Revised PWS Security Admin Support.pdf

Solicitation Number / Contract Number TBD Insert Date, Mod #

PERFORMANCE WORK STATEMENT

for

Air Force Medical Command

(AFMEDCOM)

SECURITY ADMINISTRATIVE SUPPORT

SERVICES

Solicitation/Contract Number TBD

Date (XX Month Year)

(Version Control Date: 4 Feb 2025)

Table of Contents Section Page Number

1. DESCRIPTION OF SERVICES

1.1. Background

1.2. Scope

2. GENERAL INFORMATION

2.1. Contractor Identification

2.2. Contractor Training

2.3. Contractor/Government Communication

2.4. Monthly Status/Financial Report

2.5. Place of Performance

2.6. Travel Requirements

2.7. Mission/Emergency Essential

2.8. Duty Hours

2.9. Telecommuting

2.10. Federal Holidays

2.11. Facility Closures

2.12. Conduct of Contractor Personnel

2.13. Controlled Unclassified Information (CUI)

2.14. Personnel Staffing:

3. CONTRACT REQUIREMENTS

3.1. Support Services

3.2. Minimum Qualifications:

3.3. Security Requirements. (For Unclassified Contracts)

3.4. Service Contract Reporting (SCR)

3.5. Quality Control Plan (QCP):

3.6. Post-Award and Initial Contract Performance Meeting

4. PERFORMANCE OBJECTIVES

4.1. Services Summary (SS)

5. GOVERNMENT FURNISHED PROPERTY (GFP)

6. DELIVERABLES

Appendix A

ACRONYMS

PERFORMANCE WORK STATEMENT (PWS)

SECURITY ADMINISTRATIVE SUPPORT SERVICES

1. DESCRIPTION OF SERVICES

1.1. Background.

The Air Force Surgeon General’s mission is to provide policies, procedures, and staff support to the Headquarters United States Air Force/Surgeon General (HQ USAF/SG) which includes the Air Force Medical Command (AFMEDCOM) through the oversight of the Information Security Program.

AFMEDCOM/Central Security Service (CSS) has the responsibility to oversee the security requirements and proper clearances on every individual associated with Headquarters Air Force (HAF) and AFMEDCOM programs. The Air Force (AF) staff at the Defense Health Headquarters (DHHQ) relies on the AFMEDCOM/CSS security staff to provide clear guidance on security measures, cleared individuals, and classified information. AFMEDCOM/CSS security staff focuses on providing information, industrial, and personnel security program functions and temporary visitors in the National Capital Region (NCR).

1.2. Scope.

The AFMEDCOM/CSS staff is seeking support in the security department for the USAF/Surgeon General (SG). The support shall include answering questions and processing documents according to the local procedures and policies in accordance with (IAW) DoDM5220.22V2_AFMAN16-1406V2, National Industrial Security Program: Industrial Security Procedures for Government Activities, and Department of Defense Instruction 5200.1-R, Information Security Program; and recommend revisions and updates to maintain local procedures for the protection of classified national defense and other sensitive information and systems originated or controlled by installation activities. Contractor support shall include providing expertise in local policies, safeguarding classified documents, coordinating Sensitive Compartmented Information (SCI) clearances, maintaining records, and providing security compliance guidance to assigned personnel. The contractor shall assist the Government staff by coordinating documentation for the Common Access Card (CAC), coordinating documentations for security clearances, providing guidance and notifications for Department of the Air Force (DAF)/SG and AFMEDCOM personnel who are in-processing and out-processing, and monitoring individual training requirements.

2. GENERAL INFORMATION

2.1. Contractor Identification.

All Contractor/Subcontractor personnel shall identify themselves as Government Contractor personnel during all forms of communications such as business meetings, telephone conversations, electronic mail, attendance sheets, coordination documentations, reports, and the signature blocks utilized in all correspondence. If a contract requires Government workspace, the Contractor/Subcontractor personnel shall wear a picture identification badge and identify their workspace area with their name and company affiliation.

2.2. Contractor Training.

The following courses computer-based modules or in-residence are required annually or on a one-time basis unless otherwise noted.

Training Delivery Frequency HIPAA & Privacy Act Training Web-based Annual Department of Defense (DoD) Cyber Awareness Challenge Web-based Annual

Operations Security (OPSEC) Awareness Training Web-based One-Time Security Administration Web-based One-time DoD Controlled Unclassified Information Web-based Annual Environmental Management Systems (EMS) General Awareness Training Web-based One-time

2.3. Contractor/Government Communication.

2.3.1. The Contractor shall designate a Focal Point to be the single point of contact for all Contractor and Government correspondence. The Focal Point shall provide clear and consistent written and verbal response to Government within twenty-four (24) hours of Government initiated communication (e.g., return phone calls, emails or other communication).

2.3.2. The Contractor’s Focal Point shall meet with the Government team at least quarterly.

Additional meetings may be requested by the Government or the Contractor as necessary. The Contracting Officer (CO), Contractor Focal Point, Contracting Officer Representative (CORs) and/or other designated representative will provide monthly performance feedback to the Contractor. The Contractor shall provide an agenda IAW Contract Data Requirements List (CDRL) A001 meeting agenda, CDRL A002 meeting minutes, and corresponding Data Item Description (DID).

2.4. Monthly Status/Financial Report.

The Contractor shall prepare and submit a monthly status/financial report identifying all tasks performed, status, issues, and anticipated actions consistent with the PWS. The Contractor shall provide the Monthly Status/Financial Report IAW CDRL A003 performance and cost report and corresponding DID.

2.5. Place of Performance.

The work to be performed under this contract will be performed at DHHQ, 7700 Arlington Blvd, Suite 5101 Falls Church, VA 22042.

2.6. Travel Requirements. No travel requirements under this Contract

2.7. Mission/Emergency Essential. None of the services listed in this PWS are mission/emergency essential

2.8. Duty Hours. Normal duty hours range between the hours of 7:30 a.m. to 4:30 p.m. Eastern Standard Time, Monday through Friday (excluding federal holidays).

2.9. Telecommuting.

2.9.1. Telecommuting is authorized on an ad-hoc or situational basis for this contract. Routine (3 or less days per week) and/or full-time (5 days per week) telecommuting may be authorized upon the written approval of the COR. The COR shall have final approval of telecommuting schedules. In the event telecommuting is authorized, a laptop with a Virtual Private Network (VPN) account and Common Access Card (CAC) accessibility shall also be provided and supported by the government in locations referenced in Section 2.5. In the event of unplanned closure of the facility due to natural disasters, military emergency or severe weather, the contractor may propose an alternate work location subject to the prior coordination of the contractor’s focal point and COR. Contractors shall complete the telework training course, and a signed agreement shall be in place and provided to the COR/PM prior to telecommute. The contract personnel telecommuting will ensure continuity and timeliness in completing tasks.

2.9.2. While telecommuting, contractor personnel must respond to any inquiries from the COR or designated government official within 2 hours. In the event the contractor personnel are unable to log onto their laptop due to VPN or CAC issues, the contractor employee shall either take leave following company policies, or report to an alternate location where meaningful work can be accomplished. The contractor may not charge the Government for work not performed or travel time a contractor employee may require locating a suitable alternative location. Teleworking arrangements may be revoked by the CO through written correspondence; contract personnel will be required to return to work on the next business day.

2.10. Federal Holidays.

Federal offices are closed on federal holidays as established by Federal law (5 U.S.C. 6103) and any other holidays declared by executive order. Holidays are documented by year on the Office of Personnel Management website for Federal employees located at: https://www.opm.gov/policy-data-oversight/pay-leave/federal-holidays/#url=Overview.

2.11. Facility Closures.

The Government will notify the Contractor of anticipated closure of the facility, (i.e., training, holidays, administrative leave granted to the entire staff, or other closure including down days) five (5) business days in advance or as soon as possible. A down day is a day that the United States Air Force (USAF) leadership designates as a minimal manning/liberal leave day. The employee may take leave following their company’s policies or work from an alternate location. In the event of unplanned closure of the facility due to natural disasters, military emergency or severe weather, the Government will notify the Contractor in the same manner as the Government notifies Washington D.C. area civilian personnel.

2.12. Conduct of Contractor Personnel.

2.12.1. Reference FAR 3.1002(a) in the conduct of all Contractor personnel. The CO or designated Government representative may require Contractor personnel working under this contract be removed from the job site. Removal from the job site or dismissal from the premises shall not relieve the Contractor of the contract requirements.

2.12.2. Contractor personnel shall observe Government facility parking, safety and traffic regulations that apply to all facility employees.

2.12.3. Alcoholic beverages on the job are prohibited.

2.12.4. There shall be no loud, profane or abusive language used on the job.

https://www.opm.gov/policy-data-oversight/pay-leave/federal-holidays/#url=Overview https://www.opm.gov/policy-data-oversight/pay-leave/federal-holidays/#url=Overview

2.12.5. Contractor personnel shall present a neat well-groomed appearance. Neat, clean, business casual or business attire clothing shall be worn.

2.13. Controlled Unclassified Information (CUI).

2.13.1. CUI is Government created or owned UNCLASSIFIED information that must be safeguarded from unauthorized disclosure.

2.13.2. Information requiring specific security measures indexed under one system across the Federal Government DoD Instruction 5200.48, “Controlled Unclassified Information,” established DoD CUI policy on March 6, 2020.

2.13.3. All information produced as a result of contract performance shall be reviewed prior to dissemination to determine if CUI is identified, and if so refer to Department of Defense Instructions (DoDI) 5200.48 for additional instructions regarding designation, handling, and decontrolling of CUI (including CUI identification, sharing, marking, safeguarding, storage, dissemination, destruction, and records management).

2.14. Personnel Staffing:

2.14.1. The Contractor shall accomplish, at a minimum, the following personnel staffing performance management outcomes:

2.14.1.1. Ensure positions are filled 100% and are present for duty within fifteen (15) business days after the start of the period of performance (POP) in the contract.

2.14.1.2. Ensure continuation of services during personnel absences due to sickness, leave, and voluntary or involuntary termination from employment such that impact to the Government is minimal and position vacancies do not exceed ten (10) calendar days. The Contractors shall maintain an overall filled rate of 95%.

2.14.1.3. The substitute/replacement personnel shall begin work no later than 10 calendar days after notification or immediately after departure of the incumbent personnel, whichever is earlier.

2.14.1.4. The Contractors shall promptly notify the CO and COR within five (5) calendar days of a projected vacancy exceeding ten (10) calendar days.

2.14.1.5. Provide a stable workforce with less than 30% turnover. A turnover is recorded when a worker leaves a position for any reason and the Government still has a requirement for that position.

2.14.1.6. The Government will not pay for services not rendered if a vacancy exceeds 10 business days.

3. CONTRACT REQUIREMENTS

3.1. Support Services. The contractor shall provide security administrative support services for the security department located within HAF/AFMEDCOM. The Contractor personnel shall perform the following duties.

3.1.1. Local Policies. Track, maintain records and coordinate paperwork IAW DoDI 5200.2R DoD Personnel Security Program; DoDM5220.22V2, National Industrial Security Program: Industrial Security Procedures for Government Activities, Air Force Instruction (AFI) 31-601, Industrial Security Program, and the Defense Information Security System (DISS) as they apply to the USAF/SG community.

3.1.2. Classified Documentation. Assist in administering courier briefings and provide courier documentation to individuals as required for classified handling within the NCR daily.

3.1.3. SCI Access. Coordinate any paperwork and related issues requiring SCI access and other special security capabilities with the AF Special Security Office.

3.1.3.1. Monitor and store daily end of day security checks and utilize Standard Form (SF) 701 to ensure classified information is secure. Report any concerns/non-compliance, and safeguard appropriate training to rectify. DoDM 5200.01, Volume 3, Enclosure 2, Paragraph 9, February 24, 2012 and AFI 16-1404_AFGM2019-01, Paragraph 2.7.8, 29.

3.1.3.2. Develop a process to ensure inventories of Top Secret information be conducted at minimum annually, or more frequently when circumstances warrant. DoDM 5200.01, Volume 1, Enclosure 2, Paragraph 10(b), February 24, 2012.

3.1.4. Security Compliance. Coordinate with DHA and other Security Managers on personnel status, facilities compliance, and training and security requirements.

3.1.4.1. Track and update the Commander/Director appointed security assistants in writing to manage applicable security programs i.e. Information Security Program (INFOSEC), Industrial Security, Insider Threat and/or PERSEC. AFI 16-1404_AFGM2019-01, para 2.7.1.3.

3.1.4.2. Assist with the development and implementation of an Emergency Action Plan (EAP).

Certify it has been developed to protect, remove, or destroy classified material in case of fire, natural disaster, civil disturbance, terrorist activities, or enemy action. DoDM 5200.01, Volume 3, Enclosure 2, Paragraph 10, February 24, 2012.

3.1.5. Personnel Security Investigation. Initiate, maintain, and document required personnel security investigations appropriate to the individual’s responsibilities and access to DoD Sensitive Information. The contractor shall assist the Security Manager to ensure Personnel Security Investigation (PSI) packages are completed.

3.1.6. Review Forms. Assist the Government with reviewing the SF86/85P to ensure that all information is complete. If any information is missing, then the contractor shall notify the individual and ask the individual to complete the missing information. Ensure that information is completed no later than (NLT) three (3) calendar days after receiving the form. Upon approval of the investigation from the 11th Wing, the contractor shall assist the AFMEDCOM/CSS staff in mailing a hard copy of fingerprints to Office of Personnel Management (OPM) with any other required documents.

3.1.7. Maintain lists. Maintain a list with personnel security investigations appropriate to the job responsibilities for the staff in DAF/SG and AFMEDCOM in addition to who has access to DoD Sensitive Information. Document and notify the individuals with expired investigations and unfavorable adjudications per the Security Manager’s request and update the file with current information once it is received.

3.1.8. Personnel Roster. Monitor and update a database/roster of personnel requiring re-investigations, upgraded requirements, PSI pending adjudication, personnel that are no longer with the agency and deliver to the Security Manager NLT the 10th calendar day of the month.

3.1.9. Training Notifications. Maintain a training file for all DAF/SG and AFMEDCOM personnel and provide updates to personnel when training is due for refresher. Process, track, monitor new employee training notifications sent to the Security Manager by the Government supervisor and CORs of new hires and contractors.

3.1.10. Access Control. Assist the Security Manager by gathering documentation and contact information prior to providing visitor access to the Government facility NLT twenty-four (24) hours of notification. Coordinate all documentation from employees obtaining access to AF Automated Information Systems (AIS) networks between personnel and Security Manager.

3.1.10.1. Monitor personnel to ensure members who have access to classified information possess the proper security clearance, have a signed SF 312 "Classified Information Non- Disclosure Agreement", and have a need-to-know. DoDM 5200.01, Volume 3, Enclosure 2, Paragraph 3, February 24, 2012 and AFI16-1404, AFGM2019-1, September 14, 2018, Paragraphs 2.7.2 & 5.1.1.1–5.1.1.1.3.

3.1.10.2. Ensure members who have access to classified information have a Standard Form 312 annotated in DISS. AFI16-1404, AFGM2019-1, September 14, 2018, Paragraph 5.1.1.

3.1.10.3. Create a training program/schedule for personnel to be educated and informed on reportable behaviors that fall under the continuous evaluation program. DoDM 5200.02, Section 11.2 (d), April 03, 2017.

3.1.10.4. Develop a Key and Combination Program. Track/monitor keys, combinations to storage containers, and vaults accounted for. Ensure security is commensurate with the level of classified material being protected. USSAN 1-07, Paragraph 4.8.2 – 4.8.4, April 05, 2007.

3.1.11. Customer Support. Answer general questions pertaining to visitor assistance, Information Systems security and secure conference room administration.

3.1.11.1. Coordinate with Security Manager toward developing, updating, maintaining and monitoring tools which tracks all Annual Security Training Requirements for DAF/SG and AFMEDCOM personnel. This includes personnel related to the execution of the program, such as COR, Trusted Agent and other information necessary to maintain 100% accountability of all personnel

– military, civilians and contractor.

3.1.11.2. Maintain database to ensure accuracy/integrity of reporting via in/out-processing. Monitor currency of CORs, Vendors, Trusted Agents and contractor contact information.

3.1.11.3. Assist, develop, manage and implement the Operations Security Program (OPSEC), (INFOSEC) and other security related training, as a result of policy changes, or dictated by local policy.

3.1.12. Documentation Support. File, track, route, fax, and scan documentation pertaining to personnel reports, records management, and CAC issuance.

3.2. Minimum Qualifications:

3.2.1. Three (3) year of direct experience in security administrative support services.

3.2.2. Must have an active Tier 3 (T3)

3.3. Security Requirements. (For Unclassified Contracts)

3.3.1. Personnel Clearance: The Contractor must possess an Active facility security clearance T3 prior to performing work on a classified Government contract. The Contractor assumes costs and conducts investigations for a Secret facility security clearance. The Contractor shall request personnel security clearances, at the company’s expense, for employees requiring access to classified information within 15 business days after receiving a facility clearance or, if the Contractor is already cleared, within 15 business days after service award. Contractor must have an active Facility Clearance at the time of proposal. Due to costs involved with security investigations, requests for personnel security clearances shall be kept to the minimum amount employees are required to perform contract requirements.

3.3.2. List of Contractor Personnel: The Contractor shall maintain a current listing of Contractor personnel. The list shall include Contractor personnel’s name, social security number, and level of security clearance. The list shall be validated and signed by the company Facility Security Officer (FSO) and provided to the CO and Information Protection Office prior to the service start date.

Updated listings shall be provided when Contractor personnel’s status or information changes. A Visit Request for all Contractor personnel with security clearances is required to be sent through the Defense Information System for Security (DISS) and must be updated at least annually. The Contractor shall notify the Information Protection Office at each operating location 30 business days before on-base performance of the service. The notification shall include:

3.3.2.1. Name, address, and telephone number of the company key management representatives. The contract number and contracting agency.

3.3.2.2. The highest level of classified information to which employees require access.

3.3.2.3. The location(s) of service performance and future performance, if known.

3.3.2.4. The date service performance begins.

3.3.2.5. Any change to information previously provided under this paragraph.

3.3.3. Security Requirements for Contractor Personnel Requiring Access to Classified Information.

Contractor personnel shall require view access to and/or be involved in discussions concerning classified information. A contractor’s “Facility Clearance” is required in accordance with DoD 5220.22-M Incorporating Change 2_May 18, 2016, National Industrial Security Program Operating Manual. Contractor must have an active Facility Clearance at the time of proposal. The Government will not pay for nor sponsor any Contractor's attempt to obtain a Facility Clearance. The Contractor’s FSO is responsible for ensuring that all Contractor personnel assigned to this contract have the appropriate clearance as stated in this PWS. The Contractor shall be responsible for all costs associated with security clearances. The Contractor shall provide personnel with the required clearance at the time of award.

3.3.4. A DoD Contract Security Classification Specifications T3 is required. The Contractors shall includes packaging classified information, mailing and receiving classified materials, implementing emergency procedures for protection of classified information, security checks and internal security controls for protection of classified material and high-value pilferable property. For Contractors to provide comprehensive support, they need to stay current and aware of events and information located in classified documents.

3.3.5. Contractor personnel requiring a T3 Clearance must be able to work in an environment applicable to classified and unclassified DoD information systems. These Contractor personnel provide security support shall include storage containers for classified information/material, use of base destruction facilities, classified reproduction facilities, use of base classified mail services, security badging, base visitor control, investigation of security incidents, base traffic regulations and the use of security forms and conducting inspections required by DoD 5220.22-R, Industrial Security Regulation, Air Force Policy Directive 31-6, Industrial Security, and Air Force Instruction 31-601, Industrial Security Program Management. This designator is based on the potential for an individual assigned to this position to adversely impact DoD missions or functions. The position categories on this contract include Limited Privileged and Non-Privileged, as defined in DoDM 5200.2 Procedures For The DoD Personnel Security Program (PSP). Investigative requirements for each category vary.

Tier 1 = Non-sensitive. Non-Sensitive positions are those which include mostly low risk, non-sensitive, and non-national security program responsibilities. T3 = Non-critical sensitive (Secret).

National Security positions are those in which there is a need for a security clearance to access classified, national security information.

3.3.6. Visitor Group Security Agreement (VGSA): The Contractor shall enter a long-term VGSA if service performance is on base. This agreement shall outline how the Contractor integrates security requirements for service operations with the AF to ensure effective and economical operation on the installation. The agreement shall include:

3.3.6.1. Security support provided by the AF to the Contractor, shall include storage containers for classified information or material, use of base destruction facilities, classified reproduction facilities, use of base classified mail services, security badging, base visitor control, investigation of security incidents, base traffic regulations and the use of security forms and conducting inspections required by DoDM 5220.22 Volume 2, National Industrial Security Program: Industrial Security Procedures For Government Activities, Air Force Policy Directive 16-14, Security Enterprise Governance, and Air Force Instruction 16-1406, Air Force Industrial Security Program.

3.3.6.2. Security support requiring joint AF and Contractor coordination includes packaging classified information, mailing and receiving classified materials, implementing emergency procedures for protection of classified information, security checks and internal security controls for protection of classified material and high-value pilferable property.

3.3.6.3. On base, the long-term VGSA may take the place of a Standard Practice Procedure.

3.3.7. Pass and Identification Items: The Contractor shall ensure the following pass and identification items required for service performance are obtained for personnel.

3.3.7.1. Installation Access Pass Defense Biometric Identification System (DBIDS), Visitor/Vehicle Pass (DoDM5200.08V3_AFMAN31-101V3 (FOUO)), used for contracts for less than six months to include one-day visits (i.e., warranty work).

3.3.7.2. Installation Access Card DBIDS (DoDM5200.08V3_AFMAN31-101V3 (FOUO)), used for contracts for six (6) months or more.

3.3.7.3. DoD Common Access Card (CAC), (AFI 36-3026V2), used for contracts for more than six

(6) months and requirement exists for access to the Government computer systems and software.

CAC applications are accomplished by Trusted Agents via the Trusted Agent Sponsorship System.

3.3.8. Suitability Investigations: Contractor personnel not requiring access to classified shall successfully complete, as a minimum, a Tier 3, before operating Government furnished workstations.

The Contractor shall comply with the DoDM 5200.2, AFI 17-130, Cybersecurity Program Management. T3 investigations requests are initiated using the Standard Form (SF) 86 and are submitted to the installation Information Protection Office through the using agency’s Unit Security Manager.

3.3.9. Entry Procedures to Controlled/Restricted Areas: Contractor personnel requiring unescorted entry to areas designated as controlled or restricted areas by the installation commander shall comply with base access requirements and will possess, as a minimum, a favorable suitability determination. These requirements are contained in AFI 31-101, Integrated Defense (ID), for installation access and DoDMAN5200.02_AFMAN 16-1405, Air Force Personnel Security Program, for suitability determinations. The Contractor shall comply and implement local base procedures for entry to AF controlled/restricted areas. For on-base cleared facilities over-sighted by the base Information Security Program Management (ISPM), Contractors shall comply with the National Industrial Security Program Operating Manual, previously referred to as the Industrial Security Manual, to implement controlled/restricted area requirements. The ISPM shall approve the establishment, construction, and modification of all Contractor designated controlled areas before they may be used to limit access.

3.3.10. Security Monitor Appointment: The Contractor shall appoint a security representative for the on base long term visitor group. The security representative may be a full-time position or an additional duty position. The security representative shall work with the host organization to provide employees with training required by DoDM 5200.01V1-3, DoD Information Security Program, AFPD 16-14, Security Enterprise Governance, and AFI 16-1404, Air Force Information Security Program.

The Contractor shall provide initial and follow-on training to Contractor personnel who work in AF controlled/restricted areas. AF restricted and controlled areas are explained in AFI 31-101.

3.3.11. Additional Security Requirements: In accordance with DoDM 5200.01V1-3, and AFI 16- 1404, the Contractor shall comply with AFSSI 7700, Emission Security Program; applicable Air Force COMSEC General Publication, AFIs, and Air Force Systems Security Instruction for Communication Security; and AFI 10-701, Operations Security (OPSEC) Instructions. The Contractor will comply with DoD Standard 22/Force Protection Condition Measures, DoD Standard 25/Level I-Antiterrorism (AT) Awareness Training, and associated tasking contained in DoDIO-2000.16V1_AFI 10-245-O, AT Program Implementation. Level I AT Awareness training is available for Contractor personnel and can be requested by calling the Installation AT Office.

3.3.12. Freedom of Information Act Program (FOIA): The contractor shall comply with DoDM 5400.07, DoD FOIA Program, requirements. The regulation sets policy and procedures for the disclosure of records to the public and for marking, handling, transmitting, and safeguarding FOUO material. The Contractor shall comply with AFI 33-332, Air Force Privacy and Civil Liberties Program, when collecting and maintaining information protected by the Privacy Act of 1974 authorized by Title 10, United States Code, Section 8013. The Contractor shall remove or destroy official records only in accordance with AFI 33-322, Records Management and Information Governance Program.

3.3.13. Control of Unclassified Information (CUI) The contractor shall comply with procedures outlined in Section 2002.4 of Title 32 CFR as “information the Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government, that a law, regulation, or Government wide. Additionally, the contractor will ensure all specified agency training is completed and maintained in accordance to AFMEDCOM policy. Policy requires or permits an agency to handle using safeguarding or dissemination controls.”

3.3.14. Reporting Requirements. The Contractor shall comply with AFI 71-101, Volume - 1, Criminal Investigations, and Volume - 2, Protective Service Matters requirements. Contractor personnel shall report to an appropriate authority, any information, or circumstances of which they are aware may pose a threat to the security of DoD personnel, Contractor personnel, resources, and classified or unclassified defense information. Employees shall be briefed by their immediate supervisor upon initial on-base assignment and as required thereafter.

3.3.15. Physical Security. Areas controlled by Contractor employees shall comply with base Operations Plans/instructions for Force Protection Condition (FPCON) procedures, Random Antiterrorism Measures and local search/identification requirements. The Contractor shall safeguard all Government property, including controlled forms, provided for Contractor use. At the close of each work period, Government training equipment, ground aerospace vehicles, facilities, support equipment, and other valuable materials shall be secured. During increased FPCONs, Contractors may have limited access to the installation and should expect entrance delays.

3.3.16. Key Control. The Contractor shall establish and implement key control procedures to ensure keys issued to the Contractor by the Government are properly safeguarded and not used by unauthorized personnel. The Contractor shall not duplicate keys issued by the Government. Lost keys shall be reported immediately to the CO. The Government replaces lost keys or performs re-keying.

The total cost of lost keys, re-keying or lock replacement shall be deducted from the monthly payment due to the Contractor. The Contractor shall ensure its employees do not allow Government issued keys to be used by personnel other than current authorized Contractor employees. Contractor employees shall not use keys to open work areas for personnel other than Contractor employees engaged in performance of duties, unless authorized by the Government functional area chief.

3.3.17. Lock Combinations. The Contractor shall establish procedures in local Operating Instructions ensuring lock combinations are not revealed to unauthorized persons and ensure the procedures are implemented. The Contractor is not authorized to record lock combinations without written approval by the Government functional area chief. Records with written combinations to authorized secure storage containers or Secure Storage Rooms, shall be marked, and safeguarded at the highest classification level as the classified material maintained inside the approved containers.

The Contractor shall comply with DoDM 5200.01 V1-3 security requirements for changing combinations to storage containers used to maintain classified materials.

3.3.18. Local Area Network (LAN). All Contractor employees requiring access to the Government unclassified computer network shall have a valid Tier 1 investigation verified through DISS. No Contractor employee will be provided access to unclassified computer network or its inherent capabilities (i.e., internet access, electronic mail, file and print services) without a valid Tier 1 investigation. The Contractor shall be aware of and abide by all Government regulations concerning the authorized use of the Government’s computer network including the restriction against using the network to recruit Government personnel or advertise job openings.

3.3.19. Disclosure of Information. In the performance of this contract, the Contractor may have access to data and information proprietary to a Government agency or to another Government Contractor, or of such nature that its dissemination or use, other than as specified in this contract, would be illegal or otherwise adverse to the interests of the Government or others. The Contractor and its personnel shall not divulge, or release data or information developed or obtained under performance of this contract, except to authorized Government personnel or upon written approval of the CO. The Contractor and its Contractor personnel shall not use, disclose, keep for personal use, or reproduce proprietary information bearing a restrictive legend, other than as specified in the contract.

3.3.20. Non-Disclosure Agreement (NDA). All Contractor employees shall sign the non-disclosure statement provided at the time of contract award and submit to the CO prior to beginning performance on this contract.

3.4. Service Contract Reporting (SCR)

The contractor shall report manpower data IAW the current Guidebook for Service Contract Reporting in the SAM. User Manuals: Additional guidance can be found in the Guidebook for Service Contract Reporting in the System for Award Management.

3.5. Quality Control Plan: N/A

3.6. Post-Award and Initial Contract Performance Meeting.

The Government will host a post-award meeting with the Contractor within ten (10) business days after contract award. The COR shall contact the CO and the Contractor to schedule this meeting.

Telecon/teleconference is permissible for the post-award meeting. The purpose of the post-award meeting is to introduce the Contractor to the Government representatives (PM/COR); provide the Contractor the opportunity to explain in more detail their proposal’s technical approach; and entertain questions from either party. Take-aways from the meeting should be an exchange of contact information; a timeline of when direct support will start, if not yet started; and an understanding by all https://dodprocurementtoolbox.com/cms/sites/default/files/resources/2020-10/SCR%20Guidebook%2021%20October%202020.pdf https://dodprocurementtoolbox.com/cms/sites/default/files/resources/2020-10/SCR%20Guidebook%2021%20October%202020.pdf parties of all the requirements to be performed by the Contractor and the support the Government will provide the Contractor to perform the requirements, safely and efficiently. The Contractor shall also attend an Initial Contract Performance Review thirty (30) calendar days after the Contractor assumes full performance responsibilities (i.e., after completion of transition/mobilization) to ensure that the Contractor has successfully started performance, completed transition, is fully operational, and is within the estimated cost, schedule, and performance parameters of the contract. The Contractor shall also attend a follow-up meeting ninety (90) calendar days after contract award to assess status of performance.

4. PERFORMANCE OBJECTIVES

4.1. Services Summary (SS).

The Contractor services requirements are summarized into performance objectives that relate directly to mission essential items. The performance threshold briefly describes the minimum acceptable levels of service for each requirement. These thresholds are critical to mission success.

Services Summary Table

Item# Performance Objective

PWS

Paragraph

Performance Standard

AQL/Performance Threshold

(This is the maximum error rate.)

Method of Surveillance

Provision of Qualified Personnel Contractor shall provide qualified personnel who meet or exceed the education, experience, and certification requirements specified in the PWS for each position

3.2. – 3.2.2.

All personnel meet or exceed specified requirements

Exceptional: 100% compliance

Very Good: 95-99% compliance

Satisfactory: 90-94% compliance

Marginal: 85-89% compliance

Unsatisfactory: <85% compliance

Review of personnel records and qualifications through Periodic Surveillance by

COR

Maintenance of Contract Staffing Levels Contractor shall maintain required staffing levels and fill rates for all positions as specified in the PWS, ensuring minimal disruption to operations

2.14. – 2.14.16.

Required staffing levels maintained with minimal disruption

Exceptional: 100% staffing levels maintained

Very Good: 95-99% staffing levels maintained

Satisfactory: 90-94% staffing levels maintained

Marginal: 85-89% staffing levels maintained

Unsatisfactory: <85% staffing levels maintained

Review of monthly staffing reports through Periodic Surveillance by

COR

Timely Submission of Deliverables Contractor shall submit all required deliverables, including CDRL items, on time and in the format specified in the

PWS

2.3.2., 2.4., All deliverables submitted on time and in correct format

Exceptional: 100% on-time, correctly formatted

Very Good: 95-99% on-time, correctly formatted

Satisfactory: 90-94% on-time, correctly formatted

Marginal: 85-89% on-time, correctly formatted

Unsatisfactory: <85% on-time, correctly formatted

100% inspection of deliverable submissions

Effective Program Management Contractor shall effectively manage programs and successfully perform all required tasks as outlined in the PWS, meeting or exceeding performance standards

3.1.1. - 3.1.12.

Successful completion of all required tasks

Exceptional: All tasks completed on time with excellent quality

Very Good: 95-99% tasks completed on time with good quality

Satisfactory: 90-94% tasks completed on time with acceptable quality

Marginal: 85-89% tasks completed on time or with quality issues

Unsatisfactory: <85% tasks completed on time or significant quality issues

Program reviews and task completion report assessments through Periodic Surveillance and Customer Feedback

Customer Service Contractor employees shall provide courteous and efficient customer service

3.1.1. – 3.1.12.

Customer interactions are professional, helpful, and timely

Exceptional: Zero valid customer complaints per month

Very Good: 1-2 minor valid customer complaints per month

Customer feedback surveys Observations of complaint logs

Satisfactory: 3-4 minor per month

Marginal: 5-6 minor valid customer complaints per month

Unsatisfactory: >6 minor or any major valid customer complaints per month

Track, maintain records and coordinate paperwork in accordance with DoD

5200.2R, AFI

31-401, AFI,

31-501 and

AFI 31-60.1

3.1.1.

No more than one (1) error per six (6)-month period.

Exceptional: Zero valid customer complaints per month

Very Good: 1-2 minor valid customer complaints per month

Satisfactory: 3-4 minor valid customer complaints per month

Marginal: 5-6 minor valid customer complaints per month

Unsatisfactory: >6 minor or any major valid customer complaints per month

Periodic Surveillance and Customer Feedback

Handling Classified Information.

3.1.2.

Zero (0) errors in handling classified information.

Exceptional: Zero valid customer complaints per month

Very Good: 1-2 minor valid customer complaints per month

Satisfactory: 3-4 minor per month

100% Inspection

Marginal: 5-6 minor valid customer complaints per month

Unsatisfactory: >6 minor or any major valid customer complaints per month

Compliance with existing security policies.

3.1.4. – 3.1.4.2.

No more than one (1) non-compliance per six (6) month period.

Exceptional: Zero valid customer complaints per month

Very Good: 1-2 minor valid customer complaints per month

Satisfactory: 3-4 minor valid customer complaints per month

Marginal: 5-6 minor valid customer complaints per month

Unsatisfactory: >6 minor or any major valid customer complaints per month

Periodic Surveillance and Customer Feedback

Process request for PSI by conducting reviews for complete information in forms and updating the forms within three (3) calendar days of receipt.

3.1.8.

No more than one (1) incomplete form during six

(6) month period.

Exceptional: Zero valid customer complaints per month

Very Good: 1-2 minor valid customer complaints per month

Satisfactory: 3-4 minor valid customer complaints per month

Marginal: 5-6 minor valid customer complaints per month

Periodic Surveillance and

Feedback

Unsatisfactory: >6 minor or any major valid customer complaints per month

Maintaining files of personnel who have completed training and training that is due for refresher.

3.1.9.

No more than two (2) name or date errors during a two

(2) month period.

Exceptional: Zero valid customer complaints per month

Very Good: 1-2 minor valid customer complaints per month

Satisfactory: 3-4 minor valid customer complaints per month

Marginal: 5-6 minor valid customer complaints per month

Unsatisfactory: >6 minor or any major valid customer complaints per month

Periodic Surveillance and Customer Feedback

Initiate visitor access procedures within 24 hours notification.

3.1.10.

No more than one (1) late in-process per month

Exceptional: Zero valid customer complaints per month

Very Good: 1-2 minor valid customer complaints per month

Satisfactory: 3-4 minor valid customer complaints per month

Marginal: 5-6 minor valid customer complaints per month

Periodic Surveillance and

Feedback

Unsatisfactory: >6 minor or any major valid customer complaints per month

5. GOVERNMENT FURNISHED PROPERTY (GFP)

The Contractor’s responsibilities for the GFP are outlined in the Government Property clause 52.245- 1.

6. DELIVERABLES

6.1. The Contractor shall submit all deliverables as specified in this PWS and contract Exhibit A, Contract Data Requirements List (CDRL).

6.2. All deliverables shall be submitted electronically to the COR(s) unless otherwise directed.

6.3. The Contractor shall provide informal reports by e-mail as requested by the COR.

Appendix A

ACRONYMS

Acronyms and Definitions

ACRONYM DEFINITIONS

AF Air Force

AFI Air Force Instruction

AFMS Air Force Medical Service

AFMEDCOM Air Force Medical Command

AFMS Air Force Medical Services

CAC Common Access Card

CDRL Contract Data Requirements List

CO Contracting Officer

COR Contracting Officer Representative

CSS Central Security Service

CUI Controlled Unclassified Information

DAF Department of the Air Force

DHA Defense Health Agency

DHHQ Defense Health Headquarters

DID Data Item Description

DISS Defense Information System for Security

DoD Department of Defense

DoDI Department of Defense Instructions

EAP Emergency Action Plan

FAR Federal Acquisition Regulation

FOIA Freedom of Information Act

FOUO For Official Use Only

HAF Headquarters Air Force

HIPAA Health Insurance Portability and Accountability Act of 1996

IAW In Accordance With

INFOSEC Information Security Program

LAN Local Area Network

MAJCOM Major Command

NCR National Capital Region

NDA Non-Disclosure Agreement

NIPR Non-Secure Internet Protocol Router

NLT No later than

OCR Office of Coordinating Responsibility

OPR Office of Primary Responsibility

OPSEC Operational Security

POC Point of Contact

POP Period of performance

PWS Performance Work Statement

QCP Quality Control Plan

SCI Sensitive Compartmented Information

SCR Service Contract Reporting

SF Standard Form

SG Surgeon General

SIPR Secret Internet Protocol Router

SS Services Summary

T3 Tier 3

USAF United States Air Force

VGSA Visitor Group Security Agreement