SCIF-Service PWS-DRAFT.pdf

STATEMENT OF WORK

Mission Delta 6

Space-as-a-Service (SAAS) Task Order

Solicitation/Contract Number: TBD

1 February 2026

UNCLASSIFIED

1. SCOPE

The contractor shall provide access to unclassified and classified workspaces, including at least two (2) Sensitive Compartmented Information Facilities (SCIFs) and a SCIF shared common space accredited for Sensitive Compartmented Information (SCI) with Special Access Program (SAP) operations in accordance with ICD 704. These workspaces must include adjacent secure and non-secure meeting rooms and unclassified training facilities to support USSF Mission Delta 6’s cyberspace warfare mission. Each SCIF shall accommodate a minimum of ten (10) personnel. The contractor shall maintain all facilities in compliance with applicable security regulations and standards.

APPLICABLE DOCUMENTS

The contractor shall comply with the latest approved versions of the following documents (and all applicable successor guidance), as they pertain to the services outlined in this PWS:

• ICD 705: Physical and Technical Security Standards for SCIFs

• DoDM 5105.21, Volumes 1-3: SCI Administrative Security Manual

• DoDI 5200.01: DoD Information Security Program

• 32 CFR Part 117 (NISPOM): National Industrial Security Program Operating Manual

• NIST SP 800-53: Security and Privacy Controls for Information Systems and Organizations

(as applicable to cybersecurity requirements)

• DoDI 8510.01: Risk Management Framework (RMF) for DoD Information Systems

• JSIG: Joint Security Implementation Guide

• Any Cybersecurity Service Provider (CSA)-issued policies, technical specifications, or waivers directly applicable to this effort.

2. REQUIREMENTS

2.1. SCIF Facility Provisioning

2.1.1. The contractor shall provide SCIFs meeting government-specified types and sizes, as detailed in paragraph 2.9.1. and Appendix A.

2.1.2. The contractor shall ensure all SCIFs meet or exceed the construction, TEMPEST, acoustic, and physical security standards outlined in ICD 705 and applicable Cognizant Security Authority (CSA) guidance.

2.1.3. The contractor shall obtain and maintain all necessary accreditation from the Cognizant Security Authority (CSA) – Defense Counterintelligence and Security Agency (DCSA), before conducting any classified activities within the SCIFs. Evidence of accreditation shall be provided to the Government Representative within 30 calendar days of receipt.

2.1.4. The contractor shall meet unclassified processing requirements at Project Start. Within 365 calendar days of receipt of a task order modification incorporating Special Access Program (SAP)

Kittle.Richard (US) There are currently only two SCIF available

Kittle.Richard (US) The whole SCIF will not be SAP, only certain areas

Kittle.Richard (US) Not sure if 120 is possible with current scedule requirements and a Revised DD Form 254, the contractor shall obtain SAP-Facility (SAP-F) accreditation.

2.2. Security Documentation & Reporting

2.2.1. The contractor shall maintain accurate and up-to-date security documentation for all SCIFs, including but not limited to accreditation packages, TEMPEST certifications, and incident reports.

2.2.2. The contractor shall report all security incidents to the Government Representative within 24 hours of discovery.

2.3. Personnel Security

2.3.1. All contractor personnel accessing SCIFs shall possess valid security clearances commensurate with the classified information they will be handling.

2.3.2. The contractor shall ensure all personnel receive appropriate security briefings and training prior to accessing SCIFs.

2.4. Compliance & Inspections

2.4.1. The contractor shall comply with all applicable security regulations and policies, including those outlined in ICD 705, DoDM 5105.21, and the JSIG.

2.4.2. The contractor shall allow the Government and the CSA to conduct periodic inspections of the SCIFs to verify compliance with security requirements.

2.5. Facility Operations

2.5.1. SCIF Availability: The contractor shall maintain SCIF availability at 99.9% uptime, excluding scheduled government-approved downtime. Downtime requests must be submitted to the Government Representative at least [Number] business days in advance for approval.

2.5.2. Utilities & Environmental Controls: The contractor shall provide all necessary utilities (electricity, water, etc.), HVAC, and environmental controls to maintain SCIF integrity and operational readiness. These services shall not compromise the SCIF’s security posture.

2.5.3. IT Infrastructure: The government authority shall provide and maintain IT infrastructure to support secure connectivity in all SCIF areas for JWICS, DCO-S WAN, SIPR, and NIPR networks.

This includes cabling, network hardware, and necessary security configurations.

2.5.4

2.6. Additional Security Requirements

2.6.1. Visitor Control: The contractor shall implement a visitor control system that requires all visitors to be pre-approved by the Government Representative and escorted at all times while within the SCIF.

2.6.2. Media Handling: The contractor shall establish procedures for the secure handling, storage, and destruction of classified media in accordance with ICD 705.

2.6.3. Cybersecurity: The contractor shall implement and maintain robust cybersecurity measures to protect all IT systems and data within the SCIF, in accordance with applicable DoD and NIST standards.

2.6.4. Incident Response Plan: The contractor shall develop and maintain a comprehensive Incident Response Plan (IRP) for the SCIF, to be reviewed and approved by the Government Representative.

2.7. Operational & Maintenance Requirements

2.7.1. Waste Management: The contractor shall establish procedures for the secure disposal of classified waste materials in accordance with applicable regulations.

2.7.2. Maintenance Schedules: The contractor shall provide the Government Representative with a detailed schedule of preventative maintenance for all SCIF systems, including HVAC, power, IT infrastructure, and security equipment.

2.7.3. Change Management: All proposed changes to the SCIF infrastructure or systems must be submitted to the Government Representative for review and approval prior to implementation.

2.7.4. Key Control: The contractor shall maintain a strict key control system for all SCIF access points, with a log of all key holders and access events.

2.8. Contractual & Reporting Requirements

2.8.1. Government Furnished Equipment (GFE): Contractor will comply with GFE requirements

2.8.2. Performance Metrics: The contractor shall meet the following performance metrics: ICD 704 SCIF security compliance

2.8.3. Reporting Frequency: The contractor shall submit monthly security reports to the Government Representative, detailing all security incidents, maintenance activities, and compliance status.

2.8.4. Quality Assurance: The contractor shall implement a Quality Assurance program to ensure ongoing compliance with all requirements.

2.9. Non-Exclusive Coworking Facility Space Requirements

2.9.1. Classified Office Space

2.9.1.1. Two (2) SCIFs (A & B) with accreditation from the Defense Intelligence Agency (DIA) capable of handling SCI and SAP in designated areas

2.9.1.2. SCIF A with a minimum of 4,560 square feet, 5 offices, 40 workstations, 1 huddle room

2.9.1.3. SCIF B with a minimum of 7,612 square feet, 4 offices, 71 workstations, and 1 huddle room

2.9.1.4. Joint secure area with a minimum of 2,939 square feet, which includes 3 training/conference rooms, and one large pantry

2.9.1.5. Top Secret/SCI and SECRET VTC capability, to include maintenance, sustainment, and support

2.9.2. Unclassified Office Space (1050 Newport) - See Appendix A Diagram

2.9.2.1. Unclassified office space with a minimum of 7,402 square feet which includes 8 offices, 20 workstations, 1 huddle room, 1 unclassified conference room with a minimum of 432 square feet, 1 unclassified pantry with a minimum of 598 square feet, 1 unclassified corridor with a minimum of 2,224 square feet.

2.9.2.2. Office Configuration: The unclassified office space shall be configured to support efficient workflow and collaboration. A floor plan depicting the layout of offices, workstations, and common areas shall be provided to the Government Representative for approval prior to occupancy.

2.9.2.3. Network Connectivity: The unclassified office space shall have robust network connectivity, including wired and wireless access, supporting both NIPR and potential future network requirements.

2.9.2.4. IT Infrastructure: The contractor shall provide and maintain all necessary IT infrastructure within the unclassified office space, including servers, workstations, printers, and associated software.

2.9.2.5. Conference Room Capabilities: The unclassified conference room shall be equipped with video conferencing capabilities, presentation equipment (projector, screen, audio system), and comfortable seating for a minimum of 12 participants.

2.9.2.6. Pantry Amenities: The unclassified pantry shall be equipped with essential amenities such as a refrigerator, microwave, sink, and ample counter space.

2.9.2.7. Corridor Accessibility: The unclassified corridor shall be designed to ensure clear and unobstructed access to all offices and common areas, adhering to ADA accessibility guidelines.

2.9.2.8. Environmental Controls: The unclassified office space shall maintain comfortable temperature and humidity levels, with adequate ventilation.

2.9.2.9. Security Considerations: While unclassified, the space shall incorporate basic security measures, such as controlled access and visitor registration, to prevent unauthorized entry and protect sensitive information.

2.9.2.10. Furniture & Equipment Standards: All furniture and equipment provided for the unclassified office space shall meet applicable safety and ergonomic standards.

2.9.3. Unclassified Office Space (1055 Newport) - See Appendix B Diagram

2.9.3.1. Office Configuration: The unclassified office space shall be configured to support efficient workflow and collaboration, with a minimum of 96 student desks. A floor plan depicting the layout of offices, workstations, and common areas shall be provided to the Government Representative for approval prior to occupancy.

2.9.3.2. Network Connectivity: The unclassified office space shall have robust network connectivity, including wired and wireless access, supporting both NIPR and potential future network requirements.

2.9.3.3. IT Infrastructure: The contractor shall provide and maintain all necessary IT infrastructure within the unclassified office space, including servers, workstations, printers, and associated software.

2.9.3.4. Break Room Amenities: The unclassified pantry shall be equipped with essential amenities such as a refrigerator, microwave, sink, and ample counter space.

2.9.3.5. Environmental Controls: The unclassified office space shall maintain comfortable temperature and humidity levels, with adequate ventilation.

2.9.3.6. Security Considerations: While unclassified, the space shall incorporate basic security measures, such as controlled access and visitor registration, to prevent unauthorized entry and protect sensitive information.

2.9.3.7. Furniture & Equipment Standards: All furniture and equipment provided for the unclassified office space shall meet applicable safety and ergonomic standards.

2.9.3.8. Conference Room Capabilities: The unclassified conference room shall be equipped with presentation equipment (projector, screen, audio system), and comfortable seating for a minimum of 40 participants.

2.10. Security

2.10.1. Personnel Security: All personnel requiring access to classified information shall possess an active security clearance commensurate with the level of information to be accessed, as determined by the Government. Background checks and security briefings will be conducted in accordance with DoD 5200.2-M (DoD Personnel Security Program).

2.10.2. Information Security: All classified information shall be handled, stored, and transmitted in accordance with ICD 704 (Control of Sensitive Information) and other applicable directives.

2.10.3. Physical Security: Physical security measures shall be implemented to protect facilities and prevent unauthorized access. This includes, but is not limited to, access control systems, intrusion detection systems, and surveillance cameras.

2.10.4. Cybersecurity: Cybersecurity measures shall be implemented to protect information systems and data from unauthorized access, use, disclosure, disruption, modification, or destruction. This includes compliance with DoD 8500.01 (Cybersecurity) and other applicable cybersecurity regulations.

2.10.5 SCIF Security

2.10.5.1. SCIF Accreditation: All SCIFs shall be accredited by the Defense Intelligence Agency (DIA) in accordance with ICD 705 (SCIF Requirements). Accreditation shall be maintained throughout the contract period.

2.10.5.2. SCIF Access Control: Access to SCIFs shall be strictly controlled and limited to authorized personnel only. Access control procedures shall be documented and enforced.

2.10.5.3. SCIF Communications Security: All communications within SCIFs shall be conducted in accordance with COMSEC regulations.

2.10.5.4. SCIF TEMPEST Compliance: All SCIFs shall be constructed and operated in accordance with TEMPEST standards to prevent the compromise of classified information through electromagnetic emanations.

2.10.5.5. SCIF Visitor Control: All visitors to SCIFs shall be escorted by authorized personnel and shall comply with all security requirements.

2.10.6. Incident Reporting

2.10.6.1. Security Incidents: All security incidents, including suspected breaches of security, shall be reported immediately to the Government Representative and the appropriate security authorities.

2.10.6.2. Reporting Procedures: Incident reporting procedures shall be documented and communicated to all personnel.

2.10.7. Security Inspections

2.10.7.1. Regular Inspections: Regular security inspections shall be conducted to ensure compliance with all security requirements.

2.10.7.2. Corrective Actions: Any deficiencies identified during security inspections shall be corrected promptly.

2.10.8. Contractor Responsibilities

2.10.8.1. Security Management: The Contractor shall designate a qualified Security Manager responsible for implementing and maintaining all security measures.

2.10.8.2. Security Training: The Contractor shall provide security training to all personnel requiring access to classified information.

2.10.8.3. Compliance: The Contractor shall be responsible for ensuring compliance with all applicable security requirements.

2.11. Information Systems and Infrastructure

2.11.1. This section details the requirements for information systems and infrastructure supporting this effort, encompassing both unclassified and classified (up to SAP) processing needs.

2.11.2. Unclassified Processing. The Contractor shall provide and maintain all necessary information systems and infrastructure to meet unclassified processing requirements commencing at Project Start. This includes, but is not limited to:

2.11.2.1. Secure workstations and servers.

2.11.2.2. Network connectivity (NIPRNet SIPRNet, JWICS).

2.11.2.3. SAP Facility Accreditation 365: Upon receipt of an appropriate subcontract modification and a Revised DD Form 254 adding Special Access Program (SAP) requirements, the Contractor shall establish and accredit a SAP Facility (SAP-F) in accordance with applicable ICDs and DoD directives. This includes:

Kittle.Richard (US) Currently in place

2.11.2.4. Physical Security: Implementation of physical security measures meeting SCIF and SAP-F accreditation standards (e.g., access control, intrusion detection, surveillance).

2.11.2.5. Information Systems Security: Establishment of a secure information system environment compliant with SCIF and SAP requirements, including:

2.11.2.5.1. Dedicated SAP network infrastructure.

2.11.2.5.2. Accredited SAP workstations and servers.

2.11.2.5.3. Implementation of robust cybersecurity controls.

2.11.2.5.4. Data encryption and access control mechanisms.

2.11.2.6. Personnel Security: Ensuring all personnel requiring access to classified information possess the necessary security clearances and are indoctrinated at the appropriate classification level.

2.11.2.7. Accreditation Process: The Contractor shall actively participate in the SCIF and SAP-F accreditation process with the Designated Accrediting Authority (DAA).

2.11.2.8. DD Form 254 Compliance: All information systems and infrastructure shall be operated in accordance with the requirements outlined in the Revised DD Form 254.

2.11.2.9. Government Furnished Equipment (GFE): If the Government provides any equipment, the Contractor shall be responsible for its secure operation and maintenance.

2.11.3.0. System Documentation: The Contractor shall maintain comprehensive documentation of all information systems and infrastructure, including system configurations, security controls, and maintenance records. This documentation shall be readily available for Government review.

2.12. Sustainment

2.12.1. This section outlines the requirements for long-term sustainment of all delivered systems, facilities, and services. The Contractor shall ensure continued operational capability and reliability throughout the contract period and beyond, if required.

2.13. Maintenance and Support

2.13.1. Preventative Maintenance: The Contractor shall establish and execute a comprehensive preventative maintenance program for all systems and equipment, adhering to manufacturer recommendations and industry best practices. A detailed preventative maintenance schedule shall be submitted to the Government Representative for approval within [Number – e.g., 30] days of contract award.

2.13.2. Corrective Maintenance: The Contractor shall provide responsive corrective maintenance services to address system failures and performance degradation. Response times for corrective maintenance shall be as follows:

2.13.3. Critical Failures: 8 hours

2.13.4. Major Failures: Next business day

2.13.5. Minor Failures: Five Business Day

2.13.6. On-Site Support: The Contractor shall provide on-site support personnel as required to perform maintenance, troubleshooting, and repairs.

2.14. Personnel

This section outlines the requirements for contractor personnel supporting this effort. All personnel shall be qualified, trained, and authorized to perform their assigned duties.

2.14.1. Personnel Qualifications and Clearances

2.14.1.1. Security Clearances: The Contractor shall provide cleared staff with the appropriate security clearances as specified in individual task orders. This includes, but is not limited to, TS/SCI with polygraph if required for SCIF security, escort duties, Operations & Maintenance (O&M), and Information Technology (IT) support.

2.14.1.2. Qualifications: All personnel shall possess the education, experience, and certifications necessary to perform their assigned tasks. Specific qualifications will be detailed in individual task orders.

2.14.1.3. Suitability: All personnel shall be determined to be suitable for assignment based on background checks and other assessments as required by the Government.

2.14.1.4. Personnel Management and Eligibility

2.14.1.4.1. Eligibility Maintenance: The Contractor shall ensure all contractor personnel maintain eligibility for access to classified information and suitability for continued employment throughout the contract period, as specified in individual task orders. This includes timely completion of periodic reinvestigations and security briefings.

2.14.1.4.2. Personnel Vetting: The Contractor shall conduct thorough vetting of all personnel prior to assignment, including verification of credentials and background checks.

2.14.1.4.3. Reporting Requirements: The Contractor shall promptly report any changes in personnel security status or suitability to the Government Representative.

2.14.1.4.5. Personnel Removal and Replacement

2.14.1.4.5.1. Clearance Lapses: The Contractor shall immediately remove and replace any personnel whose security clearances lapse or are revoked.

2.14.1.4.5.2. Government-Directed Removal: The Contractor shall immediately remove and replace any personnel upon request from the Government Representative, regardless of the reason.

2.14.1.4.5.3. Replacement Timeline: Replacement personnel shall possess the same qualifications and clearances as the removed personnel and shall be fully operational within 10 Business days of the removal request.

2.15. Training

2.15.1. Security Training: All contractor personnel requiring access to classified information shall receive appropriate security training, including initial and annual refresher training.

2.15.2. Job-Specific Training: The Contractor shall provide job-specific training to ensure contractor personnel are proficient in their assigned tasks.

2.16. Key Personnel

2.16.1. Key Personnel List: The Contractor shall provide a list of key personnel, including their names, titles, and contact information, within 30 days of contract award.

2.16.2. Continuity of Key Personnel: The Contractor shall make every effort to maintain continuity of key personnel throughout the contract period. Any planned changes to key personnel shall be communicated to the Government Representative in advance.

2.17. PERFORMANCE STANDARDS, SURVEILLANCE, & REPORTING

This section defines the performance standards the Contractor shall meet and the methods the Government will use to monitor and evaluate Contractor performance.

2.17.1. Performance Standards

Key Performance Indicators (KPIs): The Contractor’s performance will be evaluated based on the achievement of Key Performance Indicators (KPIs) defined in the Performance Work Statement (PWS) for each task order. These KPIs will be specific, measurable, achievable, relevant, and time-bound (SMART). Examples include:

• System Uptime Percentage

• Mean Time To Repair (MTTR)

• Customer Satisfaction Rating

• Completion Rate of Scheduled Maintenance

• Security Incident Response Time

2.17.2. Acceptance Criteria: Specific acceptance criteria for deliverables will be defined in each task order. Deliverables will be considered acceptable only if they meet these criteria.

2.17.3. Performance Levels: Performance will be categorized into the following levels:

• Exceptional: Performance consistently exceeds expectations.

• Exceeds Standards: Performance frequently meets or exceeds expectations.

• Meets Standards: Performance consistently meets expectations.

• Needs Improvement: Performance does not consistently meet expectations and requires corrective action.

• Unacceptable: Performance consistently fails to meet expectations and may result in contract termination.

2.17.4. Surveillance Methods

2.17.4.1. Government Observation: The Government will conduct periodic observations of Contractor personnel performing work to assess compliance with contract requirements.

2.17.4.2. Performance Reviews: The Government will conduct regular performance reviews with the Contractor to discuss performance against KPIs and identify areas for improvement. These reviews will be held at least [Frequency – e.g., quarterly].

2.17.4.3. Data Analysis: The Government will analyze data submitted by the Contractor (e.g., performance reports, incident reports) to identify trends and assess performance.

2.17.4.4. Inspections: The Government may conduct inspections of Contractor facilities and systems to verify compliance with security and quality standards.

2.17.4.5. Customer Feedback: The Government will solicit feedback from end-users to assess Contractor performance and identify areas for improvement.

2.17.5. Reporting Requirements

2.17.5.1. Performance Reports: The Contractor shall submit regular performance reports to the Government Representative, detailing progress against KPIs and identifying any challenges or issues. The frequency of these reports will be specified in each task order.

2.17.5.2. Incident Reports: The Contractor shall report all security incidents, system failures, and other significant events to the Government Representative within [Timeframe – e.g., 24 hours].

2.17.5.3. Corrective Action Plans: The Contractor shall submit corrective action plans to address any performance deficiencies identified by the Government.

2.17.6. Corrective Action

2.17.6.1. Corrective Action Requests (CARs): The Government may issue Corrective Action Requests (CARs) to the Contractor to address performance deficiencies.

2.17.6.2. Response to CARs: The Contractor shall respond to CARs 5 outlining the proposed corrective actions and a timeline for implementation.

2.17.6.3. Follow-Up: The Government will monitor the implementation of corrective actions to ensure they are effective in resolving the identified deficiencies.

2.17.7. DELIVERABLES

This section identifies the deliverables the Contractor shall provide to the Government throughout the contract period. Specific delivery dates, formats, and acceptance criteria will be detailed in individual task orders.

2.17.7.1. General Deliverable Requirements

2.17.7.1.2. Format: All deliverables shall be submitted in the format specified in the task order (e.g., Microsoft Word, Microsoft Excel, PDF, electronic data files).

2.17.7.1.3. Delivery Method: Deliverables shall be submitted via e-mail or Government provided collaboration platform.

2.17.7.1.4. Approval Process: All deliverables are subject to Government review and approval. The Contractor shall address any Government comments or revisions within 5 business days.

2.17.1.5. Documentation: All deliverables shall be accompanied by appropriate documentation, including user manuals, technical specifications, and training materials, as specified in the task order.

2.17.1.6. Types of Deliverables

The following is a list of potential deliverables. Specific deliverables required for each task order will be detailed in the PWS.

• Progress Reports: Regular reports detailing progress against task order objectives.

• Performance Reports: Reports detailing performance against KPIs.

• Incident Reports: Reports detailing security incidents, system failures, and other significant events. (Within 24 hours of occurrence)

• Corrective Action Plans: Plans outlining proposed corrective actions to address performance deficiencies. (Within 5 business days of CAR issuance)

• Monthly Status Reports: Summarizing activities, accomplishments, and challenges

• Project Management Plan: Outlining the Contractor’s approach to managing the task order.

(Within 30 days of task order award)

• Test Plan: Describing the testing procedures to be used to verify system functionality. (Prior to testing phase)

• Security Plan: Detailing the Contractor’s security measures to protect Government information. (Within 30 days of task order award)

• Maintenance Plan: Describing the preventative and corrective maintenance procedures.

(Within 60 days of task order award)

APPENDIX A

APPENDIX B