SaaS PWS RFI.pdf

CUI

CUI 1

Performance Work Statement (PWS) for Software as a Service (SaaS)

Process Owner: NIXPA Date: 11/06/2024 Revision:

This document provides a simplified explanation of how to execute specific programmatic processes, provides organizational points of contacts, and references applicable Air Force directives and guidance. This document does not supersede any government directive, pamphlet, or handbook. For specific guidance, individuals using this document should read and refer to the government references provided. The approved copy of this document resides electronically on SharePoint at https://usaf.dps.mil/sites/22327/Popular-Links/PAL.

DISTRIBUTION D. Distribution authorized to Department of Defense and U.S. DoD contractors only for ADMINISTRATIVE OR OPERATIONAL USE. March 10, 2022. Other requests for this document shall be referred to AFNWC /NIX Hill AFB, UT 84056-

WARNING: This document contains technical data whose export is restricted by the Arms Export Control Act (Title 22, U.S.C.

2751et seq.) or the Export Administration Act of 1979, as amended, Title 50, U.S.C., App.2401, et seq. Violation of these export-control laws is subject to severe criminal penalties. Dissemination of this document is controlled under DODD 5230.25.

DESTRUCTION NOTICE: For unclassified documents destroy by any method that will prevent disclosure of contents or reconstruction of the document.

CUI 2

Revision History

Revision Date Change Summary

- 11/06/2024 Initial Release Rev 1

CUI 3

Table of Contents

1.0 INTRODUCTION

1.1 Background

1.2 Purpose

1.3 Scope

1.4 Government Roles

1.4.1 Program Manager (PM)

1.4.2 Contracting Officer (CO)

1.4.3 COR

2.0 Performance Requirements

2.1 Key Personnel Positions

2.1.1 Team Composition and Operating Location

2.1.2 Team Participation

2.1.3 Travel

2.1.4 Labor Categories

2.2 Software Toolchain Management Services

2.2.1 Software Market Research

2.2.2 Software Toolchain Approval Package

2.2.3 Software Toolchain Procurement

2.2.4 Software Toolchain Maintenance

2.2.5 Software Toolchain License Transfer (In and Out)

2.2.6 Software Toolchain Management Support Services

2.3 Software

3.0 General Requirements

3.1 Contractor Program Management

3.1.1 Kick-Off Meeting

3.2 Scale Management

3.3 Business Relations

3.4 Financial Reporting

3.5 Personnel

3.6 Risk Management

3.7 Quality Control

3.8 Data Management

3.8.1 Electronic Data Interchange (EDI)

3.9 Security Requirements

3.9.1 CAC

3.9.2 Operations Security (OPSEC)

3.9.3 Controlled Unclassified Information

3.9.4 Non-Disclosure Agreements

3.9.5 Disseminating Scientific and Technical Information (STINFO)

3.10 Associate Contractor Agreements (ACAs)

4.0 Government Inspection

4.1 Services Summary

CUI 4

5.0 TABLE OF CONTRACT DATA REQUIREMENTS LIST

5.1 CLIN Structure

5.2 Surge CLIN Structure

ATTACHMENT 01

A1.1 CONTRACTOR NONDISCLOSURE AGREEMENT

ATTACHMENT 2

A2.1 Acronym List A2.2 Breakdown

CUI 5

1.0 INTRODUCTION

1.1 Background

The Air Force Nuclear Weapons Center (AFNWC) is providing crucial support to the Sentinel program by overseeing the development and architecture required to introduce new capabilities through diverse software procurement. This document outlines the priorities and roles essential to assisting AFNWC in swiftly deploying new capabilities in support of the warfighter

1.2 Purpose

The AFNWC Systems Directorate procures, develops, and sustains software applications supporting its nuclear deterrence mission. The goal of the AFNWC 's Information Technology (IT) Division (NIXPA) is to migrate the existing legacy software to a more evaluable architecture that can leverage the AFNWC cloud environments. This will bring capability to the war fighter faster, reduce procurement timelines, reduce program sustainment costs, and increase system reliability. AFNWC seeks to modernize the use and deployment of its current applications and leverage the advantages of cloud computing, Platform as a Service (PaaS), and Infrastructure as a Service (IaaS). Additionally, AFNWC plans to adopt continuous integration and continuous delivery pipelines to deploy software capability more quickly in support of AFNWC weapons system design reviews and business intelligence.

1.3 Scope

This Performance Work Statement (PWS) identifies the objectives for the AFNWC Software Toolchain Management Services. Currently, for FY22-FY23, the Software Team's software license buys have resulted in a current software baseline of over 700 software applications, 11,542 licenses for 1,000 current users on several networks.

Objectives include preparation of Software Approval Packages (SAP), software license procurement, and software license management. Software licenses will consist of Commercial Off the Shelf (COTS) and Government Off the Shelf (GOTS) software applications to support the AFNWC Systems Directorate.

The AFNWC Software Toolchain Management Services environment is also estimated to have a user base growing to over 1,000 users over the next five years and hosting well over 2,000 software applications. The AFNWC office is doing its best to plan for current and future growth necessary for this requirement.

1.4 Government Roles

There is a strong possibility that future growth will require additional software increases that will require potential modifications that may influence Other Direct Costs (ODC) Contract Line-Item Number (CLIN) established in the contract. Resolution is to increase ODC CLIN only to support software as a need for the AFNWC Program.

CUI 6

1.4.1 Program Manager (PM)

The PM provides primary program oversight and management of the contract. The PM ensures the Contracting Officer’s Representative (COR) is trained before performing any COR duties and supports the COR’s performance assessment activities. Additionally, the PM will also review contractor’s performance periodically.

1.4.2 Contracting Officer (CO)

The CO is the individual designated by the Air Force to direct and/or redirect the efforts of the Contractor or modify any of the items of this contract.

1.4.3 COR

The COR is the Government representative appointed by the CO responsible for monitoring, evaluating, and reporting contractor performance on all applicable contracts, or under this contract. The COR will interface with the customer, the contractor, Finance Management (FM), and the Program Management Office (PMO).

2.0 Performance Requirements

2.1 Key Personnel Positions

The contractor shall provide Key Personnel Positions (KPPs) designated in the Team Composition at the time of award. The specified skills for these positions are detailed in Labor Categories (LCAT) (see 2.1.3).

For non-KPP's, the contractor shall provide a notional staff list to meet the total quantity of Full Time Employees (FTE) articulated in Team Composition.

Note: The quantities listed represent a notional team, and the FTE quantity has been estimated by the US remnant. However, it is acceptable for the contractor to propose different options as needed.

2.1.1 Team Composition and Operating Location

The following team represents the core capabilities and competencies for the support of software license procurement and software license management services. The contractor may further segment the team as needed based on workload and direction from the Government.

• Currently, the Government Software team consists of:

• Software PM

• Configuration Managers (CM)

Several integration contractors whose primary responsibilities are to integrate the software onto AFNWC networks KPPs are included in the total FTE quantity sections below; the KPP FTE quantity is only represented in the number of hours expected. Offerors shall provide the number of FTE’s. Unless written approval is provided by the CO, the contractor will have a 28-day ramp up period prior to the start of the Period of Performance (POP).

CUI 7

FTE Expected ours per Year

Software Procurement Manager Lead 6,240

Software Procurement Manager 6,240

Software License Manager 6,240

This team will operate remotely using a government-issued Common Access Card (CAC) and Desktop Anywhere VPN set-up to access Software Team collaboration spaces. CAC cards will be provided, but the contractor will need to support their own laptops. Access to Government systems will be provided, or the Government will set up their accounts. Contractor will need access to Fences via a U-SHADE token, which will provide access to Jira and Confluence. The Government will help administer access needs. No other Government Furnished Equipment (GFE) will be provided.

2.1.2 Team Participation

The contractor shall identify one of the KPPs as the "Lead Program Manager," who shall be the interface between the Government and the KPPs associated with this contract. The "Lead Program Manager" shall report, at a minimum, on manning, leave, or any other absence of duty to the Government in a timely manner that shall not interrupt normal business. The contractor will be working remotely, not at Hill AFB. However, contractor personnel are expected to participate in team culture, including all virtual meetings as required to support the objectives of this PWS. For example, the Requirement Review Board (RRB) and Configuration Change Board (CCB) as they pertain to IT Requirements that lead to software license procurement and software license management, as well as other Software Team meetings as deemed necessary by AFNWC 's Software PMs. Contractor shall follow the deployment schedule for software delivering licenses one quarter prior to deployment.

The contractor shall participate, either in person or on Microsoft Teams, in the quarterly off-site Government Program Increment (GPI) to plan for the work schedule of license delivery. GPIs are typically held in person within the local area near Hill Air Force Base (HAFB).

2.1.3 Travel

Continental United States (CONUS) travel is anticipated for this effort. Travel shall be allowable only when it is essential to the performance of the tasks detailed in this PWS. Government-approved travel in support of this requirement shall be invoiced against the appropriate Contract Line-Item Number.

The COR shall approve all travel performed in support of this contract prior to the commencement of the travel. COR approval is also required for local travel expenses. Reimbursement for travel performed shall be in accordance with the Federal Travel Regulation (www.gsa.gov/federaltravelregulation).

CUI 8

Travel may include general and administrative expenses but shall not include profit. Contractor shall complete a Trip Report for each trip taken. Contractor is responsible for making their own travel and lodging arrangements as necessary to support the contract requirements.

2.1.4 Labor Categories

Prior to any travel, the Contractor shall submit a travel authorization request that includes (at a minimum) the following data for COR approval prior to incurring any costs (the Government may provide a travel authorization request template for use post-award) unless otherwise stated at the contract level: Contract Number; Name of Traveler; Dates; Origin and Destination; Organization to be visited; Purpose of Travel; Estimated Airfare; Estimated Lodging within regulatory limits; Estimated Per Diem; Estimated Ground Transportation; POV Use; Miscellaneous Costs; Contractor Lead PM signature.

The contractor shall invoice approved travel within ten (10) business days of final travel day/date.

The labor categories delineated below have a column indicating the needed level of security to participate in the project. The skills and tasks that are listed are a notional list that the Government feels are relevant to the project.

The contractor is welcome to propose different skill sets or solutions if needed.

CUI 9

FTE Desired Knowledge, Skills, & Experience Security Requirements

Software Procurement Manager Lead

• Extensive knowledge and understanding of software and technologies to purchase, track, and manage software licenses for a large organization

• Experience in providing consultation on the use of software intended to support on premise and cloud networks

• Excellent oral and written communication skills to help the Government craft messaging for higher leadership to include, at a minimum:

o Knowledge and experience creating PowerPoint presentations to brief in Program Management Reviews (PMRs) with program and stakeholder leadership

• Knowledge and ability to create and maintain reporting metrics to efficiently manage a software asset management metric reporting tool

• Knowledge and experience in creating and maintaining software procurement, integration, and implementation schedules

• Knowledge of development, engineering, and business software categories

• Strong analytical skills to assist with managing multiple detailed projects

• Excellent skills in building relationships with customers, stakeholders, and Subject Matter Experts (SME) to gather and report software and application information needed by the Government

• Significant experience working with software vendors to negotiate software purchase agreements and contracts

Controlled Unclassified Information (CUI)

CUI 10

FTE Desired Knowledge, Skills, & Experience Security Requirements

Software License Manager

• Extensive knowledge on software asset management and software asset management tools and technologies

• Extensive experience in software license inventories and “proof of license ownership” and “proof of license purchase”

• Extensive experience in managing support documentation for software license management, at a minimum includes, user manuals, purchase docs, supporting docs, User

• End License Agreements (UELA) etc.

Extensive knowledge on identifying unused or underutilized software licenses

FTE Anticipated Tasks

Software Procurement Manager (KPP)

• Software Market Research

• Generate the Software Capability Solutions technical report (see 2.2.1)

• Generate the Approval Package (see 2.2.2)

• Software Toolchain Procurement

• Contractor Lead/Point of Contact (POC)

Software License Manager (KPP)

• Manage and document all unit software licenses and proof of purchase

• Ensure software is used and reused in accordance with (IAW) license agreements

• Maintain Software Inventory

• Perform monthly and annual unit software inventory

• Track unit software licenses and their use

2.2 Software Toolchain Management Services

2.2.1 Software Market Research

The Software Toolchain team shall perform the necessary actions to support the existing and evolving Software Toolchain(s) in all environments (development, testing/staging, and production) to support Development, Security, Platform Enablement, and Business Operations. The contractor shall support an agile environment where the scope of work can and will change at any time as needed.

CUI 11

The Contractor shall conduct market research upon user request for what software suits their requirement. Once the Government Software PM has an approved software purchase requirement from the CCB, they will notify the Software Procurement Manager to identify Government capability needs. The Software Procurement Manager shall research and assess COTS solutions to meet those needs from a functional/enterprise and security standpoint.

Tasks include but are not limited to:

• The contractor shall interview users and conduct a Requirements Owner Interview (ROI) to identify Government requirements and research potential COTS solutions.

• The contractor shall prepare a Software Capability Solutions technical report Contract Data Requirements List (CDRL A001) upon identification of a COTS solution, or solutions within eight (8) days of Government's request. The report shall include a list of potential solutions that best meet the capability.

o The report shall include a Market Research Summary with an assessment of alternative solutions and support for any recommendations.

o The report shall note any COTS solution where the Air Force has an existing software licensing agreement in place (i.e., Enterprise Software Initiative, ESI.mil).

• The contractor shall use existing enterprise-level software licensing agreements that fulfill the identified need where it is advantageous to the Government.

2.2.2 Software Toolchain Approval Package

Upon request by the Procuring Contract Officer (PCO) or Government Software PMs, the contractor shall generate a Software Toolchain Approval Package (CDRL A002) within ten (10) business days from the date of request. The SAP will document the best COTS solution, based on discussions with the Government during the review of the initial potential solutions proposed in the Software Capabilities Solutions report. The SAP shall contain documentation to include, but not limited to, the following:

• License cost and structure based on installation into AFNWC 's environments

• Type of license issued by the software license vendor (e.g., floating, named, etc.)

• List of software features that meet Government team's objectives

• Features required that are exclusive to the selected solution, to include plug-ins or specialized features to meet the end user's objectives

• Recommended licensing package/product pricing model (if applicable) to include any gates required by vendors to achieve any bulk discounts

• Justification and verification on how the software meets security requirements for the intended networks and/or systems

CUI 12

• Identification of any prerequisite materials, support, and training needed to allow the software to be operational within the software environment

• An accurate quote for the entire software purchase

2.2.3 Software Toolchain Procurement

Upon written direction by the PCO, COR, or the Software PMs, the contractor shall purchase and acquire licenses for installation within five (5) business days from the date of written direction, via the SAP. Upon purchase, the contractor shall deliver to the Government copies of proof of purchase collaterals and license agreements for all licenses.

All software purchases shall follow US Code Title 10 Sections 2222, 2382, and 2867, AFI 63-101, AFI 33-141, AFMAN 33-407, and the most recent published DCMA guidance for Defense Business Systems Funds Certification and Defense Business System Integrated Program/Budget Review (currently, Version 3.0 published April 2014). The originals should be stored by the contractor in a central repository. Once software has been deployed, the contractor shall keep records of where it is assigned and who is the accountable point of contact, including unit, location, email, and phone number.

2.2.4 Software Toolchain Maintenance

Software shall be procured within five (5) business days of receipt of the SAP. The contractor shall utilize any existing software licensing agreements or Government Acquisition vehicles already in place, to include the original equipment manufacturer or authorized Government distributor, if possible. The Government requests the Enterprise License Agreement upon procurement of requested licenses.

The contractor shall maintain and update the evolving Software Toolchain by performing the following tasks:

• Provide license management and annual renewal reporting monthly (CDRL A003). In the monthly reports, the contractor shall provide oversight of the licenses expiring in the current and following quarter to the Software PM and Technical Point of Contact (TPOC). Please note, the Government requires a minimum of 90-days’ notice for all software license renewals.

• Renew software licenses at the written direction of the Software PM(s) via the SAP

• Provide software updates, as directed by the Government

• Utilize technologies to track availability and downtime of the Toolchain tools to increase time efficiency to fix issues

• Ensure the software is free from defects and interoperability issues. Broken or non-functioning software or licenses shall be fixed/replaced within two (2) business days.

• Provide recommended updates/improvements to the existing Software Toolchain based on technical assessments

• Provide support to increase or decrease the number of licenses for the existing Toolchain as

CUI 13

required. The contractor shall monitor usage for over or under utilization and make recommendations on a quarterly basis to ensure no exposure to over usage or wastage within reasonable limits. If over or under usage is discovered, it shall be reported to the Software PM for the software immediately with recommendations for resolution.

• Provide recommendations for additional software purchases of the same software including credits for any returns, if applicable

• Provide yearly maintenance and support of software to include renewals, and additions, upgrades, and returns

• Provide software training procurement services and training options for all software upon request

2.2.5 Software Toolchain License Transfer (In and Out)

The contractor shall work closely with previously engaged and/or existing AFNWC Software Toolchain contractors, Original Equipment Manufacturers (OEMs), vendors, and resellers, to ensure proper transfer of all existing software toolchain licenses to this contract. The contractor shall develop and execute a process that seamlessly transitions licenses without disruption to the AFNWC Software Environments.

2.2.6 Software Toolchain Management Support Services

In addition, within 90 days of contract award, the contractor shall develop a Software License Transfer Plan for transferring documentation pertaining to software toolchain licenses and tracking tools to the Government and/or a future vendor upon contract completion (CDRL A004).

The contractor shall be available during operating hours between 8:00 A.M. and 5:30 P.M. Mountain Standard Time (MST), Monday through Friday, excluding Federal Holidays (New Year’s Day, Martin Luther King Jr. Day, President’s Day, Memorial Day, Juneteenth, Independence Day, Labor Day, Columbus Day, Veterans Day, Thanksgiving, and Christmas).

2.3 Software

The contractor may be required to operate after normal business hours if the need arises. The Government shall coordinate other-than-normal operating hours with the contractor as far in advance of need as practicable.

The contractor shall purchase all software from the OEM or an authorized distributor. If the software is not available from either source, the contractor shall obtain written permission from the Government Software PM(s) or COR to purchase from another identified source. The contractor shall require their subcontractors and suppliers to purchase from the OEM or authorized distributor unless the contractor obtains written permission from the PCO to purchase from another identified source.

CUI 14

The contractor shall:

• Provide recommended updates/improvements to the existing software tools based on technical assessments

• Ensure software is free from defects and interoperability; broken or non-functioning software must be fixed or replaced within two (2) business days.

• Provide support to increase or decrease the number of licenses for the existing software tools as required

• Deliver software to the Government network administrators and provide instructions on how to download software and license keys

• Provide support to Government network administrators via direct interface with software vendors and coordinate any help assistance needed by the Government from the software vendor

3.0 General Requirements

3.1 Contractor Program Management

The contractor shall provide any equipment, materials, and supplies deemed necessary to meet the objectives of the PWS. The contractor shall integrate and coordinate all activity required to execute this contract and manage the timeliness, completeness, and quality of problem identification. The contractor shall provide corrective action plans, timely identification of issues, and effective management of subcontractors.

3.1.1 Kick-Off Meeting

Within ten (10) business days of contract award, the contractor shall support a kick-off meeting for the Government and team members. The contractor shall introduce team members and staff, and shall present and discuss organizational structure, administrative operations pertinent to this contract, technical approaches, and preliminary plans for performing contract tasks, format of reports and quarterly reviews, and a general overview of the overall approach to execute this contract (CDRL A005).

Subsequent Program Management Reviews shall be as requested by the Government.

3.2 Scale Management

This effort supports management of Government purchased software licenses for the AFNWC Program. A vital component of the AFNWC Program is the execution of the AFNWC Engineering & Manufacturing Development (EMD) contract for the development of the AFNWC Weapon System. A term of the AFNWC EMD contract is that both the Government and the AFNWC Prime Contractor independently provide the necessary software licenses to operate jointly in each entity’s digital environment during execution of the contract. This effort supports the Government’s purchase of its software licenses. The AFNWC EMD Prime Contractor is required to purchase and maintain its own licenses in support of the AFNWC EMD contract as well. The Government cannot direct the AFNWC

CUI 15

EMD Prime Contractor on where to purchase its licenses. However, an opportunity exists, and has been incentivized in the AFNWC EMD contract, for which the AFNWC EMD Prime Contractor can choose to pursue an independent agreement with the Government’s AFNWC software license manager for the purposes of continuity and achievement of scale economies and effective management. Contingent upon a private contract being established with AFNWC EMD Prime Contractor for the same services, the Government expects significant license cost savings through scale efficiencies. These economies of scale price savings shall be shared between AFNWC EMD Prime Contractor and the US Government through a parallel license cost decrease captured in the separate contracts of both entities. To prepare for this opportunity to be realized, the contractor shall provide terms and conditions, and a plan of execution for how the scale economies will be realized, evaluated, reported, and reflected in the prospective pricing of the two contracts.

This will include, but is not limited to, the following:

• A detailed plan and terms covering how the contractor will capture, evaluate, report, and realize economy of scale price savings to the US Government and AFNWC EMD Prime contractor in defined frequencies through the life of the contract.

3.3 Business Relations

The contractor shall have a single point of contact between the Government and contractor personnel to support business relations. The contractor shall coordinate all activity required to execute this contract, and manage the timeliness, completeness, and quality of problem identification. The contractor shall provide timely identification of issues, corrective action plans, and effective management of subcontractors. The contractor will provide software related risks to the Government immediately upon identification.

3.4 Financial Reporting

• The contractor shall submit cost/financial reports as part of (CDRL A006) – Monthly Status Report, this report shall identify Installed software and cost per month and quarter

• The timeframe from the purchase of software to when it is received; the time lapse between this and software installation for customer use.

• Software maintenance cost per renewal cycle (i.e., quarter, or annual renewal)

• The number of licenses added and/or deleted by software item

• The usage of the software to date

• The cost of the software to date

CUI 16

• Track the total budget for software and provide information on budget expended, projected budget requirements, and new budget requirements.

• Track the total budget for ODC, travel and labor

3.5 Personnel

The contractor shall establish a process to provide personnel in a timely manner to meet the Government’s requirement. The contractor shall be responsible for any subcontract management necessary to integrate work performed on this contract and shall be responsible and accountable for any subcontractor performance. The contractor shall propose ladder pricing for labor based on the number of licenses procured and managed.

Key Personnel Positions shall remain assigned to the program for the duration of the contract, unless otherwise approved by the COR. The contractor shall notify the COR, in writing, of the proposed substitutes and their qualifications. All changes are subject to contracting officer or COR approval.

If a KPP needs to be replaced, the contractor shall provide the Government notification within ten

(10) business days of the KPP leaving the effort and backfill their position within ten (10) business days, or as otherwise agreed to by the Government.

For all non-KPP positions, the contractor shall provide the Government notification within ten (10) business days of personnel leaving the effort and backfill their positions within 20 business days, or as agreed to by the COR.

3.6 Risk Management

The contractor shall utilize its risk management procedures, techniques, controls, and metrics to provide for the early identification of program risks. The contractor shall provide telemetry within AFNWC that helps to identify and quantify cost, schedule, and performance risks. The contractor shall be responsible for recommending the appropriate risk mitigation steps. Risks shall be a topic of discussion during program management reviews.

3.7 Quality Control

The contractor shall conduct quality control inspections to ensure of contract performances are being met.

CUI 17

Performance Objective

PWS

Para

Performance Threshold

Surveillance Method Frequency

Software

Toolchain

Approval Package

2.2.2 Satisfactory: Present

a Software toolchain Approval Package within ten (10) business days from Government tasking

COR/PM

continuous surveillance

Monthly

Unsatisfactory:

Present a Software toolchain Approval Package greater than ten (10) business days from Government tasking.

Procure Software Tools

2.2.3 COR/PM

continuous surveillance

Monthly

Satisfactory: Within 5 business days from PCO direction Unsatisfactory: Greater than five (5) business days from PCO direction

Software Toolchain maintenance

2.2.4 Satisfactory:

Non-functioning software within the toolchain is replaced

COR/PM

continuous surveillance

Monthly in less than two (2) business days Unsatisfactory:

Non-functioning software within the toolchain is replaced in greater than two (2) business days

CUI 18

3.8 Data Management

The contractor shall establish, document, and maintain all program data, and provide such data in accordance with CDRL A007. The contractor shall employ sound data management practices when developing, acquiring, controlling, and delivering all technical, management, and other required data.

The contractor shall ensure timely delivery of data, along with maintaining data quality, providing accurate updates/revisions, and making corrections as required. The contractor shall properly identify, mark, and control proprietary, For Official Use Only, and classified data. The contractor shall prepare and generate a Data Accession List (DAL) in accordance with CDRL A007, which lists all internally generated documentation, not otherwise deliverable to the Government, used by the contractor to design, install, integrate, test, and manage the project.

3.8.1 Electronic Data Interchange (EDI)

The contractor shall provide, to the best of their ability, the following types of data transfer: electronic, secure, online access point for delivery of contractor prepared CDRL data to the Government. All CDRL items shall be posted on the contractor's data delivery access point and available for Government download no later than (NLT) the delivery date specified by the applicable CDRL item.

The contractor shall notify the CDRL item distribution email addresses (via email) when each CDRL item has been posted and is available for Government access/download. The contractor shall follow Government-approved open standards for all EDI protocols, files, and formats.

3.9 Security Requirements

The contractor performing work under this contract must comply with all applicable security requirements needed for the Air Force Non-classified Internet Protocol (IP) NIPRNet. The contractor shall ensure that any software procured for use must meet the rigorous security standards set by the United States Air Force, including but not limited to, compliance with the Department of Defense (DoD) cybersecurity protocols and the Risk Management Framework (RMF). Furthermore, all software must undergo thorough vulnerability assessments and penetration testing prior to deployment. The contractor is responsible for maintaining the integrity and security of all systems and data, and for adhering to the Air Force's policies regarding software usage, data encryption, and user authentication protocols.

3.9.1 CAC

CACs are required in support of this effort. The contractor shall comply with Hill AFB Instruction 36- 812, Issue of CACs to Contractors (Contractor Verification System) and AFFARS clause 5352.242-9001, CACs for Contractor Personnel., CACs for contractor personnel should be noted that this process may take up to four (4) weeks to complete, so it is critical that contractors consider these instructions before award (i.e., when preparing a proposal in response to a Fair Opportunity Proposal Request (FOPR) and prior to changing contractor personnel after award).

CUI 19

3.9.2 Operations Security (OPSEC)

The purpose of OPSEC is to reduce the vulnerability of USAF missions to adversary collection and exploitation of critical information. Critical Information is defined as information about USAF missions or activities that the adversary needs to achieve their goals. The Contractor shall ensure compliance with DoDD 5205.02E, DoD Manual 5205.02-M, AFI 10-701, and/or other applicable Government security regulations, including procedures to protect classified and/or CUI, Government projects, and/or programs. The Contractor shall ensure that Contractor personnel who perform work on geographically separated locations or another Government facility comply with the applicable security requirements.

3.9.3 Controlled Unclassified Information

The contractor shall comply with DoDM 5200.01, Volume 4, DoD Information Security Program: CUI, Enclosures 3 and 4, for identification, protection, and training requirements of CUI. The contractor shall be responsible for training their personnel and accomplishment of the out-processing procedures identified in DoDM 5200.01, Volume 4, Enclosure 4. The contractor shall comply with DoDM 5400.07/Air Force Manual 33-302, DoD Freedom of Information Act (FOIA) Program requirements.

3.9.4 Non-Disclosure Agreements

Protection of unclassified DoD information not approved for public release on non-DoD Information Systems will be protected in accordance with DoDI 8582.01, Security of Unclassified DoD Information on non-DoD Information Systems, Enclosure 3.The contractor shall distribute CUI in accordance with DoD Instruction 3200.14, Principles and Operational Parameters of the DoD Scientific and Technical Information Program, and DoD Instruction 2040.02, International Transfer of Technology, Articles, and Services. The Contractor shall properly mark all such documents in accordance with DoD Instruction 5230.24, Distribution Statements on Technical Documents. Technical documents not subject to distribution are defined in DoD Instruction 5230.24, DoD Directive 5230.25, and DoD Manual 5010.12- M, Procedures for the Acquisition and Management of Technical Data. The contractor shall, upon request, provide to the Government, a system security plan (or extract thereof) and any associated plans of action developed to satisfy the adequate security requirements of DFARS 252.204-7012, and in accordance with NIST Special Publication (SP) 800-171, “Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations” in effect at the time the solicitation is issued or as authorized by the PCO, to describe the contractor’s unclassified information system(s)/network(s) where covered defense information associated with the execution and performance of this contract is processed, stored, or transmitted.

CUI 20

3.9.5 Disseminating Scientific and Technical Information (STINFO)

The contractor shall require all employees, prime and subcontractor personnel, to sign a Non-Disclosure Agreement (NDA) prior to starting work. The purpose of the NDA is to prevent the disclosure of sensitive Government information that the contractor may be exposed to through performance of this contract.

Copies of signed NDAs shall be submitted to the PCO.

3.10 Associate Contractor Agreements (ACAs)

The contractor shall use AFI 61-204, Disseminating Scientific and Technical Information and DoDI 5230.24, Distribution Statements on Technical Documents, when developing, reviewing, or assisting the US Government and other supporting contractors, to identify any "sensitive" media that should not be placed into the Public Domain (e.g., Classified, For Official Use Only), as well as ensuring applicable Distribution Statement, Handling and Destruction Notice, Warning Statement (for technical information with Space/Military Application under the International Traffic Arms Regulation (ITAR) or the Export Administration Regulation (EAR) for dual-use technologies), along with the Expanded Exemption Statement are applied. The contractor shall consult with their Government lead, to determine the appropriate Distribution Statement for the media. From the time of creation by the contractor, the contractor shall properly mark, properly handle, secure, and dispose of any sensitive media in the contractor’s immediate control. The contractor shall advise/alert US Government, and other supporting contractors of these requirements, for any sensitive media received which is not appropriately marked.

Throughout the course of the contract, the contractor may be required to work with, or within proximity to, other contractors within the AFNWC Directorate and program locations. The contractor shall work with the Government to have any new software installed on networks, computers, and laptops, as needed. The contractor shall enter into ACAs with applicable third-party integrators and other stakeholders after contract award for any portion of the contract requiring joint participation in the accomplishment of the requirement. The agreements shall include the basis for sharing information, data, technical knowledge, expertise, and/or resources essential to this effort, which shall ensure the greatest degree of cooperation to meet the terms of the contract. The Government will provide specific names of contractors to the contractor. ACAs shall include, but not be limited to, the following general information:

• Identify the associate contractors and their relationships

• Identify the program involved and the relevant Government contracts of the associate contractors

• Describe the associate contractor interfaces by general subject matter

• Specify the categories of information to be exchanged or support to be provided

• Include the expiration date (or event) of the ACA

• Identify potential conflicts between relevant Government contracts and the ACA; include agreements on protection of proprietary data and restrictions on employees.

CUI 21

• The contractor is not relieved of any contract requirements or entitled to any adjustments to the contract terms because of a failure to resolve a disagreement with an associate contractor.

Liability for the improper disclosure of any proprietary data contained in or referenced by any ACA shall rest with the parties to the ACA and not the Government. All costs associated with the ACAs are included in the negotiated cost of this contract. ACAs may be amended as required by the Government during the performance of this contract. The contractor shall submit copies of all ACAs to the Contracting Officer.

4.0 Government Inspection

4.1 Services Summary

Performance Objective Standard Performance Threshold

SS-1: Provide Qualified Workforce

Contractor provides qualified workforce by filling new requirements and vacancies as per the timeframe identified in PWS Paragraph 2.1

Performance is acceptable not more than one COR/CO validated complaint per quarter for filling new requirements added to the contract and/or for vacancy fills. Performance is acceptable when:

At contract award, when qualified personnel are on the job at contract start, unless previously negotiated by the CO.

OR

1) For new requirements added after contract award or when employee turnover occurs, vacancies are filled with qualified personnel within 20 business days of vacancy, unless approved in writing or otherwise directed in advance by the CO.

AND

2) There is no mission impact due to vacancies or employee turnover.

SS-2: Retain Stable Workforce

Contractor retains a stable workforce with turnover rate of less than 33% per quarter as identified in PWS Paragraph 2.1

Performance is acceptable when:

1) Turnover rate is less than 33% per quarter. AND

2) The turnover was not caused by the Government.

CUI 22

Performance Objective

Standard Performance Threshold

SS-3: Quality Performance

Contractor personnel, at a minimum, must satisfactorily meet performance requirements in PWS Paragraphs

2.0 and any subparagraphs

Performance is acceptable when:

1) Not more than one COR/CO validated complaint per quarter.

AND

2) There is no mission impact

5.0 TABLE OF CONTRACT DATA REQUIREMENTS LIST

PWS

Paragraph Description CDRL Data Item No. Delivery Dates

2.2.1 Technical Report: Software

Capabilities Solutions

A001 Eight (8) days from Governments Request

2.2.2 Technical Report: Software

Toolchain Approval Package

A002 Ten (10) business days from the date of request

2.2.4 Technical Report:

Software Toolchain Inventory & Status Report

A003 Monthly by tenth business day of the month

2.2.5 Phase out Transition Plan:

Software license transfer in/Out Plan

A004 Draft Plan shall be submitted 20 days after date of award and 120 days before end of POP for Government review

3.1.1 Agenda: Agenda and

Conference Presentation

A005 Within ten (10) days of Award

CUI 23

PWS

Paragraph Description CDRL Data Item No. Delivery Dates

3.3 Status Report: Monthly

Status Report/Cost Summary

A006 First submission due NLT ten

(10) working days after end of first full contractor's monthly accounting period after contract award.

Subsequent deliveries shall be made NLT ten (10) working days after end of contractor's monthly accounting period.

3.8 Data Accession List A007 One Government

accepted final version submitted ten

(10) days of request

3.9.3 System Security Plan &

Associated plans of Action for a Contractor's Internal Unclassified Information Systems

A008 One Government accepted final version submitted ten

(10) days of request

5.1 CLIN Structure

*Note CLIN structure is subject to change prior to contract award. The nomenclatures will remain the same but, individual CLIN numbers will change until the contract request for proposals is released.

CUI 24

CLIN Nomenclature CLIN Type Quantity Supply/Service

Base Year

0002 FFP Labor FFP 1 Service

0010 Data FFP 1 Service

ODC FFP 1 Service

0012 Travel FFP 1 Service

0016 Surge FFP 1 Service

Option Year Structure

1002 – 4002 FFP Labor FFP 1 Service

1010 – 4010 Data FFP 1 Service

1011 – 4011 ODC FFP 1 Service

1016 – 4016 Surge FFP 1 Service

5.2 Surge CLIN Structure

The contractor shall deliver services in accordance with this PWS. Labor costs are not to exceed (NTE) 25% of the labor CLIN. If this Surge CLIN is exercised, rates will be in accordance with the rates quoted for labor CLINs. This option will be exercised upon CO determination/justification of bona fide need and contractor progress. Any option may be exercised at the sole discretion of the CO by written notification to the contractor. The contractor shall have the ability to expand each team quickly to meet an increased demand for services in the event of an emergent requirement or other need. Effective surge capacity requires the coordination of multiple resources to mobilize staff and, in some cases, coordinate with outside resources to fulfill a need. The contractor shall have a surge capacity methodology, disclosed at the Kick-Off meeting, that discusses a way to address an increased need for personnel within a stated amount of time deemed reasonable by the Government. Any surge capacity issues will be addressed and/or negotiated through the CO and will be incorporated by contract modification if needed.

CUI 25

ATTACHMENT 01

A1.1 CONTRACTOR NONDISCLOSURE AGREEMENT

Contract # Task Order #

I, an employee of

, (Contractor) to support the United States Air Force (USAF) and in consideration of the USAF granting me access to Controlled Unclassified Information (CUI) and For Official Use Only (FOUO), Information held by the USAF relating to the tasks to be performed under the Task Order, intending to be legally bound, hereby agree to the following terms and conditions:

1. I understand that my assignment to support the Contractor in its contractual duties under the Task Order (the “Effort”) will involve access to CUI and FOUO Information belonging to other contractors, other third parties, or the USAF. The sharing of CUI and FOUO, Information is necessary to effectively perform the mission of the USAF.

2. Except as expressly authorized in writing by the USAF, I agree to hold CUI and FOUO, Information in trust and confidence and agree that it shall be used only for my performance of duties in support of the Contractor’s performance of the Effort, shall not be used for any other purpose, or disclosed to any third party outside the USAF. I agree that I shall not, except as expressly authorized in writing by the USAF, at any time during or after my performance of duties in support of the Contractor’s performance of the Effort, directly or indirectly, disclose, publish or disseminate, to any other person or entity, any CUI and FOUO, Information I have access to by reason of my performance of duties in support of the Contractor’s performance of the Effort, nor shall I use any such CUI and FOUO, Information for my personal use or advantage, or make it available to others not cleared for access to CUI and FOUO, Information by the USAF or lacking a need-to-know for performance of the Effort.

I will hold all CUI and FOUO, Information I have access to by reason of my performance of duties in support of the Contractor’s performance of the Effort in confidence and use it solely for the benefit of the USAF and the performance of Effort. I shall not retain any CUI and FOUO, Information, including written notes, photographs, sketches, models, memoranda, or any tangible representation of the CUI and FOUO, Information except as required in my performance of duties in support of the Contractor’s performance of the Effort. Without limiting the generality of the foregoing statements, I agree that CUI and FOUO, Information shall not be released to the media, press, competing firms, individuals, or Government officials outside the USAF for any purpose. I further understand and agree that all CUI and FOUO, Information shall be retained, disseminated, released, and destroyed in accordance with the requirements of law and applicable Department of Defense or USAF directives, regulations, instructions, policies, and guidance.

3. All information that I receive or obtain in performance of my duties in support of the Contractor’s performance of the Effort shall be deemed to be CUI and FOUO, Information, including, without limitation, visual, verbal and written information, in whatever form or medium, including, but not limited to, personal, business or financial information, or intellectual property, or technical information in the form of discussions, communications, CUI 26 designs, concepts, requirements, specifications, software, interfaces, components, processes, or similar things. I understand and agree that any work product related to the Effort, including, but not limited to, final documents and products, drafts, feeder documents, briefings, notes, and any other related oral or written communication shall CUI and FOUO, Information for purposes of this Agreement CUI and FOUO, Information shall not include information that I or the Contractor can demonstrate (A) was known by me or the Contractor without restriction as to further disclosure when received or was developed independently by the Contractor by individuals who had no direct or indirect access to such information, (B) was obtained from a source other than the USAF, its employees, agents, or contractors through no breach of confidence, (C) was in the public domain when received or thereafter enters the public domain through no breach of confidence by Contractor or myself, or (D) was used or disclosed with the prior written approval of the USAF.

4. I have been advised and understand that my violation of this agreement could cause irreparable injury to the United States. I understand that the United States Government may seek any remedy available to it to enforce this Agreement, including, but not limited to, application for a court order prohibiting disclosure of information in breach of this Agreement. I have been advised that the action can be brought against me in any of the several appropriate United States District Courts where the United States Government may elect to file the action. Court costs and reasonable attorneys’ fees incurred by the United States Government may be assessed against me if I lose such action. I understand that my violation of this Agreement may result in criminal action. I recognize that nothing in this Agreement constitutes a waiver by the United States of the right to prosecute me for any statutory violation.

5. Any questions I have regarding this agreement that I desire to direct to the USAF shall be in writing to:

[Insert name & address of USAF POC].

6. I hereby assign to the USAF all royalties, remunerations, and emoluments that have resulted, will result, or may result from any disclosure, publication, or revelation of CUI and FOUO, Information not consistent with the terms of this Agreement.

Unless and until I am…