AFLCMC-WVV EAD_RFI_PWS_Draft_R1.pdf

Performance Work Statement (PWS)

Information Assurance/Mission Assurance and Program Lifecycle Management Framework (PLMF) in support of:

United States Air Force (USAF) Air Force Materiel Command

Air Force Lifecycle Management Center (AFLCMC-WVV)

Executive Aircraft Division (EAD)

Issued by:

GSA Assisted Acquisition Services (AAS) Air Force/Navy/Space Force

Controlled by Team Lead: TBD

SECTION B – SUPPLIES OR SERVICES AND PRICES

Performance Work Statement PAGE B-1

B.1 GENERAL

The work shall be performed in accordance with all Sections of this Performance Work Statement

(PWS).

B.2 CONTRACT ACCESS FEE (CAF)

The General Services Administration’s (GSA) operating costs associated with the management and administration of this contract are recovered through a CAF. This TO shall have a separate Contract

Line Item Number (CLIN) to cover this access fee, and this CAF shall be obligated at TO Award

(TOA).

B.3 ORDER TYPE

This Task Order (TO) is a combination of Firm-Fixed-Price (FFP) and Time-and-Materials (T&M) performance-based, severable, commercial type task order issued in accordance with FAR Part 16.5.

T&M is defined under FAR 16.6, T&M. This TO also includes Direct Reimbursable Not-to-Exceed

(NTE) Contract Line Item Numbers (CLINs) for Other Direct Costs (ODCs) and Travel.

The Contractor shall provide a single rate for each labor category which will be charged no matter if the prime Contractor or a subcontractor is to perform the work. This T&M task order will be an incrementally funded award.

The contractor shall perform the effort required by this TO on a hybrid FFP + T&M basis for:

a. Mandatory Labor CLINs With Contract Line Item Structure:

Description Platform

CLIN

Base

Year

OY1 OY2 OY3 OY4

Labor VC-25A 0001 1001 2001 3001 4001 Labor VC-25B 0005 1005 2005 3005 4005 Labor C-32 0009 1009 2009 3009 4009 Labor C-37 0013 1013 2013 3013 4013 Labor C-40 0017 1017 2017 3017 4017 Labor E-4B 0021 1021 2021 3021 4021 Labor C-12 0025 1025 2025 3025 4025 Labor C-21 0029 1029 2029 3029 4029 Labor SAOC 0033 1033 2033 3033 4033 Labor VIPSAM 0037 1037 2037 3037 4037

The contractor shall perform the effort required by this TO on an NTE basis for:

Performance Work Statement PAGE B-2

b. Other Direct Costs (ODCs) CLINs:

Base

Year

OY1 OY2 OY3 OY4

Other Direct Costs (ODCs) VC-25A 0002 1002 2002 3002 4002

Other Direct Costs (ODCs) VC-25B 0006 1006 2006 3006 4006

Other Direct Costs (ODCs) C-32 0010 1010 2010 3010 4010

Other Direct Costs (ODCs) C-37 0014 1014 2014 3014 4014

Other Direct Costs (ODCs) C-40 0018 1018 2018 3018 4018

Other Direct Costs (ODCs) E-4B 0022 1022 2022 3022 4022

Other Direct Costs (ODCs) C-12 0026 1026 2026 3026 4026

Other Direct Costs (ODCs) C-21 0030 1030 2030 3030 4030

Other Direct Costs (ODCs) SAOC 0034 1034 2034 3034 4034

Other Direct Costs (ODCs) VIPSAM 0038 1038 2038 3038 4038

c. Long-Distance Travel CLINs:

Base

Year

OY1 OY2 OY3 OY4

Direct Reimbursable Travel VC-25A 0003 1003 2003 3003 4003

Direct Reimbursable Travel VC-25B 0007 1007 2007 3007 4007

Direct Reimbursable Travel C-32 0011 1011 2011 3011 4011

Direct Reimbursable Travel C-37 0015 1015 2015 3015 4015

Direct Reimbursable Travel C-40 0019 1019 2019 3019 4019

Direct Reimbursable Travel E-4B 0023 1023 2023 3023 4023

Direct Reimbursable Travel C-12 0027 1027 2027 3027 4027

Direct Reimbursable Travel C-21 0031 1031 2031 3031 4031

Direct Reimbursable Travel SAOC 0035 1035 2035 3035 4035

Direct Reimbursable Travel VIPSAM 0039 1039 2039 3039 4039

Performance Work Statement PAGE B-3

d. CAF CLINs (If Applicable):

Base

Year

OY1 OY2 OY3 OY4

CAF VC-25A 0004 1004 2004 3004 4004

CAF VC-25B 0008 1008 2008 3008 4008

CAF C-32 0012 1012 2012 3012 4012

CAF C-37 0016 1016 2016 3016 4016

CAF C-40 0020 1020 2020 3020 4020

CAF E-4B 0024 1024 2024 3024 4024

CAF C-12 0028 1028 2028 3028 4028

CAF C-21 0032 1032 2032 3032 4032

CAF SAOC 0036 1036 2036 3036 4036

CAF VIPSAM 0040 1040 2040 3040 4040

B.4 SERVICES AND PRICES

Labor is anticipated to be awarded as a T&M Labor CLIN for the base year. At the end of each contract period GSA will review the burn rates of each labor category (LCAT) to determine if there are LCATs that are consistently burned that can be put into a firm fixed price (FFP) Labor CLIN. If labor is moved from the T&M CLIN to the FFP CLIN, a new proposed pricing proposal will be negotiated between the Contractor and the Government prior to any change.

ODCs, priced across all CLINs, are to be determined (TBD) for each Period of Performance (PoP).

Travel (long distance), priced across all CLINs is TBD for each PoP.

Long-distance travel is defined as travel over fifty (50) miles from any contractor on-site location.

Local travel will not be reimbursed.

The Government will provide authorization and framework for obtaining an official (non-tourist) passport in the event the contractor is required to travel OCONUS for official duties. All requests for contingency travel shall be approved by the COR prior to commencement of travel. The contractor shall submit to the COR cost estimates for such travel. Joint Federal Travel Regulations apply. The contractor shall be responsible for all travel arrangements including airline, hotel, and rental car reservations. The contractor shall make every commercially reasonable effort to schedule travel far enough in advance to take advantage of reduced airfares.

See H.12.2, TRAVEL AUTHORIZATION REQUESTS (TAR) for the Approval for Travel Consent to Purchase (CTP) Process.

Performance Work Statement PAGE B-4

Travel is included as a Not-to-Exceed (NTE) CLIN and price for cost estimation. Locations listed in

Table 6.1 either have regular scheduled meetings or a high probability of travel in the future.

The following abbreviations are used in this price schedule:

CAF Contract Access Fee

CLIN Contract Line Item Number

FFP Firm-Fixed-Price

LH Labor-Hour

NTE Not-to-Exceed

ODC Other Direct Cost

QTY Quantity

T&M Time-and-Materials

B.5 LABOR

B.5.1 LABOR OUTSIDE THE CONTINENTAL UNITED STATES (OCONUS)

OCONUS is defined as other than the 48 adjoining states plus the District of Columbia (D.C.).

The United States (U.S.) Department of State’s (DoS) Bureau of Administration, Office of

Allowances, publishes report indexes of living costs abroad, per-diem rate maximums, quarter’s allowances, hardship differentials, and danger pay allowances. The Department of State

Standardized Regulations (DSSR) is the controlling regulation for allowances and benefits available to all U.S. Government civilians assigned to foreign Top Secret security clearance

Contractor personnel assigned to foreign areas may receive the allowances and benefits detailed in

Section H but shall not receive allowance and benefits in excess of those identified in the DSSR.

Where costs are not specifically addressed in the DSSR, the Government will reimburse the contractor for all reasonable, allowable, and allocable costs in accordance with Federal Acquisition

Regulation (FAR) Part 31, Contract Cost Principles and Procedures, and other applicable agency-specific regulatory supplements. The Assisted Acquisition Services (AAS)

Contracting Officer (CO) with input from the Air Force Lifecycle Management Center Contracting

Officer’s Representative (AFLCMC/WVV COR) will determine if costs are reasonable, allowable, allocable and in accordance with the terms of the TO.

B.5.2 INDIRECT/MATERIAL HANDLING RATE

Costs incurred for Long-Distance Travel, ODCs, OCONUS Logistical Support and Materials and

Equipment may be burdened with the contractor’s indirect/material handling rate in accordance with the contractor’s disclosed practices, provided that the master contract does not prohibit the application of indirect rate(s) on these costs.

1. If no indirect/material handling rate is allowable in accordance with the contractor’s disclosed practices, no indirect/material handling charges shall be applied to or reimbursed on these costs.

Performance Work Statement PAGE B-5

2. If no rate is specified in the schedule of prices above, no indirect rate shall be applied to or reimbursed on these costs.

The indirect handling rate over the term of the TO shall not exceed the rate specified in the schedule of prices above.

Any contractor costs submitted under the Long-Distance Travel, ODC, OCONUS Logistical

Support, and Materials and Equipment CLINs—direct or indirect—beyond the indirect/material handling rates) reflected in the schedule of prices above, will be unallowable. Subsequently, invoices for contractor costs—direct or indirect—on the Long-Distance Travel, ODC, OCONUS

Logistical Support, and Materials and Equipment CLINs, beyond the indirect/material handling rates reflected in the schedule of prices above, will be rejected as unallowable.

B.5.3 DIRECT LABOR RATES

Fully burdened rates for all labor categories will be established at the task order level. No additional indirect rates (e.g., OH, G&A, profit, material and handling charges, etc.) shall be added to the approved burdened labor rates when invoiced.

Note: Any labor categories included in the vendor's price proposal which are not included in their master contract, e.g.: Engineer, shall be listed in a crosswalk of its labor categories.

B.5.4 TIME-AND-MATERIALS (T&M) LABOR MIX AND LEVEL OF EFFORT

The labor mix and level of effort specified in the contractor’s proposal and incorporated into this

TO are for estimation purposes. The contractor may reallocate, with prior written approval of the

Assisted Acquisition Services AFLCMC/WVV COR, the number of hours by labor category, within each labor CLIN as needed to effectively manage the project, provided the total funded labor cost and total hours are not exceeded. The reallocation of hours across CLINs requires approval in advance by the AAS CO. Any additional labor categories not originally proposed or increases to total hours or increases to ceilings required during performance must be approved by the AAS CO and added to the TO by modification.

B.5.4.1 The Government anticipates the Contractor will require a level of effort (LOE) as identified in the Contractor’s Pricing Worksheet. The Pricing Worksheet delineates estimated manhours and labor categories applicable to this requirement. The Government considers 2080 hours (including federal holidays) as full time equivalent (FTE) for Contractor personnel.

In the event this task order is awarded under a GSA GWAC the offeror shall use their GSA master contract labor categories and propose labor rates, as applicable.

NOTE: If the offeror desires or chooses to propose alternative solutions, the offeror must provide the rationale explaining why they chose to deviate from the proposed mix (labor category and hours) so that it is clear that they understand the requirement. Further, for any labor category the offeror

Performance Work Statement PAGE B-6 deems to be non-exempt to the Service Contract Act, the offeror shall annotate that chosen category as non-exempt and provide rationale.

B.5.4.2 Overtime: No overtime will be authorized as a result of this order unless for any labor category the offeror deems to be non-exempt to the Service Contract Act and annotates that chosen category as non-exempt and provides rationale which is then approved by the Government.

B.5.5 ACCOUNTING FOR SERVICE CONTRACT REPORTING

Costs associated with Accounting for Service Contract Reporting are covered in the CLINs shown relate to this TO only ,as the costs associated with complying with this mandatory contract requirement are considered part of the contractor's general overhead or indirect costs of doing business with the Government. These costs are allocated across all applicable CLINs of the contract and are not typically broken out into a separate, directly funded CLIN

B.5.6 CONTRACTOR MANPOWER REPORTING

The Contractor shall ensure ALL Contractor labor hours (including subContractor labor hours) required for the performance of services provided under this task order are reported via a secure data collection site. The Contractor (and all subContractors providing direct labor under this task order) shall report complete and accurate data for the labor executed during the period of performance during each Government fiscal year (FY), which runs from October 1 to September 30. The

Contractor shall input the data into the appropriate eCMRA reporting tool, which can be accessed via a secure web site at http://www.ecmra.mil/. There are four separate eCMRA tools: Army, USAF, Navy and All Other Defense Components. The appropriate eCMRA reporting tool to use is determined by the requiring activity being supported. While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year. The Contractor shall completely fill in all required data fields. The required information includes:

(1) Contract Number;

(2) Fiscal Year (FY that the work was performed);

(3) Task Order Number;

(4) Requiring Activity Unit Identification Code;

(5) Command (Command of the Requiring Activity that would be performing the mission if not for the Contractor);

(6) Contractor Name;

(7) Total Invoiced Amount (the total dollar amount invoiced during the fiscal year, at the Task

Order level. This is the responsibility of the Contractor);

(8) Questions about Contract Performance (Contractors: Indicate if the task order includes the above services);

(9) Government Supervision (Are the Contractor personnel subject to relatively continuous supervision and control by a Government employee or officer);

(10) Government’s Tools and Equipment (Does the Government furnish the principal tools and equipment needed for task order performance);

(11) Government Facility (Are some or all of the Contractor employees provided with a workspace in a Government facility for use on a regular basis);

Performance Work Statement PAGE B-7

(12) Contracting Officer (First Name, Last Name, Phone Number, and Email);

(13) COR/COTR (First Name, Last Name, Phone Number, and Email);

(14) Contractor (First Name, Last Name, Phone Number, and Email);

(15) Location Information (Federal Supply Code (FSC), City of Installation or Services, State, Zip, and Country);

(16) Direct Labor Hours; (17) Direct Labor Dollars;

(18) Fund Cite.

Contractors may direct technical questions to the eCMRA help desk at dodcmra@pentagon.af.mil.

B.6 INCREMENTAL FUNDING

B.6.1 INCREMENTAL FUNDING LIMITATION OF GOVERNMENT’S OBLIGATION

Incremental Funding for Labor CLINs 0001 through 0040 will be allotted, upon award, and will be available for payment by the Government. Additional incremental funding for these CLINs may be allotted and available for payment by the Government as the funds become available. The estimated period of performance covered by the allotments for the mandatory CLINs is for five (5) years, or sixty (60) months, from the time of award, unless otherwise noted in Section B. The TO may be modified to add funds incrementally up to the maximum of $TBD over the performance period of this TO. In the event the full six-month Extension of Services, value TBD, is exercised, IAW FAR clause 52.217-8 the total Task Order value will be $TBD.

These allotments constitute the estimated cost for the purpose of Federal Acquisition Regulation

(FAR) Clause 52.232-22, Limitation of Funds, which applies to this TO on a CLIN-by-CLIN basis.

B.7 TRANSITION TO ALTERNATE CONTRACT TYPE

Over the course of performance, circumstances may make different contract types more appropriate for certain CLINs or Tasks than used at TO award. When it is appropriate to do so, the Government intends to transition suitable cost-reimbursement, T&M, or LH contract-type requirements to FFP contract type that transfers the risk to the contractor in accordance with FAR 16.103(c).

B.8 ANCILLARY SUPPORT

The ancillary support to be performed in this TO is defined in Section C.

[END SECTION B]

SECTION C – PERFORMANCE WORK STATEMENT

Performance Work Statement PAGE C-1

Template Version 06/05/2025

C. 1 BACKGROUND

The Air Force (AF) Executive Aircraft Division (EAD) consists of four branches; Presidential, Very

Important Person Special Air Mission (VIPSAM), Special Duty and E-4B National Airborne

Operations Center (NOAC). Each branch has mission requirements to provide Information

Technology (IT), Information Assurance (IA), and Mission Assurance (MA) insertions onto

Commercial Derivative Aircraft (CDA) meeting technology currency, emerging technologies, implementation of cybersecurity management programs, provide sustainment due to aging aircraft technologies and provide solutions through the acquisition process. EAD provides support to the following platforms:

• VC-25A/B, C-32, C-37, C-40, E-4B, RC-26, C-12, C-21, Survivable Airborne Operations

Center (SAOC), Foreign Military Sales (FMS) programs, and any new programs that get added to the EAD portfolio

C.1.1 PURPOSE

The Air Force Materiel Command (AFMC) Executive Aircraft Division (EAD), specifically the

Presidential and Executive Airlift Directorate, manages the government's fleet of aircraft used for transporting high-ranking officials, including the President. This includes the well-known Air Force

One (VC-25A), the National Airborne Command Post (E-4B), as well as other aircraft like the C-

32, C-40, C-37, C-21, and C-12. The division focuses on sustaining and improving support for these aircraft to ensure reliable transportation for senior government leaders.

The division manages the entire lifecycle of these aircraft, from acquisition and maintenance to upgrades and eventual retirement. The specific platforms include the VC-25A (Air Force One), the

E-4B (National Airborne Command Post), and various other smaller aircraft like the C-32, C40, C-

37, C-21, and C-12.

The key responsibilities of the EAD include providing transportation for senior leaders, ensuring the reliability and availability of these aircraft, and managing contractor logistics support. In essence, the Executive Aircraft Division is responsible for ensuring the safe, reliable, and efficient transportation of high-ranking government officials, with a particular focus on the critical role of presidential airlift.

C.1.2 AGENCY MISSION

The AFLCMC is responsible for managing the Air Force's aircraft lifecycle, including acquisition, sustainment, and modernization. Within AFLCMC, the Presidential and Executive Airlift

Directorate focuses on the Air Force's fleet of executive aircraft.

The Executive Aircraft Division (EAD), under the command of the Air Force Life Cycle

Management Center (AFLCMC) at Tinker Air Force Base, is responsible for managing and supporting aircraft that are based on commercial designs, like the C-37B, and is also responsible for maintaining and modifying these aircraft. The EAD acquires and sustains a variety of commercial

Performance Work Statement PAGE C-2 derivative aircraft, through which the Presidential and Executive Airlift Directorate focuses on the

Air Force's fleet of executive aircraft, including those used by senior White House, U.S. State

Department, and U.S. Department of Defense officials and is responsible for maintaining and modifying these aircraft to meet specific military needs.

The EAD provides logistical support, including maintenance, supply, personnel, and deployments, for aircraft like the RC-26, which is used for aerial surveillance and reconnaissance and collaborates with organizations like the 76th Aircraft Maintenance Group, which is home to the

568th Aircraft Maintenance and Support Group (AMXS), the first Military Repair Station certified to work on commercial derivative aircraft.

C.2 SCOPE

The EAD has mission requirements for IT/IA/MA and information systems security improvements to CDA and other ground/airborne systems involving secure systems engineering. The Contractor shall support the EAD by providing technical research and analysis to fulfill mission requirements.

EAD requires professional services to support the aircraft platform in this Non-Personal Services task order. The primary Contractor work locations for day-to-day support will be within the EAD based at Tinker Air Force Base, Oklahoma; however, travel to support mission needs at other locations may be required. The only OCONUS locations currently authorized for travel and

Contractor performance are Belgium, Japan, and Germany. All other OCONUS location travel requests must be sent to GSA for scope review before submitting a CTP.

All labor performed by the Contractor pursuant to this PWS shall cover all requirements listed within PWS Section C.4 - OBJECTIVES (PWS Section 2.0 Program Objectives/Description of

Work) and defined in PWS Section C.5 - TASKS (PWS Section 4.0 Requirements/Specific

Tasks), including the task deliverables, known and unknown, stated in PWS Section F.3 TASK

ORDER (TO) SCHEDULE AND MILESTONE DATES (PWS Section 5.0 Deliverables/Reports).

The services provided by the Contractor are required to meet the EAD mission needs, objectives, and tasks.

It is projected that, as the aircraft in EAD’s portfolio continue to age, such as the VC-25A and E-

4B fleets, there will be an increase in requirements executed under this task order in order for EAD to meet its mission to keep the aircraft operational for the user community. Maximizing aircraft availability is key to the EAD mission. Sustainment challenges for these critical assets, coupled with evolving mission needs and administration changes, necessitate the requirements placed on this task order to ensure continued, uninterrupted support for the Presidential and other EAD fleet missions. Additionally, the C-37 Recapitalization Program requirement for EAD to execute is projected to occur during this task order’s Period of Performance (PoP).

Projected requirement increases on this task order vary yearly due to each EAD fleet for EAD’s approved requirements for their respective aircraft modernization through modification programs/sustainment efforts requiring IT/IA/MA deliverables. Requirements on this task order are for deliverables to comply with upcoming Federal Aviation Administration mandates for the

Performance Work Statement PAGE C-3

National Airspace, to address aircraft obsolescence issues, and to comply with required statutory/regulatory requirements, as determined by statute and DoD/USAF leadership, for those

EAD programs.

Program Lifecycle Management Framework. EAD utilizes a structured approach to manage requirements, development, integration, transition, sustainment, and oversight activities across the program lifecycle.

C.3 INFORMATION TECHNOLOGY (IT)/NETWORK ENVIRONMENT

The contractor shall provide updates to compliance status and documentation, infrastructure support, software maintenance and support, user support, incident response, and hosting environment support. The contractor shall maintain compliance with Department of Defense (DoD)

Risk Management Framework (RMF) to retain the system’s Authority to Operate (ATO):

efforts include recurring system vulnerability and maintenance patching, maintenance of Security

Technical Implementation Guide (STIG) / Security Requirements Guide (SRG) compliance, and continuous monitoring of the system for security threats and newly discovered vulnerabilities.

Contractor shall support security roles to include compliance with applicable policies, procedures, and directives; assist in meeting security requirements for the system and its components; assist in the day-to-day operations of the system and its operational availability to support the mission.

Contractor shall maintain security staff in accordance with DoD 8570 at Information Assurance

Technical (IAT) Level 2 or higher. Information about the system and its operational status shall be maintained and reported to DoD/Air Force authoritative sources, to include National Defense

Authorization Act (NDAA) compliance and maintenance of system records in Information

Technology Investment Portfolio Suite (ITIPS) and Enterprise Mission Assurance Support Service

(eMASS) systems.

The Contractor shall coordinate with Defense Information Systems Agency (DISA) and the appropriate DoD network approval authorities to obtain required connection approvals, including submission of required documentation for system connection, cybersecurity validation, and interoperability certification, as applicable.

C.4 OBJECTIVE

The EAD requires subject matter and functional area expertise in the following objective areas:

● Cybersecurity Requirements

● Airborne Systems IT/IA/MA Mission Requirements

● IT/IA/MA Capability Gaps and Requirements

● Ground Systems Mission Requirements

● Alternatives for Mission Requirements

● Development and Assessment of IT/IA/MA Requirements

● Assessment of Impacts on IT/IA/MA Technology

● Secure Data Management Systems / PLMF

● Assessment of Capabilities in Real-World Environments

● Conference Planning and Meeting Initiatives

Performance Work Statement PAGE C-4

To meet these requirements, the Contractor will provide the EAD specialized and unique backgrounds of staff, which will enable the division to meet worldwide IT/IA/MA challenges and missions. The Contractor shall be ready to provide support across several projects or tasks, at unclassified through Top Secret, Sensitive Compartmented Information (SCI), and potentially

Special Access Programs (SAP) to effectively support task deliverables without extensive ramp up time or retraining. Personnel working these requirements are required to access the SCIFs identified in Attachment 7. These requirements are not limited to mission planning, nuclear command and control actions and Presidential support actions for EAD.

As documented in Attachment 6, the potential Task Deliverables include 1, 2, 3, 5, 6, 7, 9, 11, 14, 20, 21, 22, 27, 30, 41, 43, 44, 45, 47 and 55. These deliverables require the Contractor appropriate access for the use of program information documentation and are sourced from products classified at the SCI or SAP classification levels to include vulnerabilities, threats, capability gaps in order to provide analytical support and technical research analysis.

C.5 TASKS This is a commercial task order issued in accordance with FAR Part 16.5.

This is a hybrid FFP+T&M Type commercial task order issued in accordance with FAR Part 16.5.

C.5.1 TASK 1 – Provide Project Management

The contractor shall provide project management support under this TO. This includes the management and oversight of all activities performed by contractor personnel, including subcontractors, to satisfy the requirements identified in this Performance Work Statement (PWS).

C.5.2 TASK 2 – Cybersecurity Requirements

C.5.2.1 SUBTASK 1

Cybersecurity requires programmatic actions and strategies to evolve to a future norm of integrated planning, operations and execution. The Contractor shall conduct research and analysis to assist the

AF EAD in its assessment of priorities and strategies for achieving strategic planning, interoperability, and secure architectures in its fielding of IT/IA/MA capabilities that satisfy specified mission requirements for command, control, communications, computers and intelligence

(C4I).

C.5.2.2 SUBTASK 2

To assess aircraft system compliance with policies and interoperability, the Contractor shall conduct technical research and analysis to support recommendations for the application of leading-edge technology, existing networks, reduce vulnerabilities, and increase efficiency to mitigate aircraft operational capability gaps. The Contractor shall provide recommendations for the development of a Department of Defense (DoD) IT/IA/MA-compliant architecture framework that incorporates

Network Centric Enterprise Services and complies with the component of the Department of

Performance Work Statement PAGE C-5

Defense Information Network (DODIN) architecture (Deliverable 1: Technical Analysis and

Deliverable 2: Technology Assessment).

C.5.2.3 SUBTASK 3

The Contractor shall conduct technical research, analysis, and recommendations for existing and emerging Assessment and Authorization (A&A) activities for the USAF EAD to certify and accredit secure airborne and ground systems, information systems, and special-purpose airborne and ground systems. The Contractor shall provide cyber risk analysis for system-level components of weapons systems. It shall determine the scope of information necessary to complete analysis, determine system attributes and data requirements, review architectural documentation, block wiring diagrams, system interface analysis, hardware and software information and configurations, technical analysis, mission information, mission essential subsystem, and develop Assessment and Authorization packages IAW

DoDI 8510.01 Risk Management Framework (RMF) for DoD Systems. The Contractor shall determine maturity and extent of data available and able to be collected, locate information sources, and support system information package development. Cyber risk prioritization may be accomplished with Government participation to develop and deliver the system package. (Deliverable 3:

Assessment and Authorization Analysis).

C.5.2.4 SUBTASK 4

The Contractor shall design and evaluate test plans for USAF systems to include aircraft or Internet

Protocol based network systems. The Contractor shall utilize a proven assessment methodology for evaluating weapons systems to evaluate complex system-of-systems components, published academic articles relating to aviation cyber security, prepare reports, establish access to systems integration laboratories (SIL) and incorporate rigor associated with formal test and evaluation for assessing AF weapons systems that will be reflected in pre and post-test reports. Test planning will require Government approval of proposed method of test within test plans prior to execution.

(Deliverable 4: Test Plan and Assessment).

C.5.2.5 SUBTASK 5

The Contractor shall provide onsite assessment of USAF weapons systems and associated components. They shall analyze avionics systems and weapons systems components’ firmware and software, identify vulnerabilities in avionics systems and weapons systems components’ firmware, software and protocols, determine access vectors for potential targeting of avionics systems and weapons systems components, develop proof-of-concept demonstrations for identified vulnerabilities, and identify means to non-cooperatively introduced malware and counterfeit firmware and software into avionics systems and weapons systems components. The results shall be compiled into a Cyber Vulnerability Performance Assessment. (Deliverable: 5 Vulnerability

Assessment).

Performance Work Statement PAGE C-6

C.5.2.6 SUBTASK 6

The Contractor shall: evaluate risks to EAD weapons systems and potential impacts to the EAD mission for identified vulnerabilities, formally classify vulnerabilities; perform risk analysis on vulnerabilities for prioritization; provide risk rating for identified vulnerabilities considering mission impact and characterization of vulnerabilities; and provide formal mitigation recommendations for addressing vulnerabilities trends in EAD weapons systems that may have strategic implications across multiple platforms; and deliver these results in a risk analysis. (Deliverable 6: Risk Analysis).

C.5.2.7 SUBTASK 7

As new technologies and capabilities are developed, the Contractor shall draft analysis for survivability and threats to EAD platform systems information networks and databases that will enable EAD to develop assessments, evaluations, and residual risk analysis for inclusion in the associated DoD A&A packages (Deliverable 7: Technical Analysis for Integrating IA/MA into

Command, Control, Communications, Computers, Intelligence, Surveillance, and Reconnaissance

(C4ISR)).

C.5.2.8 SUBTASK 8

The Contractor shall conduct assessments related to the technical, operational, and scheduling aspects of strategic planning efforts. The Contractor shall conduct technical analyses of tools, techniques, and procedures to capture the state of commercial and military technology, aerospace operations, and infrastructure. Based on this technical analysis, the Contractor shall develop recommendations for Transformation Plans and Plans of Action and Milestones (POA&M) associated with cybersecurity measures on the aircraft. (Deliverable 8: Recommendations for

Transformation Plans and Plans of Action and Milestones).

C.5.2.9 SUBTASK 9

The Contractor shall provide technical analyses for capability-based planning processes and other strategic planning efforts through architecture development, requirements analysis, capability analysis, technical and resource evaluation of alternatives, and examination of key enabling technologies consistent with other agencies and commands (Deliverable 9:

Capabilities/Requirements Analysis).

C.5.2.10 SUBTASK 10

The Contractor shall provide analytic techniques and models for EAD’s planning processes that analyze the Presidential, Special Air Mission, Special Duty, E-4B NAOC platform’s objectives of seamless airborne and ground communications, security priorities, and a strategy for achieving those objectives (Deliverable 10: Network Modeling of Fleet).

Performance Work Statement PAGE C-7

C.5.2.11 SUBTASK 11

The Contractor shall develop recommendations for Concepts of Operations (CONOPSs), and for

Headquarters (HQ) DoD planning and requirements structure (Deliverable 11: CONOPS and

Requirements Structure Recommendations).

C.5.2.12 SUBTASK 12

The Contractor shall perform technical assessments, threat assessments, and critical infrastructure protection analyses across EAD. The Contractor shall develop a system or infrastructure risk assessment methodology that provides a qualitative assessment of IT/IA/MA related actions, results, and related metrics (Deliverable 12: Risk Assessment Methodology).

C.5.3 TASK 3 – Compliance of Airborne Systems to Meet IT/IA/MA Mission Requirement

C.5.3.1 SUBTASK 1

The Contractor shall conduct IT/IA/MA technical research and analysis and shall identify requirements for airborne systems and modifications to CDA to assist EAD in complying with CDA and stakeholder requirements (Deliverable 13: Recommendations for Airborne IT/IA/MA

Prioritization).

C.5.3.2 SUBTASK 2

The Contractor shall analyze existing and evolving DoD policies to identify IT/IA/MA technical shortfalls that emerge during the development of secure airborne systems. The Contractor shall analyze information gathered from the Airborne Security Plan and report the impacts identified on specific systems to AF EAD branches and weapon systems and provide recommendations on findings. (Deliverable 14: Airborne Security Plan and Program Protection Plan).

C.5.3.3 SUBTASK 3

The Contractor shall analyze airborne system specifications, program success criteria, program exit criteria, system safety requirements, and Operational Test and Evaluation (OT&E) requirements against IT/IA/MA objectives (Deliverable 15: Objective Analysis for Airborne Systems). Based on the analysis, the Contractor shall develop recommendations for aligning new technologies, policies and procedures. (Deliverable 16: Airborne Policy and Procedure Assessment and

Recommendations).

C.5.3.4 SUBTASK 4

The Contractor shall conduct technical research and analysis to identify and test emerging technologies to identify the impact of technologies on programs for aircraft, training, and system modification. (Deliverable 17: Airborne Technology Impact Analysis).

Performance Work Statement PAGE C-8

C.5.3.5 SUBTASK 5

The Contractor shall perform technical assessments and deficiency analysis to integrate commercial system engineering drawings and specifications into EAD flight and maintenance manuals. The

Contractor shall ensure accurate and on-time technical orders (TOs) are delivered to the Government in an electronic format per Attachment 6 - Deliverables. The Contractor shall review and assess existing TOs and recommend changes required to integrate modifications or changes to the aircraft during maintenance or modification efforts. (Deliverable 18: T.O. Analysis and Recommendations) .

C.5.3.6 SUBTASK 6

Based on the prioritized requirements, the Contractor shall provide technical research, analysis, and recommendations regarding military Capability Requirements (CR)s, associated capability gaps, and other related data and to provide refined requirements and system-level performance attributes for materiel and non-materiel capability solutions. (Deliverable 19: Requirement Analysis).

C.5.4 TASK 4 – Analyze and Identify IT/IA/MA Capability Gaps and Requirements

C.5.4.1 SUBTASK 1

To support EAD’s response to IT/IA/MA capability gaps with CDA and other ground, airborne systems and platforms, the Contractor shall identify deficiencies, requirement shortfalls and recommend updates to requirements documents. (Deliverable 20: Capability Gap Analysis).

C.5.4.2 SUBTASK 2

The Contractor shall conduct technical analyses, including the development of requirements, test, and modification of CDA and other ground, airborne systems and platform systems, subsystems, and components. (Deliverable 21: CDA Feasibility).

C.5.4.3 SUBTASK 3

The Contractor shall provide support in addressing identified capability gaps through research and assessment of emerging technologies. The Contractor shall demonstrate prototype solutions of the forefront technologies. (Deliverable 22: Prototype Solution of Capability Gap ).

C.5.4.4 SUBTASK 4

The Contractor shall develop recommendations for the way ahead for modifications and development planning (including the development of databases) to identify and report impacts on the status of aircraft modifications (Deliverable 23: Modification and Development Planning

Recommendations and Deliverable 24: Databases).

Performance Work Statement PAGE C-9

C.5.4.5 SUBTASK 5

The Contractor shall provide technical analysis and recommendations focused on identifying, evaluating, and implementing actions to mitigate Diminishing Manufacturing Sources and Material

Shortages (DMSMS) events. The Contractor shall recommend to the Government options that identify solutions to resolve DMSMS when they occur to mitigate the risk of EAD part availability affecting mission readiness (including the development of databases). (Deliverable 25: DMSMS

Analysis Recommendations and Deliverable 26: DMSMS Case Management Databases).

C.5.4.6 SUBTASK 6

The Contractor shall provide engineering and operational analyses to evaluate system designs and analyze EAD and other ground, airborne systems and platform functionalities (e.g., communication systems, system-level requirements, emerging technologies, CDA, and other ground, airborne and platform systems modernization programs) and airborne systems risks. (Deliverable 27: System

Design, Functionality, and Risk Assessment).

C.5.4.7 SUBTASK 7

The Contractor shall conduct technical analyses of requirements definition, development, production, test, modification, and sustainment of EAD and other ground, airborne and platform systems modernization programs. (Deliverable 28: Analysis of Modernization Programs).

C.5.4.8 SUBTASK 8

The Contractor shall provide technical analysis, assessments, identification, and recommendations for potential Doctrine, Organization, Training, Materiel, Leadership and Education, Personnel, and

Facilities (DOTMLPF) approaches to mitigating capability gaps to assist EAD in meeting requirements. (Deliverable 29: DOTMLPF Analysis).

C.5.4.9 SUBTASK 9

The Contractor shall provide technical research, analysis, and recommendations in developing short-and long-term strategic plans to include experimentation efforts, concept formulation, technology identification, technology insertion, technology transition, and additive manufacturing enhancing the ability of EAD to proactively identify solutions to real and potential issues. (Deliverable 30:

Strategic Plan Recommendations).

C.5.5 TASK 5 – Compliance of Ground Systems to Meet Mission Requirements

C.5.5.1 SUBTASK 1

The Contractor shall conduct technical research, analysis and develop recommendations to identify requirements specific to individual ground systems ensuring EAD’s compliance with both newly

Performance Work Statement PAGE C-10 developed ground systems and modifications to existing ground systems with EAD and stakeholder requirements. (Deliverable 31: Requirements Recommendations for Ground Systems).

C.5.5.2 SUBTASK 2

The Contractor shall analyze existing and evolving DoD IT/IA/MA policies to identify shortfalls related to technical issues that will emerge during the development of secure ground systems.

(Deliverable 32: Ground Systems Policy Gap Analysis).

C.5.5.3 SUBTASK 3

The Contractor shall analyze ground system specifications, program success criteria, program exit criteria, system safety requirements, and Operation Test and Evaluation (OT&E) requirements to ensure that objectives are met. (Deliverable 33: Objective Analysis for Ground Systems). Based on the results of the analysis, the Contractor shall develop recommendations for aligning new technologies, policies and procedures. (Deliverable 34: Ground Policy and Procedure Assessment and Recommendations).

C.5.5.4 SUBTASK 4

The Contractor shall perform technical research and analysis to identify and test emerging technologies to support platform training and ground modifications. (Deliverable 35: Ground

System Technology Impact Analysis).

C.5.5.5 SUBTASK 5

Based on the recommended requirements priorities, the Contractor shall provide technical research, analysis, and recommendations regarding military Capability Requirements (CR)s, associated capability gaps, and other related data and to provide refined requirements and system-level performance attributes for materiel and non-materiel capability solutions. (Deliverable 36:

Requirement Analysis).

C.5.5.6 SUBTASK 6

The Contractor shall conduct research to provide analysis, courseware, and/or systems ensuring

EAD’s ability to meet its training requirement for its aircraft and/or related ground systems.

(Deliverable 37: Training Materials).

C.5.6 TASK 6 – Detailed and Viable Alternatives for Mission Requirements

C.5.6.1 SUBTASK 1

The Contractor shall conduct technical analysis, technology studies, analyses of alternatives (AoAs), and feasibility analysis to ensure that EAD can evaluate operational effectiveness of platform systems to meet mission capabilities. The Contractor shall draft a study plan that shall specify

Performance Work Statement PAGE C-11 assessment actions, timetables, and deliverables for an AoA and shall then coordinate the analysis through the appropriate organizations for approval. (Deliverable 38: Analysis of Alternatives).

C.5.6.2 SUBTASK 2

The Contractor shall draft Technology Plans that should include EAD platform systems technology and capabilities (Deliverable 39: Technology Plan). The Contractor shall draft Technology

Roadmaps that include a description of USAF EAD platform systems technology, capabilities, desired outcome, and schedule for deployment. (Deliverable 40: Technology Roadmap).

C.5.6.3 SUBTASK 3

The Contractor shall develop or arrange for briefings on selected advance technologies and their impact on EAD platform systems. (Deliverable 41: Advance Technology Presentation). The

Contractor shall draft summary analysis on selected advance technologies and their impact on EAD platform systems, including a risk analysis of potential systems and subsystems (Deliverable 42:

Advance Technology Analysis).

C.5.7 TASK 7 – Development and Assessment of IT/IA/MA Requirements

C.5.7.1 SUBTASK 1

The Contractor shall conduct technical research and analysis, and provide recommendations for the development of mission needs, capability acquisition procedures, and requirements documents. The

Contractor shall develop. .capability-based analysis, to include recommendations to. .Initial

Capabilities Documents (ICDs), Capability Development Documents (CDDs), and Capability

Production Documents (CPDs) and associated briefings (e.g., Requirements Strategy Review

(RSR)). (Deliverable 43: Mission Need Analysis).

C.5.7.2 SUBTASK 2

The Contractor shall analyze requirements, constraints, and guidelines described in requirements documents and shall apply the results of the analysis to develop recommendations for the optimal method of incorporating IT/IA/MA into systems that merge voice, data, and video traffic over networks (Deliverable 44: IT/IA/MA Recommendations for Systems that Merge Voice, Data, and

Video Traffic).

C.5.8 TASK 8 – Assessments of Impacts on IT/IA/MA Technology

C.5.8.1 SUBTASK 1

The Contractor shall provide research and analysis pertaining to the development of applications and system interfaces that EAD will need to securely integrate evolving technologies into the platform systems. (Deliverable 45: Interface Control Document).

Performance Work Statement PAGE C-12

C.5.8.2 SUBTASK 2

The Contractor shall conduct technical research and analysis and develop recommendations for the development, execution, and documentation of large-scale Advanced Concept Technology

Demonstrations (ACTDs), simulations, experiments, and exercises. (Deliverable 46: ACTD

Analysis).

C.5.8.3 SUBTASK 3

The Contractor shall conduct technical research and analysis and shall develop recommendations pertaining to airborne and ground secure voice communications to those designated ground and airborne platforms that require common access to joint, global, and network-centric applications and tools. Additionally, the Contractor shall analyze new technologies, procedures, and policies identified in the ACTD experiments. (Deliverable 47: Component ACTD Analysis).

C.5.9 TASK 9 – Secure Data Management Systems/Program Lifecycle Management

Framework (PLMF)

C.5.9.1 SUBTASK 1

A Secure Data Management System for Program Lifecycle Management is utilized to provide

Lifecycle Sustainment Analysis for USAF EAD platforms.

C.5.9.2 SUBTASK 2

The Contractor shall provide technical reports, cloud infrastructure administration, and software deployments in support of PLMF to EAD program office affected by the releases. The Contractor shall provide IA process compliance and documentation required to operate the PLMF. In addition, the Contractor shall include generation, monitoring, and updates to all required IA documentation, compliance status data, infrastructure support, software maintenance and support, user support, incident response, and hosting environment support. The Contractor shall also maintain compliance with DoD RMF to retain the system’s Authority to Operate (ATO). These efforts include recurring system vulnerability and maintenance patching, maintenance of Security Technical

Implementation Guide (STIG)/Security Requirements Guide (SRG) compliance, and continuous monitoring of the system for security threats and newly discovered vulnerabilities. The Contractor supported security roles will include:

● Information System Security Manager (ISSM): ensures compliance with applicable policies, procedures, and directives

● Information System Security Officer (ISSO): assists in meeting security requirements for the system and its components

● IA Automated Information System (AIS) System Administrators (SAs): assist in the day to-day operation of the system and provide operational availability to support the mission

Performance Work Statement PAGE C-13

C.5.9.3 SUBTASK 3

The Contractor shall provide PLMF infrastructure support to ensure the system is stable, reliable, and up to date. The Contractor shall also provide full PLMF software development support including a Configuration Control Board (CCB) for reviewing and approving changes, regular code reviews scans and software testing. This task maintains separate testing, staging, and production environments to facilitate updates and software configuration management for the PLMF. The testing environment will be contractor funded. The Contractor shall also provide a PLMF help desk and user support. In addition, the Contractor shall provide an incident response capability to restore system functionality or otherwise address the incident condition as quickly as possible.

C.5.9.4 SUBTASK 4

The Contractor shall manage the Cloud Hosting of the PLMF in the Amazon Web Services (AWS)

GovCloud environment at Impact levels 5 (NIPR) and 6 (SIPR) with a cross domain solution from level 5 to 6. The Contractor will coordinate with a Tier 2 Cybersecurity Service Provider (CSSP) to ensure maintenance of a secure server in the cloud environment. The

Contractor shall coordinate across the EAD community to ensure cloud hosting costs are shared.

The Contractor shall provide an operational DevSecOps pipeline to support build, test, integration, scanning, deployment, and sustainment activities for all containerized applications. Pipelines shall leverage mature tools and processes referenced in existing program environments.

The Contractor shall maintain DoD 8570-compliant and credentialed cloud engineering and operations staff and ensure all containerized hosting environments meet applicable ATO requirements, RMF controls, and continuous monitoring expectations. Environments shall support access to NIPR, SIPR, JWICS, and associated eMASS systems as required.

C.5.9.5 SUBTASK 5

The Contractor shall provide fleet management, program management, module enhancements, and system administration for PLMF, including a detailed chronology of known or forecasted aircraft lifecycle events, along with comprehensive fleet management. The Contractor shall provide technical research, analysis, and recommendations to EAD to aid in developing a secure, capabilities-based planning process for identifying, interpreting, and leveraging near-, mid-, and long-term opportunities, as well as metrics for capturing existing, new, and emerging requirements.

From Day One the PLMF shall have the ability to:

• Sustain existing Service-Oriented Architecture (SOA) to enable seamless data exchange and integration with authoritative data sources, such as: Air Force/A4 Basing and Logistics

Analytics Data Environment (BLADE), Air Force Core Automated o Maintenance System (CAMS for Mobility - G081), Air Force Master Nuclear o Certification List (MNCL), Project Management Resource Tools Enterprise Analytics o (PMRT EA), Comprehensive Capital Analysis and Review (CCAR), and Boeing VECTOR.

Performance Work Statement PAGE C-14

• Provide a secure, fully…