PWS Implementation of Advanced Government Simulation Architectures (IAGSA) v2.pdf

i

PERFORMANCE-BASED WORK STATEMENT (PWS)

IMPLEMENTATION OF ADVANCED GOVERNMENT SIMULATION

ARCHITECTURES (IAGSC)

FOR

AFSC/SWX

12/4/2024 ii

TABLE OF CONTENTS

1 Introduction

1.1 Purpose

1.2 Background

1.3 SCOPE

2 BASIC SERVICES

2.1 Program Management

2.2 Software Engineering Services

2.3 Cybersecurity

2.4 System Administration

2.5 Training and Tactics, Techniques, and Procedures Support

2.6 Materials

3 SERVICE SUMMARY

4 CDRL SUMMARY

5 ADDITIONAL REQUIREMENTS

5.1 Government Provided Support

5.2 Quality Control Plan

5.3 Quality Assurance

5.4 Safety and Health Standards

5.5 Manpower Reporting:

5.6 Personnel Roster

5.7 Safety

5.8 Voluntary Protection Program (VPP)

5.9 Obtaining Identification

5.10 Removal of Contractor Personnel

5.11 Network Access:

5.12 Security Requirements

6 SECURITY:

7 CONFLICTS OF INTEREST

8 GENERAL INFORMATION

8.1 Hours of Operation

8.2 Billable Hours

9 ENVIRONMENTAL CONTROLS

iii

9.1 Hazardous Work Environment

9.2 Notification of Environmental Spills

9.3 Safety Program

10 GOVERNMENT OBSERVATIONS

11 ENVIRONMENTAL:

12 Contracting officer Representative Appendix A – Acronym Appendix B – NDA Appendix C – SAFETY

1 INTRODUCTION

The purpose of this Performance of Work Statement (PWS) is to define the tasks required for the Implementation of Advanced Government Simulation Architectures (IAGSC). The objective of this effort is to deliver non-personal services to support government development and integration of software products into Department of Defense (DoD) systems for the Air Force Sustainment Center’s (AFSC) Software Development Directorate, Experimentation Division (AFSC/SWX).

1.1 Purpose

The mission of AFSC/SWX is to lead the way with early system and experimental software, driving innovation and accelerating capability development to enhance warfighter effectiveness.

1.2 Background

The AFSC/SWX develops software products and integrates modeling and simulation capabilities into various DoD platforms and Systems. They provide technical support and software development for Space, Aircraft, Threat Modeling, Command and Control (C2), Joint Simulation Environment (JSE), Test, Training, Experimentation, and Intelligence Surveillance and Reconnaissance (ISR) programs and activities. AFSC/SWX operates in multiple government owned & operated software development and integration environments and multiple security levels for various customers.

Modern Technology Solutions Inc. (MTSI), the incumbent with Cage Code: 0X988, continues providing software development and support for the Air Force Sustainment Center (AFSC) Software Directorate's Experimentation Division (AFSC/SWX). Customers supported by this effort include 4th and 5th generation aircraft platforms, advanced and experimental weapons systems, and simulators and simulated environments that enable high-end / advanced testing, training, and TTP development. These advanced systems include programs identified as Operational Imperatives by the Secretary of the Air Force and have the highest-level emphasis possible to execute on time.

1.3 SCOPE

The scope of this contract is to provide non-personal services to work with government personnel to perform the following tasks:

- Software development for various DoD customers

- Integration of modeling and simulation capabilities into software and hardware environments

- Research and development of advanced software and hardware capabilities for integration into DoD systems

- Cybersecurity activities necessary to perform software development and integration

- Lifecycle software testing including Validation and Verification of modeling and simulation capabilities

- Integration of Intel Community (IC) developed information into threat representative capabilities

- Systems Engineering support for related activities

2 BASIC SERVICES

2.1 Program Management

2.1.1 Program Management Review (PMR)

The contractor shall prepare for and brief via a quarterly Program Management Review (PMR) the technical status of program management, details of funding execution, relevant personnel actions, accomplishments, risks and issues.

2.1.1.1 The contractor shall conduct the PMR with the government quarterly

2.1.1.2 The contractor shall submit for government approval 2 weeks prior to the meeting the proposed topics and agenda (CDRL A003)

2.1.1.3 The contractor shall provide the government meeting charts in contractor format 2 business days before the meeting. (CDRL A003)

2.1.1.4 The contractor shall provide meeting minutes in contractor format to the government within 3 business days of the meeting (CDRL A003)

2.1.2 Program Management

The contractor shall provide overall program management of this contract to manage contract cost, schedule, performance, and risks as they pertain to contract requirements.

2.1.3 Monthly Status Updates

The contractor shall provide to the government updates on contract execution, including funding, and any major changes to contract risks and issues.

Performance Standards:

2.1.3.1 The contractor shall conduct a status update meeting with the government monthly and shall provide meeting minutes in the Monthly Status Report.

(CDRL A001)

2.1.3.2 The contractor shall submit status of funding and any other meeting artifacts in contractor format to the government within 1 business day of the meeting. (CDRL A001)

2.1.4 Meeting Support

The contractor shall provide programmatic and technical support to regularly occurring weekly and ad-hoc meetings as requested by the government.

2.1.5 Staffing Management

The contractor shall manage the staffing of personnel required to perform the activities laid out in this PWS as requested by the contract assigned Technical Lead.

2.1.5.1 The contractor shall provide updated pricing information and a plan to meet the requested staffing levels within 10 business days of the government Contract Officer (CO) or Contracting Officer Representative (COR) request.

2.1.5.2 The contractor shall ensure that personnel performing work under this

PWS are qualified and must possess at a minimum a secret security clearance and have the ability to maintain higher clearances as necessary.

2.1.5.3 The contractor shall fill requested positions within 90 days unless otherwise authorized by the CO.

2.1.6 Cyber Security

The contractor shall provide program management of the activities described in section

3.3 of this PWS.

2.1.6.1 The contractor shall provide in contractor format schedules and weekly updates of the tasks needed to execute section 3.3 of this PWS and incorporate these into PMRs, Status Updates, and other regularly schedule meetings as needed. (CDRL A001)

2.2 Software Engineering Services

2.2.1 Software Engineering / Development

The contractor shall provide software engineering services alongside the government technical team in a government DevSecOps environment, including but not limited to software sustainment, and modeling and simulation integration into software products for experimental and operational systems

2.2.1.1 The contractor shall execute all work under paragraph 3.2 of this PWS on government owned and directed systems.

2.2.1.2 The contractor shall provide unlimited data rights to all software developed and delivered on the government owned and directed systems.

2.2.1.3 The contractor shall NOT introduce any proprietary data, code, software, information, etc., into the government code-base or onto government systems without the written consent of the on-site government technical lead.

2.2.1.4 The contractor shall provide Agile and DevSecOps operations expertise and management to integrate with the government technical team to perform management of software development activities to meet assigned tasks and requirements.

2.2.1.5 The contractor shall conduct Research and Development (R&D) activities needed to integrate advanced models / simulations, advanced software capabilities, and advanced hardware capabilities into new and legacy Air Force platforms and systems. (CDRL A001)

2.2.1.6 The contractor shall conduct software sustainment activites, including code refactoring, necessary to sustain code baselines. (CDRL A005)

2.2.2 Systems Engineering

The contractor shall provide systems engineering services to support activities laid out in sections 3.2, 3.3, and 3.4 of this PWS.

2.2.3 Software Integration

The contractor shall provide integration support to integrate advanced technologies and other software products into new and legacy Air Force platforms and systems. Examples include but not limited to: JSE, VATS, and F-16.

2.2.3.1 The contractor shall provide software and hardware integration and installation support at various worldwide military facilities for activities laid out in section 3.2 of this PWS.

2.2.4 Software Testing

The contractor shall support life-cycle testing of software products.

2.2.4.1 The contractor shall prepare and deliver software test plans for government approval as requested by the contract assigned Technical Lead.

2.2.4.2 The contractor shall deliver software test reports as soon as practicable, but no later than 30 days after completion of a software test event. (CDRL A006)

2.2.4.3 The contractor shall provide support to generate and document deficiencies discovered during formal testing activities.

2.2.4.4 The contractor shall conduct cybersecurity related testing on government software products to inform activities in section 3.3 of this PWS.

2.2.4.5 Support Val/Ver (AI)

2.3 Cybersecurity

2.3.1 Cybersecurity Oversight

The contractor shall lead the development and processing of security related approvals and efforts, to include Interim Authority To Test (IATT), and Authority to Operate processes on various Information Technology (IT) and mission related systems (CDRL A006)

2.3.1.1 The contractor shall provide qualified and certified (ie level II and level III

Information Assurance Manager certifications) personnel as needed to perform cybersecurity duties.

2.3.1.2 The contractor shall work with assigned Security Control Assessor Representatives (SCARs), IT Approving Officials (AOs), and their staff’s to provide all information necessary to accredit various networks and IT infrastructure.

2.3.1.3 The contractor shall analyze evaluate, and document cybersecurity aspects of software and IT infrastructure to identify, manage, and mitigate cybersecurity risks and vulnerabilities to assigned government systems.

(CDRL A001)

2.3.1.4 The contractor shall report any major risks or issues to the Contract Assigned Technical Lead and higher-headquarters’ assigned cybersecurity experts for appropriate reporting and tracking purposes. (CDRL A008)

2.4 System Administration

2.4.1 Systems Administration

The contractor shall provide System Administrators and IT specialists to monitor, maintain, configure and support the IT systems needed to execute the activities outlined in this PWS.

2.4.1.1 The contractor shall provide qualified and certified (ie security plus) personnel as needed to perform system and network administration duties across NIPRNet, SIPRNet, JWICS and various other TS/SCI and SAP networks.

2.4.1.2 The contractor shall assist with documentation and activities needed to accomplish tasks laid out in section 3.3.1 of this PWS.

2.4.1.3 The contractor shall provide expertise needed to design, document, implement and accredit new government owned networks as requested by the contract assigned Technical Lead.

2.4.1.4 The contractor shall support life-cycle operations of IT systems, including install, repair, replace, remove and destruction of IT equipment at the appropriate classification levels and facilities.

2.4.1.5 The contractor shall perform Data Transfer Authority duties and responsibilities on government owned networks as requested by the contract assigned Technical Lead.

2.5 Training and Tactics, Techniques, and Procedures Support

2.5.1 Tactics, Techniques, and Procedures (TTPs) support

The contractor shall provide operational TTP subject matter expertise to ensure modeling, simulation, and software products are integrated into operationally relevant and useful capabilities.

2.5.2 Training

The contractor shall provide subject matter expertise to conduct ad-hoc training for combined contractor / government teams. (CDRL A009)

2.5.2.1 The contractor shall provide Agile and DevSecOps expertise for ad-hoc training at the request of the contract assigned Technical Lead.

2.5.2.2 The contractor shall provide operationally relevant subject matter experts for ad-hoc training at the guidance of the contract assigned Technical Lead

2.5.2.3 The contractor shall provide training materials in government provided format 7 days prior to a planned training event for government approval.

2.5.3 Systems Engineering

The contractor shall provide systems engineering services to support activities laid out in sections 3.2, 3.3, and 3.4 of this PWS.

2.6 Materials

2.6.1 The contractor may invoice monthly on the basis of cost incurred for the Materials and Equipment and ODC CLINs. The invoice shall include the PoP covered by the invoice and the CLIN number and title. In addition, the contractor shall provide the following detailed information for each invoice submitted, as applicable. Spreadsheet submissions are required. (CDRL A002)

a. Materials and Equipment and ODCs purchased.

b. Request to Initiate Purchase (RIP) or Consent to Purchase (CTP) number or identifier.

c. Date accepted by the Government.

d. Associated CLIN.

e. Project-to-date totals by CLIN.

f. Cost incurred not billed by CLIN.

g. Remaining balance of the CLIN.

h. Any applicable Fee.

i. Approved RIP or CTP cost and variance from actual costs

j. Explanation of variances exceeding ten percent of the approved versus actual costs

3 SERVICE SUMMARY

PWS

Paragraph Performance Objective

Performance Threshold

2.1.3.2, 2.1.6.1, 2.2.1.5, 2.3.1.3

Monthly status report

Monthly status report shall be submitted NLT 15 calendar days ARO and NLT the 10th calendar day of each month

2.6.1 Contract invoicing and payment report Payment report shall be delivered 10 days prior to invoice approval.

2.1.1.2, 2.1.1.3, 2.1.1.4

PMR Meeting agenda

PMR shall be held quarterly.

Meeting agenda will be approved 2 weeks prior. Charts shall be delivered 2 days prior. PMR meeting minutes shall be delivered within 3 business days of meeting.

2.1.3.1 Status Update Meeting Meeting shall be held monthly

2.2.1.6 Software documentation

conduct software sustainment activites, including code refactoring, necessary to sustain code baselines as needed?

2.2.4.2 Software Test Report

shall deliver software test reports as soon as practicable, but no later than

30 days after completion of a software test event.

2.3.1 Cyber security

Develop and update mission criticality analysis vulnerability assessments, risk evaluations, and identification and counter measurement implementations for mission-critical functions. Provide weekly updates of the tasks needed to execute section 3.3

2.3.1.4 Status Report

Report any major risks or issues to the Contract Assigned Technical Lead and higher-headquarters’ assigned cybersecurity experts for appropriate reporting and tracking purposes as required

2.5.2 Training material

provide training materials in government provided format 7 days prior to a planned training event for government approval.

5.4.3 TCIR/DART TCIR/DART shall be delivered

annually NLT the 15th of January

5.7.1 Accident/Mishap Report

Accident/Mishap Report shall be delivered within 3 calendar days after injury/mishap

5.6.1 Personnel Roster

Contractor personnel roster shall be submitted NLT 15 calendar days

ARO and NLT the 10th calendar day of each month

4 CDRL SUMMARY

Contract information data shall be delivered electronically in accordance to the corresponding requirement for each Data Item listed in Table 5-1 (below). The contractor shall have no more than one error per quarter for all CDRL submittals. The contractor shall submit CDRLs according to the due date indicated and have no more than one CDRL per quarter submitted after the identified due date. Grammatical errors do not count as an error. Substantive mistakes shall be corrected within two working days and corrective action taken to prevent recurrence of inaccurate late CDRLs.

Table 5-1

Exhibit Title PWS Paragraph

Delivery

A001 Monthly status report 2.1.3.2, 2.1.6.1, 2.2.1.5, 2.3.1.3

By the 10th day of each month

A002 Contract invoicing and payment report

2.6.1 10 days prior to invoice acceptance

A003

Meeting agenda

2.1.1.2, 2.1.1.3, 2.1.1.4

Meeting agenda delivered 2 weeks prior to PMR. Meeting charts delivered 2 days prior to PMR. Meeting minutes delivered 3 days after

PMR

A004 Status Update Meeting 2.1.3.1 Meeting held on the 2nd

Thursday of each month A005 Software documentation 2.2.1.6 As Required A006

Software Test Report

2.2.4.2 No later than 30 days

after completion of a software test event

A007 Cyber security 2.3.1 By Thursday of each week

A008 Status Report 2.3.1.4 As Required A009

Training material

2.5.2 7 days prior to a planned training event for government approval

A010 TCIR/DART 5.4.3 Annually NLT the 15th of January

A011 Accident/Mishap Report 5.7.1 3 calendar days after injury/mishap

A012 Personnel Roster 5.6.1 10th calendar day of each month

5 ADDITIONAL REQUIREMENTS

5.1 Government Provided Support

The Government will provide necessary working space, including heat, light, ventilation, and electrical powered outlets for the use of contractor personnel. The Government will provide access to the necessary facilities where the equipment resides. The primary place of performance shall be Wright Pat Air Force Base (AFB), OH Bldg 802.

Government telephones shall be used for official business only.

The contractor shall be responsible for safeguarding all Government property provided for contractor use.

5.2 Quality Control Plan

The contractor shall establish a complete Quality Control Plan (QCP) to ensure the requirements of this contract are provided as specified. The contractor's quality management program shall comply with the minimum quality management systems elements specified in the American National Standards Institute (ANSI), American Standards Organization (ASO), and International Standard Organization (ISO) family of standards. The report shall be submitted to the 309 MXSG Lead Analytical Chemist, NLT 30 days post contract award.

5.3 Quality Assurance

5.3.1 The AFSC/SW will perform assessments of the contractor’s performance.

Subsequent to contract award, specific name and contact information of the AFSC/SW Representative with a letter defining duties and authority will be furnished to the contractor.

5.3.2 The AFSC/SW COR will inform the task manager in person when discrepancies occur and will request corrective action. AFSC/SW COR will make a notation of the discrepancy on the assessment checklist with the date and time the discrepancy was noted and will request the task manager (or authorized representative) to initial the entry on the checklist.

5.3.3 The government may inspect each task as completed or increase the number of quality control inspections if deemed appropriate because of repeated failures discovered during quality control inspections or because of repeated customer complaints.

5.3.4 Any matter concerning a change to the scope, prices, terms or conditions of this contract shall be referred to the CO.

5.4 Safety and Health Standards

5.4.1 The contractor shall follow and adhere to the Air Force is part of the Occupational Safety and Health Administration (OSHA).

5.4.2 Voluntary Protection Program (VPP). The contractor is required to attain familiarization with the requirements of VPP. Information on the VPP can be accessed at http://www.osha.gov/dcsp/vpp/index.html. VPP requirements apply to contractors whose employees work more than 1,000 hours per quarter. The contractor shall flow down these requirements to all sub-contractors who qualify as applicable contractors under this contract.

5.4.3 The contractor shall provide from its OSHA 300 information the Total Case Incident Rate/Days Away Restricted or Transferred (TCIR/DART) rate by 15 January of each year to the CO for submission as part of the installation's annual OSHA VPP self-evaluation report. (CDRL A010)

5.4.4 System Safety Program Plan. The contractor shall implement a safety program that ensures protection of Government personnel and property. As part of the Safety Program the contractor shall establish a Safety Plan IAW Appendix B of this PWS. The contractor shall submit the Safety Plan within fifteen (15) days after contract award.

5.5 Manpower Reporting:

5.5.1 The Contractor shall report ALL Contractor labor hours (including sub-contractor labor hours) required for performance of services provided under this contract via a secure data collection site. The Contractor is required to completely fill in all required data fields at http://www.SAM.gov

5.5.2 Reporting inputs will be for the labor executed during the period of performance for each Government fiscal year (FY), which runs 1 October through 30 September. While inputs may be reported any time during the FY, all data shall be reported no later than 31 October of each calendar year. Contractors may direct questions to the Contractor Manpower Reporting Application (CMRA) help desk.

5.5.3 Uses and Safeguarding of Information: Information from the secure web site is considered to be proprietary in nature when the contract number and Contractor identity are associated with the direct labor hours and direct labor dollars. At no time will any data be released to the public with the Contractor name and contract number associated with the data. User Manuals: Data for Air Force service requirements must be input at the ECMRA link. User manuals for

Government personnel and Contractors are available at the ECMRA link at http://www.SAM.gov

5.6 Personnel Roster

5.6.1 The Contractor shall submit a Personnel Roster to the COR within fifteen (15) business days After Receipt of Order (ARO), tenth (10th) calendar days from the beginning of each month, and at the COR’s request (CRDL A012).

5.7 Safety

5.7.1 General Safety Requirements: The Contractor shall implement a safety program that ensures protection of Government and contractor personnel and property.

(CDRL A011).

5.7.2 Record and report promptly (within one hour) to the contracting officer or designated government representative (GR), all available facts relating to each instance of damage to government property or injury to either contractor or government personnel.

5.7.3 In the event of an accident/mishap, take reasonable and prudent action to establish control of the accident/mishap scene, prevent further damage to persons or property, and preserve evidence until released by the accident/mishap investigative authority through the contracting officer.

5.7.4 If the government elects to conduct an investigation of the accident/mishap, the contractor shall cooperate fully and assist government personnel in the conduct of investigation until the investigation is completed

5.8 Voluntary Protection Program (VPP)

5.8.1 Hill AFB, along with the entire Air Force, has adopted the VPP as recognized by Occupation Safety and Health Administration (OSHA). Consequently, VPP impacts all “applicable contractors” operating on Air Force Installations. It is the contractor’s responsibility to ensure its on-site employees and managers have a comprehensive understanding of VPP as well as full compliance with OSHA requirements. Detailed information on VPP is available on the OSHA website (http://www.osha.gov/dcsp/vpp/index.html). Contractors, whether regularly involved in routine site operations or engaged in temporary projects such as construction or repair, must follow the safety and health rules of the installation or VPP site.

http://www.sam.gov/

5.8.2 VPP requirements apply to contractors whose employees work more than 1,000 hours quarterly. The Contractor shall flow down these requirements to all subcontractors who qualify as applicable contractors under this contract.

5.9 Obtaining Identification

5.9.1 During performance of the contract, the contractor shall be responsible for obtaining required identification for newly assigned personnel. Upon the termination or completion of the contract, or in the case of an employee who no longer requires access to the work site, the contractor shall be responsible for promptly returning credentials to the SWX Mission Partner Affiliate Sponsor (formerly Trusted Agent). Lost badges shall be reported to the SWX Support Branch Chief within one (1) working day of the badge being lost.

5.9.2 For a Controlled Access Card (CAC) to be issued to the contractor, then the contractor shall be required to complete and submit CAC application form for each of the firm's employees who must have access to the installation and Individual Information form to begin this process with the SWX Mission Partner Affiliate Sponsor (formerly Trusted Agent).

5.10 Removal of Contractor Personnel

5.10.1 The contractor understands that any contractor employee may be summarily and immediately removed from or denied access to any Government property, facility, and installation at the sole discretion of competent Government authority if that authority determines such action is necessary to protect or preserve Government property, safety, and security, or to maintain good order and discipline.

5.11 Network Access:

5.11.1 The Contractor must meet the same security and training requirements as government employees for access to WPAFB's network or Automated Information Systems (AIS).

5.11.2 For those contractor employees who require government computer access only, a National Agency Check with written Inquiries (NACI) must be accomplished through the government.

5.11.3 Contractor employees requiring a government provided e-mail account shall annually complete the Information Assurance Awareness training. Interim access may be granted by Designated Approving Authorities only after submission of the NACI and favorable finger print determination has been received by the applicable security manager.

5.11.4 Contractors who no longer need network or AIS access shall report within 3 business days to the appropriate security manager and the Functional System Administrator.

5.11.5 The contractor understands that any contractor employee may be summarily and immediately removed from or denied access to any government property, facility, and installation at the sole discretion of competent government authority if that authority determines such action is necessary to protect or preserve government property, safety and security, or to maintain good order and discipline.

5.12 Security Requirements

5.12.1 The contractor shall comply with all Security, Force Protection, and Antiterrorism requirements enforced at each installation. The contractor shall comply with local unit in and out processing procedures for all contractor personnel to ensure proper security-related briefings and debriefings are accomplished.

5.12.2 The contractor shall obtain security clearances within 90 days for all of their employees.

5.12.3 The contractor shall prepare a subcontractor DD Form 254

5.12.4 Security Incidents

Should a security incident occur, the contractor shall:

5.12.4.1 Immediately report to the site location Group Security Manager all available facts related to each instance.

5.12.4.2 Take such precautions as the Security Manager may reasonably require for security purposes.

5.12.4.3 Take reasonable and prudent action to establish control of the scene, prevent further violation, and to preserve evidence until released by proper authority.

5.12.4.4 Cooperate fully and assist Government personnel as the Government conducts an investigation of the violation.

5.12.4.5 Participation shall last until the investigation is complete.

5.12.5 Keys, Building Access Cards, and Building Badge Control

5.12.5.1 The Contractor shall establish and implement methods of making sure that all keys, vindicator cards, and building badges issued to the Contractor by the Government are not lost, misplaced, or used by unauthorized persons.

5.12.5.2 The Contractor shall not duplicate any keys issued by the Government.

5.12.5.3 The Contractor shall immediately report the occurrence of a lost key to the appropriate building Facility Manager, and vindicator cards and building badges to the appropriate Security Managers.

5.12.5.4 The Contractor shall prohibit the opening of locked areas by the Contractor employees to permit entrance of persons other than the Contractor’s employees engaged in the performance of assigned work in those areas, or personnel authorized entrance by the Security Managers.

5.12.6 Communications Security

5.12.6.1 All communications with DoD organizations are subject to Communications Security (COMSEC) review.

5.12.6.2 The DoD authorizes the military departments to conduct COMSEC monitoring and recording of telephone calls originating from, or terminating at, DoD organizations.

5.12.6.3 The Government advises the Contractor that at any time they place a call to, or receive a call from, a DoD organization, they are subject to COMSEC procedures.

5.12.6.4 The Contractor assumes the responsibility for ensuring wide and frequent dissemination of the above information to all employees dealing with official DoD information.

5.12.7 Operations Security (OPSEC)

5.12.7.1 Contractors who have access to Wright Patterson AFB facilities or critical information shall have OPSEC training IAW AFI 10-701, Operations Security (OPSEC), Initial training will be provided by SWX and lasts approximately one hour, with recurring annual training lasting approximately one half hour. Contractors shall immediately comply with Installation and Group OPSEC programs.

5.12.7.2 Public release of any information is not authorized and, if requested, will comply with Public Affairs and all other OPSEC measures to ensure the best balance of lawful disclosure for the American public and denial of advantage for our adversaries.

5.12.7.3 No photography, or videotaping, is allowed on the installation without approval from the owning organizations Group Director/Commander on an approved photography letter from Public Affairs. This includes the use of personal cell phones with picture and video capability.

5.12.7.4 Critical Items/Information shall not be discussed outside normal contract conditions. A Critical Items/ Information List (CIL) can be provided and should not be considered all inclusive.

5.12.8 Controlled Unclassified Information (CUI) generated by the contract, and its employees, shall ensure protective measures are applied. ALL DoD unclassified information MUST BE REVIEWED AND APPROVED FOR RELEASE before it’s provided to the public in accordance with DoDD 5230.09, Reference J.

5.12.8.1 Disclosure of information is prohibited for release of unclassified information to the public without approval of the contracting activity.

5.12.8.2 Contractors will comply with CUI requirements detailed in DoDM 5200.01-V4, DoD Information Security Program: Controlled Unclassified Information (CUI).

6 SECURITY:

6.1 Contractor employees who have access to Wright Patterson AFB, government facilities or critical information shall be trained on Operations Security (OPSEC), human relations, and security education and motivation within 90 days after initial assignment of the contract IAW AFI 10-701 Para. 4.1-4.2.

6.2 During performance of the contract and at the termination or completion of the contract, the contractor shall be responsible for obtaining required identification for newly assigned personnel, and for prompt return of credentials per the SWX out process for any employee who no longer requires access to the work site. Lost badges shall be reported to the SWX Security Office within one working day of loss.

6.3 If a security violation occurs, the contractor shall immediately report to the SWX Security Manager all available facts relating to each instance. The contractor shall take such precautions as the Security Manager may reasonably require for security purposes. The contractor shall take reasonable and prudent action to establish control of the scene, prevent further violation, and to preserve evidence until released by proper authority. The contractor shall cooperate fully and assist government personnel as the government conducts an investigation of the violation. Participation shall last until the investigation is completed.

6.3.1 Contractor Training

6.3.1.1 The Contractor shall ensure employees complete required block training before performing any services. The Contractor will not be penalized for hours spent attending these required courses. The Contractor shall also ensure that annual training is completed before expiration date and that new mandatory training is completed within time frames designated by the Air Force.

6.3.1.2 The Contractor shall ensure contractor personnel receive adequate training (safety, security, etc.). The Government will provide training on a space available/no charge basis when it is the only source of such instruction.

6.3.1.3 The Contractor shall maintain training and briefing records for all personnel attending Government furnished training and briefings, and provide the COR a roster of trained personnel upon request.

6.3.1.4 Mandatory Training. The Contractor shall ensure Contractor personnel attend at Contractor expense all applicable training required by law, Office of Personnel Management, Department of Defense (DoD), and/or AF policy (including command and local policy).

6.3.2 Conflicts of Interest

6.3.2.1 The contractor shall not assign to contract or task order performance any person, including any employee of the U.S. Government, if employing that person would create a conflict of interest under any law, regulation, or policy of the United States Government. Additionally, the contractor shall not assign to contract or task order performance, any person who is an employee of the Department of the Air Force, either military or civilian, unless such person seeks and receives approval according to DoD Directive 5500.7-R, Standards of Conduct, and any other applicable regulation or policy of the Department of the Air Force or its subordinate commands, as applicable, including but not limited to Air Force Materiel Command.

6.3.2.2 Contractors will not use any other form of identification to access any government installation or facility while working on a government contract except the issued credentials associated with the awarded contract or task order. Example: using a military retiree card to access an installation to work on a contract.

6.3.3 Security Requirements

6.3.3.1 Foreign nationals (FN) will not be escorted, or sponsored, onto the installation without being properly vetted. Any request must follow 309

SWEG OI 16-1404, Security Requirements section 7. FNs must be approved for access via the Foreign Disclosure Office and Air Force Office of Special Investigations (AFOSI).

6.3.3.2 The contractor shall comply with all security, force protection, operation security and antiterrorism requirements at each installation.

6.3.3.3 The contractor shall comply with 309 SWEG in and out-processing procedures for all contractor personnel to ensure required security-related briefings and debriefings are accomplished. Specific in and out-processing checklists may be included at the task order level.

6.3.3.4 The contractor will use the COR. as the primary means of reviewing and approving forms and for communicating with necessary government representatives.

6.3.4 Communications Security

6.3.4.1 All communications with DoD organizations are subject to Communications Security (COMSEC) review.

6.3.4.2 The DoD authorizes the military departments to conduct COMSEC monitoring and recording of telephone calls originating from, or terminating at, DoD organizations.

6.3.4.3 The Government advises the contractor that at any time they place a call to, or receive a call from, a DoD organization, they are subject to COMSEC procedures.

6.3.4.4 The contractor assumes the responsibility for ensuring wide and frequent dissemination of the above information to all employees dealing with official DoD information.

6.3.5 Operations Security (OPSEC)

6.3.5.1 During the course of this contract, in addition to those restrictions, instructions and guidelines delineated in PWS and/or other references provided, the contractor will adhere to the following minimum requirements.

6.3.5.2 Introduction of personnel electronic devices into government spaces, laptops, tablet Personal Computers (PC)s, cellular phones, cameras, recording devices, and data recording/storage devices is strictly controlled and forbidden in most cases. Company issued equipment required for the performance of work must be approved by the 309 SWEG security managers (SM). This may include both Collateral IPO and SAP APO offices. Photography and recording is not allowed in restricted areas and controlled areas except for official use and by approved photography letter only. NOTE: Unless otherwise stipulated in the contract, contact the Installation Public Affairs or SM for approval.

6.3.5.3 Contractor personnel shall not discuss government operations in public or over unprotected or unencrypted communications. Official Business controlled unclassified information (CUI) may only be transmitted as directed in the PWS as it adheres to CUI Guidelines.

6.3.5.4 The Contractor shall not post to company websites, publications, newsletters, or other media any images, data or information that reveal sensitive government operations, personnel, equipment, and/or classified or CUI. When in doubt, company press releases, related to this contract, will be coordinated through the Public Affairs Office prior to release.

6.3.5.5 Contractor personnel shall not disclose to unauthorized third parties, post to unofficial sites (including all Social Networking sites) any images, data or information that reveals sensitive government operations, personnel, equipment, including, but not limited to: Tactics, techniques and procedures, production or work schedules, any visible or concealed modifications, upgrades, additions to Air Force installations, property or weapons or equipment; increases, change, or decreases in work/deployment frequency or government personnel, project schedules, logistics or material delivery schedules; specialized equipment orders, deliveries, shipments, etc. (Unauthorized disclosure and transfer of National Security Information is punishable under 18 USC § 793.);

Unauthorized disclosures and attempts to solicit this type of information by unauthorized third parties or others not affiliated with this contract shall be reported to the SM and/or installation SFS, COR, and, if applicable, the company FSO and/or the Defense Security Service.

6.3.5.6 Practice OPSEC and implement countermeasures to protect Critical Information (CI) and other sensitive unclassified information and activities vigilance or degrade the planning and execution of military operations performed or supported by the contractor in support of the mission.

Protection of CI will include the adherence to and execution of countermeasures which the contractor initiates or as provided by OPSEC manager or installation OPSEC Program Manager, for CI on or related to the PWS.

6.3.5.7 The contractor must mark and protect any information IAW CUI, to include E-mail, and adhere to all CUI standards and policies.

6.3.5.8 Contractors who have access to the Ogden Air Logistics Complex (OO- ALC) and Globally Separated Units (GSU)s facilities or critical information shall have OPSEC training IAW AFI 10-701, Operations

Security (OPSEC). OPSEC training will be conducted within 30 days of assignment.

6.3.6 Antiterrorism (AT) Requirements

6.3.6.1 Contractor personnel who require routine physical access to a Federally controlled facility or military installation shall receive Force Protection Training within 30 days of requiring access and annually thereafter.

6.3.6.2 IAW DoD Instruction O-2000.16 Volume 1, DoD AT Program Implementation. Force Protection training: Frequency: Initially upon assignment/ annually thereafter. Presentation/ means: Unit Security Manager, TSS Course MLMW0846, mylearning/TFAT. Source: AFI10- 245; AFI71-101V4; AFMAN31-201V4; AFTTP 3-4.6; DoDD 5240.06; &

DODI 2000.16.

6.3.7 Contractor Identification & Badges

6.3.7.1 All contractor management, staff and contractor personnel shall be clearly identified as such at ALL times. Contractor identification shall include visible badges, conversations, mail, email, teleconferences, video teleconferences, faxes, and/or other electronic communication whether with government personnel, other contractor personnel, or with the public when supporting this contract where their status as contractor employees might not otherwise be apparent or where they might be mistaken for civil service employees. At a minimum, contractor management staff or contractor personnel shall clearly identify themselves using the label “contractor” in email addresses in accordance with Federal Acquisition Regulation (FAR) 37.114(c), Special Acquisition Requirements; opening ALL phone conversations with a statement materially the same as, “[office name], I am [employee name], a [prime contractor’s company name] employee,” including the employing contractor’s name in the letterhead and/or signature block of any written correspondence; and any other means necessary.

6.3.7.2 Credentialling Contractors: CACs are issued/Adjudicated based off the Hill AFBI 36-30264 MAY 2023, DoDM 1000.13, DODI 5200.46, DOD Investigation and Adjudicative Guidance for Issuing the Common Access Card (CAC). Common Access Cards (CACs) serve two purposes: To provide authorization for physical access to federally controlled installations/facilities and to obtain logical access to federally controlled information systems and networks. If a logical need is not determined for access to Information systems, a DBIBS will be issued to Contractor Personal.

6.3.8 In/Out-Processing

6.3.8.1 All contractors are required to in/out-process from each respective organization regardless of if they are issued a DBIDS or CAC.

6.3.8.2 Contractor employees will complete the same in/out processing checklist from the assigned organization. Employees removed from the contract will be required to return all government issued credentials and equipment to the issuing office the same day of separation. If employee is unable to return the credentials and equipment, then the contracting supervisor will ensure that all credentials are returned to the issuing SM the same day.

6.3.9 Security Incident

6.3.9.1 Should a security incident occur, the contractor shall: immediately report to the site location Security Manager (SM) all available facts related to each instance, take such precautions as the SM may reasonably require for security purposes, take reasonable and prudent action to establish control of the scene; prevent further violation, to preserve evidence until released by proper authority; and cooperate fully and assist Government personnel as the Government conducts an investigation of the violation. NOTE: Participation shall last until the investigation is complete.

6.3.10 Training Requirements

6.3.10.1 Contractors may be required to complete the following trainings as applicable and administered electronically, whenever possible, or in-person:

6.3.10.2 Training required for all personnel to include GSU Globally Separated Units.

6.3.11 Operations Security (OPSEC) Awareness – Frequency: Initially upon assignment (within 30-days) and annually thereafter IAW AFI 10-701, Operations Security (OPSEC). Presentation/Means: Unit Security Manager or TSS Course #MHPSEC9800301BR, mylearning/TFAT DoD 8570.01-M Information Assurance Workforce Improvement Program, 19 December 2005;

Information Systems Security Line of Business, 22 February 2007

6.3.12 Controlled Unclassified Information (CUI) Frequency: Initially upon assignment (within 30-days) and annually thereafter. Presentation/Means: Unit Security Manager, TSS Course MLMW2289, mylearning/TFAT. Source: IAW DoDI 5200.48_AFI 16-1403 Paras 2.10d & 3.6B. Controlled Unclassified Information

(CUI).

6.3.13 Unit Indoctrination and Orientation Training – Frequency: within 30 calendar days of assignment. Presentation/Means: Unit Security Manager IPO Annual security refresher orientation Course # TBD (NOTE: for cleared personnel, initial/ Annual Training for cleared personal, TSS Course #MHPSEC9802900BR is required before access to classified information is granted).

6.3.14 Counter-Insider Threat (C-InT) Training - This training covers procedures for C- InT awareness and reporting. Frequency: Initially upon assignment (within first 30-days) and annually thereafter. Presentation/Means: Unit Security Manager or TSS Course MLMW2216, mylearning/TFAT. Source: AFI 16-1402, Counter- Insider Threat Program Management, PARA 3.3; DoD Manual 5200.01. Volume 3 Enclosure 5_DAFMAN 16-1404, Volume 3 Para 3 (e) (Added)(AF).

6.3.15 Force Protection training: Frequency: Initially upon assignment/ annually thereafter. Presentation/ means: Unit Security Manager, TSS Course MLMW0846, mylearning/TFAT. Source: AFI10-245; AFI71-101V4;

AFMAN31-201V4; AFTTP 3-4.6; DoDD 5240.06; & DODI 2000.16.

6.3.16 Annual STINFO Awareness Training: Cleared Personal Requirement, this training cover rules regarding classified information material. Frequency: Prior to initial access to classified information and annually tell security access termination. Presentation/ Means: Unit Security Manager, TSS Course CHPOPS00020000BR, mylearning/TFAT. Source DoD Manual 5200.01, Volume 3, enclosure 5_ DAFMAN 16- 1404, Volume 3 PARA 3(c).

6.3.17 NATO Brief Requirements: NATO Briefing for all Cleared Personnel. This training covers to facilitate potential access to NATO classified information, who are briefed on their responsibilities for protecting U.S. classified information shall be briefed simultaneously on the requirements for protecting NATO information. A written acknowledgement of the individual’s receipt of the NATO briefing and responsibilities for safeguarding NATO classified information shall be maintained. As stipulated in Reference (u), access to NATO classified information shall also require a supervisor’s determination of the individual’s need to know and possession of the requisite security clearance. Frequency:

Initially upon assignment (within first 30-days). Presentation/ means: Unit Security Manager, TSS Course MHPSEC9803000BR: 75SC NATO Security Awareness Brief, NATO Briefing Receipt/ Letter. Source: DODM 5200.01_Volume1_AFMAN 16-1404_Volume1.

6.3.18 Cyber Awareness Training – this training required with access to DoD to Information technology systems. Frequency requirements initially upon assignment/annually thereafter. Presentation/ means: mylearning/TFAT. Source:

DoD 8570.07-M, Information Assurance Workforce Improvement Program, 19 December 2005; Information Systems Security Line of Business, 22 February 2007.

6.3.19 Derivative Classification Training: This training Covers proper procedure to perform derivative classification. All cleared personal with access to a classified information system. Frequency: Initially when personal request access to classified systems and annually until access termination. Presentation/ means:

Unit Security Manager, TSS Course # MLMW2207, mylearning/TFAT. Source:

DoD Manual 5200.01, volume # Enclosure 3, Enclosure 5 _DAFMAN 16-1404, Volume 3, Paras 3 (d) & 7(c) & 7(g) (Added)(DAF).

7 CONFLICTS OF INTEREST

The Contractor shall not assign to contract or task order performance any person, including any employee of the U.S. Government, if employing that person would create a conflict of interest under any law, regulation or policy of the United States Government. Additionally, the Contractor shall not assign to contract or task order performance, any person who is an employee of the Department of the Air Force, either military or civilian, unless such person seeks and receives approval according to DoD Directive 5500.7-R and any other applicable regulation or policy of the Department of the Air Force or its subordinate commands, as applicable, including but not limited to Air Force Materiel Command.

8 GENERAL INFORMATION

8.1 Hours of Operation

8.1.1 Normal Hours of Operation: The contractor shall perform the services required under this contract during the following hours: Monday through Friday 0600- 1700 – EXCEPT FEDERAL HOLIDAYS and other base closures.

8.1.2 Federal Holidays: Unless otherwise required by the Government, the contractor shall not have access to the Government facilities on the following federal holidays: New Year’s Day, Martin Luther King’s Birthday, Washington’s Birthday, Memorial Day, Independence Day, Juneteenth, Labor Day, Columbus Day, Veterans’ Day, Thanksgiving Day, and Christmas Day. If a holiday falls on Saturday, it is observed on Friday and working hours are Monday through Wednesday for that week. If the holiday falls on a Sunday, it is observed on Monday. Any other circumstances that may prompt base closure, such as Days of National Mourning, may also restrict opportunity to perform the exchanges. In the event of a base closure, exchanges shall be performed on the next business day. There may also be up to six AFMC Goal Days and four Wingman Days per year awarded to Government civilian employees, as well as possible weather related days and Government directed holidays. On these days, the contractor shall not generally be required to work and the Government shall not be billed for work not performed.

8.1.3 Down Days/Weather Days: The Government will notify the contractor when official notice has been given for Energy/Weather Down days. The contractor is not expected to work on any Energy/Weather Down days.

8.1.4 Travel to other Government facilities or other contractor facilities may be required to perform the services required by this PWS, both within the contiguous United States and overseas. The contractor shall be responsible for obtaining any passports or visas and making travel arrangements to and from any CONUS location.