Attachment No. 1.docx

AIR FORCE RESEARCH LABORATORY

INFORMATION DIRECTORATE

ROME, NEW YORK

STATEMENT OF WORK

FOR

VANISH

FAIR OPPORTUNITY PROPOSAL REQUEST

27 MARCH 2024

(SOLICITATION NUMBER FA8750-24-R-B002)

TABLE OF CONTENTS

1.0 OBJECTIVE

1.1 The objective of this effort is to provide the Air Force Research Laboratory Information Directorate (AFRL/RI) with the ability to rapidly respond to weapon information system development, acquisition, engineering, integration, and transition requirements; to improve cost efficiencies for supported Air Force (AF), Department of Defense (DoD), Intelligence Community (IC), and other United States Government (USG) customer organizations by exploring and generating novel capabilities and software services; and to foster the development, delivery, and protection of systems having Open System Architecture and corresponding components that will meet the needs of existing and future information systems customers.

2.0 SCOPE

2.1 The scope of this effort is to provide integrated information technology-based solutions, to include developmental engineering and ancillary engineering services, throughout the developmental cycle to rapidly respond to Government mission requirements and to ensure systems are technically mature for integration and information sharing; built on standards compliant, cloud-based architectures; and capable of being transitioned into operational environments with robust security and Information Assurance (IA). The scope covers the entire systems development life-cycle and includes information system analysis, design, development, prototyping, integration, short-term maintenance, modification, and delivery of capabilities; information system test capability analysis, fabrication, integration, test, and installation in support of operations. It further includes ancillary engineering services for Government planning, execution, systems integration activities to identify and resolve weapon and intelligence information system program, financial, data management, research and engineering, information assurance, and sustainability issues.

.3.0 BACKGROUND

3.1 AFRL/RI is a primary development and transition activity for information sharing and software re-use for AF, DoD, IC, and USG customers. As such, the work is developed/applied in an information intensive, collaborative environment that requires all stakeholders (e.g., program managers, researchers, data analysts, equipment developers, design engineers, and operational users) to rapidly assess information system capabilities, take proactive action to remedy information system design, operational, and assurance shortfalls, and acquire and support prototype equipment to meet real world contingencies and fast tempo military operations. To support their respective missions, AFRL/RI needs advanced information technology prototypes, agile software developmental approaches, operational and transition procedures, and technical support to satisfy customer requirements. Contractor personnel will be positioned at AFRL/RI and other Government installations as required.

4.0 TECHNICAL REQUIREMENTS. The Contractor shall accomplish the following:

4.1 Developmental Engineering.

4.1.1 Design, implement, and integrate advanced assured mission technologies and frameworks. Analyze legacy, transitioning and/or emerging technology and methods for information intelligence capabilities to address whether the current or anticipated needs of the weapon information systems can be fulfilled.

4.1.1.1 Conduct data collection and analysis, document analytical findings, and provide technical performance assessments for legacy, transitioning and/or emerging technologies. Investigate, prototype, and test actual and surrogate assured mission execution technologies and frameworks to facilitate the examination of weapon information systems in terms of improved interoperability and effective information sharing across different operational levels of expeditionary force and tactical domains.

4.1.1.2 Assess multiple transitioning and emerging capabilities and their ability to provide the enhanced situational awareness required for accurate weapons systems employment and impact awareness and/or automated Command and Control (C2) actions. Investigate technologies and techniques for intelligence cueing, threat recognition, and those supporting multi-domain information request formulation. Perform analytical and tradeoff studies designed to identify, assess, and select state of the art tools for improved electronic-attack detection and countermeasure posturing.

4.1.1.3 Design and develop testbeds that can simulate and stimulate operational scenarios and provide realistic environments for conducting demonstrations and experiments at DoD and other installations specified by the Government. Establish testbed situational awareness and C2 frameworks in which enabling technologies can be examined. Perform data collection and subsequent analyses to establish valid test results, documented in Test & Evaluation (T&E) Plans and T&E Reports as deliverables, which can be used as ground truth when testing the precision and recall of fusion/correlation engines and countermeasure posturing.

4.1.1.3.1 Design and develop tools that can be used to automate the assessment of enabling technologies. Tools shall contain built-in metrics to assess and rank against similar systems enabling technologies. Configure and test components during live exercises, capability demonstrations and technology experiments.

4.1.1.4 Investigate technologies and techniques for integrated C2, Intelligence, Surveillance, & Reconnaissance (ISR) and weapons for tactical systems. Investigate methods for effective integration of disparate C2 applications and services to achieve interoperability. Conduct assessments and trade-off studies to select the potentially most effective techniques for evaluation; establish common methods for transforming systems into services and integrating these services into federations; perform technology experimentation for integrated C2 and tactical systems; and develop scenarios, measures for evaluation, test planning, measurement capture techniques, experimentation execution, evaluation, and lessons learned.

4.1.1.4 Research, design, implement, and integrate systems and solutions that enable correlation, fusion, and extended utilization of intelligence data sources and products. These may include but are not limited to: Geospatial Intelligence (GEOINT), Signals Intelligence (SIGINT), Measurement and Signatures Intelligence (MASINT), Open-Source Intelligence (OSINT) and Human Intelligence (HUMINT).

4.1.2 System Engineering and Rapid Prototyping

4.1.2.1 Conduct research and analysis of emerging technologies and system designs. Document the pros and cons of each technology and system and their possible benefit to the weapon information systems that it is, or will be, employed on. Document the information learned and recommendations made. Utilize rapid prototyping and analytical modeling to develop proof-of-concept hardware and systems, T&E environments, and prototype systems to simulate such things as capabilities achieved and mission effectiveness.

4.1.2.2 Evaluate intelligence data exploitation capabilities using associated Government-Off-The-Shelf (GOTS) and Commercial-Off-The-Shelf (COTS) hardware and software for use in commercial and military applications. Conduct engineering analysis through trade studies and gap analyses in support of Tasking, Processing, Exploitation and Dissemination (TPED).

4.1.2.3 Engineer and develop technical solutions through use of state-of-the-art technologies including Machine Learning (ML) and Artificial Intelligence (AI), as related to the development of Geospatial Intelligence systems (Processing, Exploitation and Architecture) and other customer-specific capabilities for the U.S. Government.

4.1.2.4 Perform Cyber Threat Analysis, Mapping, and Prioritization. Document, evaluate, and recommend cyber readiness ways forward for weapon systems to include cybersecurity analysis for compliance and protection, cybersecurity software and tools in use, weapon system mission threads and cybersecurity mission assurance, and the latest technology of cybersecurity policies and processes evolving across the DoD enterprise.

4.1.2.5 Perform Model-Based Systems Engineering (MBSE) and Development. Engineer and develop technical solutions for National and Organizational security priorities using Model Driven Development (MDD), MBSE, and other emerging and existing model-based technologies. Current examples include the Joint Enterprise Modeling and Analytics (JEMA) and Brewlytics development platforms.

4.1.2.6 Develop a phased program plan enabling rapid component development and demonstration with continuous incremental capability improvement of the full prototype platform system.

4.1.2.6.1 Implement a program execution approach which includes continuous user community outreach, an implementation lifecycle, and collaboration amongst the Intelligence Community (IC) stakeholders.

4.1.2.6.1.1 The implementation lifecycle shall include maintaining a prioritized list of activities, identified risks, execute fallback plans, and track milestones and deliverables schedule.

4.1.3 Acquisition Engineering

4.1.3.1 Perform engineering activities for prototype systems that have been field integrated at customer sites but not transitioned. Prototype systems will be located in the National Capital Region, the island of Hawaii and other locations as specified by the Government.

4.2 Engineering/Technical Analysis.

4.2.1 Program Management Technical Support at AFRL/RI, Rome NY.

4.2.1.1 Provide project design, development, integration, test and evaluation, and transition of prototype capabilities related to information systems, architectures, and information assurance methods.

4.2.1.1.1 Develop and maintain prototype readiness for research efforts, to include installation of hardware and software in a relevant environment, applying industry and Government mandated security controls and documenting readiness level.

4.2.1.1.2 Organize, schedule, and participate in software development, access, assurance and software validation and verification (V&V) activities; provide technical inputs as well as develop and maintain software program schedules, plans, checklists, documentation and procedures; schedule, organize, and conduct technical documents risk reduction activity; provide corrective actions to software programs, performance improvement, and adaptive maintenance within the bounds of existing system specifications.

4.2.1.1.3 Review software documentation for adequacy, completeness, and consistency; implement a software development process; monitor software documentation delivery schedules; and identify software problems and improvements.

4.2.2 Perform developmental engineering activities for prototype systems that have been developed, integrated, but not yet transitioned in order to foster system communication, co-operation, and interoperability among organizations. Further develop, modify, and provide short term maintenance for established systems at customer sites to include system factory maintenance, system software operations, software tool set enhancements, modify existing databases to support common information services, and engineering and testing environment maintenance. Systems may be in the National Capital Region, AFRL, other DoD locations, and other locations as specified by the Government.

4.2.2.1 Research and develop cloud migration strategies to scale data services, tools, and advanced analytic processing. Ensure programs remain functional during the transition to cloud-based services. Additionally, implement open standards for IC-wide interoperability while taking into account data formatting, software versioning and control requirements.

4.2.2.2 Design and conduct the following levels of testing: (1) Periodic Development Test and Evaluation (DT&E) at contractor facilities, (2) Government Acceptance Testing (GAT)/in-plant acceptance testing (IPAT) prior to final upgrade delivery; and (3) testing required to accommodate Assessment and Authorization (A&A)/Certification Test and Evaluation (CT&E) testing and certification.

4.2.2.2.1 Develop Test Plans, to be executed in prototypes or representative environments, which address all requirements of a full Operational Test and Evaluation (OT&E). The Test Plan shall document the steps for conducting test procedures, compiling system problem reports during testing, tracking of system problem reports through resolution, compilation of and publication of test report and familiarize system testing personnel with the software.

4.2.2.3 Perform research and engineering in the areas of design analysis, functional evaluation, and transition of enterprise tools for the DoD, IC, and other Government agencies.

4.2.2.3.1 Design, develop and plan for implementation and integration of advanced assured mission technologies and frameworks.

4.2.2.3.2 Develop and update as required: maintain software development plans, test plans and procedures, system documentation, and documentation of information assurance compliance.

4.2.2.3.3 Document deficiencies in design and functionality of candidate software and recommend improvements in function, performance, and security.

4.2.2.4 Research, develop and improve visual programming environments for rapid design and development of analytic processes and software development for augmenting the capabilities of visual programming environments for the IC, DoD and Government communities.

4.2.2.5 Provide cybersecurity engineering for cloud-based systems focusing on security for system deployments within cloud-based environments such as Commercial Cloud Services (C2S) as well as others.

4.2.2.5.1 Analyze proposed cloud-based system design(s), and system security documentation for adherence to security practices in accordance with DoD and IC directives, National Institute of Standards and Technology (NIST) publications, and industry best practices to determine possible effects of system design vulnerabilities and weaknesses.

4.2.2.5.2 Provide security guidance and implementation recommendations for cloud-based system deployment scenarios, to include the transition of legacy systems into a cloud-based environment, engineering new systems to utilize cloud service offerings vs. virtualized system services, and a review of hybrid system deployments to securely utilize existing physical infrastructure in conjunction with cloud services.

4.2.2.5.3 Perform IA duties in compliance with Office of the Director of National Intelligence (ODNI) IC Directive (ICD) 503, NIST 800’s series publications and organizationally developed documents that include, but are not limited to, rigorous application of IA policies, assessment and implementation of technical vulnerability corrections, guidance on configuration management, and recommended remediation to security anomalies or integrity loopholes.

4.2.2.5.4 Perform systems engineering for the migration and transition of the National Geospatial-Intelligence Agency (NGA) operations to cloud-based services (e.g. Amazon Web Services (AWS), C2S, and other cloud platforms) to improve access, commonality, and analyst trade-craft.

4.3 Kick-Off Meeting

4.3.1 Participate in a Government-scheduled Kick-Off Meeting after Task Order award. The Government, with mutual input from the contractor, will schedule an initial Kickoff Meeting to be conducted within 45 days of Task Order award. Contractor personnel, including those of the prime and any subcontractor, responsible for management and technical effort also shall participate in subsequent Kick-Off Meetings prior to initiating new efforts under the Task Order. The purpose of Kick-Off Meetings is to (1) aid both the Government and contractor personnel in achieving a clear and mutual understanding of all requirements, and (2) identify and resolve potential problems. The contractor shall be prepared to discuss any requirements requiring clarification. The contractor shall prepare a tentative agenda for Kick-Off Meetings and submit this agenda to the COR.

4.4 Reports and Documentation

4.4.1 Continually determine the technical status of the effort and report the progress towards the accomplishment of task order requirements. (See CDRL, A001)

4.4.2 Continually determine the status of funding required for task order performance. (See CDRL, A002)

4.4.3 Conduct oral presentations at such times and places designated in the task order schedule. Provide the status of the technical progress made to date in performance of the task order. (See CDRL, A003)

4.4.4 Provide the following documentation:

4.4.4.1 Program Management Plan (PMP). Develop a PMP which describes the organization and execution of performance to meet all technical requirements. The PMP shall include, but not be limited to: schedule, technical performance, cost, deliverables, and work breakdown structure information. (See CDRL, A004)

4.4.4.2 Functional Requirements Document (FRD). Develop, update and deliver a FRD that translates and communicates Functional requirements and Key Performance indicators from functional needs of the operational field units. (See CDRL, A005)

4.4.4.3 Concept of Operations (CONOPS). Develop and document CONOPS for the prototyped systems and their capabilities as necessary for analyst interface, understanding, and operation. (See CDRL, A006)

4.4.4.4 System Architecture and Design Plan. Develop, update and deliver the System Architecture and Design Plan to show the planned architecture for each task. Identify all interfaces. Document the development process to be used and capture the intended functionality to be delivered. (See CDRL, A007)

4.4.4.5 Configuration Management Plan. Develop, update and deliver a Configuration Management Plan describing the way that configuration management will be conducted for each effort and monitoring configuration status. (See CDRL, A008)

4.4.4.6 Software Version Description. Develop, update and deliver a Software Version Description (SVD) document describing contents and versions of the delivered software and hardware. (See CDRL, A009)

4.4.4.7 Trade Study Report. Perform Trade-off analysis and technology trade studies to identify the most effective techniques and technologies applications to weapon systems and weapon systems research. (See CDRL, A010)

4.4.4.8 Prototype Test Plan and Report. Develop, update, and execute a Test and Evaluation Plan for the demonstration of the delivered products of this effort. Document the test results, procedural changes, comparison to metric standards, pertinent issues and exceptions, and functional capabilities. (See CDRL, A011)

4.4.4.9 User Guide. Develop and document a User Guide for all developed software. (See CDRL, A014)

4.4.4.10 Administrator’s Guide. Develop and document an Administrator’s Guide for all developed software. (See CDRL, A015)

4.4.5 Information Assurance (IA) Report. Develop IA documentation and related artifacts to support the Authorization and Accreditation of the requirements in this SOW, in accordance with DoDI 8500.2, Information Assurance Implementation (6 Feb 2003) and to ICD 503, as applicable. (See CDRL, A012)

4.4.6 Document all technical work accomplished and information gained during the performance of this contract. Include all pertinent observations, nature of problems, positive as well as negative results, and the design criteria results established, where applicable; procedures followed; process developed; “lessons learned”; integration and testing results; etc. The details of all technical work shall be documented to permit full understanding of the techniques and procedures used in evolving technology or processes developed. (See CDRL, A017)

4.4.7 Work Plans. Develop, update and maintain Work Plans as defined in paragraph 4.7. (See CDRL, A013)

4.5 Software and Hardware

4.5.1 Deliver all software and hardware developed, assembled, or acquired to the Government in accordance with the contract schedule and the following:

4.5.1.1 Deliver all software developed under this effort as source and object (executable) code. Include the commented source listings and source code. (See CDRL, A015)

4.5.1.2 Delivered software and hardware under this effort is to be completely maintainable and modifiable with no reliance on any non-delivered computer programs, hardware, or documentation other than those provided by the Government.

4.5.1.3 For all software and hardware purchased or licensed, arrangements shall be made for licensing and maintenance agreements to be transferred to the Government upon completion of this effort. (See CDRL, A015)

4.5.1.4 For any items purchased as contractor-acquired property during the reporting period, please document the following information within the status report: Item Name, Description, Quantity, Unit of Measure, Serial Number, Manufacturer CAGE Code, Mfr Part Number, Mfr Model Number, Date of Acquisition, and Unit Acquisition Cost. This information may be included as an Excel spreadsheet attachment to the status report. (See CDRL, A001).

4.6 Overseas Travel to OCONUS locations to be determined.

4.6.1 Comply with all Government foreign travel requirements as specified by this effort. Additional information and/or training maybe required by each country visited.

4.7 Work Plans (WP)

4.7.1 Perform the work required under this order in accordance with detailed performance information provided by the Government, in the form of a WP. WPs shall not constitute assignment of new work, shall not change the terms or conditions of this order, and shall not constitute a basis for any increase in the amount of fixed fee or extension to the period of performance. WPs shall provide the following information at a minimum:

4.7.1.1 Detailed performance information for work to be performed, cross referenced to the applicable Contract Line-Item Number (CLIN) and SOW paragraphs.

4.7.1.2 Government estimate of the level and duration of effort likely required to accomplish the WP.

4.7.1.3 Unique identifying number including the Government fiscal year and order in which issued (e.g., Work Plan 2025-01, Work Plan 2025-02).

4.7.1.4 Documentation required per Contract Data Requirements List. (See CDRL, A013)

4.7.2 Upon receipt of a WP from the Government, perform an analysis and provide implementation strategies to define possible and recommended approaches, potential resolutions, effort required, characterizations of various approaches and relationships to other ongoing efforts, advantages and disadvantages of approaches, schedule, risks and cost of alternative courses of action. Present results to the Government via a WP update, appropriately numbered to distinguish it from the WP issued by the COTR (e.g. Work Plan 2025-01-A, Work Plan 2025-02-A), for review, discussion, disposition, coordination and approval. Include testable performance requirements, deliverable items, documentation required, delivery schedule, and cost, as applicable. The Government will analyze the WP update to ensure the Contractor’s approach is commensurate with the SOW, the WP issued by the COTR, and the estimated level and duration of effort; notify the Contractor of any required changes; and, once acceptable, document the WP as final.

4.8.1 Work on this effort will require or allow Contractor access to Privacy Information. Content contained within the cloud services is subject to the Privacy Act. As such, the Contractor shall adhere to the Privacy Act, Title 5 of the U.S. Code, Section 552a, and applicable agency rules and regulations.

4.8.2 Work on this effort will require or allow Contractor access to Level 2 Public or Non-Controlled Unclassified Information (CUI). Content contained within the cloud services is subject to the Freedom of Information Act (FOIA). As such, the Contractor shall adhere to the FOIA regulations, and applicable agency rules and regulations. This level accommodates Non-CUI information categorizations based on CNSSI (Committee on National Security Systems) Instruction 1253 up to low confidentiality and moderate integrity (L-M-x).

4.8.3 Work on this effort will require or allow Contractor access to Level 4 Controlled Unclassified Information (CUI), including “Export Controlled,” and “For Official Use Only” data, and non-National Security Systems (NSSs). Content contained within the cloud services is subject to the Freedom of Information Act (FOIA). As such, the Contractor shall adhere to the FOIA regulations, and applicable agency rules and regulations. This level accommodates CUI information categorizations based on CNSSI (Committee on National Security Systems) Instruction 1253 up to moderate confidentiality and moderate integrity (M-M-x).

4.8.4 Work on this effort will require or allow Contractor access to Level 5: Higher Sensitivity Controlled Unclassified Information (CUI), Mission Critical Information, and National Security Systems (NSSs). This CUI requires a higher level of protection as deemed necessary by the information owner, public law, or other Government regulations, such as information related to unclassified NSSs. This level accommodates NSS and CUI information categorizations based on CNSSI (Committee on National Security Systems) Instruction 1253 up to moderate confidentiality and moderate integrity (M-M-x).

4.8.5 Work on this effort will require or allow Contractor access to Level 6: Classified Information up to SECRET which includes information that has been determined to be classified national security information or Restricted Data (RD). This impact level requires a higher level of protection and accommodates classified information categorizations up to moderate confidentiality and moderate integrity (M-M-x).

4.8.6 Work on this effort will require or allow Contractor access to classified information above SECRET which includes information that has been determined to be classified national security information or Restricted Data (RD). Use cloud services approved for the classification and information categorization in accordance with applicable DoD and Intelligence Community policies.

4.8.7 Data Ownership. All Government data, Government-related data, and metadata is and shall remain the exclusive property of the U.S. Government.

4.8.8 Disposition. Provide for the transition of data in commercially available, or open and non-proprietary format (and for permanent records, in accordance with disposition guidance issued by National Archives and Record Administration). The Cloud Service Provider (CSP) shall ensure that the Government retains access and download capability of all Government data, and Government-related data, on demand within one week of request, in an open format (e.g., ASCII, CSV, XML). “Open format” means platform independent, machine readable, and made available to the public without restrictions that would impede the re-use of that information.

4.8.9 Provide appropriate limitations and requirements regarding contractor and third-party access to, and use and disclosure of, Government data and Government-related data.

4.8.10 Support applicable inspection, audit, investigation, or other similar authorized activities specific to the relevant types of Government data and Government-related data, or specific to the type of cloud computing services being acquired. Ensure the CSP is able to supply the agency with audit trails, exception reports and transaction logs, if requested.

4.8.11 Support and cooperate with applicable system-wide search and access capabilities for inspections, audits, and investigations.

4.8.12 Coordinate with the COTR/COR to respond to any spillage occurring in connection with the cloud computing services being provided under this effort.

4.8.13 Store all Government data within the 50 states, the District of Columbia, or outlying areas of the United States, unless the Government data is physically located on DoD premises or the Contractor is otherwise authorized in writing by the Contracting Officer.

4.9 Safety Requirements.

4.9.1 Comply with all safety and health requirements necessary for the protection of personnel, facilities and equipment including, but not limited to, the Occupational Safety and Health Administration (OSHA) standards, while performing this contract at the Air Force Research Laboratory (AFRL), Rome Research Site (RRS), Rome NY. It is the contractor’s sole responsibility to make certain that all safety requirements are met.

4.9.1.1 Maintain a written safety program for compliance with the applicable OSHA standards, and make said program available for review by the Government upon request by the Contracting Officer.

4.9.1.2 In the event of a mishap, or a “near miss”, during the performance of this contract at AFRL RRS, notify the Contracting Officer or the DET 4 Safety Office in an expeditious manner. Written notification shall be provided to the Contracting Officer (who will forward a copy to the DET 4 Safety Office) within 72 hours and shall include the following information (Air Force Form 978 Supervisors Mishap Report may be used):

1. Contract, Contract number, Name and Title of Person(s) Reporting

1. Date, Time and exact location of accident/incident

1. Brief Narrative of accident/incident (events leading to accident/incident)

1. Cause of accident/incident (if known)

1. Type of injuries resulting from the accident/incident and estimated cost of accident/incident (material and labor to replace/repair)

1. Nomenclature of equipment involved in accident/incident

1. Personnel involved in accident/incident

1. Corrective Actions (taken or proposed)

1. Other pertinent information

4.9.2 AFRL RRS uses a Safety and Health Management System (SHMS) to implement and manage its safety programs. A SHMS is a systematic approach to managing safety and health activities by integrating occupational safety and health programs, policies, and objectives into organizational policies and procedures. Simply stated, a SHMS is a set of safety and health program components that interact in an organized way. An effective SHMS consists of five critical elements that apply safety and health management practices of employers who have been successful in protecting the safety and health of their employees. All contractors are required to familiarize themselves with the requirements of a SHMS. An example of a SHMS is OSHA’s Voluntary Protection Program (VPP). Detailed information on VPP is available at the OSHA website at http://www.osha.gov/dcsp/vpp/index.html. On-site contractors are required to attend the Local Conditions for Newcomers (Course 2) as part of in-processing at AFRL RRS.

4.10 Program Protection

4.10.1 Contractor employees during the performance of this effort may be required to have access to Critical Technology Elements (CTE), Enabling technologies, Critical Program Information (CPI) or other potential sensitive information. Contractor employees will be required to protect this information from disclosure to unauthorized personnel and companies.

4.10.1.1 Provide a security plan to comply with the requirements of protection for this sensitive information when requested by the Government COTR/COR. (See CDRL, A007)

4.10.1.2 Notify the Government immediately within 24hrs of all security incidents involving loss, compromise, or suspected compromise of CTE/CPI IAW DoDM 5200.01-V3, Enclosure 6. CTE/CPI involved in the incident shall be specifically identified in inquiry and investigation reports.

4.10.1.3 Employees shall be required to accomplish an initial Standard Form 424, “Research and Related Senior/Key Person Profile (Expanded)”. Provide an initial report of personnel working on the contract at time of award. Provide an updated SF 424 on an annual basis and be required to provide an updated list anytime new personnel join. (See CDRL, A008)

4.10.1.4 In the event a security risk is identified and the government has determined the security risk exceeds the acceptable threshold, the contractor will be notified and informed of the termination/decline of award. Government will be only required to provide a general statement of the reasoning due to government OPSEC measures.

4.10.2 If Controlled Unclassified Information (CUI) and associated Critical Information is involved in this effort, CUI shall be protected to prevent adversary collection and exploitation. Comply with DoDI 5200.48 CUI.

4.10.2.1 If requested by the Government COTR/COR, provide a security plan (or extract thereof) and any associated plans of action developed to satisfy the adequate security requirements of DFARS 252.204-7012, and in accordance with National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, “Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations” in effect at the time the solicitation is issued or as authorized by the contracting officer, to describe the contractor’s unclassified Information System(s)/network(s) where Covered Defense Information (CDI) is associated with the execution and performance of this contract and is processed, is stored, or transmitted. (See CDRL, A007)

4.10.2.2 If applicable, ensure that all personnel involved in this effort take CUI training through MyLearning https://lms-jets.cce.af.mil/moodle/ (if they have CAC) or through CDSE at https://securityawareness.usalearning.gov/cui/index.html.

4.10.3 Operations Security (OPSEC). In accordance with AFI 10-701, implement OPSEC measures, which shall include ensuring employees receive training and follow appropriate OPSEC measures during the performance of the contract. Implement OPSEC measures and must be an integral part of the daily activities.

4.10.3.1 If requested by the Government COTR/COR, develop and implement an OPSEC Standing Operating Procedure (SOP) for review and approval by the Government (COTR and AFRL/RIOF) in accordance with the CDRL. (See CDRL, A007)

4.10.3.2 OPSEC Training: This program requires that contractor personnel maintain OPSEC posture through training for all contract personnel involved in this effort. Ensure that employees complete Level I OPSEC training within thirty (30) calendar days of joining the project team. Employees must also complete annual OPSEC awareness training.