SAM.gov Draft PWS.pdf

Air Force Research Laboratory (AFRL) Enterprise RDT&E IT Support (ERITS) Performance Work Statement (PWS)

AIR FORCE RESEARCH

LABORATORY (AFRL)

Enterprise RDT&E IT Support

(ERITS)

3 October 2024

Table of Contents

1.0 Background 7

Air Force Research Laboratory (AFRL) 7

Research Collaboration and Computing Directorate (RC) 7

Research Development Test and Evaluation (RDT&E) Environments 7

Enterprise RDT&E Services 8

Enterprise Laboratory Services Zone (ELSZ) 8

2.0 Enterprise Laboratory Services Zone(ELSZ) Support CLIN 0001 8

2.1 Scope 8

2.2 Task Areas 9

2.2.1 Research / Investigation 9

2.2.2 Testing 9

2.2.3 Software Testing 9

2.2.4 Implementation 9

2.2.5 Database Management 10

2.2.6 Operations 10

2.2.7 Maintenance 11

2.2.8 System and Capability Monitoring 11

2.2.9 Cybersecurity 11

2.2.10 Network Management 12

2.2.11 Remote Workstation Management 13

2.2.12 Help Desk Operations 13

2.2.13 Training/User Engagement 14

2.2.14 Software/Web Application Development or Modification 14

2.2.15 Documentation Support 14

2.2.16 Automated Data Processing Equipment (ADPE) Custodian Function 15

2.2.17 COMSEC Custodian Function 15

2.2.18 Classified Courier Function 15

2.2.19 Information Systems Security Manager (ISSM) 15

2.2.20 Remote Isolated Network Onboarding Assistance 15

2.2.21 Project and Team Management 15

2.2.22. Customer Outreach 16

Requirements 16

2.3.2 Tactical Operations Support 16

2.3.1.1 AFRL CITO Council Support 16

2.3.1.2 General Administrative Support 16

3.0 Deliverables 17

3.1. Contractor Submission 17

3.2. Government Review 17

3. Government Delays in Reviewing Deliverables or Furnishing Items 17

4.0. Service Delivery Summary (SDS) 18

5.0. Voluntary Protection Program (VPP) 18

6.0 Government Furnished Resources 21

Desk Telephones 21

Mobile/Wireless Telephones and Smart Devices 21

Electronic Mail (E-mail) 22

Copiers and Fax Machines 22

Computer and Internet 22

Canvassing, Soliciting, or Selling 22

Security Violations Using Government Equipment 22

Validation of Government Furnished Items (GFI) and Equipment Inventory 22

7.0 Contractor Furnished Resources 23

8.0 General Information 23

8.1 Place of Performance 23

8.2 Government Management 24

8.3 Non-Disclosure Agreements (NDAs) 24

8.4 Normal Duty Hours 24

8.5 Extended Hours and Surge Support 24

8.6 Materials Purchasing – CLIN 0004 25

8.7 Travel – CLIN 0005 25

9. Initial Business/Kickoff Meeting 27

10.0 Contractor Employee and Training Requirements 27

11.0 Contractor Point of Contact (POC) 28

12.0 Security and Identification Procedures 28

13.0 Quality Control 30

14.0 Quality Assurance 30

15.0 Performance of Services During Emergency Conditions 30

16.0 Contractor Manpower Reporting 31

17.0 System Transition 31

Phase-In Plan 31

1819.0 Anticipated period of performance 33

19.0 Critical skills for this effort 34

20.0 Anticipated Hardware and Software to be Supported 34

20.1 Representative Hardware 34

20.2 Representative Software 35

21.0 PERSONNEL 35

General Requirements 35

21.1 Specific Expertise and Experience 36

21.2 Training 37

21.2.1 Contractor Staff Training 37

21.2.2 Mandatory Government Training 37

21.3 Personnel Retention and Recruitment 37

22.0 Contractor Performance Assessment Reporting System (CPARS) Assessment

Personal Service 38

APPENDIX A: Environment Breadth and Complexity 40

A.1 AFRL RDT&E ELSZ 40

A.1.1 Current Approved Zones 40

A.1.1.1 Unclassified Extranet 40

A.1.1.2 Unclassified Isolated Intranet 40

A.1.1.3 VISION 40

A.1.1.4 Digital Laboratory Environment (DLE) 40

A.1.2 Current Core Capabilities 41

A.1.2.1 Large File Transfer and Sharing 41

Secure File Transfer Protocol (SFTP) 41

Web-based File Sharing (NextCloud) 4241

A.1.2.2 Distributed Software Development 42

GitLab Enterprise 42

A.1.2.3 Web-based collaboration 42

Tiki 4342

Media Wiki 4342

A.1.2.4 Email List Serving (Mailman) 43

A.1.3 Current Additional Isolated-Only Services 43

A.1.3.1 Isolated-to-isolated Email 4443

A.1.3.2 Isolated-to-isolated Instant Messaging 4443

A.1.3.3 Isolated-to-isolated Virtual Meetings 4443

A.1.4 Possible Future Expansion 44

A.1.4.1 Possible Future Zones 44

A.1.4.2 Possible Future Capabilities 44

A.1.4.2.1 Comprehensive Search 44

A.2.1 Current Approved Environments 44

A.2.1.1 Unclassified DREN 44

A.2.1.2 Unclassified Isolated 4544

A.2.1.3 VISION 45

A.2.2 Current Services 4645

A.2.2.1 Infrastructure Services 4645

Authentication 4645

Domain Name Service (DNS) 4645

Network Time Protocol Service (NTP) 4645

Encryptor/VPN management 46

Automated IT Systems Lifecycle Management 46

A.2.2.2 Cyber Security Services 4746

Update Services 4746

Linux Update Service 4746

Software Library Update Service 47

Anti-Virus / Anti Malware Update Service 47

System log centralized collection, review, and archiving 4847

Security Information and Event Management (SIEM) 4847

Assured Compliance Assessment Solution (ACAS) Scanning and Reporting

A.2.3 Possible Future Expansion 4847

A.2.3.1 Possible Future Environments or Task Areas 48

Network Troubleshooting 48

Centralized Site Firewall Administration and Monitoring 48

System Hosting and Management 48

Mobile Support 4948

APPENDIX B: Federal, DoD, and Air Force IT and Cyber Security Policies and Instructions 5049

APPENDIX C. Service Delivery Summary 5150

1.0 Background

The Air Force Research Laboratory (AFRL) is the primary research and development organization for the U.S. Air Force. AFRL consists of nine Technology Directorates (TDs) and a headquarters organization with over 11,000 members including over 6,000 scientists and engineers (S&Es). AFRL is headquartered at Wright Patterson Air Force Base (WP AFB) (AFRL HQ, Sensors Directorate, Materials Directorate, Aerospace Vehicles Directorate, and the 711th Human Performance Wing) with remote organizations at Arlington, Virginia (Air Force Office of Scientific Research); Rome, NY (Information Directorate); Eglin AFB, FL (Weapons Directorate); Kirtland AFB, NM (Space Vehicles Directorate and Directed Energy Directorate); Edwards AFB, CA (Aerospace Vehicles Directorate); and Maui, HI (Directed Energy Directorate).

Digital Capabilities Directorate (IZ)

The Digital Capabilities Directorate (IZ) provides enterprise Information Technology (IT) capabilities to AFRL. IZ has six divisions: Cyber Security Management (IZC); Service Delivery and Support (IZD); Financial Management (IZF); High Performance Computing Shared Resource Center (IZH); Support Request (IZR); and Architecture and Experimentation (IZX). IZ staff are spread across several buildings at WP AFB, OH (buildings 676, 45, 15, and 16).

Research Development Test and Evaluation (RDT&E) Environments

AFRL has over 13,000 research, development, test, and evaluation (RDT&E) IT systems using a diverse set of operating systems including Microsoft Windows 10 (roughly 45%), Apple Mac OSX (roughly 10%), and various Open-Source Linux distributions (roughly 45%) (Red Hat Enterprise Linux, CentOS, Fedora, Ubuntu, etc.).

These systems are spread across several networks depending on requirements. The Non-classified Internet Protocol Routing NETwork (NIPRnet) or Air Force NETwork (AFNET) is the Air Force business and operations network. AFRL has moved the majority of research IT systems off of AFNET because of strict security constraints that impede conducting research. The Defense Research and Engineering Network (DREN) is a high speed (100Gbps backbone), low latency network dedicated to research and engineering. Most of AFRL's research IT systems that require external network access (Internet) are connected to enclaves connected to DREN. Depending on requirements, some systems may be separated off onto isolated/segregated or stand-alone networks that maximize flexibility but greatly limits collaboration between labs and sites. AFRL's research IT environment also spans Unclassified, Collateral Secret, and Top Secret and above networks.

Enterprise RDT&E Services

Enterprise Laboratory Services Zone (ELSZ)

The AFRL RDT&E ELSZ is a research collaboration and information sharing environment intended to meet the unique needs of AFRL's S&Es. It is intended to support collaboration between AFRL sites as well as between AFRL S&Es and their external partners (academics, contractors, other government agencies, and other DoD services). It is not intended to duplicate other collaborative services already available through other Air Force or DoD collaboration systems (MS SharePoint, milSuite, etc.).

The ELSZ environment currently consists of three operating environments: the Unclassified ELSZ DREN Extranet, the Unclassified ELSZ Isolated Intranet (ISO-U), and the VISION (VISION).

The current ELSZ environments are based on virtualized servers running on top of a type 1 hypervisor on blade servers connecting to an iSCSI (Internet Small Computer System Interface) based Storage Area Network (SAN) via multiple 10Gbps Ethernet links. The overall environment has a 10Gbps Ethernet link to the DREN. The virtual servers providing the user and infrastructure capabilities are typically running either Microsoft Windows Server, Red Hat Linux or CentOS Linux. There are also a handful of Microsoft Windows based servers for Windows Update Services and Active Directory (AD) authentication services

The core ELSZ infrastructure is housed in the building 676 data center at WPAFB in Dayton, Ohio.

2.0 Enterprise Laboratory Services Zone(ELSZ)

Support CLIN 0001

2.1 Scope

The contractor shall perform the following task areas across all current environments and capabilities described in Appendix A, Section A.1 (AFRL RDT&E ELSZ Environment Breadth and Complexity). The AFRL RDT&E ELSZ system is focused on user capabilities supporting research collaboration and information.

2.2 Task Areas

2.2.1 Research / Investigation

The contractor shall research new collaboration and information sharing capabilities.

The contractor shall provide results of their research to the ELSZ Program Manager.

2.2.2 Testing

The contractor shall test capabilities as needed. Test virtual systems shall be developed in an environment with access restrictions as needed.

2.2.3 Software Testing

The contractor shall verify and conduct, if necessary, all software and applications used in the Enterprise RDTE IT Environment are tested and formally approved by the applicable system Authorizing Official (AO) or if not yet tested and approved the contractor shall schedule and perform the software testing. Software testing shall address three priority areas:

1. All operating systems, application or server software and web applications used in the AFRL Enterprise RDT&E IT environment, including the ELSZ environment.

2. Common client software used to access ELSZ services (some examples could include but not be limited to FileZilla and other SFTP clients and SFTP/SSHFS clients for Windows or the Git Large File Support (LFS) extension).

3. Other RDT&E software common to the AFRL RDT&E environments that has not been tested yet.

All software testing shall use an AFRL enterprise Cybersecurity office approved process and results shall be submitted for AFRL enterprise wide RDT&E approval for use. Any existing software used that has significant updates shall be re-tested and approved by the AO prior to being put in production use. Minor software updates do not require AO re-approval but should be reviewed and approved by the Enterprise RDT&E ISSM prior to implementation.

2.2.4 Implementation

The contractor shall implement ELSZ capabilities on virtualized and or containerized systems built using automated processes (Ansible). All code implementing system configuration changes, or any manual changes shall be managed using the ELSZ-hosted installation of GitLab.

The contractor shall construct a virtualized and/or containerized (Docker, OpenStack, Kubernetes, etc.) service infrastructure for the new zones as decided by the ELSZ Program Manager. All application and user data and databases shall be stored on the network storage and not within the virtual machine disk image unless pre-approved by the Program Manager. The contractor shall configure the servers into logically or physically segregated pools so that access to Virtual Machines can be restricted to just contractor system admin staff or open to all ELSZ users or open to contractor system admin staff and select test users.

2.2.5 Database Management

The contractor shall implement, configure, harden, operate, and optimize a variety of database servers to include MySQL, MariaDB, and PostgreSQL to support web-based user applications.

2.2.6 Operations

Once the virtualization/containerization foundation, supporting infrastructure capabilities, and collaborative capabilities are in place, operational, and security hardened – the contractor shall maintain these capabilities in compliance with Federal, DoD and AF IT and security requirements listed in Appendix B.

The contractor shall perform weekly back-ups (full back-up each weekend with incremental back-ups nightly) of user data and system images.

This software could be Open-Source Software, government purchased and provided commercial software, or contractor purchased software.

All activities shall be carried out in full compliance with relevant Federal, DoD, AF, AFMC, Base, and Organizational regulations, instructions, and procedures listed in Appendix B. The contractor shall be responsible for assessing and adapting operations to comply with changes in official Government policy in these areas when notified by the Government team that a relevant policy has changed that could affect work done on this contract.

The contractor staff shall enter and track all user support issues and non-helpdesk/non-repeating work in a web-based helpdesk ticket and issue tracking system that is part of the overall ELSZ system. Contractor use of the Government identified system is mandatory. This includes all work done on the systems whether it is a user support issue or an internal issue.

The ELSZ system has been described as a non-mission critical system. The system description and system security authorization package describe that uptime will be best effort during normal business hours. Scheduled downtime, due to system or application patching or restarting, shall be minimized during normal duty hours and coordinated with the ELSZ Program Manager. Unscheduled downtime shall be reported to the ELSZ Program Manager as soon as possible. Classified data spillage incidents, major hardware failures, or other events such as power outages or weather-related issues that could cause significant delays in a return to normal operational status shall also immediately be reported to the ELSLZ program manager. A return to operational status will be best effort during normal duty hours when facilities are accessible, and the government shall be notified of an estimated time of completion as soon as possible.

Each interrupt/outage shall be logged and disclosed to the Government (a) within 24 hours and (b) in a format (provided by the Government).

The ELSZ operations shall be manned by the contractor, at a minimum, from 8am to 5pm, Eastern Daylight Time (EDT), Monday through Friday except Federal holidays.

2.2.7 Maintenance

The contractor shall maintain all ELSZ components and systems. Significant patches or updates shall be installed and tested on the ELSZ testing infrastructure. If there are no problems, then the Patches or updates shall be applied to the appropriate production server(s).

All physical and virtual server Secure Shell (SSH) based access shall be via CAC certificate or SSH-key based authentication. All SSH processes shall be configured to deny username-password authentication, unless absolutely required as determined by the Government Program Manager, on a system-by-system basis, for all physical and virtual systems across all support environments. All formal systems administrators' SSH keys shall be replicated to all physical and virtual systems across all support environments.

2.2.8 System and Capability Monitoring

The contractor shall complete the implementation of Zabbix in order to automate the collection and display of systems, capability usage, and reliability metrics data on web-based dashboards. An application status dashboard shall be accessible to anyone with an account in the environment.

2.2.9 Cybersecurity

The contractor shall ensure that all contractor staff servicing the organization are made aware of their duties, restrictions, procedures and regulations relating to information security. Contractor-provided Information Assurance (IA) services shall include, but are not limited to:

● Maintain and utilize Elastic Search

● Implementing and tracking compliance with network security directives

● Conducting weekly scheduled vulnerability scans using at least ACAS, and resolving identified issues

● Conducting ad hoc vulnerability scans using ACAS as necessary

● Tracking and resolving malicious logic incidents

● Handling account requests to include creating the accounts, password resets, updates to accounts, etc.

● Resolution of classified spillage incidents. A spillage incident could be identified by either Government or Contractor personnel. The Contractor shall be in charge of notifying the Cyber Security Office who will inform the Contractor of the steps required to resolve the issue

All physical and virtual servers shall be security hardened according to the relevant DISA Security Technical Implementation Guides (STIGs) or as documented in the system security authorization package (A&A). All approved deviations from the STIG configurations shall be documented in a Plan of Actions and Milestones (POA&M) as part of the AFRL Enterprise RDT&E environment Risk Management Framework (RMF) A&A package.

All physical and virtual servers shall have all Air Force designated Category 1, critical, and high vulnerabilities corrected or mitigated within two weeks of detection and identification. Air Force designated Category 2, 3, and medium vulnerabilities shall also be corrected or mitigated within 30 days. Air Force designated low vulnerabilities shall be corrected or mitigated within 60 days. DoD/AF will determine the level of vulnerability. The contractor shall create POA&M entries for any vulnerability that cannot be corrected, to document mitigation measures.

The contractor shall provide STIG compliance reports and resolved vulnerability scan reports to the Information System Security Manager (ISSM) for inclusion in the (A&A).

In addition to the ELSZ hosted environments, the contractor shall security harden, patch, and cybersecurity monitor all baseline systems (TACLANEs, Firewalls, Linux workstations, and Windows workstations) within the VISION network environment.

2.2.10 Network Management

The contractor shall manage ELSZ to the External Router and External Firewall that are connected to the DREN Point of Presence at WP AFB. The contractor shall build and manage the firewall rules to control traffic to the enterprise environments.

The contractor shall install, configure, and manage all internal network devices in each service zone (Unclassified DREN, ISO-U, VISION) to include but not be limited to the top of rack switches, blade chassis network switches, storage switches, VPN appliances, and TACLANE encryptors.

ELSZ Isolated Network Interconnects Management: The contractor shall deploy, install, configure, and manage the VPN/firewall appliances to build the ELSZ wide-area isolated network. The contractor shall pre-configure the appliances as much as possible and ship them to identified AFRL sites. The contractor shall coordinate schedules and procedures with those AFRL sites to deploy and configure the VPN end points to join them into the wide area isolated network. The contractor shall utilize a centralized management console to maintain the network VPN interconnects and configure firewall rules to control traffic on the wide-area isolated network (what traffic is allowed to the ELSZ Isolated Intranet and what traffic is allowed between the interconnected laboratory networks). Some travel may be required to visit connecting sites to assist with implementation and configuration of the VPN appliances.

VISION Interconnects Management: The contractor shall deploy, install, configure, and manage the TACLANE encryptors to build the VISION classified wide-area isolated network. The contractor shall pre-configure the appliances as much as possible and ship them to identified AFRL and AFRL-partner sites. The contractor shall coordinate schedules and procedures with those sites to deploy and configure the TACLANEs to join them into the classified wide area isolated network. Some travel may be required to visit connecting sites to assist with implementation and configuration of the TACLANE appliances.

2.2.11 Remote Workstation Management

The contractor shall build, configure, install, and remotely manage standardized Linux and Microsoft Windows workstations for the VISION zone. Systems management and configuration management of the remote systems shall be accomplished using Ansible, Chocolatey, and Active Directory deployed Group Policy Objects (GPOs).

2.2.12 Help Desk Operations

The ELSZ Helpdesk shall be operated and manned by the contractor during normal AFRL business hours (8am to 5pm), Eastern Standard Time (EST), Monday through Friday excluding Federal Holidays.

The contractor shall provide user support (helpdesk operations) to users (currently 2,200 total active users) of the ELSZ systems (Unclassified DREN Extranet, ISO-U, and VISION). Support shall include, but is not limited to, creating accounts; assisting users in resetting or updating their passwords or other authentication credentials; and assisting users with using any of the user facing services of the ELSZ systems. The contractor shall also perform network and system troubleshooting to determine root causes of any user issues or problems. The helpdesk administrator(s) shall also assist the primary systems administrators or other contract functionals when not performing helpdesk functions.

The Contractor staff shall enter and track all user support issues in the ELSZ-hosted installation of OSTicket but will transition support issues to a Service Now instance during the period of performance of this contract.

The contractor shall provide an initial response to helpdesk queries within 4 business hours. Requests received at the end of the business day shall be responded to the morning of the next business day. The contractor shall create user accounts within 1 business day of receiving the completed and approved request form.

2.2.13 Training/User Engagement

The contractor shall learn and become proficient in the configuration and use of the ELSZ collaboration applications. The contractor shall develop and keep current training materials for the ELSZ and VISION capabilities. The contractor shall conduct in-person/on-site and Video Teleconference (VTC) based training sessions with end users.

The contractor shall assist users with the configuration of ELSZ collaboration applications to meet their project or working group requirements or use case. The contractor shall conduct and lead user engagement meetings on a schedule established by the ELSZ program manager utilizing the VISION system to collect customer feedback and resolve customer issues.

2.2.14 Software/Web Application Development or Modification

The contractor shall modify existing ELSZ-hosted open-source web applications, unless an alternative method is pre-approved by the Program Manager, to allow CAC/PKI-cert only authentication. These modifications shall be contributed to the original open-source application projects, if approved by the Government Program Manager, to ensure that future versions of these Open-Source Software applications include this functionality.

The contractor shall also be required to develop, modify, or configure existing Open- Source Software applications in use by the Government to support system usage and reliability metrics dashboarding and monitoring. All code developed or modifications developed for open-source software applications under this contract shall be delivered with unlimited rights.

2.2.15 Documentation Support

The contractor shall support maintenance of the A&A by creating and maintaining content for the documentation, drawings, etc., as necessary.

The contractor shall maintain continuity documentation of all processes, procedures, and system & application configurations used in the operations and maintenance of the environment.

The contractor shall develop user instructions and other documentation to inform users on how to utilize the ELSZ capabilities. This documentation shall be maintained in the ELSZ Wiki and Frequently Asked Questions (FAQ).

2.2.16 Automated Data Processing Equipment (ADPE) Custodian

Function

The contractor shall support AFRL/IZD as the primary and alternate Automated Data Processing Equipment (ADPE) custodian for all accountable equipment used within the AFRL/IZD division. The contractor shall complete Air Force equipment custodian training.

2.2.17 COMSEC Custodian Function

The contractor shall act as COMSEC equipment custodians for the TACLANEs that are part of this network, as well as COMSEC Key Operating Account Agents (KOAAs). [The contractor shall be required to take Air Force COMSEC custodian and key management training.]

2.2.18 Classified Courier Function

The contractor shall be required to courier classified equipment and materials between buildings and potentially between WPAFB, Ohio and remote locations.

2.2.19 Information Systems Security Manager (ISSM)

The contractor shall act as the ISSM for the overall Enterprise RDT&E IT environment.

The ISSM shall be responsible for creating and maintaining any AFRL Risk Management Framework (RMF) system authorization and accreditation packages for the environment with a minimum of quarterly review and potential updates. The ISSM shall be responsible for creating and maintaining any necessary Memorandums of Agreement (MOAs) between the Enterprise RDT&E IT environment and the using organizations. The ISSM shall periodically review all physical and cyber security measures.

2.2.20 Remote Isolated Network Onboarding Assistance

The contractor shall support remote AFRL or AFRL-partner sites with preparing their networks, troubleshooting issues, and assisting them with developing their Risk Management Framework (RMF) packages and artifacts/documentation to get approval to connect remote laboratory resources to the AFRL wide-area isolated RDT&E network environments.

2.2.21 Project and Team Management

The contractor shall provide project and team management to coordinate efforts across the ELSZ and VISION Environments under this effort. These efforts shall include the following.

2.2.21.1 Contractor must provide and manage resources necessary to ensure the staff meets ongoing, schedule and performance requirements to the Government.

2.2.21.2 Contractor must provide management of contractor personnel performing tasks in this task order. The contractor must designate a principal point of contact for technical issues.

2.2.21.3 Contractor must provide a Monthly Status Report (MSR) to the COR, utilizing the MSR Template contained in Appendix (-).

2.2.21.4 Contractor must provide the name of the Contract Manager and alternate(s) in writing to the COR. The contractor must ensure all personnel assigned to this task order meet the minimum requirements specified in the

PWS.

2.2.21.5 Contractor shall submit a trip report to the COR as well as the Government person directing the travel. Trip report shall include the following details: purpose, location and length of trip, travelers, and individuals contacted during trip, synopsis of all discussions, future actions identified, decisions made, or issues of concern arising during trip.

2.2.22. Customer Outreach

The contractor shall maintain constant communication with ELSZ and VISION users by organizing and leading user groups to stay abreast of issues.

Requirements

2.3.2 Tactical Operations Support

2.3.1.1 AFRL CITO Council Support

The contractor shall plan, facilitate, coordinate, and track actions for AFRL CITO Council related meetings and tours. CITO meetings are held monthly with remote face-to-face meetings roughly three times a year. This work occurs at least monthly.

2.3.1.2 General Administrative Support

The contractor shall provide support to the AFRL/IZC division chief exercising confidentiality, tact, and diplomacy. High-level of proficiency with business software applications (e.g., Office 365) to prepare correspondence, reports, presentations, email communications, and scheduling. Receives, screens, and directs incoming calls, visitors, mail, and email. Maintains files, records, and calendars; arranges business travel, coordinates meeting arrangements, and tracks purchases and expenses.

Participates in the development and implementation of administrative standards, policies, and practices for the AFRL/IZC.

3.0 Deliverables

All deliverables must meet professional standards, utilize the templates contained in the Appendices section of this PWS, and comply with the requirements set forth in this PWS. All deliverables shall be submitted in electronic format as unlocked, unencrypted Portable Document Format (PDF) file with selectable text and graphics. All electronic deliveries must be anti-virus scanned before delivery to the Government.

3.1. Contractor Submission

Deliverables are to be transmitted with a cover letter, on the prime contractor’s letterhead, describing the contents. Deliverables are to be submitted electronically and in accordance with the DD Form 1423 attached to the contract. The contractor shall provide hard copy deliverables as required per the Government’s request.

3.2. Government Review

Government personnel will have 10 business days to review deliverables (to include resubmissions) and provide written acceptance/rejection. Authorized Government representatives will notify the contractor of deliverable acceptance or provide comments in writing. The contractor shall incorporate Government comments or provide rationale for not doing so within 5 business days of receipt of comments. Government acceptance of the final deliverable will be based on resolution of Government comments or acceptance of rationale for non-inclusion. Additional changes volunteered by the contractor will be considered a resubmission of the deliverable.

3. Government Delays in Reviewing Deliverables or Furnishing Items

If contractor performance or submission of deliverables is contingent upon receipt of Government furnished items (data, equipment, materials, facilities, and support) or input, or upon Government review and approval of interim items or draft documents (collectively referred to as Government Performance), the Government shall specify, if not already specified within this PWS, when it will provide such items or input, or the time it will need to perform reviews or give approvals. If the Government fails to meet item, input, review, or approval deadlines, contractor performance or submission of deliverables shall automatically be extended one business day for each day of government delay. The contractor shall promptly advise the Contracting Officer of any delays in receipt of Government furnished items, input, reviews, or approvals.

3.4. The contractor shall submit the following deliverables:

3.4.1 Monthly Status Report

The contractor shall include the technical progress made under this contract, utilizing the MSR Template contained in Appendix (-). The Monthly Status Report shall not exceed 15 pages in length and be primarily focused on the highlights and significant events of the month.

3.4.2 Monthly Invoice

The contractor shall provide a monthly invoice, no later than the 10th calendar day of the month following the monthly reporting period, to be submitted simultaneously with the MSR, utilizing the MI Template contained in Appendix (-). As applicable, the invoice shall include but not be limited to:

▪ Clear identification of all costs.

▪ Travel costs.

▪ Supporting documentation for travel costs. Refer to PWS 5.3 for specific requirements.

▪ Other Direct Costs.

▪ Supporting documentation for other direct costs. Refer to PWS 9.7 for specific requirements.

▪ As required, the contractor shall comply with line item (i.e., per individual positions, different programs, program areas, etc.) invoicing requests.

4.0. Service Delivery Summary (SDS)

Performance Standards, Acceptable Quality Levels (AQLs), and Incentives/Disincentives are defined in PWS Attachment C, the Service Delivery Summary (SDS). The SDS criteria will be used to determine if performance requirements are met.

5.0. Voluntary Protection Program (VPP)

Applicability: This section of the PWS applies to “Applicable Contractors” as defined below.

VPP Definitions:

a) Applicable contractors. A contractor whose employees worked at least 1000 hours at the site in any calendar quarter within the last 12 months and is NOT directly supervised by the applicant (installation).

b) Days Away Restricted, and or Transfer Case Incident Rate (DART). Number of recordable injuries and illness cases per 100 full-time employees resulting in days away from work, restricted work activity, and/or job transfer that a site has experienced in a given time frame.

c) Total Case Incident Rate (TCIR). Total number of recordable injuries and illness cases per 100 full-time employees that a site has experienced in a given time frame.

d) Voluntary Protection Program: The Voluntary Protection Program (VPP) promotes effective worksite-based safety and health. In the VPP, management, labor, and OSHA establish cooperative relationships at workplaces that have implemented a comprehensive safety and health management system. Approval into VPP is OSHA’s official recognition of the outstanding efforts of employers and employees who have achieved exemplary occupational safety and health.

Requirements:

WP AFB is recognized under the Occupational Safety and Health Act (OSHA) VPP.

VPP impacts all “applicable contractors” operating on Air Force Installations. It is the contractor’s responsibility to ensure its employees and managers have a comprehensive understanding of VPP as well as full compliance with OSHA requirements. The contractor shall follow the safety and health rules of the installation or VPP site. Detailed information on VPP is available on the OSHA website at https://www.osha.gov/dcsp/vpp/index.html.

Applicable contractors are required to submit their Total Case Incident Rate (TCIR) and Days Away Restricted or Transferred (DART) rates and OSHA Form 300A annually to the contracting officer for consolidation and submission as part of the installation’s annual VPP Safety and Health Management report.

An applicable contractor’s VPP shall identify the processes and procedures the contractor shall use to track compliance with the Safety and Health Plan, and the process and procedures that shall be used to correct violations.

It is the applicable contractor’s sole responsibility for compliance with the OSHA (Public Law 91-596). The contractor shall submit a Safety and Health Plan and corresponding site safety checklist to the Government Program Manager 10 days after contract award.

The contractor’s plan shall include appropriate measures to ensure the contractor reacts promptly to investigate, correct and track alleged safety and health violations and/or uncontrolled hazards in contractor work areas. Additional, installation specific references and policies may be included/attached to the delivery order. The plan shall:

● Demonstrate a management commitment to employee safety and health.

● Identify the application of the safety and health plan to subcontractors.

● Identify the roles and responsibilities of the following individuals:

◦ Management.

◦ Supervisors.

◦ Employees

◦ Safety Coordinator.

● Identify applicable safety rules and regulations.

● Include a worksite hazard analysis to include base-line hazard identification and required control measures.

● Include a job site analysis to include hazards to tasks required to control measures.

● Identify employee safety and health training requirements and the documentation process.

● Include a workplace inspection frequency, to include identifying the individual conducting the inspections.

● Include employee hazard reporting procedures.

● Identifies individual(s) responsible for corrective action hazards.

● Identifies first aid/injury procedures.

● Identifies procedures for accident investigation and report.

● Identifies emergency response procedures; and

● Identifies the process for tracking controlled hazards in contractor work areas

An applicable contractor is responsible for establishing these requirements for all sub-contractor who qualify as applicable contractors under the resulting contract.

The Contractor shall ensure its employees and subcontractors promptly report pertinent facts regarding mishaps involving reportable damage or injury to the AFRL Safety Office and the COR and cooperate (IAW AFI 91-204) in any Air Force safety investigation and shall comply with the Contractor’s safety and health plan.

6.0 Government Furnished Resources

The government will furnish the following “as is” at no cost to the contractor for their use in direct support of tasks outlined in this PWS:

● Adequate facilities that include office space and furnishings shall be provided for on-site members of the staff assigned to the program. The government shall decide the internal facility location for the contractor operations. Government personnel, such as the COR, can decide to reside in the same general office area as the contractor to facilitate a cooperative relationship between the contractor and the government. The contractor shall keep all office, workspace and communications rooms free from clutter and adhering to Air Force standards for safety and security.

● Custodial services for any identified facilities.

● Local and long-distance phone service, fax machine, and reproduction machine in or near occupied facilities.

● Miscellaneous office supplies.

● Government forms, publications, and documents, if required.

● Computers, common use software, communication networks, and other resources owned or leased by the government for use by on-site contractor personnel as approved by the COR.

● The government shall furnish utilities at no cost to the contractor for performance of this order if performed in a government-owned or leased facility.

The contractor shall conform to the provisions of Air Force Instructions for safeguarding the government-furnished facilities and material contained herein.

Desk Telephones Government telephones are provided for use in conducting official business. Contractor personnel are permitted to make calls that are considered necessary and in the interest of the Government. The contractor shall follow the same policies as Government personnel for telephone usage.

Mobile/Wireless Telephones and Smart Devices Government issued mobile/wireless telephone and smart devices may be assigned to contractor personnel when the Government determines it is in the Government’s best interest. Contractor personnel are prohibited from using any Government issued device for personal use.

Electronic Mail (E-mail) All Government e-mail access and use by contractor personnel shall be in support of the individual’s official duties and contract/order responsibilities. All information that is created, transmitted, received, obtained, or accessed in any way or captured electronically using Government e-mail systems is the property of the Government.

Contractor personnel are prohibited from forwarding e-mail generated from a Government provided e-mail account to personal devices.

Copiers and Fax Machines Copiers are to be used to copy material for official Government business only in the performance of the contract/order. Contractor personnel shall not use fax machines for other than official Government business in the performance of the tasks in the contract/order.

Computer and Internet All Internet and electronic media access accomplished by contractor personnel (utilizing Government furnished equipment) shall be for official Government business in the performance of the tasks in the contract/order.

Canvassing, Soliciting, or Selling Contractor personnel shall not engage in private activities for personal gain or any other unauthorized purpose while on Government-owned or leased property, nor may Government time or equipment be utilized for these purposes.

Security Violations Using Government Equipment Any contractor violating Government security policies, guidelines, procedures, or requirements while using Government equipment or while accessing the Government network may, without notice, have their computer and network access terminated, be escorted from their work location, and have their physical access to their work location removed at the discretion of the CO/COR. The CO/COR will notify the contractor of the security violation and request immediate removal of the contractor employee.

Validation of Government Furnished Items (GFI) and Equipment Inventory The contractor shall develop and maintain a complete GFI inventory that shall be made available to the Government upon request. Within three (3) business days of receipt of any GFI, the contractor shall validate the accuracy of the materials and notify the COR and/or other identified Government representatives, in writing, of any discrepancies, and update the GFI inventory list.

NOTE: Validation shall consist of the contractor checking for physical and logical completeness and accuracy. Physical completeness and accuracy shall be determined when all materials defined as Government furnished are provided. Logical completeness and accuracy shall be determined when all materials defined and associated with a program, system, or work package are provided.

7.0 Contractor Furnished Resources

Not applicable.

8.0 General Information

The following establishes the general requirements and guidelines governing the performance of the tasks outlined in this PWS.

8.1 Place of Performance

The primary work location under this PWS is WP AFB, Dayton, Ohio, Area B, Building 676 with Buildings 16 and 45 as secondary work locations if overflow space is needed.

There will also be Occasional meetings in buildings 45 and 16 or other AFRL WPAFB facilities. Telework, or staggered telework, schedules will be approved at the government’s convenience. The contractor remains responsible for the work covered within the PWS. The Government does not have current plans to reduce it’s telework posture; however, this language ensures mutual understanding that an increased telework posture beyond current activities must be coordinated and approved. Any deviation requires prior approval from the Contracting Officer.

In the event an emergency is declared for Dayton, Ohio necessitating the implementation of an alternate work location, services provided under the contract may require implementation of an alternate work location. The Contracting Officer will make notification to the Contractor’s business Point of Contact (see section 10.0). A modified work location will be adopted for the duration of the declared emergency, and the contractor shall comply with the provisions of that alternate work location.

The CO/COR may require the contractor to periodically use an alternate work location for testing and reporting on AFRL Continuity of Operations (COOP) or enterprise telework procedures and capabilities (shall not exceed 2 days per month per person unless directed by the Contracting Officer).

The contractors shall be responsible for assisting with or accomplishing end-of-day security checks for their room in Bldg 676 if no government person is present at the end of the day.

For the classified processing facilities located in Bldg 676, services include, but are not limited to, escorting customers performing work, opening and closing room on as-needed basis, arming and disarming Intrusion Detection Systems (IDSs) and alarms, retrieving and storing classified data files.

8.2 Government Management

The AFRL Service Delivery and Support Division (AFRL/IZD), within the AFRL Digital Capabilities Directorate (IZ), will serve as the lead for the management of this contract.

8.3 Non-Disclosure Agreements (NDAs)

All contractor personnel that have potential access to government-only restricted information and files because of their system administrative or application administrative privileges shall sign a Non-Disclosure Agreement (NDA) with AFRL. The NDA shall state that government-only information shall not be shared with the employee's employer. NDAs must be signed before system administrative or privileged access for contractor personnel may be granted. These NDAs will be kept on file with the official contract folder and records or in the electronic records for the contract.

8.4 Normal Duty Hours

The contractor personnel are expected to perform their work within AFRL’s normal operating hours of 0800 to 1700, Monday through Friday, excluding government observed holidays. WP AFB and the AFRL support a flexible work schedule. Full time contractors working the normal shift are expected to arrive no later than 0900hrs and leave no earlier than 1500hrs (AFRL's core hours) unless approved by the COR as needed. If variances are required from the core operating hours, the contractor shall obtain permission from the COR in advance if possible.

8.5 Extended Hours and Surge Support

Extended hours are rare; however, if additional extended hours support is needed beyond the normal performance within the order, such support will be identified in advance to the contractor and shall be funded by a separate time and materials Contract Line Item (CLIN). This effort may also include additional temporary support to accomplish special studies on topics of interest to the AFRL enterprise. For example, this could be to bring in a subject matter expert for 3 to 6 months to assist in the production of a report on some topic.

It is anticipated that the workload will increase above the Core Support provided via CLIN 0001 and 0002 and surge support may be required based on fluid schedule requirements. In anticipation of this increase, additional support required will be obtained via the utilization of CLIN 0003 – T&M Surge. Such support may encompass the entire scope of work identified as CLIN 0001 or CLIN 0002 - Core Labor. The Surge ceiling as identified in the FON will become the ceiling basis for any, and all, future tasks exercised. No surge requirements will extend beyond the period of performance of the CORE (CLIN 0001) effort. To ensure maximum flexibility, the contractor shall include a complete price list identifying the proposed Firm Fixed Price hourly labor rates for all labor categories to support CLIN 0001 - Core Labor, for the life of the task order. Prior to exercising this CLIN, the Government will identify a need that cannot satisfactorily be met with the staffing baseline as provided in staffing quote, or otherwise amended. The primary basis for the determination that the "additional workload" associated with such need falls into the optional surge labor CLIN vs. the core labor CLIN would largely be due to the determination that the labor mix and level of effort (i.e. accepted staffing plan that formed the staffing baseline) for the core labor incorporated into the original task order award isn't sufficient to perform the additional workload (e.g. potential new large-scale security constructs, subject matter expertise related to specialized short-term initiatives, mandated project schedule compression, etc.). A bilateral agreement will be reached between the parties to Firm Fix Price the effort requested using the labor categories and labor rates previously negotiated at award. This process may continue in any increment until the entire ceiling has been expended. The lifecycle ceiling for this CLIN will not increase without applying additional requirements found in the FAR.

8.6 Materials Purchasing – CLIN 0004

The contractor may require various minor materials and small equipment to complete their tasks in a timely manner. An Other Direct Costs (ODC) CLIN will be established for this purpose. The COR must approve all purchases before being made. The contractor shall not purchase items in excess of $3500 for a single purchase without the prior approval of the Contracting Officer (CO). Larger components and systems will be purchased under a separate contract and provided by the government. This CLIN will be focused on the purchase of small items, components, or software (for example: KVM switches, computer memory (RAM), hard drives, etc.) to support capability integration efforts, system upgrade efforts, or to rapidly replace failed components in the ELSZ to return the system to operational status.

8.7 Travel – CLIN 0005

8.7.1 Travel

The contractor may be required to travel, both locally and outside of the local area, in support of this PWS. Travel costs are reimbursable in accordance with the Joint Regulations (JTR) and FAR 31.205-46. The travel shall be approved by the COR in advance by the contractor’s submission of the following information to the COR: name of traveler(s), dates of travel, location of travel, method of travel, and estimated cost of total travel. Conditions and limitations applying to travel associated under this PWS are:

8.7.2 Travel Greater than 50 Miles

Travel greater than a 50-mile radius from the Wright Patterson area of Dayton, Ohio is considered travel outside of the local area. Government approved TDY or temporary assignments for training, symposia, conferences, and other purposes are reimbursable.

When TDY travel is required, per diem costs are reimbursable.

8.7.3 Travel Vouchers

Travel vouchers shall include proof of payment for cost reimbursement. Invoice submissions including travel costs shall include completed travel expense sheets (i.e., travel voucher) for each trip and each employee who traveled.

The travel expense report, receipts of $75 or more (with exceptions being lodging and transportation), and supporting documentation (e.g., approval email for exceeding per diem rates, cost…