SOO – Audit Services 27 Apr 2026

STATEMENT OF OBJECTIVES (SOO)

FOR

AIR FORCE SERVICES CENTER (AFSVC)

AUDIT SERVICES

SECTION I

1.0. INTRODUCTION.

1.1.This Statement of Objectives (SOO) is to acquire advisory and expert services from a qualified firm to support the Air Force Central Nonappropriated Funds (NAFs) for their annual independent audits. The primary objective of this engagement is to provide expert guidance and hands-on support to ensure the NAF financial statements are “audit ready”.

This means ensuring they are prepared to a standard that will allow an independent auditor to provide reasonable assurance that the statements are presented fairly, in all material respects, and in conformity with U.S. Generally Accepted Accounting Principles (U.S. GAAP), as well as policies prescribed by the Department of Defense (DoD), including DoD Financial Management Regulation 7000.14-R, Volume 13, and DoD Instructions (DoDI) 1015.15.

1.2.The Services herein are preparatory and advisory in nature and do not constitute the performance of the audit itself or replace the professional judgement of the eventual independent auditor.

1.3. BACKGROUND.

1.4.The Air Force Nonappropriated Fund (NAF) portfolio is a significant financial operation, managing total investments of approximately $3.4 billion. As the organization prepares for its Fiscal Year 2024 (FY24) audit, a critical need has been identified to ensure its financial records are audit ready.

1.5.Current processes are highly manual, which introduces risks to data accuracy and efficiency. Key deficiencies exist in the current documentation, creating an urgent need for the development, enhancement, and implementation of:

• Formal internal control documentation

• Timely and accurate reconciliations; and

DRAFT

• Standard Operating Procedures (SOPs)

1.6. This engagement is required to remediate these specific gaps and prepare the NAF portfolio for a successful financial audit. For the purpose of this engagement, the ten Air Force Central Nonappropriated Funds consist of the following:

1.6.1. Air Force Financial Management Fund (AFFMF). The AFFMF serves as the central bank for all installations, command, and Air Force level NAFIs and is administered by the Air Force Chief of Staff. It acts as the financial manager for all NAFIs under the oversight responsibility of the Air Force Service Council. It also acts as the bank for NAFIs of the Air Force Civilian Welfare Fund and the Air Force Fisher House Fund operating on Air Force installations. The system functions to concentrate daily cash deposits and disbursements made by field NAFIs throughout the world into one concentration account at a contracted national bank under the Cash Management Investment Program. AFFMF also provides loans to the other Air Force central NAFIs. Excess cash is invested in certificates of deposit and U.S. Government securities. Total asset balance as of September 30, 2024, approximates $1,415M. The financial framework of the AFFMF is prepared and recorded under the guidance of DoD prescribed regulatory policy.

1.6.2. Air Force Insurance Fund (AFIF). The AFIF is a self-insurance fund covering the civilian personnel employed with the NAFIs and certain property owned by the NAFIs. The programs are classified into the following groups: Property and Casualty Insurance Programs (Asset, General Liability, Aircraft Hull, & Aero Club Liability), Unemployment Compensation & Worker's Compensation, and Employee Benefit Programs (Group Life & Group Medical). The fund assesses each NAFI a specified rate for each type of coverage. The fund has established reserves and pays any claims on the various coverages for which they are liable. The fund is not completely self-insured. Premiums are paid to a commercial carrier for inventory losses at warehouses overseas to guarantee against excessive loss. In addition, the fund purchases commercial insurance coverage from independent companies for group life coverage. Total asset balance as of September 30, 2024, approximates $376M. The financial framework of the AFIF is prepared and recorded under the guidance of DoD prescribed regulatory policy.

1.6.3. Air Force Lodging Fund (AFLF). The AFLF provides funding for construction of Temporary Lodging Facilities (TLFs), Visiting Officer Quarters (VOQ), Visiting Airmen Quarters (VAQ), and Visiting Quarters (VQ) at various Air Force installations worldwide. The AFLF has the lodging centralization projects in place to improve efficiencies of installation lodging activities Air Force wide. The lodging centralization projects are funded by installation-level lodging NAFIs that have transferred excess monies to the AFLF. The AFLF's major source of revenue is the assessment charged to the field NAFIs on a predetermined daily rate per unit rented.

Total asset balance as of September 30, 2024, approximates $1,835M. The financial framework of the AFLF is prepared and recorded under the guidance of DoD prescribed regulatory policy.

1.6.4. Air Force Morale, Welfare, and Recreation Fund (AFMWRF). The AFMWRF provides funding to morale, welfare, and recreation programs that benefit U.S. Air Force personnel, DoD beneficiaries, and their dependents. The fund's major source of revenue is the declared dividends from the Army and Air Force Exchange Service (AAFES), the assessments of amusement machine revenue at overseas installations, and other authorized sources. AFMWRF also receives appropriated funds (APF) through Memorandum of Agreements (MOAs) from DoD for morale, welfare, and recreation programs. Available cash in the AFMWRF is transferred to the Air Force Base Capital Improvement Fund for capital improvement projects or for designated projects. Total asset balance as of September 30, 2024, approximates $536M. The financial framework of the AFMWRF is prepared and recorded under the guidance of DoD prescribed regulatory policy.

1.6.5. Air Force Base Capital Improvement Fund (AFBCIF). The AFBCIF’s principal function is to provide grants for capital improvements such as for equipment and facilities which the installation-level morale, welfare, and recreation funds cannot fund on their own. The major goal of the AFBCIF is to accelerate the flow of cash into needed capital improvements. The fund’s continuing operations and future capital improvement grants will be financed by income from interest earnings and a transfer of funds from the AFMWRF, when available. Additionally, AFBCIF receives MOA related transfers from AFMWRF for the benefit of installation-level NAFI project activities. Total asset balance as of September 30, 2024, approximates $742M. The financial framework of the AFBCIF is prepared and recorded under the guidance of DoD prescribed regulatory policy.

1.6.6. Air Force NAF Employee Retirement Plan Trust (AFERPT). The AFERPT serves as the funding medium for the U.S. Air Force Nonappropriated Fund Employee Retirement Plan for NAF civilian employees (the Plan). This Plan, a single employer plan, is a defined benefit plan covering participating U.S. citizens who are regular NAF civilian employees of Air Force NAFIs and certain other former AF NAFI employees with rights to benefit portability. Contributions made under the Plan are paid to the AFERPT. All assets held pursuant to the Plan are held in the AFERPT for the purposes and beneficiaries designated in the Plan’s plan document, including payment of administrative expenses. Total asset balance as of September 30, 2024, approximates $572M. The financial framework of the AFERPT is prepared and recorded as prescribed by accounting principles generally accepted in the United States (U.S. GAAP).

1.6.7. United States Air Force (USAF) Nonappropriated Fund (NAF) Employees’ 401(k) Savings Plan Trust (AFSPT). The USAF adopted a savings plan for regular USAF Nonappropriated fund employees, known as the USAF NAF Employees' 401(k) Savings Plan. The Plan requires the establishment of a trust into which any contributions paid to the Plan will be held by a Trustee and invested, reinvested, and distributed, all in accordance with the provisions of the Plan. The Plan and the Trust conform to the provisions of Sections 401(k) and 501(a) of the Internal Revenue Code of 1986. The Trust consists of contributions from plan participants and their employing NAFIs, dividends, interest, and other income from the investments. The Trustee maintains records of administration of Trust assets, including accounting for all Trust assets transferred to an Investment Manager and the receipts, investments, and disbursements related to assets so transferred. Total asset balance as of September 30, 2024, approximates $354M. The financial framework of the AFSPT is prepared and recorded as prescribed by accounting principles generally accepted in the United States (U.S. GAAP).

1.6.8. Air Force Civilian Welfare Fund (AFCWF). The AFCWF was established as an Air Force central NAFI for the purpose of serving as a successor fund for Nonappropriated funds (NAF) generated by the operation of civilian NAFIs, to provide a means by which funds may be distributed among civilian NAFIs, to manage central programs which support civilian NAFIs, and to provide funding to establish or support installation Civilian Welfare Fund programs. It is funded through the assessment income from installation civilian welfare NAFIs based on rates established by the Air Force Civilian Welfare Fund Board. Total asset balance as of September 30, 2024, approximates $1M. The financial framework of the AFCWF is prepared and recorded under the guidance of DoD prescribed regulatory policy.

1.6.9. Air Force Fisher House Fund (AFFHF). The mission of the AFFHF is to administer funds for the operation, maintenance, and improvement of all Fisher Houses in the Air Force by the Air Force Fisher House Fund Board which has oversight responsibility. Fisher Houses are built or designated to provide temporary housing and support for the patients who use military treatment facilities and their families. The Fisher House Foundation (FHF), a not-for-profit organization, builds the houses at no cost to the military. The houses are carried as assets of the installations. The primary revenue sources for AFFHF are donations, reimbursements from FHF for bed-nights, interest and dividends, and transfers from DoD Operations and Maintenance funds. Total asset balance as of September 30, 2024, approximates $45M. The financial framework of the AFFHF is prepared and recorded under the guidance of DoD prescribed regulatory policy.

1.6.10. Air Force Mission Essential Feeding Fund (AFMEFF). The AFMEFF was established to oversee and support the operations of mission essential feeding facilities at Air Force installations. The AFMEFF is primarily funded by appropriated funds authorized by statute through memorandum of agreements (MOAs) to support the food operations. Installation-level mission essential feeding facilities are grouped into portfolios under the guidance of the Air Force Food Transformation Initiative.

These portfolios consist of a certain number of AF installations whereby contracted vendors provide the necessary staffing for the operations, maintenance, and management of the feeding facilities of each designated portfolio. Total asset balance as of September 30, 2024, approximates $273M. The financial framework of the AFMEFF is prepared and recorded under the guidance of DoD prescribed regulatory policy.

1.7. PRIOR AUDITS.

For both Fiscal Year 2022 (FY22) and Fiscal Year 2023 (FY23), the independent financial statement audits resulted in a Disclaimer of Opinion. This outcome was due to the auditor’s inability to obtain sufficient appropriate audit evidence to support the financial statements, indicating fundamental deficiencies in the existing financial processes and a lack of reliable supporting documentation. In response, AFSVC has initiated internal efforts to remedy inefficiencies although gaps remain. This SOO is to acquire an expert advisory contractor to lead a comprehensive remediation program. The work required will directly address the root causes that led to the previous disclaimers of opinion. The contractor will be expected to:

• Assess and validate the remediation work already in progress

• Build upon efforts to develop a complete and robust control environment

• Design and implement solutions for all remaining deficiencies across the NAFs

SECTION II

2.0. CONTRACTOR QUALIFICATIONS

The Contractor must provide a team of qualified personnel with the collective expertise required to successfully execute the objectives outlined in this Statement of Objectives (SOO). The proposed team must demonstrate comprehensive experience in providing financial management advisory, audit readiness, and internal control remediation services to federal government agencies, with a strong preference for experience within the Department of Defense (DoD) or with Nonappropriated Fund Instrumentalities (NAFIs).

2.1. To meet the Government's objectives, the Contractor's proposed team must collectively possess the following capabilities and qualifications:

2.1.1. Project Leadership & Execution: Demonstrated prior experience successfully managing and executing projects of similar size, scope, and complexity. This includes the ability to serve as the primary Government point of contact, lead complex workstreams, and ensure the overall quality and timely delivery of all project objectives.

2.1.2. Subject Matter Expertise: A progressive mix of relevant professional experience across the team (ranging from foundational fieldwork up to eight or more years of advanced advisory experience) focused directly on audit readiness, internal and external auditing, government accounting, internal control design and remediation, and financial process improvement for government entities.

2.1.3. Technical Capabilities: Proven ability to execute complex financial tasks and detailed fieldwork, including but not limited to: process documentation, Standard Operating Procedure (SOP) development, account reconciliations, control implementation and testing, data analysis, and peer mentoring.

2.1.4. Professional Certifications: Inclusion of personnel holding active, relevant professional certifications required to validate financial deliverables. The team must include at least one licensed Certified Public Accountant (CPA) and should ideally incorporate other relevant credentials such as Certified Internal Auditor (CIA), Certified Government Financial Manager (CGFM), or Certified Information Systems Auditor (CISA).

2.1.5. Educational Foundation: Personnel performing detailed accounting, auditing, or financial fieldwork must possess a Bachelor's degree from an accredited college or university in Accounting, Finance, or a related business field, which must include a minimum of 24 credit hours in accounting.

2.2. Submission Requirements for Personnel Qualifications.

The Contractor's quote submission must include an organizational chart for the proposed team and a Key Personnel Qualifications Matrix. The matrix must clearly map the proposed key personnel (by role or name) to the minimum qualifications, certifications, and experience levels required to execute the objectives stated herein.

SECTION III

3.0. DELIVERABLES

3.1. The Contractor will provide the necessary advice and expert services to remediate the internal control deficiencies that led to prior audit disclaimers and to establish a sustainable, audit-ready financial environment for the 10 Air Force Central Nonappropriated Funds (NAFs). All deliverables must be submitted electronically in Microsoft Office, or Adobe PDF format to the COR. The deliverables are detailed below:

3.1.1. Project Management and Reporting. The Contractor will establish and maintain a formal project management framework to ensure the engagement stays on schedule and AFSVC has full visibility into progress and any emerging risks.

3.1.1.1. Project Management Plan (PMP): Within 10 business days of award, the Contractor will develop and deliver a draft PMP to the COR detailing the Contractor's approach for completing all tasks defined in SOO to include the project schedule, key milestones, risk management approach, communication plan, and resource allocation. The COR will provide feedback within 5 business days after receipt. The Contractor shall then have 5 business days to submit the Final PMP.

3.1.1.2. Monthly Progress and Reconciliation Package : The Contractor will provide the COR with a combined Monthly Progress and Reconciliation Package by the 15th of each month. These reports will detail activities completed, progress against milestones, risks and issues identified, and planned activities for the next period. The format will shift during the engagement from Contractor-prepared reconciliations to AFSVC-prepared/Contractor-reviewed reconciliations, as defined in the PMP. The COR will provide feedback or acceptance within 10 business days after receipt.

3.1.1.3. Review Sessions: The Contractor will conduct, at a minimum, bi-weekly status meetings with the COR and key NAF stakeholders to review progress, address concerns, and update action plans.

3.1.2. Financial Reconciliation and Remediation. The Contractor will be responsible for resolving all outstanding reconciliation issues and establishing a repeatable, internal capability for performing timely and accurate reconciliations.

3.1.2.1. Backlog Remediation: The Contractor will perform comprehensive cash and other key account reconciliations for all 10 funds, clearing the entire backlog from the start of FY24 to present. This includes identifying, investigating, and resolving all reconciling items.

3.1.2.2. Template Development: The Contractor will develop standardized, reusable reconciliation templates tailored to the specific needs of each fund.

These templates will become Government property.

3.1.2.3. Data Gap Analysis: The Contractor will identify gaps or deficiencies in current financial data required for successful reconciliation and provide actionable recommendations for corrective action.

3.1.3. Internal Control and Process Documentation. The Contractor will design, document, and support the implementation of a robust internal control framework and associated business processes.

3.1.3.1. Internal Control Assessment and Designs: The Contractor will assess the current internal control environment, identify deficiencies, and design an enhanced control framework that is compliant with COSO Internal Control framework and Government Auditing Standards (GAGAS).

3.1.3.2. Control Documentation: The Contractor will formally document all recommended internal controls in a comprehensive Risk and Control Matrix (RCM). This documentation will be sufficient to meet independent audit requirements.

3.1.3.3. Preliminary Draft of Key Documentation: To ensure the format and level of detail meet AFSVC expectations, the Contractor will provide the COR with a Preliminary Draft of the Standard Operating Procedures (SOPs) Manual and the Risk and Control Matrix (RCM) for a representative sample of two key processes. This is due no later than 60 days after contract award.

The COR will provide feedback within 15 business days after receipt.

3.1.3.4. SOP Development: After incorporating feedback from the preliminary draft, the Contractor will develop and deliver a comprehensive set of Standard Operating Procedures (SOPs) manuals and Internal Control Documentation for all 10 funds, covering all key accounting and financial reporting processes, including (but not limited to) cash management, revenue collection, procurement, fund transfers, and financial statement close processes. This is due no later than 120 days after contract award. The COR will provide feedback within 20 business days after receipt.

3.1.4. Knowledge Transfer and Staff Training. A critical component of this scope is to ensure AFSVC personnel are fully proficient in executing the new processes and controls to sustain audit readiness independently.

3.1.4.1. Formal Training: The Contractor will develop and deliver formal training sessions for all relevant accounting and management staff on the newly implemented reconciliation procedures, SOPs, and internal control responsibilities.

3.1.4.2. Proficiency Validation: In the final phase of the engagement, the Contractor's role will shift to one of quality assurance, reviewing the work performed by Government personnel to validate their proficiency and ensure procedures are being executed correctly.

3.1.5. Draft Final Report and Training Materials. After receipt of feedback on the draft documentation, the Contractor shall provide the COR with a Draft Final Report summarizing all project findings and remediation activities, along with all Draft Training Materials. This is due 30 business days before the end of the period of performance. The COR and other stakeholders will provide feedback within 15 business days after receipt. NOTE: There can be several generations of the Draft Final Report until all stakeholder feedback is adjudicated

3.1.6. Final Deliverable Package. After concurrence on the Draft Final Report, the Contractor shall have 10 business days to provide the COR with the Final Deliverable Package. This package will contain the final, approved versions of all project documentation, including the Final Audit Readiness Report, Final SOP Manuals, Final Internal Control Documentation, all Reconciliation Templates, and all Training Completion Records. This submission marks the completion of the contract.

SECTION IV

4.0. CONTRACT ADMINISTRATION.

4.1. Reporting.

4.1.1. The Contractor will provide weekly progress reports (See sample in 7.3.

Weekly Status Report) and/or other updates as needed to provide the Contracting Officer’s Representative (COR) with the status of the tasks completed for the week.

The status report must identify action and/or items completed by individual contract resources, planned task/activities, risks and status updates.

4.1.2 Provide a list of planned task/activities for the week in the status report.

Subsequent status reports will include completed percentage of the previous week’s planned task/activities and a new list of planned activities for the following week.

4.1.3 The Contractor will provide a monthly contract progress report, with their monthly invoice, that will be consistent with the submitted and COR approved weekly status reports. (See 7.4. Contract Progress Report).

4.2. Meetings.

4.2.1. Kick-Off Meeting. A kick-off meeting will be held virtually no later than five

(5) business days after contract award, on a date and time agreed upon by both parties. The Contractor will designate a primary Point of Contact (POC).

4.2.2. Status Meetings. The frequency, day and time of status meetings will be determined by the COR and the Contractor after contract award.

4.2.3. Meeting Minutes. Status and recommendations identified or discussed in meetings or collaborative sessions will be provided in writing by the Contractor within four (4) business days of initial discussion unless otherwise coordinated between the COR & Contractor.

SECTION V

5.0. GENERAL INFORMATION.

5.1. Place of Performance

5.1.2. Work for this contract will be conducted on site at Air Force Services Center (AFSVC) 3515 S. General McMullen, San Antonio, TX 78236-9854 alongside the AFSVC COR and the Subject Matter Expert (SME) staff.

5.2. Government Furnished Equipment (GFE) & Personnel

5.2.1. AFSVC will provide GFE-owned PCs to do the required work and to access the applications along with workspace for Contractor’s personnel.

5.2.2. If the GFE malfunctions, the Contractor must notify the COR immediately.

5.2.3. GFE Updates. Any updates or additional required software, security patches, or maintenance will be accomplished by AFSVC. If required, AFSVC will provide other GFE as resources permit during this timeframe.

5.3. Travel

5.3.1. All travel must be mutually coordinated & reimbursed by AFSVC in accordance with the Federal Travel Regulations (FTR see Clause 29 of the NAF Standard Clauses).

5.4. Identify Known or Possible Conflicts of Interest

5.5. Security and Training Requirements

5.5.1 Highest level: UNCLASSIFIED. The preponderance of work will be at the unclassified level.

5.5.2 Building Access. Unescorted access to AFSVC Building 1 is approved on a case-by-case basis and will be coordinated through the COR and AFSVC’s Security Manager.

5.5.3 Training. Cyber Awareness Challenge Training, Controlled Unclassified Information (CUI) Training (one-time) and Privileged User Cybersecurity Responsibilities (if server access is required). All Government training required will be provided at no cost by the Government.

5.6. Security Clearances

5.6.1 The Contractor will ensure that personnel requiring access to AFSVC information systems, or its data have the proper and current cybersecurity certifications as determined by AFSVC cybersecurity teams to perform cybersecurity functions in accordance with DoDM 8140.03, Cyberspace Workforce Qualification and Management Program located at https://dodcio.defense.gov/Portals/0/Documents/Library/DoDM-8140- 03.pdf.

5.6.1 The Contractor shall meet the following contract/security clearance requirements, including:

5.6.1.1 The Contractor shall safeguard and comply with the rules and regulations issued under DoDI 5200.02, DoD Personnel Security Program (PSP), 21 Mar 2014; AFMAN 16-1405, Air

Force Personnel Security Program; AFM 33-152, User Responsibilities and Guidance For Information Systems; DoDD

8500.01 security, 14 Mar 2014; AFI 17-130, Air Force Cybersecurity Program Management; and DoDM 8140.03, Information Assurance Workforce Improvement Program requirements and respective updates to the listed rules and regulations. The Contractor shall follow the DoD Privacy Office guidelines for submittal of Information Assurance Technical (IAT) security clearances

5.6.1.2. Contractor personnel shall not be assigned to perform duties within IAT-II or IAT-III, and or requiring “Limited Privileged Access” such as system or database administration rights, to any NAFI application or network.

5.6.2. Tier 1 requests are initiated using the Standard Form (SF) 85. Tier 3 requests are Initiated using the Standard Form (SF) 86 and are submitted to the installation Information Protection Office through the Unit Security Manager. The initiation of the Tier 1 or Tier 3 shall include the submission of all required information and verified through the Department of Defense (DoD) Defense Information System for Security (DISS) database. The Contractor shall comply with the rules and regulations under DMDC Trusted Associate Sponsor System Overview Guide, Version 5.7, Sept 2018 and associated updates; all Common Access Card (CAC) holders must, at minimum, have an initiated a favorable completion of an FBI fingerprint check, or a DoD determined equivalent investigation. The NAFI may grant a waiver to allow the Contractor to start work after submitting all required information, passing a successful FBI fingerprint check and DISS.

5.6.3. All Contractor personnel requiring system access must be adjudicated with a Favorable determination in DISS.

5.6.4. All Contractor personnel requiring system access must sign a non-disclosure agreement.

5.6.5. All Contractor personnel requiring system access must respond to the AFSVC Security Manager’s inquiries within three business days (excluding federal holidays), not to exceed 72 hours. If Contractor personnel do not respond to the AFSVC Security Manager’s inquiries within three business days, their non-action on this matter provides grounds for termination.

5.7. Privacy Act.

5.7.1. The Contractor shall safeguard and comply with the agency rules and regulations issued under Public Law 110-53 (42 U.S.C. § 2000ee- 1) Section 803; Department of the Air Force Policy Directive (DAFPD) 33-3, Information Access Programs; Department of Defense Instruction (DoDI) 5400.11, DoD Privacy and Civil Liberties Programs; DoD 5400.11-R, Department of Defense Privacy Program; Department of Defense Instruction (DoDI) 5400.16, DoD Privacy Impact Assessment (PIA) Guidance; DoDI 1000.30, Reduction of Social Security Number (SSN) Use Within DoD; the Privacy Act of 1974 (5 U.S.C. § 552a); the E-Government Act of 2002 (44 U.S.C. 3601 et seq.); Office of Management and Budget (OMB) Memorandum M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information; and AFI 33-332, AF Privacy and Civil Liberties Program and associated updates to the agency rules and regulations. Penalties are applied for misuse or unauthorized disclosure of PII. The Act (5 U.S.C. 552a) provides for civil remedies for injured parties, including actual damages, attorney fees, and litigation costs.

5.8. Cybersecurity.

5.8.1. Where applicable, the Contractor shall ensure all components in the contractor solution, any applications that process, store, and/or transmit credit card information/cardholder data are thoroughly assessed and meet the most current version of the Payment Card Industry Data Security Standards (PCI DSS). The solution must meet all PCI DSS compliance requirements identified by the Payment Card Industry Security Standards Council. The Contractor shall provide to the NAFI sufficient evidence of PCI DSS Compliance certification regarding the solution’s PCI DSS compliance status. All contractor activities must maintain strict adherence to PCI DSS v4.0.1 or later requirements including:

• Implementation of all applicable security testing procedures per Requirement 11

• Maintenance of secure coding practices per Requirement 6.2.4

• Regular security awareness training per Requirement 12.6

• Incident response procedures per Requirement 12.10

5.8.2. Federal Cybersecurity Standards:

• Compliance with NIST SP 800-53 security controls

• Implementation of CISA cybersecurity directives

• Adherence to DoD 8500 series information assurance requirements

• Integration with DoD Risk Management Framework (RMF) processes

5.8.3. Continuous Monitoring:

• Real-time security monitoring capabilities

• Automated compliance validation tools

• Regular penetration testing and vulnerability assessments

• Continuous network segmentation validation

5.9. Security Education, Training and Awareness (SETA) and Operations Security (OPSEC) Training.

5.9.1. Contractor employees will complete initial and annual refresher SETA and OPSEC training within five days of on-boarding for initial, and annually as dictated by the unit security manager.

5.9.2. Data Stewardship and Governance.

5.9.2.1. The NAFI will have unlimited rights to all technical data unless the Contractor takes specific actions and includes prescribed legends in their submission, and/or data products to limit or restrict such NAFI rights for particular identified items. “Technical data” refers to recorded information and includes, but is not limited to, research and engineering data and drawings, specifications, standards, process sheets, manuals, technical reports and computer software documentation. It does not include computer software or financial, cost/pricing or other contract and grant administrative data but does include any developed intellectual property not specific to the data.

5.9.2.2. Data and information generated during this agreement is owned by the NAFI. Data must be physically separated from the data of other users, on separate drives or computers, and appropriate firewalls must be established to prevent other users from accessing NAFI data.

5.9.2.3. All materials or reports generated using Air Force information are the property of the Air Force. The Air Force name or any plan information shall not be shared with a third party.

5.9.2.4. Should the NAFI elect not to execute option years or at the end of the contract period, whichever is sooner, data must at all times be promptly accessible until converted to the new system with no additional separation fee.

5.10 Contracting Officer’s Representative (COR) Responsibilities.

5.10.1. The Contracting Officer (CO) will designate an individual as the Contracting Officer’s Representative (COR).

5.10.2. The COR is responsible for administering the performance of work under this contract. In no event will any understanding, agreement, modification, change order, or other matter deviating from the terms of this contract be effective or binding upon the contracting customer unless formalized by proper contractual documents executed by the CO prior to the completion of the contract.

5.10.3. This designation will remain in effect throughout the life of the contract, unless terminated sooner in writing by the Contracting Officer or due to reassignment. Primary responsibilities of the COR may include, but are not limited to, the following:

5.10.3.1. The COR is responsible for performing post award

administrative functions necessary to ensure performance of services required by this contract. If the COR believes performance by the Contractor has not met the level required by the contract, the problem will be referred to the CO for resolution.

5.10.3.2. The COR will maintain and approve the list of all products required to be delivered by the Contractor as well as when the product is delivered and its acceptability status, this includes the project schedule.

5.10.3.3. The COR will maintain a record of all contract deliverables and a copy of the email message or cover letter used to deliver the deliverables.

5.10.4. COR will work with the CO to ensure the following responsibilities are adhered to:

5.10.4.1. Verify that the Contractor performs the technical requirements of the contract in accordance with the terms, conditions, and specifications therein. Specific emphasis will be placed on the quality provisions, for both adherences to the contract provisions and to the contractor's own quality control program.

5.10.4.2. Perform, or cause to be performed, inspections necessary in connection with contractual performance and verify that the Contractor has corrected all deficiencies.

5.10.4.3. Perform acceptance for the customer of services performed under this contract.

5.10.4.4. Communication will be the key to success of this effort.

Maintain liaison and direct communications with the Contractor and the CO. Written communications with the Contractor and other documents pertaining to the contract will be signed by the COR and a copy will be furnished to the CO.

5.10.4.5. Monitor the contractor's performance, notify the Contractor of deficiencies observed and direct appropriate action to affect correction.

Record and report to the CO incidents of faulty or non-conforming work, delays, or problems.

5.11. AFSVC Point of Contact (POC) Responsibilities.

5.11.1. Appoint the AFSVC POC prior to commencement of work.

5.11.2. Arrange Entrance/Exit Briefings with the AFSVC commander and others.

5.11.3. Assist the Contractor by providing entrance to the installation and reasonable communication capabilities to include telephones (DSN and Commercial) and internet.

5.11.4. Maintain direct contact, liaison, and interaction with the COR and Contractor.

5.11.5. Perform acceptance, in conjunction with the COR, of the deliverables/services performed under this contract.

5.11.6. Monitor the contractor's performance; record and report to the COR incidents of faulty or non-conforming work, delays, or problems.

10.0. DEFINITIONS & ABBREVIATIONS

Contracting Officer (CO). The duly appointed Government agent authorized to award or administer contracts. The contracting officer is the only person authorized to contractually obligate the Government.

Statement of Objective (SOO). A formal contracting document used to describe the goals and objectives expected from soliciting Contractor work.

AF – Air Force AFSVC – Air Force Services Center AFMAN – Air Force Manual AFI – Air Force Instruction APF – Appropriated Fund DAFMAN – Department of Air Force Manual DAFI – Department of Air Force Instruction DoD – Department of Defense DoDI – Department of Defense Instruction FSS- Force Support Squadron MWR – Morale, Welfare, and Recreation NAF – Nonappropriated Fund NAFI – Nonappropriated Fund Instrumentality SSC – Shared Service Center

9.1 Sample Weekly Status Reports or as agreed upon by COR

9.2 Sample Contract Progress Report

CUI

CUI

9.3 NAFI Observed Holidays

Holiday

New Year’s Day Birthday of Martin Luther King, Jr.

Washington’s Birthday Memorial Day Juneteenth National Independence Day Independence Day Labor Day Columbus Day Veterans Day Thanksgiving Day Christmas Day