PWS for FISMA_20250717.pdf

PERFORMANCE WORK STATEMENT (PWS)

For

PACIFIC AIR FORCES (PACAF)

ASSESSMENT AND AUTHORIZATION (A&A)

FOR

FEDERAL INFORMATION SYSTEM MANAGEMENT ACT (FISMA)

AND

CYBERSECURITY HARDENING

AT

PACAF

JOINT BASE PEARL HARBOR-HICKAM (JBPHH), HAWAII

17 July 2025

Contract Number: ________________ i

TABLE OF CONTENTS

SECTION PAGE

1 General Information

1.1 Contracting Officer’s Representative (COR)

1.2 Contract Title

1.3 Background

1.4 Objectives

1.5 Scope

2 Description of Services

2.1 Cybersecurity SME

2.1.1 Duties and Responsibilities

2.1.2 Requirements

2.1.3 Skills, Knowledge, & Abilities

2.1.4 Deliverables

2.1.5 Positions

2.2 Theater Vulnerability Analyst

2.2.1 Duties and Responsibilities

2.2.2 Requirements

2.2.3 Skills, Knowledge, & Abilities

2.2.4 Deliverables

2.2.5 Positions

3 Services Summary 4 Period of Performance

4.1 Duration

4.2 Performance Period

4.3 Preplacement Personnel

5 Place of Performance 6 Travel

6.1 Travel General

6.2 Air Transportation

6.3 Auto Rental

6.4 Per Diem

6.5 Billeting

6.6 Travel Confirmation

6.7 Travel Reimbursement

7 Security Clearance Requirements

7.1 Site Visit Coordination

7.2 Clearance

7.3 Visit Authorization Letters

7.4 Information Security and other miscellaneous requirements 8 Hours of Operation

8.1 Normal Operation Hours

8.2 Base Shutdown/Inclement Weather

8.3 Federal Holidays

9 Standards of Conduct 10 Records ii

11 Government Furnished Property (GFP) Government-Furnished Equipment (GFE) / Government-Furnished Information (GFI)

Acronyms Acronyms Continued

1 General Information

1.1 Contracting Officer’s Representative (COR)

Organization: HQ PACAF/A634 Department of Defense Activity Address Code (DODAAC): F2CFSQ Address: 25 E St, JBPHH, 96860 Phone Number: (808/315) 448-4982

1.2 Contract Title

PACAF Assessment and Authorization (A&A) for Federal Information System Management Act (FISMA) and Cybersecurity Hardening

1.3 Background

The HQ PACAF has approximately 45,000 military and civilian personnel primarily serving at ten Main Operating Bases (MOBs) at the following locations: Andersen AFB, Guam; Diego Garcia, British Indian Ocean Territory (BIOT) Geographically Separated Unit (GSU); Eielson AFB, Alaska; Joint Base Elmendorf-Fort Richardson (JBER), Alaska; Joint Base Pearl Harbor- Hickam (JBPHH), Hawaii; Kadena AB, Japan (Okinawa), Kunsan AB, South Korea; Misawa AB, Japan; Osan AB, South Korea; and Yokota AB, Japan.

PACAF's area of responsibility (AOR) extends from the West coast of the United States to the East coast of Africa and from the Arctic to the Antarctic, covering more than 100 million square miles. In addition to the ten MOBs, PACAF supports over 100 Geographically Separated Units (GSUs), Collocated Operating Bases (COBs), and Forward Operating Locations (FOLs). All GSUs, COBs, and FOLs are hereinafter referred to collectively as GSUs.

HQ PACAF has had contract cybersecurity support since May 2003. As a result, PACAF has consistently been the top USAF MAJCOM in compliance with FISMA requirements as well as Cyber Operations Readiness Assessments (CORA) and Command Cyber Operational Readiness Inspections (CCORI) conducted by United States Cyber Command (USCYBERCOM).

1.4 Objectives

The objectives of this contract are to:

1) Enhance and sustain PACAF’s cybersecurity posture by implementing congressional FISMA, Department of Defense (DoD), AF cybersecurity directives, while ensuring compliance with DoDI 8510.01, RMF for DoD Systems,

2) Prepare/mentor Numbered Air Force (NAF), Wing and cybersecurity forces through Cyberspace Readiness Review and Mentorship (CRR-M) program,

3) Assist/prepare PACAF Wings for USCYBERCOM CORAs & CCORIs ISO missions operating on PACAF Non-classified Internet Protocol Router Networks (NIPRNet), Secret Internet Protocol Router Networks (SIPRNet) and supported information systems, and

4) Support vulnerability management efforts.

This work shall be accomplished by four (4) individuals residing in Honolulu, Hawaii.

Four (4) contractors shall work for the HQ PACAF Cybersecurity Office and conduct security assessments, and provide security consultation to military and DOD civilian personnel within PACAF AOR. The contractors, at the Government’s request, shall augment as unit inspection preparation team providing required expertise in Vulnerability Management, Physical Security, Emission Security (EMSEC), Cross Domain Solutions (CDS), and network security consulting.

The contractors will also support NAF/Wings to be “cyber ready” via scheduled CRR-M. CRR- M assessments will utilize USCYBERCOM and DISA criteria as it relates to CORA and the most recent effort involving CCORI.

The Cybersecurity SMEs contractors shall also assist in posturing PACAF MOBs and GSUs enclaves for successful maintenance of A&A/RMF. Additionally, these contractors shall:

1) Assist in providing up-dates through AF central FISMA database repository, Technology Investment Portfolio Suite (ITIPS).

2) Ensure A&A data is synchronized across AF and DISA repositories (Enterprise Mission Assurance Support Service (eMASS) and ITIPS), NIPRNet Systems/Network Approval Process (SNAP) and Global Information Grid Interconnection Approval Process (GIAP).

3) Provide monthly status reports.

Theater Vulnerability Manager SME shall also support the vulnerability management efforts by providing expertise to command wide engagements with PACAF vulnerability managers with the goal to enhance PACAF MOBs and GSUs cybersecurity posture.

1.5 Scope

Under the direction of HQ PACAF Cybersecurity Chief, the contractors shall assist and consult with maintaining regulatory requirements of Cybersecurity for PACAF MOBs SIPRNet and NIPRNet enclaves and give guidance/solutions with regards to cyber readiness (CORA & CCORI support). Contractors are to provide specialized expertise to Communications/Cyber Squadrons and Wings across the PACAF Area of Responsibility (AOR).

The contract positions are for assessment, training support, and products for A&A of all AF circuits/enclaves at the nine (9) PACAF MOBs and two (2) GSUs as identified below.

Location Support Anderson AB, Guam 2 NIPRNet and 2 SIPRNet circuits, Including GSU:

2 NIPRNet/2 SIPRNet - Diego Garcia

Eielson AFB, Alaska 2 NIPRNet and 2 SIPRNet circuits JBER, Alaska 2 NIPRNet and 2 SIPRNet circuits JBPHH, Hawaii 2 NIPRNet and 2 SIPRNet circuits Kadena AB, Japan 2 NIPRNet and 2 SIPRNet circuits

Kunsan AB, Korea 2 NIPRNet and 1 SIPRNet circuits Misawa AF, Japan 2 NIPRNet and 2 SIPRNet circuits Osan AB, Korea 2 NIPRNet and 2 SIPRNet circuits Yokota AB, Japan 2 NIPRNet and 2 SIPRNet circuits

The required cybersecurity assessment, services, support, and products fall into these categories:

Cat. # Category

1 RMF/FISMA/ATO Compliance

2 CRR-M

3 CORA & CCORI Support 4 Vulnerability Management

2 Description of Services The contractor shall acquire and maintain all required certifications, accounts, and documentation to accomplish the objectives within the scope of the contract.

2.1 Cybersecurity SME

This position works directly for the PACAF Defensive Cyber Operations and Mission Assurance Branch but works with various PACAF AOR personnel to execute the following duties and responsibilities.

2.1.1 Duties and Responsibilities

Cybersecurity SME Duties and Responsibilities are as follows:

Item # Duty and Responsibility

2.1.1.1 Deliver Cybersecurity and RMF/FISMA support to PACAF mission owners;

distributing current policy and provide guidance, and mentorship to the cyber forces to ensure compliance.

2.1.1.2 Assist PACAF MOBs & GSUs improve & maintain implementation of congressional FISMA, DoD, and AF cybersecurity directives.

2.1.1.3 Conduct (on-site and/or virtual) A&A validation and reviews, using National/DoD/AF standards (e.g., DISA Security Technical Implementation Guides (STIGs), National Institute of Standards and Technology (NIST) SP 800- 12).

2.1.1.4 Collect and develop A&A artifacts in accordance with AO Office

2.1.1.5 Assisting MOBs and GSUs maintain and sustain A&A packages, including tracking/updating A&A documents/products in the following databases:

☐ Connection Approval Process (CAP) for SNAP ☐ GIAP circuit management tools ☐ eMASS and ITIPS ☐ Continuous Monitoring Risk Scoring (CMRS) efforts

2.1.1.6 Assist MOB and GSUs create and maintain comprehensive RMF products for the theater circuits/enclaves via eMASS as required. Products must include all requirements IAW applicable DoD and AF Instructions.

2.1.1.7 Assist the Government in the creation, consultation, revision, finalization, submission of the deliverables for RMF to include but not limited to the following:

☐ System Security Plan ☐ Ports Protocol Services Matrix (enclave) ☐ Artifacts for control validation (STIG results, Policies, Scans, Charters, etc., unit provided) ☐ Plan of Actions and Milestones (POAMs) ☐ System Topology

2.1.1.8 Provide updates through AF central FISMA database repository, ITIPS.

2.1.1.9 Ensure A&A data are synchronized across AF and DISA repositories (eMASS, ITIPS, SNAP, and GIAP).

2.1.1.10 Assist processing circuit connection requests for all the main bases through

SIPRNet Global Information Grid (GIG) Interconnection Approval Process (GIAP) System (SGS) and the NIPRNet SNAP.

2.1.1.11 Prepare and mentor NAF, Wing and cybersecurity forces through the CRR-M program.

2.1.1.12 Train and assist PACAF MOBs & GSUs personnel in the use of DoD security technical implementation tools and technology to maintain & improve cyber readiness.

2.1.1.13 Consult to resolve any issues with DoD required vulnerability scanning tools, including system credentials, access control list, and identified network assets.

2.1.1.14 Consult to resolve any issues with DoD required endpoint security solutions for all host devices in the network enclaves.

2.1.1.15 Assist and prepare PACAF Wings for CORAs & CCORIs on NIPRNet, SIPRNet and supported information systems.

2.1.1.16 Create CORA and CCORI scores and Risk Assessment Report for the MOBs & GSUs using DISA CORA Scoring and Risk Assessment tools

2.1.1.17 Provide recommendations for mitigations & follow-on actions to include POAMs.

2.1.2 Requirements

Cybersecurity SME Requirements are as follows:

Item # Position Requirements

2.1.2.1 General Position Requirements

2.1.2.1.1 Top Secret (TS) / Sensitive Compartmented Information (SCI) security clearance

2.1.2.1.2 DoD 8140, the DoD Cyber Workforce Manual

Anyone (1) of the following:

☐ Advanced - CISM or CISSO or CPTE or CySA+ or FITSP-A or GCSA or CISA or CISSP or CISSP-ISSEP or GSLC or GSNA or DoD 8570.1-M certified at Information Assurance Technical (IAT) Level 3 - Anyone (1) of the following:

☐ CompTIA Advanced Security Practitioner Continuing Education (CASP+ CE) ☐ Certified Information Systems Auditor (CISA) ☐ Certified Information Systems Security Professional (CISSP) (or Associate -this means the individual has qualified for the certification except for the number of years’ experience) ☐ Certified Cloud Security Professional (CCSP)

2.1.2.1.3 Have 2-3 years of experience and the skills required to execute Federal, National, DoD, USAF CIO, and US State Department Requirements to be able to assess cyber risk, identify mission sets, and defend the mission.

2.1.2.1.4 Have 2-3 years of experience of applying, assessing, and advising MAJCOM staff and Wings on cybersecurity requirements.

2.1.2.1.5 Understand the AF Cyber architecture and PACAF MOBs and GSUs roles.

2.1.2.1.6 Ability to travel to PACAF MOBs and GSUs to conduct duties and responsibilities

-at a maximum up to 40% of the time.

2.1.2.1.7 Proficiency in Microsoft Office Suite products and SharePoint collaborative tools.

2.1.2.1.8 Training highly preferred prior to starting; however, must have the ability to obtain within 3 days of starting and maintain certificates of completion for the following training:

☐ Level 1 Anti-Terrorist Training - within the past year https://jkodirect.jten.mil/html/COI.xhtml?course_prefix=JS&course_number=-

US007

☐ Level A Survival, Evasion, Resistance, and Escape (SERE) Training - within the past 1-2 years https://jkodirect.jten.mil/html/COI.xhtml?course_prefix=J3T&course_number

=A-US1329

☐ USFK Training - no time requirement (only required to be taken once) https://jkodirect.jten.mil/html/COI.xhtml?course_prefix=USFK&course_number=

-US171

☐ DoD Cyber Awareness Challenge - within the past year https://jkodirect.jten.mil/html/COI.xhtml?course_prefix=DOD&course_number=-

US1364-23

☐ Operations Security (OPSEC) Awareness - within the past year https://jkodirect.jten.mil/html/COI.xhtml?course_prefix=PAC&course_number=-

US017

☐ Derivative Classification IF103.16 - within the past year https://www.cdse.edu/Training/eLearning/IF103

☐ Force Protection - within the past year https://lms-jets.cce.af.mil/moodle/enrol/index.php?id=12739

COR will provide update website addresses to the above that may change.

2.1.2.2 RMF/FISMA/ATO Requirements

2.1.2.2.1 Have 2-3 years of experience conducting RMF/FISMA/ATO A&A.

2.1.2.2.2 Have 2-3 years of experience maintaining accreditation at a level consistent with

AF, DoD and FISMA requirements for all base enclaves and providing situational awareness of assigned systems at MOBs and GSUs.

2.1.2.2.3 Have 2-3 years of experience with DISA Connection Approval Process vehicles (e.g., SNAP, SGS, GIAP, and CDS-approval).

2.1.2.2.4 Expertise with FISMA compliance vehicle – AF centralized repository for FISMA reporting is ITIPS.

http://www.cdse.edu/Training/eLearning/IF103

2.1.2.2.5 Expertise with AF System A&A process vehicles (e.g., eMASS, AF PPSM, AF Software Approval) to produce ATO, ATC, Interim Authority to Connect (IATC).

2.1.2.3 CRR-M Requirements

2.1.2.3.1 Have 2-3 years of experience of conducting assessments of SIPRNet/NIPRNet network, enclave, and system security posture providing guidance, mitigation recommendations and familiarization to personnel on cyber security to include prepare/advise pre-, post-, and during-inspections.

2.1.2.3.2 In-depth experience with DISA STIGs and by-product analysis

2.1.2.4 CORA & CCORI Support Requirements

2.1.2.4.1 Have 2-3 years of experience of conducting CORA & CCORI inspections.

2.1.2.4.2 Expertise with CORA process vehicles.

2.1.2.4.3 Expertise with CCORI process vehicles (e.g., MADSS, ELICSAR, etc.)

2.1.2.4.4 Expertise with USCYBERCOM/DISA CORA Scoring Tools (option to utilize the

AF “Cyber Ready 365”).

2.1.3 Skills, Knowledge, & Abilities

Cybersecurity SME Skills, knowledge, and abilities are as follow:

Item # Skill, Knowledge, or Ability

2.1.3.1 Ability to deliver on-site and remote Cybersecurity, RMF, and FISMA support to mission owners through the distribution of current policies and providing guidance and mentorship to the cyber forces.

2.1.3.2 Knowledge of congressional FISMA, DoD, and AF cybersecurity directives.

2.1.3.3 In-depth experience conducting (on-site and/or virtual) A&A validation, reviews and mentorship pursuant to National/DoD/AF standards (e.g., DISA STIGs, NIST

SP 800-12, NIST SP 800-53, AFI 17-101, CRR-M).

2.1.3.4 In-depth experience collecting and developing A&A artifacts.

2.1.3.5 Ability to maintain and sustain A&A packages, including tracking/updating A&A documents/products in the following databases:

☐ CAP for SNAP ☐ GIAP circuit management tools ☐ eMASS and ITIPS ☐ CMRS efforts

2.1.3.6 Proficiency in creating and maintaining RMF products for the theater circuits/enclaves via eMASS.

2.1.3.7 Experience in creating, consulting, revising, finalizing, submitting RMF deliverables.

2.1.3.8 Ability to provide up-dates through AF central FISMA database repository, ITIPS.

2.1.3.9 In-depth experience ensuring A&A data is synchronized across AF and DISA repositories.

2.1.3.10 Knowledge of processing circuit connection requests through SGS and SNAP.

2.1.3.11 Experience in mentoring cyber workforce personnel to excel in implementing and sustaining security best practices and cyber-readiness, leveraging CORA methodology within the PACAF-specific Cyber-Readiness Maturity Model (CRR- M).

2.1.3.12 Knowledge of how to resolve issues with DoD vulnerability scanning tools, including system credentials, access control list, and identified network assets.

2.1.3.13 Knowledge of how to resolve issues with DoD required endpoint security solutions for all host devices in the network enclaves.

2.1.3.14 In-depth experience preparing Wings for CORAs & CCORIs on NIPRNet, SIPRNet and supported information systems.

2.1.3.15 In-depth experience with CORA and CCORI scores and Risk Assessment Report for the MOBs & GSUs using DISA CORA Scoring and Risk Assessment tools

2.1.3.16 Ability to provide recommendations for mitigations & follow-on actions to include POAMs.

2.1.3.17 Experience with email, and other communication platforms to include but not limited to MS Teams group chats, MS SharePoint site, and VoIP Phones.

2.1.3.18 Proficiency with the latest Microsoft tool suite (i.e., PowerPoint, Excel, Word, etc.).

2.1.3.19 Ability to collaborate with others.

2.1.3.20 Ability to brief technical information to both technical and non-technical audiences.

2.1.3.21 Experience briefing senior leaders and large audiences.

2.1.4 Deliverables

Cybersecurity SME Deliverables are as follow:

*Note: Presentation deliverables may be required to be presented to PACAF Director of Air and Cyberspace Operations and/or other stakeholders when there is potential of mission impact. Also, “Site Visit” refers to FISMA, RMF, CRR-M, CORA, or CCORI site visits.

Item # Deliverable Title Format Due Date Distribution & Copies

Frequency & Remarks

2.1.4.1 Resume MS Word or

Adobe & Email

Prior to 30 September 2025 and NLT 3 working days prior to any new replacement personnel’s start date

Website & Email Once and then as needed

- Send to CO/PM and COR

2.1.4.2 PACAF CRR-M

and Other Cybersecurity Assistance Travel Schedule

MS Excel & Email

Initial NLT end of last duty day in Oct, Updates NLT one duty date after known changes

Website & Email Annually and then as needed

- Update file & send email updates COR

2.1.4.3 PACAF CRR-

M/RMF Support Plan

MS Word or MS Excel & Email

NLT 30 workdays prior to site visit date

Website & Email Required prior to every site visit

2.1.4.4 Tech Exchange

Meeting

MS Teams & Email

NLT 10 workdays prior to site visit date

Website & Email Required prior to every site visit

2.1.4.5 Specific Site Visit

Schedule

MS Word or MS Excel & Email

NLT 10 workdays prior to site visit date

Website & Email Required prior to every site visit

- contains results from Technical Exchange Meeting

2.1.4.6 Travel Cost

Estimates

Adobe Form NLT 15 workdays prior to travel date

Email Required prior to every

TDY

2.1.4.7 In-Brief or

Office Call

PowerPoint & Brief

First day of site visit Website & Email Required first day of every site visit

Item # Deliverable Title Format Due Date Distribution & Copies

Frequency & Remarks

2.1.4.8 Site Visit Hotwash Email Daily at close of

business day during site visit

Email Required daily for every site visit

2.1.4.9 Out-Brief Brief with

PowerPoint

Last day of site visit Website & Email Required for every site visit

2.1.4.10 Site Visit AAR MS Word, Excel, or PowerPoint

NLT 15 workdays from date of return from site visit

Website & Email Required following every site visit

2.1.4.11 POAM Presentation PowerPoint After POAM created Website & Email Monthly or By request

2.1.4.12 Monthly Status

Report inputs Word, Excel, or PowerPoint

1st workday of the month or as directed

Website & Email Monthly - Provide current status & way ahead:

RMF/FISMA/ATO

compliance, CRR-M, CORA/CCORI support, travel schedule, and status of critical POAMs.

2.1.4.13 Status Updates Brief with a

PowerPoint

2nd workday of the month or as directed

Website & Verbal Presentation

Monthly or as directed

2.1.4.14 Cyber Readiness

Review (CRR) Report

CORA/CCORI

Scoring tool or equivalent

Final day of CCR Website & Email 90 days prior to a scheduled CORA or CCORI or upon request

2.1.4.15 CRR Presentation Brief with a

PowerPoint

Same as CRR Report Website & Verbal Presentation

Same as CRR Report

2.1.4.16 CRR Update Report Table in MS

Word, Excel Spreadsheet or PowerPoint

Approx. 30 & 60 days after CRR Completion

Website & Email 60 and 30 days prior to when a Base is scheduled for CORA or CCORI review, upon request, or yearly.

Copies

Frequency & Remarks

2.1.4.17 CRR Update

Presentations

Brief with a PowerPoint

Same as CRR Update Report

Website & Verbal Presentation

Same as CRR Update Report

2.1.4.18 Risk Assessment

Report & Mitigation Recommendations Presentation

Brief with a PowerPoint

Final Day of CORA or

CCORI

Website & Verbal Presentation

As directed - PACAF has historically had 3 CORAs on average per year

2.1.5 Positions

Number of Cybersecurity SME positions and their locations are as follow.

Item # Position Location Positions

2.1.5.1 Cybersecurity SME JBPHH, Hawaii 1

2.1.5.2 Cybersecurity SME JBPHH, Hawaii 1

2.1.5.3 Cybersecurity SME JBPHH, Hawaii 1

2.2 Theater Vulnerability Analyst

This position works directly for the PACAF Defensive Cyber Operations and Mission Assurance Branch but works with various PACAF AOR personnel to execute the following duties and responsibilities. The position shall provide expert support, analysis and research into exceptionally complex problems, and processes relating to PACAF Theater Vulnerability Management.

2.2.1 Duties and Responsibilities

Theater Vulnerability Analyst Duties and Responsibilities are as follows:

Item # Duty and Responsibility

2.2.1.1 Analyzes PACAF AOR cyber security posture reports.

2.2.1.2 Provides PACAF cyber units expertise and fix action guidance.

2.2.1.3 Interfaces with base cyber units and provides PACAF leadership a depiction of

PACAF Wings ability to:

☐ Scan Assured Compliance Assessment Solution (ACAS), ☐ Mitigate (via MS System Center Configuration Management (SCCM)/MS

Endpoint Configuration Manager (MECM)), and ☐ Maintain Host Based point products mandated by the DoD (End Point Security formerly known as HBSS).

2.2.1.4 Maintains proficiency on current and future End Point Security assessment tools.

2.2.1.5 Assists PACAF cyber field support team with Vulnerability Management (VM).

2.2.1.6 Provide and/or coordinate vulnerability mentor training (virtual or on-site) to

PACAF bases as requested.

2.2.1.7 Creates and maintains cyber security/VM management training documentation.

2.2.1.8 Interfaces with cyber security technicians/ISSMs to maintain up-to-date reporting to keep PACAF compliant.

2.2.1.9 Maintains command wide SCCM & MECM health status.

2.2.1.10 Coordinate with Vulnerability Management teams upon scan result analysis.

☐ Identify patching issues/troubleshooting way ahead.

☐ Produce report to chain of command informing of patching status.

2.2.1.11 Analyzes & produces command wide NIPRNet & SIPRNet weighted vulnerability indicator scores.

2.2.1.12 Produces & disseminates cyber security/vulnerability reports to PACAF staff containing current MAJCOM security posture.

2.2.1.13 Utilizes CORA reports from the DISA J3 website on SIPRNet to advise PACAF Cybersecurity staff of findings and level of risk.

2.2.1.14 Assists with cyber operations briefs by preparing and briefing command-wide statuses to the PACAF Director of Air and Cyberspace Operations.

2.2.1.15 Creates and conducts PACAF compliance update briefs on command wide cyber security status and assist with troubleshooting cyber security short falls.

2.2.1.16 Assists with creating TASKORDs to raise PACAF cyber security posture.

2.2.1.17 Tracks status of VM POAMs until completion and reports at risk POAMs to

PACAF leadership.

2.2.1.18 Augments CRR-M team as required.

2.2.1.19 Maintain Internet Protocol (IP) space and asset lists to cover 100% base assets.

2.2.1.20 Maintain MAJCOM ACAS Account with auditing role in order to analyze and produce vulnerability metrics

2.2.1.21 Maintain SIPRNet PROD Account in order to provide command wide

SCCM/MECM patching analysis on SIPRNet

2.2.1.22 Maintain ELICSAR Account for situational awareness of cybersecurity toolsets used in PACAF

2.2.1.23 Maintain AFNET Compliance Tracker Account in order to maintain situational awareness of CTOs, MTOs, TCNOs pertaining to vulnerability management

2.2.1.24 Provides Government Representative

☐ Contract Personnel Roster ☐ Updates to contractor availability ☐ Contract Invoices & Funding Expenses ☐ Monthly Status Report (MSR) ☐ Contractor’s Non-Disclosure Agreements (NDA) ☐ Kick-Off Brief & Close-Out Brief ☐ Transition Brief ☐ Assistance with processing contractors travel requirements

2.2.1.25 Track contract.

☐ Labor/Events/Workload/Travel schedule & expenses ☐ Metrics of Program for Yearly Closeout

2.2.1.26 Provides Cybersecurity SME contractors assistance with:

☐ Common access Card (CAC) ID processing and renewals ☐ Building Badge processing and renewals

☐ DD254

☐ TS/SCI processing and renewals ☐ Synchronized Pre-deployment and Operational Tracker (SPOT) processing.

☐ Financial preparation ☐ Letters of Identification ☐ Travel Estimates/Schedule

2.2.1.27 Ensure all contractors follow all applicable commercial, and government/military standards which include, but are not limited to the following:

☐ Department of Defense Instruction 8500.01, Cybersecurity ☐ Department of Defense Instruction 8510.01, RMF for DoD Systems ☐ Committee on National Security Systems Instruction 1253, Security

Categorization and Control Selection for National Security Systems ☐ National Institute of Standards and Technology Special Publication 800-53, Security and Privacy Controls for Federal Information Systems and

Organizations ☐ National Institute of Standards and Technology Special Publication 800-53A, Guide for Assessing the Security Controls in Federal Information Systems and Organizations: Building Effective Security Assessment Plans

☐ National Institute of Standards and Technology Special Publication 800-39, Managing Information Security Risk: Organization, Mission, and Information System View

☐ National Institute of Standards and Technology Special Publication 800-30, Guide for Conducting Risk Assessments

☐ All applicable DISA STIGs and Security Review Guides (SRGs) ☐ Air Force Instruction (AFI), 17-130 Cyber Security Program Management ☐ AFI 17-101, RMF for Air Force Information Technology (IT) ☐ AFI 17-110, Information Technology Portfolio Management and Capital

Planning and Investment Control Where existing commercial or military standards allow for options or are undefined, the Contractor shall make written recommendations to the Government.

Upon acceptance of the recommendation by the Government, it will be incorporated as a PACAF standard for implementation.

2.2.2 Requirements

Theater Vulnerability Analyst Requirements are as follows:

Item # Position Requirements

2.2.2.1 General Position Requirements

2.2.2.1.1 TS/SCI security clearance

2.2.2.1.2 DoD 8140, the DoD Cyber Workforce Manual

Anyone (1) of the following:

☐ Advanced - CISM or CISSO or CPTE or CySA+ or FITSP-A or GCSA or CISA or CISSP or CISSP-ISSEP or GSLC or GSNA or DoD 8570.1-M certified at IAT Level 3 - Anyone (1) of the following:

☐ CASP+ CE

☐ CISA

☐ CISSP (or Associate)

☐ CCSP

2.2.2.1.3 Have 2-3 years of experience and the skills required to execute Federal, National, DoD, USAF CIO, and US State Department Requirements to be able to assess cyber risk, identify mission sets, and defend the mission.

2.2.2.1.4 Have 2-3 years of experience of applying, assessing, and advising MAJCOM staff and Wings on cybersecurity requirements.

2.2.2.1.5 Understand the AF Cyber architecture and PACAF MOBs and GSUs roles.

2.2.2.1.6 Ability to travel to PACAF MOBs and GSUs to conduct duties and responsibilities

-at a maximum up to 40% of the time.

2.2.2.1.7 Proficiency in Microsoft Office Suite products and SharePoint collaborative tools.

2.2.2.1.8 Training highly preferred prior to starting; however, must have the ability to obtain within 3 days of starting and maintain certificates of completion for the following training:

☐ Level 1 Anti-Terrorist Training - within the past year https://jkodirect.jten.mil/html/COI.xhtml?course_prefix=JS&course_number=-

US007

☐ Level A Survival, Evasion, Resistance, and Escape (SERE) Training - within the past 1-2 years https://jkodirect.jten.mil/html/COI.xhtml?course_prefix=J3T&course_number

=A-US1329

☐ USFK Training - no time requirement (only required to be taken once) https://jkodirect.jten.mil/html/COI.xhtml?course_prefix=USFK&course_number=

-US171

☐ DoD Cyber Awareness Challenge - within the past year https://jkodirect.jten.mil/html/COI.xhtml?course_prefix=DOD&course_number=-

US1364-23

☐ Operations Security (OPSEC) Awareness - within the past year https://jkodirect.jten.mil/html/COI.xhtml?course_prefix=PAC&course_number=-

US017

☐ Derivative Classification IF103.16 - within the past year https://www.cdse.edu/Training/eLearning/IF103

☐ Force Protection - within the past year https://lms-jets.cce.af.mil/moodle/enrol/index.php?id=12739

COR will provide update website addresses to the above that may change.

2.2.2.2 Theater Vulnerability Analyst Requirements

2.2.2.2.1 Have 3-4 years of experience conducting Network Vulnerability Engineering functions.

2.2.2.2.2 Expertise in the following DoD, AF, DISA, NIST, NIAP and PACAF processes:

☐ 3-4 years of experience of DoD approved Scanning Tools (e.g., ACAS) ☐ 3-4 years of experience of Microsoft SCCM & MECM ☐ Familiarization of End Point Security Point Product requirements ☐ Ability to analyze and develop cyber vulnerability information into an understandable presentation.

☐ Proficiency in Microsoft Office Suite products and SharePoint collaborative tools to build trend analysis.

☐ In-depth experience with DISA STIGs and by-product analysis.

2.2.3 Skills, Knowledge, & Abilities

Theater Vulnerability Analyst Skills, knowledge, and abilities are as follow:

Item # Skill, Knowledge, or Ability

2.2.3.1 Ability to maintain view rights to SIPRNet and NIPRNet vulnerability tools to analyze and compile data for leadership.

2.2.3.2 In-depth understanding of current vulnerability management practices and processes, including scanning, patching, and metric reporting, with the ability to stay updated on evolving tools, techniques, and industry standards.

http://www.cdse.edu/Training/eLearning/IF103

2.2.3.3 Knowledge and understanding of USAF Methods and Procedures Technical Order (MPTO) 00-33-1109A, USCYBERCOM Computer Network Defense (CND), Common Vulnerabilities and Exposures (CVE), Directives, Task Orders (TASKORDs), Operational Orders (OPORDs), and Information Assurance Vulnerability Management (IAVM) programs and a like.

2.2.3.4 Understanding of Host Base Security System (HBSS), Trelix, and Microsoft Defender for Endpoint (MDE):

☐ How to produce asset lists to identify devices capable of hosting an ESS agent.

☐ How to produce asset lists to identify devices not capable of hosting an ESS agent (whitelists).

☐ Ho to analyze client health status and courses of action to resolve discrepancies.

2.2.3.5 Experience conducting discovery scans to identify unknown base assets.

2.2.3.6 Experience dissecting complex data sets, identify patterns, and draw actionable conclusions to assess vulnerabilities and recommend mitigation strategies

2.2.3.7 Experience maintaining scanning credentials to achieve 98% access rate on base assets to include Program Management Office (PMO) systems IAW ACAS BPG.

2.2.3.8 Experience conducting vulnerability scanning via ACAS/Tenable.sc on 100% of assets during assigned scan schedule.

2.2.3.9 Ability to develop innovative solutions to mitigate identified vulnerabilities, balancing resource constraints and operational needs.

2.2.3.10 Experience with email, and other collaboration platforms to include but not limited to MS Teams group chats, MS SharePoint site, and VoIP/VTC endpoints.

2.2.3.11 Proficiency with the latest Microsoft tool suite (i.e., PowerPoint, Excel, Word, etc.).

2.2.3.12 Ability to lead collaboration efforts effectively across the PACAF AOR.

2.2.3.13 Ability to brief technical information to both technical and non-technical audiences.

2.2.3.14 Experience briefing senior leaders and large audiences.

2.2.3.15 Excellent Communication skills (Written and Verbal)

2.2.3.16 Ability to Lead

2.2.3.17 An understanding of the organizational and functional layout of Pacific Air Forces

(PACAF) command structure within its Area of Responsibility (AOR) to include Combatant Commands, Wings, Groups, Squadrons, tenant units, GSUs and MOBs.

2.2.3.18 Proficiency time management

2.2.3.19 Proficiency in critical analysis, decision making and problem-solving.

Comprehensive understanding of DOD cybersecurity frameworks and policies for identifying, analyzing, and prioritizing potential threats and impact to theater and mission operations, and intel-based response recommendations (i.e. MITRE Att&ck Framework, Cyber Threat Bulletins (CTBs) NIST CSF, CJCSI 3020.45B &

OPORD 8600.24, TASKORD 17-0106.)

2.2.4 Deliverables

Theater Vulnerability Analyst Deliverables are as follow:

*Note: Presentation deliverables may be required to be presented to PACAF Director of Air and Cyberspace Operations and/or other stakeholders when there is potential of mission impact. Also, “Site Visit” refers to FISMA, RMF, CRR-M, CORA, or CCORI site visits.

Copies

Frequency & Remarks

2.2.4.1 Resume MS Word or

Adobe & Email

Prior to 30 September 2025 and NLT 3 working days prior to any new replacement personnel’s start date

Website & Email Once and then as needed

- Send to CO/PM and COR

2.2.4.2 Report Monthly

PACAF AOR cyber security posture Analysis

MS Word, Excel Spreadsheet or PowerPoint

1st workday of the month (report on completed month)

Website & Verbal Presentation

Monthly

2.2.4.3 Expertise & fix

action guidance

MS Word, Excel Spreadsheet or PowerPoint

NLT 8 duty hours from time of notification

Website & Verbal Presentation

Upon Request

2.2.4.4 Cyber security/VM

management training documentation

MS Word, Excel, PowerPoint, etc.

As needed

NLT 15 workdays from date of notification

Website & Email By Request

2.2.4.5 Report on PACAF

Wings’ ability to scan ACAS, mitigate, and maintain Host Based point products

Brief with a PowerPoint

NLT 2nd Tuesday of the month or as directed

Website & Verbal Presentation

Monthly or as directed

Copies

Frequency & Remarks

2.2.4.6 Report on PACAF

SCCM & MECM

health status

MS Word, Excel, PowerPoint, etc.

As needed

NLT 2nd Tuesday of the month or as directed

Website & Email Monthly - NIPRNet & SIPRNet Server & client status

2.2.4.7 Command wide

SIPRNet & NIPRNet Vulnerability Status

Brief with a PowerPoint

NLT 2nd Tuesday of the month or as directed

Website & Verbal Presentation

Monthly or as directed

2.2.4.8 Command or

theater-wide NIPRNet & SIPRNet weighted vulnerability indicator scores

Brief with a PowerPoint

NLT 2nd Tuesday of the month or as directed

Website & Verbal Presentation

Monthly or as directed

2.2.4.9 Cyber security

vulnerability reports containing security posture.

Brief with a PowerPoint

NLT 2nd Tuesday of the month or as directed

Website & Verbal Presentation

Monthly or Upon Request

2.2.4.10 Command or

theater-wide SIPRNet & NIPRNet End Point Security Assessment Status

Brief with a PowerPoint

NLT 2nd Tuesday of the month or as directed

Website & Verbal Presentation

Monthly

2.2.4.11 TASKORD inputs MS Word NLT 8 duty hours

from time of notification

Website & Email Upon Request

2.2.4.12 Travel Cost

Estimates

Adobe Form NLT 10 duty days prior to travel date

Email Required prior to every

TDY

Copies

Frequency & Remarks

2.2.4.13 Monthly Status

Report inputs

Word, Excel, or PowerPoint

1st workday of the month or as directed

Website & Email Monthly - Provide current status & way ahead:

summary of work performed, travel schedule, any due outs, etc.

2.2.4.14 Personnel Roster MS Excel NLT two business

days upon request

Website & Email Upon Request

2.2.4.15 Updates to

contractor (Ctr) availability

MS Excel By Request - TBD Website & Email Monthly or By Request

2.2.4.16 Invoices & Funding

Expenses

MS Excel 15th of the month Email Monthly

2.2.4.17 NDA Adobe Form NLT Wednesday Email Once - Upon Ctr Onboard

2.2.4.18 MSR MS Word 15th of the month Website & Email Monthly - report on previous month

2.2.4.19 Kick-Off Brief PowerPoint &

Brief 1st Week of Oct 2023 or TBD

Website & Presentation

Once or By Request

2.2.4.20 Transition Brief PowerPoint &

Brief

1st Week of July 2024 or TBD

Website & Presentation

Once or By Request

2.2.4.21 Close-Out Brief PowerPoint &

Brief

1st Week of Sept 2024 or TBD

Website & Presentation

Once or By Request

2.2.5 Positions

Number of Theater Vulnerability Analyst positions and locations are as follow.

Item # Position Location Positions

2.2.5.1 Network Vulnerability Engineer JBPHH, Hawaii 1

3 Services Summary Services summary is as follows:

Performance

Objective

PWS

Paragraph Performance

Threshold The contractor shall enhance and sustain PACAF’s cybersecurity posture by implementing congressional FISMA, DoD, AF cybersecurity directives while ensuring compliance with DoDI

8510.01 (RMF for DoD Systems).

1.4. Performance occurs with no required re-

performance or re-work at least 90% of the time.

The contractor shall prepare/mentor NAF, Wing and cybersecurity forces through CRR-M program.

1.4. Performance occurs with no required re-

performance or re-work at least 90% of the time.

The contractor shall assist/prepare PACAF Wings for USCYBERCOM CORAs & CCORIs ISO missions operating on PACAF NIPRNet, SIPRNet and supported information systems.

1.4. All mandatory artifacts contain required

information and are delivered on time at least 90% of the time.

The contractor shall support vulnerability management efforts.

1.4. Deliverables (reports, presentations, training documents, status, travel cost estimates) contain required information and are delivered on time at least 90% of the time.

The contractor shall provide contract positions with contract administrative support.

2.2.1.

2.2.1.24.

2.2.1.25.

2.2.1.26.

2.2.1.27.

Performance occurs with no required re-performance or re-work at least 90% of the time.

4 Period of Performance

4.1 Duration

The Period of Performance is for a period of one (1) base year, plus four (4) option year periods.

4.1.1 Base Year (BY): 30 September 2025 to 29 September 2026

4.1.2 Option Period 1 (OY1): 30 September 2026 to 29 September 2027

4.1.3 Option Period 2 (OY2): 30 September 2027 to 29 September 2028

4.1.4 Option Period 3 (OY3): 30 September 2028 to 29 September 2029

4.1.5 Option Period 4 (OY4): 30 September 2029 to 29 September 2030

4.1.6 The inclusion of FAR Clause 52.217-8, Option to Extend Services, would allow for a contract extension up to six (6) additional months.

4.2 Performance Period

4.2.1 Performance period for this contract will begin on 30 September 2025.

4.2.2 Contractor shall have all qualified personnel on-site starting on 30 September 2025.

4.2.3 Prior to 30 September 2025, the Contractor will provide a copy of each personnel’s resume to the CO/PM and COR for qualification review.

4.3 Preplacement Personnel

4.3.1 The Contractor shall have hired a personnel replacement that meets the contract qualifications/standard no later than 30 calendar days after Contractor personnel leaving and on-site no later than 60 calendar days from Contractor personnel leaving, unless approved in writing or otherwise directed in advance by the CO. The Contractor will provide a copy of the replacement personnel resume to the CO/PM and COR for qualification review.

4.3.2 Contractor shall not charge the government for vacant positions after 60 calendar days from a position becoming vacant, if there is no on-site replacement.

4.4 Accountability

The contractor may be required to account for the whereabouts of their personnel should this information be requested by the COR.

5 Place of Performance The primary place of performance is HQ PACAF (Bldg. 1102 Rm H210, JBPHH, Hawaii 96853). The Contractor shall have access to Government facility five days per week, Monday through Friday, eight hours a day, except when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings, unless otherwise approved.

6 Travel

6.1 Travel General

6.1.1 Travel in and around the place of performance is required throughout the period of performance.

6.1.2 Frequent temporary duty (TDY) travel to Government Facilities Outside the Continental United States (OCONUS) and the Continental United States (CONUS) is required. Duration of all other TDYs is dependent on the predetermined scope of work at the Government Facility.

Some locations may require an additional trip per year for Cyber Readiness Reviews when required by CORA scheduled events.

6.1.3 A Government Letters of Identification (LOI) shall initiate all TDY NLT 30 days from travel. Only a Contracting Officer (CO) will approve travel through the LOI process. This LOI shall be used for identification purposes only.

6.1.4 Long distance travel shall occur via commercial transportation (except where military transportation is the only method of travel) utilizing the current rates in accordance with Federal Acquisition Regulation (FAR) Part 31 and the most current version of the Joint Travel Regulations (JTR).

6.1.5 Travel to Diego Garcia (BIOT) will require travel to Singapore to connect with Diego Garcia MILAIR to and from Paya Lebar AMC terminal).

6.1.6 Contractors shall check the applicable country(ies) in the Foreign Clearance Guide (https://apacs.milcloud.mil/fcg/fcg.cfm) to determine credential requirements (i.e., CAC/orders, passport/visa, pre-travel training/documentation, theater/country clearance) and to find out if an Aircraft and Personnel Automated Clearance System (https://apacs.milcloud.mil/apacs/login.jsp) request submission is required.

6.1.7 All travel cost estimates will be approved by the CO prior to travel arrangements. Travel rates shall be negotiated prior to departure and fair and reasonable pricing shall be based on per diem expenses based on the Joint Travel Regulation (JTR) for an equivalent Government Service (GS) employee (GS-12).

6.1.8 Actual travel shall be authorized by the CO in writing prior to performance and will be paid IAW FAR Part 31.205-46.

6.1.9 The contractor shall provide a copy of travel receipts within 5 working days of completing travel to the COR.

6.1.10 All travel to Japan also requires an approved Letter of Authorization (LOA) through the Synchronized Predeployment and Operational Tracker (SPOT) found at https://spot.dmdc.mil/.

The Contractor must have access to SPOT to initiate the LOA which will then be approved by the COR and CO. This LOA is in addition to the required LOI that supplies all details of the trip to be approved.

6.2 Air Transportation

Air transportation shall be made by the contractor. Travel arrangements SHALL NOT be made prior to approval of LOI. All travel shall be at coach/tourist (i.e., government category) accommodations unless otherwise approved by the CO. The contractor shall obtain airfare at competitive rates and submit a written rate comparison to the government when air travel is necessary.

6.3 Auto Rental

Automobile rental shall be approved on a case-by-case basis. Authorized rental must be justified and proposed by the contractor and approved by the CO. If approved, auto rental shall be reimbursed via the travel invoice.

6.4 Per Diem

While a contractor employee is in a government authorized travel status, the contractor shall be reimbursed a per diem allowance for subsistence and lodging in accordance with FAR 31.205-

46. Per Diem payments shall be made after receipt of proper travel invoice and supporting documentation and shall not exceed amounts allowable.

6.5 Billeting

Billeting arrangement must be withing the destination base's billeting rate that is consistent with

JFTR.

6.6 Travel Confirmation

Contractor employees shall not commence overseas travel without prior approval and confirmation. It is the traveler's responsibility to make certain they are approved.

6.7 Travel Reimbursement

6.7.1 Travel shall be at the direction of the government and reimbursed in accordance with the contract’s funded Contract Line-Item Number (CLIN).

6.7.2 Approved travel shall be reimbursed to the contractor in accordance with the FAR Part 31.

6.7.3 Travel will be reimbursable only if traveling outside of a fifty (50) mile radius of their normal duty location.

6.7.4 When invoicing, contractors shall provide supporting receipts to be reimbursed for travel.

6.7.5 If LOI cost is exceeded, justification will need to be provided for the increased cost.

6.7.6 Travel and other direct cost will be reimbursed to the contractor in accordance with the JFTR on a cost-only basis. No profit, fee, or overhead will be paid to the contractor for travel expenses. The Government will accept the application of G&A NTE 5% of authorized travel costs for the Prime Company. The Government will NOT accept G&A of authorized travel costs for any Sub Companies under the Prime Company.

7 Security Clearance Requirements

7.1 Site Visit Coordination

The contractor shall coordinate site visits with site POCs at least 72 hours prior to requiring any site access. Contractor personnel without security clearances performing any task under this PWS must be escorted by Government personnel who are cleared. Contractor shall adhere to current installation security policies.

7.2 Clearance

7.2.1 The personnel assigned to the Cybersecurity SMEs and Theater Vulnerability Manager positions are required to have and maintain building access to the PACAF HQ building in addition to a TS/SCI security clearance. See Department of Defense Form 254, Contract Security Classification Specification, for security guidance and additional security requirements.

7.2.2 This section shall be considered a supplement to block 13 of the Government provided DD Form 254, Contract Classification Specification. The following security requirements shall apply to this effort.

References:

a. DISA Form 786, DISA Statement of Information System Use and Acknowledgement of

User Responsibilities

b. DISA Policy Letter, Unauthorized Connections to Network Devices, 11 September 2013

c. DISA Instruction 240-110-8, Information Security

d. DISA Instruction 240-110-36, Personnel Security

e. DISA Instruction 240-110-38, Industrial Security

f. DISA Instruction 240-110-43, Insider Threat Program

g. DISA Instruction 630-230-19, Cybersecurity

h. DoDM 5200.01, Vol 1-4 Information Security Program, 24 February 2012

i. DOD 5200.02, Procedures for the DoD Personnel Security Program, 3 April 2017

j. DoD Instruction 5200.48, Controlled Unclassified Information (CUI), 6 March 2020

k. DOD 5220.22-M, National Industrial Security Program Operating Manual, February

2006 Incorporating Change 02 May 2016

l. DoDM 5105.21 Sensitive Compartmented Information (SCI) Administrative Security

Manual: Administration of Information and Information Systems Security

7.2.3 The work to be performed under this contract is up to Top Secret level for Cybersecurity SMEs and Theater Vulnerability Manager positions. The work will require Sensitive Compartmented Information (SCI) access eligibility for the Cybersecurity SMEs and Theater Vulnerability Manager.

7.2.4 All personnel performing on or supporting contract in any way shall be U.S. citizens. The personnel security requirements for this contract cover the individuals supporting the Task Areas delineated in the table below. Contractor personnel must possess the interim or final security clearance eligibility delineated in the table below when performance starts.

PWS

Task /

Subtask

Clearance Level

Level of Classified Access

Justification for Access to Classified

2.1

2.1.1 2.1.4

Top Secret JWICS, SIPR, COMSEC

In order to effectively evaluate & mitigate vulnerabilities in support of A&A/FISMA, CORA and CCORI preparations, the cybersecurity SMEs require access to SIPR and classified information that identify vulnerabilities on SIPR enclaves. Additionally, in order to fully understand and effectively evaluate & mitigate vulnerabilities, the SME must be aware of specific adversary techniques and procedures; attack vectors and active systems being targeted - this sensitive information are only available on SIPR and JWICS (there are cases where special access program may be involved).

2.2

2.2.1 2.2.4

Top Secret JWICS, SIPR

In order to fully understand and effectively evaluate & mitigate vulnerabilities, the Theater Vulnerability Analyst must be aware of specific adversary techniques and procedures; attack vectors and active systems being targeted - this sensitive information are only available on SIPR and JWICS (there are cases where special access program may be involved).

7.2.5 All personnel requiring TOP SECRET SCI access will abide with the following access requirements:

a. All SCI will be handled in accordance with special security requirements, which will be furnished by the HQ PACAF SSO.

b. SCI will not be released to contractor employees without specific release approval of the originator of the material as outlined in governing directives; based on prior approval and certification of "need-to-know" by the designated COR.

c. The Contractor Special Security Officer (CSSO) will submit names, social security numbers, duty positions, clearance level and date, investigation level and date, and contract for each individual contractor requiring SCI access to the COR for approval.

COR will acknowledge receipt of official requests to the CSSO confirming member’s need-to-know. CSSO will submit a request for special background investigations in accordance with the NISPOM. Each member must submit the entire personnel security questionnaire package to the personnel security branch. The CSSO, and individual, as required, must follow the instructions provided.

d. Inquiries pertaining to classification guidance involving SCI will be directed to HQ

PACAF SSO through the COR.

e. All SCI material and/or systems furnished in support of this contract will remain the property of the Department of Defense (DoD), department agency, or command originator. Upon completion or cancellation of the contract, all furnished SCI material and/or systems will be returned to the direct custody of the supporting COR/SSO or destroyed IAW instructions outlined by the COR/SSO.

f. SCI will be stored and maintained only in properly accredited facilities at the contract locations. Contractors will not reproduce any SCI without the permission of the COR.

Any material that is reproduced will be classified, controlled, and accounted for in the same manner as the originals.

g. Contractors will not release SCI material to any activity, individual, or consultant organization not…