Sheppard SPC - Statement of Work.docx

Statement of Work Digital Student Processing Platform for Student Assignments Sheppard AFB (SAFB) 82 FSS/FSPP (Student Personnel Center) CAO 3 Sept 2026

1. Background: Our organization trains 10k military students annually and manages in/out-processing tasks related to personnel tracking, training certifications, and assignment preparations. The current in/out-processing is a paper-based manual process, leading to delays and administrative burden. An automated, digital solution is required to improve efficiency, accuracy, and security.

2. Objective: The vendor must provide a turnkey solution that can be rapidly configured by the end users. The vendor must configure a digital platform with profile-based in/out-processing checklists that include relocation requirements while enabling communication/collaboration for process stakeholders and a dashboard allowing transparency for leadership. The platform/solution must exist within the Air Force Network’s (AFNet’s) Microsoft Office 365 site collection and be capable of configuring user needs. The platform must meet DoD cybersecurity standards. Although the platform does not currently require integration with military personnel systems it is desired to allow possible scalability in the future. The platform must be a commercial-off-the-shelf solution or a modified commercial product that is configured/tailored to the requirements outlined below.

3. Scope: The contractor must configure a fully functional web application in accordance with the requirements outlined in this SOW. The scope includes the configuration, deployment, training, and maintenance of the platform, as well as future scalability to accommodate policy and program changes.

4. Requirements: Create or provide an automated routing/workflow platform that eliminates the paper-based process for student relocation. The platform must include a messaging/communication tool on each student’s profile to allow all agencies and customers to have a single point of conversation to facilitate necessary actions, edits, or amendments for each student. The web application must include the following capabilities:

4.1 Process Automation and Communication:

· Serve as a centralized electronic focal point for tracking in/out-processing activities.

· Streamline document routing and include a communication feature to allow conversation between all stakeholders on a student’s profile by configuring pre-existing software.

· Replace multiple communication streams (e.g., email, Teams, phone calls) with a single, unified platform to eliminate gaps and single points of failure.

· Enable role-based user profiles with defined access and abilities for the following offices that are all internal to Sheppard AFB. All numbers are estimates and are subject to change.

· Student Personnel Center (SPC) [5 leads/15 technicians]

· SPC leads and technicians need full access to all Student Profiles and Electronic Relocation Folders (see 4.4) to include the ability to push/pull documents from other agencies on their behalf.

· Military Training Leaders (MTL) [15 leads/50 technicians]

· MTL lead and technicians need full access to all Student Profiles and Electronic Relocation Folder (see 4.4).

· Students

· Support agencies to include:

[10,000 annually]

· Support agencies only require access to documents that have been designated to flow through their office (see table 4.4)

· Finance

· Traffic Management Office (TMO)

· Information Protection Office (IP)

· Base Operation Medical Cell (BOMC)

· Dental Clinic

· Immunizations Clinic

· Bioenvironmental Engineering

· Military and Family Readiness Center (M&FRC)

· Exceptional Family Member Program (EFMP)

[2 leads/3 technicians] [3 leads/5 technicians] [2 leads/4 technicians] [2 leads/3 technicians] [2 leads/3 technicians] [2 leads/3 technicians] [2 leads/3 technicians] [2 leads/3 technicians] [2 leads/3 technicians]

· The SPC Team Leads will be the system administrators. Therefore, they must have access to assign/authorize all rights/roles within the system. Each agency lead will require access to assign their technicians rights/roles to include lateral assigning (i.e. MTL lead assigning new MTL lead/technicians).

· System is required to store student information for up to 3 months following the student's Report No Later Than Date (RNLTD) to their next duty location. An archive/disposition process will be required for information that is older than this for students. System must retain data trends for at least three years.

· System must be capable of handling 5,000 active student records at a given time.

4.2 Dashboard and Reporting:

· Provide a built-in dashboard for leadership to track real-time customer status and progression along standardized timelines to allow transparency for leadership and process improvement opportunities.

· Automate trend data reports within the platform for weekly, monthly, quarterly, and annual periods to brief leadership to include stagnant time and processing rate/success. All lead roles (SPC, MTL, and other support agencies) need the ability to pull data trends for leadership.

4.3 User Profiles

· Enable profile authentication to allow a student to connect with their tasks upon opening the tool [the method of authentication is open but Common Access Card (CAC) certificate (Public Key Infrastructure) or DOD Identification numbers will be possessed by every user].

· All users will require CAC certificate/digital signature abilities.

· System must handle structured and unstructured data, including scanned documents, while maintaining compliance with privacy regulations (Privacy Act of 1974) and current DoD and Department of Airforce (DAF) security standards to include those governing Personal Identifiable Information (PII) and Controlled Unclassified Information (CUI) program requirements.

4.4 Student Profile and Electronic Relocation Folder:

Each student requires a profile with their identifiable information as well as an electronic relocation folder.

· Each student requires a profile containing personal information related to their relocation. Currently, the Government uses a Microsoft Access database that creates new profiles by uploading a CSV (.csv) file for new students weekly. We also maintain data integrity three times a week by importing a text (.txt) file. The new platform's data management functionality must be capable of handling the same process by possessing the capability to upload .csv and .txt files to automatically populate student information (1x week for .csv/ 3x week for .txt file) to retain current data. Below is a list of the minimum fields that would be updated with these files.

Gaining Unit

TRS (Training Squadron)

AFSC (Air Force Specialty Code)

RNLTD (Report No Later Than Date)

· Example: Every Thursday a CSV file is loaded to create the student’s profile. Every Monday, Wednesday, and Friday a text file is loaded to maintain current data.

· Each profile must contain an electronic relocation folder that must be organized by “Tabs” that include all “Documents” required for the student to receive their follow-on assignment. Documents need to be fillable templates (full document listing below) that can be electronically signed using CAC certificates within the platform. Every student will require a unique combination of documents as each situation is case by case. Therefore, the student’s profile and relocation folder must allow editing to allow Student Personnel Center (SPC) technicians to add/subtract documents to the student’s folder (full document listing below). If a student’s identifiable information, assignment, or family situation changes the SPC technicians need the ability to add or subtract documents at any time. Each required task or document must include instructions, timelines, the assigned agency, status of completion, and priority. The system must also be scalable to accommodate increased student volume.

· Electronic Relocation folder requirements will include the following “Tabs” and “Documents” provided in the Table below. Additionally, each individual student's documents must be downloadable in a single file (all documents in one file) for transmission via email. “Doc Attached” items require the official, properly marked version of the document with the appropriate CUI markings in the Banner/Header and Footer as well as the CUI Designation Indicator Block.

· Electronic Relocation Table- Column explanations:

· Type:

· “Doc attached” requires the official, properly formatted version of the document. The user should be able to print this document while retaining the official formatting. These documents are printed as hardcopies to be sent with the member for verification at their gaining base.

· “Verification only” is not formatting dependent, a simple check box is sufficient

· Source:

· “Template” requires the official documents to not only be attached with proper formatting, but it needs to be a fillable document, able to be opened, edited, and signed all while retaining the proper formatting.

· “Upload” is for documents that must be completed by outside websites/agencies, therefore they simply upload the finished version.

· Requirement:

· “Mandatory” items are for EVERY SINGLE student

· “Variable” means the item is dependent on the career field, family situation, and location of the next assignment.

· Agency Requiring Access:

· SPC, MTL, BOMC, Immunizations, Bioenvironmental, Security, and Wing Information Protection Office are all support agencies that are laid out in section 4.1. Therefore, if the agency is listed in the Table below, that office will be included in the routing of whatever document it shares a row with.

Requiring Access

TAB 1

Attached

Attached

Attached

Attached

TAB 2

Attached

Attached

TAB 3

Attached

TAB 4

Attached

Attached

/SPC

Attached

Attached

Attached

Security Office

Retainability (Military Personnel Flight) Doc Attached

· Electronic Relocation folders must replace hardcopy checklists and streamline completion tracking for all involved agencies.

4.5 System Features:

The system must:

· Track deadlines and send warnings to customers/supporting agencies by af.mil email addresses when unmet deadlines are approaching.

· Show the current location of a document (for example if the SPC technician looks at a student’s profile, they should be able to look at the security clearance memo and know if it is sitting with the student, the security assistant, the MTL, or the SPC)

· Require electronic signatures using CAC certificates for required “template” forms without leaving the system. The Government’s intent is that all documents should be signed within the platform.

· The System's target response times must be comparable to those of other Air Force SharePoint services, assuming the absence of network speed or hardware limitations.

· The system must auto save data/progress in the case of a system outage. Students cannot be expected to restart any part of a process due to system outage.

· Documents must be printable. In case of platform degradation, the government requires access for continuous processing to include accessing document libraries and printing abilities (i.e. manual system, offline working file).

· Auto populate documents containing SSANs with CUI banner, footer, and designator indicator block markings. Note: Only applies if documents downloaded or attached will contain a member’s SSAN.

5. Training:

The contractor must conduct on-site training for up to 130 users over the course of 5 days. Training sessions must occur during normal duty hours (0800–1500 CST, Monday–Friday) and include the following:

· Operation of the software

· Operational processes

· System programming options

· Backup procedures.

The contractor must provide operations manuals and training materials (“how to guide” and “troubleshooting guide” at a minimum).

6. Software Support:

The contractor must provide annual software support. Annual support must cover licensing, software updates, and Helpdesk assistance. The Helpdesk must be available for trouble shooting via phone call or instant messaging from 0700-1600 CST Monday through Friday to exclude all federal holidays. System degradation directly impacts student technical training out-processing. Therefore, issues reported to the Help Desk by 1200 CST must be acknowledged by end of day. System outages require resolution within four hours, or a status update must be provided. The contractor acknowledges that Air Force Office 365 services undergo regular cybersecurity patching (approximately ten updates annually). The vendor is responsible for resolving any system issues resulting from these updates as part of normal maintenance.

7. Warranty

The contractor must provide a standard commercial warranty. Warranty services must commence upon acceptance and include detailed written procedures for issue resolution.

The contractor must provide operations manuals and training materials (“how to guide” and “troubleshooting guide” at a minimum).

8. Cybersecurity requirements

The system must be capable of meeting Department of War cybersecurity requirements. Specific features and requirements include but are not limited to the listing in Attachment 1, Cybersecurity and Related System Requirements.

9. SECURITY REQUIREMENTS.

9 INFORMATION PROTECTION.

Common Access Card (CAC) Credentialing Requirements.

There are two SP personnel categories outlined in this section. “Covered” SP personnel are those who require a national security background investigation to fulfill their contractually driven duties. “Uncleared” SP personnel are those who do not require a national security background investigation to fulfill their contractually driven duties. Unless explicitly specified otherwise in this section, the term “SP Personnel” or “SP Employee” refers to both categories, Covered or Uncleared.

The SP must comply with FAR 52.204-9, Personal Identity Verification of Contractor Personnel, Office of Personnel Memorandum, 15 December 2020, Credentialing Standards for Issuing Personal Identity Verifications Cards under Homeland Security Presidential Directive 12 and New Requirement for Suspension or Revocation of Eligibility for Personal Identity Verification Credentials, DoDI 5200.46, DoD Investigative and Adjudicative Guidance for Issuing the Common Access Card (CAC), DoDM 1000.13, DoD Identification (ID) Cards, ID Card Life-Cycle, and DAFI 36-3026 Vol 2, Common Access Card (CAC).

The SP must maintain a current listing of employees and identify those SP employees who require a CAC. The list must include employees’ name (First, MI, Last). The list must be validated and signed by the SP Program Manager or designee and provided to the Contracting Officer (CO), COR, and Mission Partner Affiliation Sponsor (MPAS) at least 30 calendar days prior to the contract start date. Updated listings must be provided to the CO, COR and MPAS no later than 5 business days of a change in an existing employee's status or information (e.g. name change), or when employee(s) are added or removed. The SP must ensure sensitive information (i.e., Privacy Act information) is properly marked and protected from unauthorized access, disclosure, or manipulation. Exception: The SP must notify the CO, COR and MPAS no later than 24hrs of SP personnel who leave abruptly, without notice and do not turn in their CAC beforehand. One of 3 criterion must apply for SP personnel to be sponsored for a CAC. They must require:

a. Both physical access to a DoW installation and access, via login, to a DoW Information Technology (IT) network

b. Access to a DoW IT network

c. Access to multiple DoW installations on a recurring basis for 6 or more months

Actions will be taken by the government to issue a Defense Biometric Identification Data System (DBIDS) Card for SP personnel requiring access to Sheppard AFB, however, not meeting requirements for CAC sponsorship. SP personnel being sponsored for a CAC will be provided instructions by the government on how to complete the DoD ICAMSS application and then notify the SP when approved. SP personnel must obtain a CAC from the nearest Real Time Automated Personnel Identification Documentation System (RAPIDS) Issuing Facility (typically the local Military Personnel Flight (MPF)). While visiting or performing work on installation(s)/location(s), SP personnel must wear or prominently display the CAC as required by the governing local policy.

SP personnel not meeting reciprocity requirements for CAC eligibility, as outlined in DoDI 5200.46 and the 15 December 2020 OPM memorandum, must undergo the following credentialing requirements.

Interim CAC Eligibility Credentialing Requirements.

An interim CAC eligibility determination will be rendered by a representative from the 82d Force Support Squadron Civilian Personnel Section (82 FSS/FCSA) upon:

a. Submission of a Tier 1 or higher-level investigation request to the DoD investigation service provider

b. Favorable review of the intended CAC recipient’s completed investigative questionnaire

c. Favorable review of a Federal Bureau of Investigation (FBI) National Criminal History Check (fingerprint check)

SP personnel requiring elevated privileges to the unclassified network must possess a favorably adjudicated Tier 3 national security investigation in accordance with DoDM 5200.02_AFMAN 16-1405, Section 2, Paragraph 3.2.b.(2), Table 2, before being granted privilege access to the network. The government must submit all investigation request at no cost to the SP through the sponsoring unit’s security assistant to the 82d Training Wing Information Protection office (82 TRW/IP).

Final CAC Eligibility Credentialing Requirements.

Once the background investigation is completed, a final CAC eligibility determination will be issued by the Defense Counterintelligence Security Agency (DCSA) Trust Decision Adjudication (TDA). If DCSA TDA defers the decision, an 82 FSS/FSCA representative will render the final determination.

Uncleared SP personnel whose final CAC eligibility is at risk of being denied or revoked are entitled to due process in accordance with DoDI 5200.46, implemented through local procedures established at Sheppard AFB. See “Denial or Revocation of Final CAC Eligibility.”

If a Covered SP employee receives a denial or revocation of eligibility for access to classified information or for a sensitive national security position, this automatically results in concurrent denial or revocation of final CAC eligibility. Because Covered SP personnel already receive due process under national security adjudication standards, DoDI 5200.46 due process requirements do not apply in these cases.

SP personnel whose final CAC eligibility has been denied or revoked may reapply for a Personal Identity Verification (PIV) credential no earlier than 1 year after an adjudication or appeal authority issue its final decision.

Intent to Deny or Revoke Final CAC Eligibility (Uncleared SP Personnel).

Uncleared SP personnel will be notified by 82 FSS/FSCA in writing, via a Statement of Reasons (SOR), of the intent deny or revoke their final CAC eligibility with the applicable disqualifying condition(s) from the HSPD 12 credentialing standard(s). Uncleared SP personnel will be provided 10 calendar days to acknowledge receipt and 30 calendar days to provide a written response to refute or mitigate the concerns noted in the SOR.

Denial or Revocation of Final CAC Eligibility (Uncleared SP Personnel).

Uncleared SP personnel will be notified by 82 FSS/FSCA, in writing, via a Letter of Denial/Revocation, of the decision to deny or revoke their final CAC eligibility with the reason that their SOR response failed to mitigate the applicable disqualifying condition(s) from the HSPD 12 credentialing standard(s). Uncleared SP personnel will be provided 10 calendar days to acknowledge receipt and convey their intent to appeal the denial/revocation and 30 calendar days to provide a written response refuting or mitigating the concerns noted in the SOR to the 3-member Sheppard AFB Appeals Board (SPSAB) though the 82 TRW Director of Staff (DS). After providing the SPSAB their response, the Uncleared SP employee will be notified in writing of the SPSAB decision within 45 calendar days. If the SPSAB renders a favorable final CAC eligibility the MPAS will be notified to reissue the Uncleared SP employee a CAC. If the SPSAB upholds the denied/revoke final CAC eligibility credentialing, their decision is not subject to further appeal.

Reporting Adverse Information on SP Employee(s) Issued a CAC Credential.

The SP must immediately, and no later than 5 business days after discovery, notify the 82 TRW/IP, through the COR and sponsoring unit SA, upon becoming aware of any credible adverse information on SP personnel. 82 TRW/IP will notify 82 FSS/FSCA. Although not all inclusive, adverse information (e.g. work mishaps, failed urinalysis, arrest, DUI/DWI, domestic violence, etc.) that may pose a risk to the life, safety, property, or health of employees, contractors, vendors, or visitors to a federal facility; to the government’s physical assets or information systems; to records, including privileged, proprietary, financial or medical records; or to the privacy of the individuals whose data the government holds in its system. This includes notifying the 82 TRW/IP of adverse information leading to terminating SP personnel for cause.

Based on the nature and severity of the risk, 882 FSS/FSCA may issue a suspension of CAC eligibility for affected SP personnel. When this occurs, 82 FSS/FSCA will notify the MPAS and COR through the unit SA. Upon notification of suspension, the SP must ensure affected SP personnel immediately return their CAC to the MPAS or COR.

Disposition of PIV or DBIDS Credential.

The SP must ensure SP personnel notify the MPAS or COR if their PIV or DBIDS credential is lost, damaged or compromised or when SP personnel are being suspended or out on short or long-term disability from employment no later than 1 business day of becoming aware. The SP must also ensure SP personnel return their PIV or DBIDS credential to the MPAS or COR under the following conditions no later than the 1 business day of becoming aware.

a. Suspension or revocation of PIV or DBIDS credentials eligibility

b. Termination of employment or contract

c. Possession of an expired PIV or DBIDS credential

d. No longer meets the criterion to be sponsored for a PIV or DBIDS credential

Operations Security (OPSEC). The SP must comply with Air Force OPSEC requirements in accordance with AFI 10-701, Operations Security (OPSEC). The SP must:

a. Become familiar with the organization's critical information and indicators

b. Protect critical information and indicators from disclosure. This includes, but is not limited to letters, articles, books, electronic mail (e-mail), social media postings, web log (blog) postings, internet message board discussions, or other forms of dissemination or documentation. SP employees should solicit the advice of their immediate supervisor, COR, unit SA, and/or base OPSEC Signature Manager, when publicly posting or publishing work-related information to internet-based capabilities. This will aid in preventing disclosure of critical information and indicators within the public domain.

c. Ensure photographs are not distributed nor publicly display critical information and indicators. Examples include but are not limited to casualties, destroyed or damaged equipment, protective measures of military facilities, and flightline activities.

d. Ensure employees do not publicly reference, disseminate, correct, or publish critical information or indicators already compromised. This provides further unnecessary exposure of the compromised information and may serve as validation.

e. Destroy (e.g., burn, shred) all products (e.g., official and working papers, hard drives, disks, tapes, recordings) containing critical information or indicators when no longer needed to prevent the reconstruction, inadvertent disclosure or exploitation of critical information.

f. Avoid discussing critical information on non-secure telephones, cellular, or satellite telephones, or other non-secure forms of communication equipment.

Controlled Unclassified Information (CUI). The SP must comply with DoDI 5200.48, Controlled Unclassified Information, DoDI 5200.48_DAFI 16-1403, Controlled Unclassified Information, DoDM 5200.01v1_DAFMAN 16-1404v1, Information Security Program, and FOIA Program. The SP must monitor CUI aggregation and compilation based on the potential to generate classified information pursuant to security classification guidance addressing the accumulation of unclassified data or information.

Security, Education, Training and Awareness (SETA). SPs personnel must complete SETA requirements driven by DoDM 5200.01v3, Information Security Program, DoDM 5200.02, Personnel Security Program, DAFI 16-1402, Insider Threat Program, DAFI 5200.48_DAFI 16-1403, Controlled Unclassified Information, and AFI 10-701, Operations Security (OPSEC) within thirty (30) calendar days of full performance start and annually thereafter as applicable. This includes SETA categorized as a Total Force Awareness Training requirement per DAFMAN 36-2689, Training Program. Guidance will be provided by the government at fulfilling the applicable SETA requirements.

Security Executive Agent Directive (SEAD) 3 Reporting Requirements. The SP must notify the sponsoring unit SA no later than 1 business day of becoming aware of any potential disqualifying condition(s) that meets a SEAD 3 reporting criterion pertaining to a SP employee(s) who requires a national security background investigation to fulfill their contractual duties at Sheppard AFB. The unit SA will notify the COR and 82 TRW/IP who will, in turn, report the incident to the DCSA Trust Decision Adjudication.

Insider Threat Reporting Requirements. The SP must report to the sponsoring unit SA no later than 1 business day of becoming aware of one or more Defense Insider Threat Management Analysis Center threshold event pertaining to a SP employee(s) possessing a credential to access Sheppard AFB. The unit SA will notify the COR and 82 TRW/IP who will, in turn, report the incident to the DAF Counter-Insider Threat Hub.

10. OMBUDSMAN.

1. An ombudsman has been appointed to hear and facilitate the resolution of concerns from offerors, potential offerors, and others for this acquisition. When requested, the ombudsman will maintain strict confidentiality as to the source of the concern. The existence of the ombudsman does not affect the authority of the program manager, contracting officer, or source selection official. Further, the ombudsman does not participate in the evaluation of proposals, the source selection process, or the adjudication of protests or formal contract disputes. The ombudsman may refer the interested party to another official who can resolve the concern.

2. Before consulting with an ombudsman, interested parties must first address their concerns, issues, disagreements, and/or recommendations to the contracting officer for resolution. Consulting an ombudsman does not alter or postpone the timelines for any other processes (e.g., agency level bid protests, GAO bid protests, requests for debriefings, employee-employer actions, contests of OMB Circular A-76 competition performance decisions).

3. If resolution cannot be made by the contracting officer, the interested party may contact the ombudsman, Mr. Juan Martinez, Deputy Director, AFICC/KT, 2035 First Street West, JBSA Randolph TX 78150-4304, telephone 210-652-1722, juan.martinez.2@us.af.mil.Concerns, issues, disagreements, and recommendations that cannot be resolved at the Center/MAJCOM/DRU/SMC ombudsman level, may be brought by the interested party for further consideration to the Air Force ombudsman, Associate Deputy Assistant Secretary (ADAS) (Contracting), SAF/AQC, 1060 Air Force Pentagon, Washington DC 20330-1060, phone number (571) 256-2395, facsimile number (571) 256-2431.

4. The ombudsman has no authority to render a decision that binds the agency.

5. Do not contact the ombudsman to request copies of the solicitation, verify offer due date, or clarify technical requirements. Such inquiries shall be directed to the contracting officer.

11. CONTRACTOR ACCESS TO DEPARTMENT OF AIR FORCE INSTALLATIONS.

1. The contractor shall obtain base identification and vehicle passes, if required, for all contractor personnel who make frequent visits to or perform work on the Department of the Air Force installation(s) cited in the contract. Contractor personnel are required to wear or prominently display installation identification badges or contractor-furnished, contractor identification badges while visiting or performing work on the installation.

2. The contractor shall submit a written request on company letterhead to the contracting officer listing the following: contract number, location of work site, start and stop dates, and names of employees and subcontractor employees needing access to the base. The letter will also specify the individual(s) authorized to sign for a request for base identification credentials or vehicle passes. The contracting officer will endorse the request and forward it to the issuing base pass and registration office or Security Forces for processing. When reporting to the registration office, the authorized contractor individual(s) should provide a valid driver’s license.

3. During performance of the contract, the contractor shall be responsible for obtaining required identification for newly assigned personnel and for prompt return of credentials and vehicle passes for any employee who no longer requires access to the work site.

4. When work under this contract requires unescorted entry to controlled or restricted areas, the contractor shall comply with the previously included requirements, DAFI 31-101, Base Defense Operations, and DoDMAN5200.02_DAFMAN16-1405_DAFGM2026-01, Air Force Personnel Security Program as applicable.

5. Upon completion or termination of the contract or expiration of the identification passes, the prime contractor shall ensure that all base identification passes issued to employees and subcontractor employees are returned to the issuing office.

6. The contractor shall provide an after-hours contact number or after-hours email in the Emergency Mass Notification System (EMNS) for each of their personnel, whose normal place of duty is on a DoD installation or within a DoD facility. The contractor shall comply with any additional requirements in DAFI 10-206, Operational Reporting for emergency operational reporting. Foreign Nationals may participate and may remove themselves from the Emergency Mass Notification System at any time. To update information, personnel can access the globe icon on their system desktop screens and choose the “Access Self-Service” option.

7. Failure to comply with these requirements may result in withholding of final payment.

12. COMMON ACCESS CARDS (CAC) FOR CONTRACTOR PERSONNEL.

1. For installation(s)/location(s) cited in the contract, contractors shall ensure Common Access Cards (CACs) are obtained by all contract or subcontract personnel who meet one or both of the following criteria:

· Require logical access to Department of Defense computer networks and systems in either:

· the unclassified environment; or

· the classified environment where authorized by governing security directives.

· Perform work, which requires the use of a CAC for installation entry control or physical access to facilities and buildings.

2. Contractors and their personnel shall use the following procedures to obtain CACs:

· Contractors shall provide a listing of personnel who require a CAC to the contracting officer. The government will provide the contractor instruction on how to complete the Contractor Verification System (CVS) application and then notify the contractor when approved.

· Contractor personnel shall obtain a CAC from the nearest Real Time Automated Personnel Identification Documentation System (RAPIDS) Issuing Facility (typically the local Military Personnel Flight (MPF)).

3. While visiting or performing work on installation(s)/location(s), contractor personnel shall wear or prominently display the CAC as required by the governing local policy.

4. During the performance period of the contract, the contractor shall:

· Within 7 working days of any changes to the listing of the contract personnel authorized a CAC, provide an updated listing to the contracting officer who will provide the updated listing to the authorizing government official;

· Return CACs in accordance with local policy/directives within 7 working days of a change in status for contractor personnel who no longer require logical or physical access;

· Return CACs in accordance with local policy/directives within 7 working days following a CACs expiration date; and

· Report lost or stolen CACs in accordance with local policy/directives.

5. Within 7 working days following completion/termination of the contract, the contractor shall return all CACs issued to their personnel to the issuing office or the location specified by local policy/directives.

6. Failure to comply with these requirements may result in withholding of final payment.

Attachment 1: Cybersecurity and Related System Requirements Developer and support personnel will be prohibited from taking or using Personally Identifiable Information (PII) or Controlled Unclassified Information (CUI) outside of the approved system. This limitation includes but is not limited to screenshots, email, ticketing, messages, recordings, analytics, or backups unless the system and flow are expressly identified and approved.

Compliance with, and inclusion of, the following criteria are required. NOTE: Compliance with DoW cybersecurity standards, both current and future, as well as compliance with applicable laws and regulations are required. This list is for reference but should not be considered to be all inclusive.

a. Vendor must be a certified Microsoft Developer or equivalent and authorized to work with Office 365 environments.

b. The vendor must meet all requirements to gain AFNET access and/or Air Force Information Systems.

c. Comply with "The Privacy Act, 5 U.S.C. 552a; 32 CFR Part 310; DoDI 5400.11; AFI 33-332; and RFO 24.104 and 52.224-1 through 52.224-2.

d. Provide a method of masking the visibility of Social Security Numbers.

e. Comply with Government approved Data Loss Prevention policies and connector allowlists to prevent unauthorized access to the DAF365 environment.

f. Prohibit consumer connectors and external AI, analytics, telemetry, source control, ticketing, storage, and backup.

g. Maintain production environments, identities, service principals, connections, and logs under government control.

h. Obtain Authorizing Official determination that the system is within an existing boundary.

i. Limit the ability to download and/or print any documents which have been uploaded to the system to specifically identified user groups.

j. Restrict access to any uploaded documents to specifically identified user groups.

k. Apply correct page markings (CUI, etc) to documents and system pages as required by current and future Department of War policy, as well as existing and future laws and regulations.

l. Comply with privacy-safe support rules and access limitations as outlined in RFO

24.104 and 24.3, RFO 52.224-1 through 52.224-3; RFO 52.204-9; DoD Class Deviation 2026-O0025; R-DFARS 252.204-7008 and 252.204-7012; the current DoD assessment clause under the deviation; and R-DFARS cloud provisions and clauses.

m. Comply with AFI 33-332 and R-DFARS 252.204-7012 as they related to potential or actual security breaches.

n. Comply with DODI 5200.48, RMF controls, and records/litigation-hold requirements as they related to CUI incidents, audits, and preservation.