the contractor. The CO will use all information submitted by the contractor, and any other relevant information known to CDM/PK, to determine whether an award to the contractor may take place, and whether the mitigation plan adequately avoids, neutralizes, or mitigates the OCI.

If any such conflict of interest is found to exist, the CO may determine that the conflict cannot be avoided, neutralized, mitigated, or otherwise resolved to the satisfaction of the Government, and the contractor may be found ineligible for award. Alternatively, the CO may determine that it is otherwise in the best interest of the U.S. to contract with the contractor and include the appropriate provisions to avoid, neutralize, mitigate, or waive such conflict in the contract awarded.

The contractor’s performance of work on this task order may create actual or potential OCI on future CDM Program Office acquisitions.

The Contractor shall provide a plan that describes the processes and procedures they will implement to avoid or mitigate any actual or perceived OCI. The plan shall outline how the Contractor evaluates, mitigates (where necessary), and reevaluates any potential or perceived conflicts between this contract and other work performed by the Contractor or team members.

2.3 HIRING STATUS REPORT (HSR)/PERSONNEL ROSTER. The Contractor shall provide an HSR every Friday, starting with the first Friday after contract/task order award, until all positions are filled, or as requested by the Government. The HSR shall contain, as a minimum, the name, security clearance and adjudication date, for each new hire. The Contractor shall provide a Hiring Status Report (HSR) until all positions are filled. The last HSR provided shall also contain the number of incumbent offers and acceptances. After contract start the HSR will become the Personnel Roster. The contractor shall maintain a current listing of employees. The list shall include the employee's name and level of security clearance. The list shall be validated and signed by the company Program Manager and provided to the Contracting Officer Representative. An updated listing shall be provided when an employee's status or information changes. Note: the Government may require a contractor’s DoD Electronic Data Interchange (EDI) number or social security number for some transactions, i.e., verifying clearances in Defense Information Security System (DISS), processing visitor requests, etc.

2.3.1 NOTICE OF IMPENDING HIRE. For SCI positions, the Contractor shall deliver an electronic notice of impending hire once the decision is made to select an individual to fill an open position. Notice shall be sent to COR/CO to be forwarded to the cognizant requirement owner and security office. The notice will have the following attached:

- Selectee’s qualification summary for review by the COR to ensure compliance with the PWS

- Completed Special Access Program Nomination Package Pre-Screening Questionnaire

- Selectee’s full name, Date of Birth (DOB), and Social Security Number (SSN).

The contractor shall utilize encrypted email or password protected files protect Personally Identifiable Information (PII) in accordance with the Privacy Act.

2.4 MONTHLY STATUS REPORT (MSR). The contractor shall develop and provide an MSR at the IDIQ level (RR#1). The MSR shall include the following:

a. Activities during reporting period, by task (include ongoing activities, new activities, and activities completed, and progress to date on all above mentioned activities). Each section shall start with a brief description of the task.

b. Problems and corrective actions taken. Also include issues or concerns and proposed resolutions to address them.

c. Personnel gains, losses, and status (security clearance, etc.).

d. Government actions required.

e. Schedule (show major tasks, milestones, and deliverables; planned and actual start and completion dates for each).

f. Summary of trips taken, conferences attended, etc. (attach Trip Reports to the MSR for reporting period).

g. Accumulated invoiced cost for each CLIN up to the previous month.

h. Projected cost of each CLIN for the current month.

i. Detailed analysis showing expenditures and future projections related to the Labor-Hour CLIN.

2.5 TRIP REPORT. The Government will identify the need for a Trip Report when the request for travel is submitted. The contractor shall keep a summary of all long-distance travel including, but not limited to, the name of the employee, location of travel, duration of trip, and POC at travel location. Trip reports shall also contain Government approval authority, total cost of the trip, a detailed description of the purpose of the trip, and any knowledge gained. The RR# will be detailed at the TO level.

2.6 TECHNICAL ISSUES PAPERS/POINT PAPERS/BRIEFINGS. The Contractor shall prepare, coordinate and distribute Technical Issue Papers, Point Papers and/or Briefings as tasked by the COR (or his designated representative) in support of this Performance Work Statement. These products will be completed in accordance with Government guidelines and formats which will be provided upon award of the task orders.

2.7 QUALITY CONTROL PLAN (QCP). The contractor shall develop and maintain an effective quality control program to ensure the services of this PWS are being met. The contractor shall develop a Draft QCP (RR #2) that includes quality control processes and procedures and apply them to meet this requirement. The QCP shall be submitted to the CO for acceptance at the Kick-Off Meeting. Updated versions of QCP shall be submitted to the CO for acceptance no later than 10 business days of implementation by the Contractor (RR #3).

2.8 CONTINUITY FOLDER. The contractor shall develop and maintain continuity folders IAW task requirements defined in this PWS (Section 1.3). Continuity folders will be made available to the Government upon request.

2.9 MEETING REPORTS/TELECON NOTES. Meeting Reports (Contractor format) shall be submitted within five (5) working days of the meeting when tasked by the COR (or his designated representative) in support of this PWS (RR #4). These reports must include, at a minimum, the purpose of the meeting, attendees, date, issues discussed, decisions/recommendations made and a list of action items with associated assignments.

2.10 PROJECT MANAGEMENT PLAN. The contractor shall document all support requirements in a PMP. The contractor shall provide the Government with a draft PMP (RR #5) on which the Government will make comments. The final PMP (RR #6) shall incorporate the Government’s comments. The PMP shall be updated as project changes occur, no less frequently than annually (RR#7).

The PMP shall:

a. Describe the proposed management approach.

b. Contain detailed Standard Operating Procedures (SOPs) for all tasks.

c. Include milestones, tasks, and subtasks required in this TO.

d. Provide for an overall Work Breakdown Structure (WBS) with a minimum of three levels and associated responsibilities and partnerships between Government organizations.

e. Describe in detail the contractor’s approach to risk management under this TO.

f. Describe in detail the contractor’s approach to communications, including processes, procedures, communication approach, and other rules of engagement between the contractor and the Government.

g. Include the contractor’s draft Baseline QCP.

2.11 SERVICES SUMMARY. See Attachment

2.12 GOVERNMENT FURNISHED PROPOERTY (GFP). The Government will provide access to facilities, office space, supplies and services, to include workstations, computers, and phones. Access will be granted to classified and unclassified military Local Area Network (LAN) services, LAN support, telephones, and reproduction facilities. If the contractor determines additional equipment is required, the contractor shall notify the Government, in writing, of the applicable information/equipment required to accomplish the mission. The contractor shall assume responsibility for all GFP in its possession. Government-issued badges, identification cards, passes, and vehicle registration media are accountable forms and, as such, are U.S. Government property to be accounted for, protected, and returned to the Government. The responsibility shall extend to any subcontractors. Only authorized personnel may have access to use of GFP.

2.12.1 GOVERNMENT PROVIDED INFORMATION (GFI) DOCUMENTATION. The Government will provide access to relevant Government organizations’, information, documentation, manuals, texts, briefs, and other materials as required and available.

2.12.2 GOVERNMENT VEHICLES. It is in the Government’s interest that contractor personnel associated with this TO have access to operate general-purpose Government vehicles in the accomplishment of tasks shall be in accordance with 41 CFR 101-39 and 41 CFR 101-38.301-1. Those contractor personnel shall possess a valid state driver’s license and adhere to the same Government instructions and procedures as Government personnel. However, the use of Government vehicles and adherence to Government instructions and procedures does not transfer contractor employees into Government personnel.

2.13 OTHER DIRECT COSTS (ODC)

2.13.1 TRAVEL. The Contractor shall be required to travel in support of tasks listed in paragraph 1.3 to fulfill PWS requirements. Contractor costs for travel will be reimbursed at the limits set in the following regulations (see FAR 31.205-46): Federal Travel Regulation (FTR) - prescribed by the GSA, for travel in the contiguous United States (U.S.).

The contractor may invoice monthly on the basis of cost incurred for cost of travel comparable with the FTR. The invoice shall include the period of performance covered by the invoice, the CLIN number and title. Separate worksheets, in MS Excel format, shall be submitted for travel.

CLIN Total Travel: This invoice information shall identify all cumulative travel costs billed by CLIN. The current invoice period’s travel details shall include separate columns and totals and include the following:

a. Travel Authorization Request number or identifier, approver name, and approval date

b. Current invoice period

c. Names of persons traveling

d. Number of travel days

e. Dates of travel

f. Number of days per diem charged

g. Per diem rate used

h. Total per diem charged

i. Transportation costs

j. Total charges

k. Explanation of variances exceeding ten percent of the approved versus actual costs

l. Indirect handling rate All cost presentations provided by the contractor shall also include Overhead charges and General and Administrative charges in accordance with the contractor’s DCAA cost disclosure statement.

Local travel to attend meetings within the local city or base of assignment commuting vicinity shall be considered a cost of doing business and shall not be separately reimbursed.

2.14 DEFENSE BASE ACT INSUREANCE. Defense Base Act (DBA) Insurance coverage is required for employees of all Contractors working OCONUS, according to the Department of Labor (FAR 28.305). Insurance costs shall not be included in the negotiated fully-loaded labor rates. The Contractor shall include a breakdown of all authorized costs in each applicable invoice. DBA insurance is cost reimbursable and NTE $30,000 annually.

2.15 MATERIALS. Contractor shall coordinate all materials with the COR or designated representative. Materials are cost reimbursable and NTE $50,000 annually.

2.16 SECURITY. The Contractor and all Contractor personnel shall abide by all AF and local rules, procedures, and standards of conduct. A Department of Defense Contract Security Classification Specification (DD FM 254) is required for access to classified material. The Contractor shall also perform in accordance with the Compliance with National Industrial Security Program Operating Manual (NISPOM--DoD 5220.22M).

2.16.1 SECURITY CLEARENCES. All personnel performing work on this contract shall possess a TS/SCI clearance unless pre-coordinated with the COR and Contracting Officer. Personnel performing on this PWS shall be a U.S. Citizen and shall require a security clearance. Information used to perform the above work may be classified up to TOP SECRET/SCI. The contractor must possess or obtain a facility security clearance at the level of TOP SECRET prior to proposal submission. The contractor shall request personnel security clearances (Submit Clearance Paperwork through Defense Counterintelligence and Security Agency (DCSA) to the Office of Personnel Management) for personnel requiring access to classified information within 15 days after contract award. Due to costs involved with security investigations, requests for contractor security clearances shall be kept to an absolute minimum necessary to perform contract requirements. Contractor personnel shall have appropriate clearances prior to commencing work on any task unless otherwise approved in writing by the Government. The Contractor shall also complete visit requests for each individual that will be performing work in the Defense Manpower Data Center (DMDC) prior to performance start unless otherwise approved in writing by the CO. The Prime Contractor shall ensure that any teaming partners or subcontractors have the appropriate clearances prior to beginning performance. The SAF/AA CDM owns the SCI indoctrination process for this contract. Once the transition period is complete and performance starts, the contractor will be responsible for updating the Contractor SCI Eligibility Request letter as personnel are added to or deleted from the contract, providing the letter to SAF/AA CDM, and scheduling an appointment for indoctrination or debriefing on an as needed basis.

2.16.2 CLEARENCE REQUIREMENT. If access to classified information is a requirement at the Contractor’s facility, a SF 312 Non-Disclosure Agreement (NDA) initiated by the company’s Facility Security Officer is required. The Contractor must possess or obtain a facility security clearance at the appropriate classification level for the work prior to performing contract work. The contractor is responsible for obtaining all NDAs with all applicable Government, corporate, supplier, and sub tier vendors with proprietary, restricted, competition sensitive, or any other restricted (e.g., non-foreign disclosure due to public law) data that will be used or accessed during the execution of the TO. The contractor shall use the Government approved NDA form and provide to the CDM COR upon request. The contractor shall comply with the TO DD Form 254 requirements. The Government will oversee handling and storage of classified information and provide appropriate storage capability for all classified material. All classified information and controlled unclassified information (CUI) shall be returned to the Government upon completion of the TO.

The TO requires access to proscribed information. No proscribed work on this TO shall be accomplished by company under foreign ownership, control or influence (FOCI) (DODM 5220.22 Vol 3) or under Foreign Government Ownership (10 U.S.C. 2536 and DFARS 209.104- 1). The prime contractor is responsible for any and all proscribed information which may flow down to their subcontractors. If the TO requires access to proscribed information, AND the subcontractor(s) are categorized as foreign ownership, control or influence (FOCI) (DODM 5220.22 Vol 3) or Foreign Government Ownership (10 U.S.C. 2536 and DFARS 209.104-1) and will have access to proscribed information, then the contractor must immediately notify the Government that a National Interest Determination (NID) must be obtained PRIOR TO a FOCI or Foreign Government Ownership company’s access to proscribed information. The agency’s will determine if a NID is in the program offices’ best interest to request and in the classification authorities’ best interest to approve. If the Government elects not to pursue the NID or the NID is disapproved, subcontractor(s) shall not access proscribed information.

If the subcontractor or any personnel within their company do not require access to proscribed information, then a NID is not required. However, the prime contractor is responsible to satisfy all aspects of the “Security Requirements” sections of the PWS, including appropriate measures to ensure subcontractor personnel are not inadvertently exposed to proscribed information.

Access to classified networks is required for the effort.

Trustworthiness determinations are required for access to unclassified Government IT systems and routine physical access to a federally-controlled facility. A favorable National Agency Check with Written Inquiries (NACI) is required for IT Level III access. The contractor shall submit personnel security investigative paperwork for trustworthiness determinations IAW FIPS Pub 201-2, Federal Information Processing Standards Publication Personal Identity Verification of Federal Employees and Contractors and the Directorate’s procedures. Issuance/retrieval of CACs will be IAW AFI 36-3026, Identification Cards for Members of the Uniformed Services, Their Eligible Family Members, and Other Eligible Personnel, and Air Force Life Cycle Management Center (AFLCMC) and CDM policy.

2.16.2.1 CLEARENCE DOCUMENTATION. Prior to contract start, and as changes occur, the Contractor shall provide the Government (COR and SSO) a list of all company employees assigned to this task order. The list shall include the employees’ Names, Location of Performance, and Security Clearance.

2.16.2.2 LISTING OF EMPLOYEES. The contractor shall maintain a current listing of employees. The list shall include the employee's name, position, and level of security clearance. The list shall be validated and signed by the company Facility Security Officer (FSO) and provided to the Sponsoring Agencies Security Manager. An updated listing shall be provided when an employee's status or information changes. The HSR/Personnel Roster may be used to satisfy this requirement.

2.16.2.3 NOTIFICATION. The contractor shall notify the Servicing Security Activity (SSA) at each location (s) and the local unit through the Defense Information Security System (DISS), 30 days prior to contract performance on base. In the remarks section in the Defense Information Security System (DISS) visit request, add the contract number and the company Facility Security Officer’s name and contact number. Visit request must be one file with SAF/AA CDM.

2.16.2.4 SECURITY MANAGER APPOINTMENT. The contractor shall appoint a security manager for the on base Visitor Group. The security manager may be a full time position or an additional duty position. The security manager shall provide employees with training required by DoD 5200.1-R, Information Security Program Regulation, and AFI 16-1404, Air Force Information Security Program. The contractor will also provide initial and follow-on training to contractor personnel who work in Air Force controlled/restricted areas. Air Force restricted areas and controlled areas are explained in AFI 31-101, The Air Force Installation Security Program.

2.16.2.5 PASS AND IDENTIFICATION ITEMS. The contractor shall ensure the pass and identification items required for contract performance are obtained for employees and non-Government owned vehicles. The contractor shall comply with Air Force Manual (AFMAN) 31-113, Installation Perimeter Access Control and the

2.16.2.6 RETREIVING IDENTIFICATION MEDIA. The contractor shall retrieve all identification media, including vehicle passes from employees who depart for any reason before the contract expires (e.g. terminated for cause, retirement, etc.).

2.16.2.7 TRAFFIC LAWS. The contractor shall ensure all contractor employees comply with traffic regulations while using U.S. Government provided vehicles and while driving on U.S. Government property.

2.16.2.8 WEAPONS, FIREARMS, AMMUNNITION. Contractor employees are prohibited from possessing weapons, firearms, or ammunition, on themselves or within their contractor-owned vehicle or privately-owned vehicle while on any Government installation.

2.16.2.9 FOR OFFICIAL USE ONLY (FOUO). The contractor shall comply with DoD 5400.7-R, Chapter 4, DoD Freedom of Information Act (FOIA) Program, requirements. This regulation sets policy and procedures for the disclosure of records to the public and for marking, handling, transmitting, and safeguarding FOUO material.

2.16.2.10 CYBERSECURITY. The contractor may have access to sensitive (to include privileged and confidential) data, information, and materials of the U.S. Government. These printed and electronic documents are for internal use only and remain the sole property of the U.S. Government. Some of these materials are protected by the Privacy Act of 1974 (AMENDED) and Title 38. Unauthorized disclosure of Privacy Act or Title 38 covered materials is a criminal offense.

2.16.2.11 REPORTING REQUIREMENTS. The contractor shall immediately report to an appropriate Government authority any information or circumstances of which they are aware of that may pose a threat to the safety and/or security of DoD personnel, contractor personnel, resources, and classified or CUI.

The contractor shall immediately notify the Government Security Manager, the host base Information Protection office and CDM COR of any potential or actual security incident or violation including potential or actual unauthorized disclosure or compromise of classified and/or CUI.

2.16.2.12 PHYSICAL SECURITY. The contractor shall safeguard all Government property and controlled forms provided for contractor use and adhere to the Government property requirements. At the end of each workday, all Government facilities, equipment and materials shall be secured, including workstations. Contractors shall comply with all security requirements while conducting duties within CDM facilities. For work which requires security checks, all Government facilities, equipment, and materials shall be secured pursuant to the requirements as outlined in AFI 16-1404 AFMC SUP 1. The contractor is responsible for complying with all applicable requirements outlined in AFI 16- 1404 AFMC SUP 1.

2.16.2.13 IN/OUT PROCESSING. The contractor shall ensure contractor personnel in-process with the unit security manager/information systems security officer on the first duty day in the Government activity and out-process with the unit security manager/information systems security officer NLT the period of performance end date of the TO or NLT the last duty day in the Government activity, whichever occurs first. Contractor personnel shall repeat the process with the TO regardless if the employee is employed with the same contractor or the task performance occurs within the same Government activity. The process will facilitate review of contractual security requirements, verification of personnel security clearances or investigations, issuance/retrieval of CACs, issuance/termination of computer accounts, system network access cards and building accesses, to include keys and or fobs for facility access.

2.16.2.14 CONTROLLED/RESTRICTED AREAS. The contractor shall comply with local base procedures for entry to Air Force controlled or restricted areas where contractor personnel work. The Government will complete an AF Form 2586, Unescorted Entry Authorization Certificate, completed and signed by the sponsoring agency’s Security Manager, before a Restricted Area Badge will be issued. Contractor employees shall have a favorably completed NACI investigation before receiving a Restricted Area Badge. Interim access may be granted IAW AFI 31-501, Personnel Security Program Management.

2.16.2.15 ACCESS. The contractor shall permit the CDM COR or authorized representative access to all work areas, records, and data used in the performance of the contracted services. The contractor shall provide support, and not interfere with the CDM COR, State, Federal and other designated personnel in the performance of official duties. Access shall be provided as soon as possible, but not exceed one workday after the request.

2.16.2.16 KEY CONTROL/ACCESS BADGE CONTROL. The contractor shall establish and implement methods of making sure all keys/badges issued to the contractor by the Government are not lost or misplaced and are not used by unauthorized persons. The contractor shall not duplicate any keys issued by the Government.

2.16.2.17 LOST KEYS. The contractor shall immediately report to the Quality Assurance Evaluator (QAE) or PM any occurrences of lost or duplicated keys. In the event keys, other than master keys, are lost or duplicated, the contractor may be required, upon written direction of the contracting officer, to re-key or replace the affected lock or locks without cost to the Government. The Government may, however, at its option, replace the affected lock or locks or perform re-keying and deduct the cost of such from the monthly payment due the contractor. In the event a master key is lost or duplicated, all locks and keys for that system shall be replaced by the Government and the total cost deducted from the monthly payment due the contractor.

2.16.2.18 PROHIBITED USE. The Contractor shall prohibit the use of keys, issued by the Government, by any persons other than the Contractor’s employees. The Contractor shall also limit the opening of locked areas by Contractor employees to permit entrance of persons engaged in performance of contract work requirements in those areas.

2.16.2.19 LOCK COMBINATIONS. The Contractor shall control access to all Government provided lock combinations to preclude unauthorized entry. The Contractor is not authorized to record lock combinations without written approval by the Government. Records with written combinations to authorized secure storage containers, secure storage rooms, or certified vaults, shall be marked and safeguarded at the highest classification level as the classified material maintained inside the approved containers.

2.16.2.20 AUTOMATIC DATA PROCESSING EQUIPMENT. Automatic Data Processing Equipment (ADPE). The Contractor shall establish and implement procedures to ensure all ADPE, to include laptops and other data processing devices, issued to the Contractor by the Government are not lost or misplaced, are not used by unauthorized persons are not subject to unauthorized external devices. The Contractor shall immediately report to the CO or PM any occurrences of lost ADPE within two (2) hours of discovery of the occurrence. In the event that ADPE is lost, the Contractor may be required, upon written direction of the CO, to replace the equipment at no additional cost to the Government. The Government may replace the equipment and deduct the cost of such from the monthly payment due the Contractor.

2.16.2.21 COMMUNICATIONS SECURITY (COMSEC). Contractors will require access to COMSEC information. The DD254 will give further instructions on safeguarding and managing COMSEC material.

2.16.2.22 OPERATIONS SECURITY (OPSEC). The purpose of OPSEC is to reduce the vulnerability of USAF missions to adversary collection and exploitation of critical information. Critical Information is defined as information about USAF missions or activities the adversary needs to achieve its goals. The contractor shall ensure compliance with DoDD 5205.02E, DoD Manual 5205.02-M, AFI 10-701 and/or other applicable Government security regulations including procedures to protect classified and/or CUI, Government projects and/or programs. The contractor shall ensure contractor personnel who perform work on geographically separated locations or another Government facility comply with the OPSEC procedures of the facility. The contractor shall implement security requirements as listed in the unit’s OPSEC Plan, which will be provided as Government Furnished Information (GFI).

2.16.2.23 SECURITY TRAINING. The contractor shall ensure Visitor Group personnel participate in the Government activities initial and reoccurring security training IAW AFI 16-1404, Air Force Information Security Program, Para 1.4.4 and Chapter 6; AFI 10-701, Operations Security, Chapter 5, DoDM 5200.01, Volume 4, DoD Information Security Program: Controlled Unclassified Information, Enclosure 4, and the Visitor Group Security Agreement, Training Section.

2.16.2.24 COMBATING TRAFFICKING IN PERSONS. Trafficking in Persons (TIP) is a worldwide problem posing a transnational threat involving violations of basic human rights. The DoD has a zero tolerance policy for TIP. As part of the 2013 National Defense Authorization Act, the Pentagon is required to take action against any contractor engaging in any activities related to labor trafficking, sex trafficking, and child soldiering. The contractor shall familiarize its employees with the DoD ‘Combating Trafficking in Persons’ information at: http://ctip.defense.gov/Home.aspx, and shall immediately report suspicious activity of any employee to the CDM COR.

2.16.2.25 CLASSIFIED VISITS. The contractor shall process all classified visit requests via Defense Information Security System (DISS) in support of tasks within DoD. Classified visits outside DoD will require Visit Authorization Letters (VALs) IAW the National Industrial Security Program Operating Manual (NISPOM) or otherwise noted.

2.16.2.26 PROGRAM PROTECTION PLANNING. The contractor shall implement security requirements as listed in the Government-furnished Program Protection Plan (PPP), if applicable, to mitigate foreign intelligence collection, technology exploitation, and system vulnerabilities relative to the protection of Critical Program Information (CPI).

2.16.2.27 PRESS/NEWS RELEASE. The contractor shall not make any press/news release pertaining to this procurement without prior Government approval and only in coordination with the CO.

2.16.2.28 NON-DISCLOSURE REQUIREMENTS. If the contractor acts on behalf of, or provides advice with respect to any phase of an agency procurement, as defined in FAR 3.104-4, then the contractor shall execute and submit a Corporate Non-Disclosure Agreement (NDA) Form and ensure that all its personnel (to include subcontractors, teaming partners, and consultants) who will be personally and substantially involved in the performance of the contract/TO:

a. Are listed on a signed Addendum to the NDA Form (Section J, Attachment L) prior to the commencement of any work on the TO.

b. Are instructed in the FAR 3.104 requirements for disclosure, protection, and marking of contractor bid or proposal information, or source selection information.

c. Are instructed in FAR Part 9 for third-party disclosures when acting in an advisory capacity.

d. All proposed replacement contractor personnel shall also be instructed in the requirements of FAR 3.104. Any information provided by contractors in the performance of this TO or obtained from the Government is only to be used in the performance of the TO. The contractor shall put in place appropriate procedures for the protection of such information and shall be liable to the Government for any misuse or unauthorized disclosure of such information by its personnel, as defined above.

2.16.2.29 PROTECTION OF INFORMATION. Controlled Unclassified Information (CUI) is any information that law, regulation, or Government wide policy requires to have safeguarding or disseminating controls, excluding information that is classified under Executive Order 13526, Classified National Security Information, December 29, 2009, or any predecessor or successor order, or the Atomic Energy Act of 1954, as amended. The National Archives and Records Administration (NARA) CUI Registry (http://www.archives.gov/cui/registry/category-list.html) identifies approved CUI categories and subcategories, provides general descriptions for each, identifies the basis for controls, and sets out procedures for the use of CUI. The contractor shall comply with DoDM 5200.01, Volume 4, DoD Information Security Program: Controlled Unclassified Information (CUI), Enclosures 3 & 4, for identification, protection, training, and accomplishment of out-processing requirements. The contractor shall comply with DoD 5400.7‑R/Air Force Manual 33‑302, DoD Freedom of Information Act (FOIA) Program, requirements.

Protection of CUI and unclassified DoD information not approved for public release on non- DoD Information Systems will be protected IAW DoDI 8582.01, Security of Unclassified DoD Information on non-DoD Information Systems, Enclosure 3. Unless specific categories of CUI require more stringent controls, non-DoD Information Systems must be protected using the guidelines set forth in NIST Special Publication 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations.

The contractor shall comply with DFARS 252.204-7012 SAFEGUARDING COVERED DEFENSE INFORMATION AND CYBER INCIDENT REPORTING (Sep 2015). The subpart applies to contracts and subcontracts requiring safeguarding of unclassified controlled technical information resident on or transiting through contractor unclassified information systems. The subpart does not abrogate any existing contractor physical, personnel, or general administrative security operations governing the protection of unclassified DoD information, nor does it impact requirements of the National Industrial Security Program.

Classified information – The contractor shall comply with the DD Form 254, DoD Contract Security Classification Specification.

2.17 TRANSITION PLAN

2.17.1 TRANSITION IN. The transition-in period will be a minimum of 15 calendar days for Project Lead and one (1) assistant to process and obtain required visas, security badges, ID/CAC cards, computer system access requests, and receive workplace orientation for all contracted employees to receive required documents and are in place for PoP start. The Contractor shall provide a Draft Transition-In Plan to the Contracting Officer at the Kick-Off Meeting (RR#8). The Contractor shall provide a Final Transition-In Plan (RR#9) within three (3) business days after receipt of the Government’s comments.

2.17.2 TRANSITION OUT. Prior to the end of the PoP, the incumbent Contractor shall support up to 60 calendar days transition period with the incoming Contractor. During this period, all programs, information, data, etc., will be passed from the incumbent Contractor to the incoming Contractor so that there is no break in mission support. The Contractor shall maintain continuity folders for each contract position. Folders shall detail the routine duties performed, status of current projects, and a point of contact list for both routine duties and project coordination. Folders shall be maintained, and be available, for Government review throughout the performance of the contract and be provided to the incoming Contractor during the transition period (Reference 5.7). The Contractor shall provide a Draft Transition-Out Plan to the Contracting Officer within six (6) months of performance start (RR #10). The Contractor shall provide the Final Transition-Out Plan within ten (10) business days after receipt of the Governments’ comments. The Final Transition-Out Plan shall then be updated annually except for the final year of performance in which the Transition plan shall be updated quarterly (RR #11).

2.18 PERFORMANCE SCHEDULE

2.18.1 PERIOD OF PERFORMANCE. The Period of Performance for the IDIQ will be: TBD

2.18.2 PLACE OF PERFORMANCE. Place of performance will be within the Continental United States (CONUS). Specific places of performance will be identified at the task order level.

2.19 CONTRACTOR IDENTIFICATION. Each Contractor employee shall, while on duty, wear in plain view on the upper portion of his outer garment a metal or plastic identification badge to be furnished by the Contractor, containing the company name, employee name, and the section where the employee works. Contractor employees shall clearly identify themselves as "Contractors" at all times, in all communications and representations, including in the workplace, at meetings, in conversations, telecommunications, mail, e-mail, and faxes, whether with Government personnel, other Contractor personnel, or with the public. Contractors with access to the base LAN or with an official Government e-mail address shall include their company name in the signature block and the designation "CTR" in the global address. The Contractor shall notify the Government if the "CTR" designation is not included in the global address.

2.20 ALTERNATE WORK LOCATION. Alternate work locations shall be permitted for this task order on a case-by-case basis with Government approval. If primary duty location is not available to the contractor (i.e. office closed) then the contractor may be directed to telecommute or work from an alternate location. Working from an alternate location shall not involve working with or transporting classified information.

2.21 DUTY HOURS. Operating hours are 24 hours a day, 365 days a year including holidays and weekends however, contractor duty hours will be determined by the work center. Contractor must be able to support missions 24 hours a day, 365 days per year. All work performed is considered mission essential. Federal Holidays will be observed for personnel working at CONUS locations. Personnel working at OCONUS locations may be required to follow the schedule at the local place of performance. Contractor employee will be notified of the hours prior to Temporary Duty (TDY) departure.

2.22 ADDITIONAL SUPPORT (OPTIONAL). The Government may include optional support at the task order level which will be pre-priced.

2.23 FEDERAL HOLIDAYS. Federal Holidays observed for personnel working at CONUS locations include:

2.24 SHUTDOWN AND INCLEMENT WEATHER. All tasks are considered mission essential. Personnel must report for duty regardless of weather or base operating status unless pre-coordinated with the Government.

2.25 KICKOFF MEETINGS. The contractor shall schedule, coordinate, and host a Project Kick-Off Meeting at the location approved by the Government.