Statement of Work (SOW).pdf

P a g e | 1

PACAF AFSW Tactical Networking Course

Statement of Work

Version 1.0

12 December 2024

P a g e | 2

1) Course Description: This tactical communications course is designed for the Pacific Air

Force Special Warfare and is unique to their specific networks, waveforms, and system requirements.

a) The duration of the course shall be a minimum of 10 training days and no more than 15 training days, for 12 students.

b) The curriculum shall cover all materials in this SOW equipment and supplies section with the express purpose of satisfying the course desired end-state objectives.

c) The overall course intent is for 1D7 and 1Z3 personnel from PACAF UTCs to learn and train in a team environment to achieve overall course objective outcomes as opposed to an individual training task item approach.

2) Facilities/Access:

a) The 1st ASOG shall source a classroom facility on Joint Base Lewis McChord entirely separate from the 5th ASOS or 1st ASOG facilities for the duration of the period of instruction.

b) The contractor requires a DD-254 to maintain the appropriate access level (TS/SCI).

c) Authorized to receive Government-furnished cryptographic equipment.

d) Authorized to have email and access to both SIPRNET and JWICS.

e) Authorized to have administrative rights to SIPR network stacks.

3) Instructor Qualifications:

a) Instructor Qualification/Prerequisites: The Contract shall ensure instructors possess appropriate security clearances for the operation of the system and instructor lessons. This requirement cannot be waived.

b) The contractor is expected to maintain a minimum of 2 full-time team members who are graduates of the USAF Weapons School. This requirement underscores the need for highly qualified personnel to deliver the course effectively.

c) The contractor shall provide 3 instructors for the entirety of the course. All instructors will have intimate knowledge of Air Force tactical data links, ground radio systems, and PACAF domain SIPR networking program of record equipment to deliver the course content effectively and ensure a comprehensive learning experience for the attendees.

4) Courseware:

a) The contractor shall manage, develop, distribute, publish, maintain, and update courseware (format, grammar, spelling, and content), specifically to achieve the desired course end state objectives as outlined in this SOW.

b) The Contractor shall produce a “PACAF AFSPECWAR Networking Field Handbook” to serve as a quick reference guide for graduates to continue the application of course principles in a field environment.

c) The Government maintains the right to modify the course syllabus up to 30 days before execution. This flexibility ensures the ability to restructure coursework as needed, shift focus areas and cater to specific audiences. However, these modifications will not introduce new equipment alter desired end states beyond what's already in this SOW and will not extend the course beyond 15 training days.

d) Within ten (10) days of course completion, the contractor shall solicit, and the U.S.

Government as a valued partner, shall provide written feedback on the curriculum. This feedback will be utilized to adjust the desired learning objectives, instruction blocks, instructors, and training materials. Feedback is crucial in our continuous effort to improve the course.

P a g e | 3

e) Within sixty (60) days of course completion, the contractor must implement any changes, update course materials, and be ready to execute additional training iterations if the Government solicits.

f) The contractor shall host a bi-monthly working group to solicit stakeholder feedback and provide project status reports.

5) Security (Cybersecurity)

a) The Contractor shall comply with the cybersecurity guidance to ensure compliance with:

1) AFI 17-130, Cybersecurity Program Management.

2) AFI 17-101 Risk Management Framework (RMF) for Air Force Information

Technology (IT).

3) AFI 33-332, The Air Force Privacy and Civil Liberties Program.

4) AFMAN GM 17-1303, Cybersecurity Workforce Improvement Program.

5) CJCSI 6211.02D, Defense Information Systems Network (DISN) Responsibilities.

6) CNSSI 1253, Security Categorization and Control Selection for National Security

Systems.

7) DoD 5400.11R, Department of Defense Privacy Program.

8) DoDI 8500.01, Cybersecurity.

9) DoDI 8510.01, Risk Management Framework (RMF) for DoD Information

Technology (IT).

10) DoDM 8570.01, Information Assurance Workforce Improvement Program (Replaced with DoDD 8140.01).

11) DoDI 8582.01, Security of Unclassified DoD Information on Non-DoD Information

Systems.

12) NIST 800.30, Guide for Conducting Risk Assessments.

13) NIST 800.37, Guide for Applying the Risk Management Framework to Federal

Information Systems

14) NIST 800.53, Security and Privacy Controls for Federal Information Systems and

Organizations.

15) AFI 16-1404, Air Force Information Security Program.

16) AFMAN 17-1301 Computer Security (COMPUSEC).

17) AFSSI 7700, Emission Security (EMSEC)

18) Air Force Manual 33-214, Emission Security Countermeasures Review.

19) Air Force Pamphlet 63-113, Program Protection Planning for Life Cycle

Management.

20) Appendix III to Office of Management and Budget Circular No. A-130, “Security of

Federal Automated Information Resources”

21) DoD 5220.22 Volume 2, AFMAN 16-1406 Volume 2, National Industrial Security

Program

22) DoDI 5200.44 Protection of Mission Critical Functions to Achieve Trusted

Systems and Networks

23) DoDD 8140.01, Cyberspace Workforce Management

24) FIPS PUB 199, Standards for Security Categorization of Federal Information and

Information Systems.

25) ISO 10005 Quality Management Systems

6) Operations Security (OPSEC)

a) The Contractor shall develop an OPSEC plan and apply OPSEC principles and practices to reduce program vulnerability from successful adversary collection and exploitation of Critical Information.

7) Communications Security (COMSEC)

P a g e | 4

a) Access to COMSEC material is restricted to US citizens holding final US Government clearances. Such information is not releasable to personnel holding only reciprocal clearances. The Contractor shall obtain and maintain External Certificate Authority certificates for authenticating, digital signing, and or encrypting communications allowing security electronic communications with the Government.

b) The Contractor shall comply with COMSEC requirements IAW AFMAN 17-1302, Communications Security (COMSEC) Operations.

c) The Contractor shall train all employees having access to, or a requirement for using COMSEC material in the proper way of handling and safeguarding such equipment.

8) Industrial Security

a) The Contractor shall establish, implement, and maintain security requirement IAW provisions of the Department of Defense Manual (DoDM) 5200.01, Vol 1-4, DoD Information Security Program. The Contractor shall comply with DoDD 5400.07 /Air Force Manual (AFMAN) 33- 302, DoD Freedom of Information Act (FOIA) Program requirements. This regulation sets policy and procedures for disclosure of records to the public. See DoDM 5200.01 Volumes 1-4, Information Security Program, for marking, handling, transmitting, and safeguarding controlled unclassified information and material.

b) The Contractor shall comply with requirements of DD form 254, DoDM 5220.22 Vol 2/ AFMAN 16-1406 Vol 2.

c) The Contractor shall report to an appropriate Government authority any information or circumstances which they are aware that may pose a threat to security of DoD personnel, Contractor personnel, resources, and classified or unclassified defense information.

d) The Contractor shall obtain a Defense Information Security System (DISS) account(s) to accomplish requirements of this contract.

e) The contractor shall provide a system security IAW a System Security Plan (SSP) for operation and maintenance of all classified components for the required security level.

9) Personnel Security

a) The Contractor shall ensure the requirements for granting access to classified information are met, is current, and as defined in the following:

1) DD Form 254

2) DoD 5220.22-M

3) DoDM 5200.01 Volumes 1-4

4) DODM 5200.01/AFI 16-1404, Air Force Information Security Program Management

5) DODM 5220.22 Vol 2/AFI 16-1406, National Industrial Security Program

b) All Contractor personnel shall obtain a DoD security clearance to the TOP SECRET level at a minimum as a condition of employment. The Contractor shall maintain the appropriate security clearances for its personnel during the duration of the contract.

c) The Contractor shall comply with, coordinate, and complete a DD Form 254, Department of Defense Contract Security Classification Specification requirements. Upon execution of award, the PCO will sign the DD Form 254. All classified information and equipment shall be returned to the Government upon contract termination or when notified by the U.S. Government that the equipment is needed.

d) The Contractor shall submit personnel security investigative paperwork for trustworthiness determinations IAW DODM 5220.22, Vol 2/AFI 16-1406, Vol 2, Air Force Industrial Security Program within 15 days of contract award.

P a g e | 5

10) Security Training

a) The Contractor shall ensure that each Contractor and Subcontractor employee completes the appropriate security training for the information being handled; (a) prior to performing any contract work, and (b) completes the annual refresher training throughout the PoP.

b) In addition to DoD Cybersecurity training, the Contractor shall ensure that each Contractor and Subcontractor employee completes specific Cybersecurity training IAW the applicable site and device SSP noted in #11.

11) Security Violation

a) Violations of rules, regulations, procedures, and policies will be dealt with consistent with the Contractor’s Security Violation Policy and Uniform Code of Military Justice.

Violations will be evaluated on an individual basis and will be adjudicated based on the ultimate impact to National Security and prior record of employee(s) involved. A security violation is any failure to comply with security regulations and or instructions, resulting in a real or potential compromise of classified/sensitive program information. In addition, any willful failure to comply with security policies and procedures constitutes a security violation even when no compromise has taken place. Security violations or suspected violations shall be immediately reported to the Security Manager, 1st ASOG Information Protection, 62nd Air Base Wing (JBLM) Acquisition Program Manager, and Contracting Officer within 24 hours of the incident, for investigation and subsequent reporting to the Security Police/Contract Security Office/Office of Special Investigations, as appropriate.

b) Examples of violations include, but are not limited to, the following:

1) Any willful failure to comply with the security regulations and procedures established in this and other documents as published.

2) Disclosure of classified information to any person not having required clearance or need to know.

3) Unauthorized admittance of un-cleared personnel

4) Any discrepancy resulting in an inadvertent disclosure or loss of classified information.

5) Failure to properly secure a classified security container, room, or facility.

6) Unauthorized reproduction of classified documentation or data.

7) Failure to properly mark classified material (e.g., UNCLASSIFIED, CONFIDENTIAL, SECRET, SPECIAL CATEGORY)

8) Input of classified information on an unclassified Automated Information System

(AIS) or bringing unauthorized AIS onto the site.

9) An inquiry will be performed in the event of a security incident. If it is determined the security incident is a probable or actual compromise, a damage assessment will be performed. The Contractor shall support the Original Classification Authority (OCA) during damage assessment.

12) Quality Assurance

a) The U.S. Government has the right to visit the facility and observe instruction of students. The Contractor shall recognize FAR clauses 52.246-2, 3, 4, and 5, Inspection of Services and Supply for Fixed Price and Cost Reimbursement Contracts.

P a g e | 6

13) Safety

a) The Contractor shall generate, implement, maintain, a safety plan to analyze, prevent, eliminate, and or minimize hazards IAW commercial best practices, Military Standard (MIL-STD)-882E, DoD Standard Practice for System Safety, AFMAN 91-203, Air Force Consolidated Occupational Safety Instruction standards, Occupational Safety and Health Act (OSHA), local base regulations (if applicable), and Environment, Safety and Occupational Health (ESOH).

b) If required, The Contractor shall take additional immediate precautions as directed by the Procurement Contracting Officer (PCO) for health and safety purposes.

c) The Contractor shall be responsible for the proper handling, storage, transportation, and disposal of hazardous waste resulting from performance of this contract IAW AFI 32- 7042, Waste Management, host-installation directives and guidelines (if applicable), 40 Code of Federal Regulations (CFR), Parts 260 - 271, and 49 CFR, Parts 171 and 172 and paragraph 2.2.9.4.

14) Training Management

a) Compliance with the regulations listed on the attached reference table is mandatory.

b) Given 10 days' notice and not withstanding preexisting equipment obligations to real world operations or exercise support, the 1st ASOG/607th ASOG will make the below equipment available to the contractor for the purposes of curriculum and courseware development.

c) As applicable, the USG will provide subject matter experts (SME) that will provide recommendations regarding standardizing equipment configuration for the course.

d) Once equipment configurations have been standardized, the contractor will develop a course form detailing the recommended equipment configuration. Before the course start, all USG provided equipment will comply with this course form:

1) Cloud RF

2) PRC-161

3) PRC-163: TSM, SATURN

4) PRC-117G: MUOS, SATURN

5) PRC-167: TSM, SATURN

6) PRC-160: 3GALE, 3G+, 4G, LDD

7) SKL: 1ASOG Crypto Requirements Letter

8) Ground Link-16 Terminals (MOJO, Maneuver Gateway)

9) Kymeta COMSAT Terminals

10) Starshield COMSAT Terminals

11) Cradlepoint Routers

12) PACAF Program of Record Communications Fly Away Kits

13) Silvus 4200/4200

14) Trellisware 875/950: TSM, TSM-LRM, Red Multi-Network Bridge

15) Commercial VPNs

e) Use of the ADDIE (Analysis, Design, Development, Implementation, and Evaluation) methodology or an Instruction System Design (ISD) acceptable to the USG.

f) Contractor will document student training and progression using AF Form 623A: Record of Individual training. All student documentation will be turned over to the USG upon course completion.

g) The contractor shall provide written materials (e.g., manuals, handbooks, texts) customarily provided with course offerings. Upon course completion, such

P a g e | 7 documentation will become USG property.

h) The contractor will provide for no greater than a 4:1 student to instructor ratio for each training event.

15) Exercise Mission Support

a) The contractor shall provide on-site mission support for 3 annual

PACAF/INDOPACOM level exercises to maintain current TTP development and forward mission support to ensure syllabus rewrites are driven from current operational needs and requirements.

16) Training Cancelation and Rescheduling

a) The U.S. Government must notify the contractor ten (10) business days before the scheduled training date if there is a need to cancel or reschedule the training. If the U.S.

Government needs to reschedule a course start date, the U.S. Government must collaborate with the contractor to determine a mutually agreeable time and date for the rescheduled training. Failure to cancel or reschedule within the specified timeframe will result in the U.S. Government being liable for the contracted dollar amount of the training course. If the contractor cannot proceed with the training on the agreed-upon date, the contractor must inform the U.S. Government at least 21 business days before the scheduled training date.

17) Limitation of Liability

a) Except as expressly provided for herein, neither party shall be liable to the other for special, consequential, incidental, or indirect damages arising out of or in connection with its performance under this Agreement, whether in contract, tort, or otherwise, even if such party has been made aware of the possibility of such damages.

18) Warranties

a) The manufacturer of any products and services furnished hereunder provides warranties to the extent such warranties are customarily offered to the public or the relevant manufacturer's other regular customer(s) in the regular course of business, except for any express or implied warranties that this Agreement and anything furnished hereunder may not have. Neither party will be liable for any indirect, special, consequential, or punitive damages in connection with or arising out of the performance of this Agreement or the use of any item of confidential and proprietary information furnished hereunder, except as provided herein.

19) Desired Student End-state Objectives

a) When given factory default TW-875, TW-950, PRC-163, and/or PRC-167 devices with appropriate peripheral devices (SKL + TSM crypto, programming and fill cables, antennas, planning software and devices), students will be able to create a TSM-X mission plan, program PRC-16x radios for Type 1 SECRET data and voice operations, and program the TW-875/950 devices as Type 3 relay devices.

b) When given factory default TW-875, TW-950, PRC-163, and/or PRC-167 devices with appropriate peripheral devices (SKL + TSM crypto, programming and fill cables, antennas, planning software and devices, and Layer 2 VPNs), students will be able to create a TSM-X mission plan, program PRC-16x radios for Type 1 SECRET data and voice operations, and program the TW-875/950 devices as Red Multi-Network Bridge devices and perform

P a g e | 8 successful Red MNB operations across both Line of Sight transport means, as well as Layer 2 VPN via Commercial ISP.

c) When given transmit frequency, antenna, line loss, and desired coverage points, students will be able to build an effective RF network to service the coverage points using CloudRF planning software with both TSM and Silvus networks.

d) When given a default imaged TACP laptop with WINTAK and previously programmed TSM- X radios, students will be to physically network the TSM-X systems with the WINTAK TACP laptop system via DHCP and Static network interface addressing.

e) When given a default imaged TACP laptop with WINTAK, TRAX, and previously programmed TSM-X radios, students will be to physically network the TSM-X systems with the TRAX + WINTAK laptop system to ingest target data from downstream TAK or EMSO devices into WINTAK, and convert to J series targets and transmit out TRAX over JREAP-C.

f) When given PACAF program of record Communications Fly Away Kits, TACP Maneuver Gateway, and TRAX + WINTAK software, students will be able to connect to distant end JREAP-C servers as a client and provide that connectivity to other network users via RF Link- 16 and across Type 1 TSM networks.

P a g e | 9

Acceptance and Inspection Summary

Performance Objective SOW Reference Performance Threshold Did the contractor manage, develop, distribute, publish, maintain, make corrections to, and update courseware IAW

SOW.

4 (a, b, c, d, e, f) Contractor shall perform requirements in the SOW with 100% accuracy, and within required timelines stated unless more time is allowed for by the

USG.

Cybersecurity 5 Contract shall meet all cybersecurity requirements listed in the SOW. Do system administrators have a recognized computer certification, security plus, etc…

OPSEC 6 Contractor shall develop and apply OPSEC principles and practices IAW the parameters listed in the SOW in all aspects of the course.

COMSEC 7 Contractor shall comply with all COMSEC requirements in the SOW, and IAW AFMAN 17- 1302. Is all security clearance being maintained? Are COMSEC training provided to all contractors handling

COMSEC?

Security 8, 9, and 10 Has the contractor established, implemented, and maintain security IAW the SOW? Does the contractor have a DISS account? Has the contractor developed a Security Plan for the level of information being handled? Do all personnel have a current and adjudicated security clearance for the level required?

P a g e | 10

Training Management 14 Does courseware/training comply with the ADDIE methodology or USG accepted methodology? Are written materials, handbooks, texts, provided to all students. Is the course syllabus maintained, and course layout effectively communicated to all students?

Training Management 14 Has the contractor documented student progress, and provided feedback to students for improvement?

GLOSSARY / ACRONYMS TABLE:

AFI - Air Force Instruction AFMAN - Air Force Manual C2 - Command and Control COMPUSEC – Computer Security COMSEC - Communications Security CNSSI - Committee on National Security Systems Instruction DD-254 - Department of Defense Contract Security Classification Specification DISN - Defense Information Systems Network DISS - Defense Information Security System DoD - Department of Defense EMSEC - Emission Security FAR – Federal Acquisition Regulation FIPS PUB - Federal Information Processing Standards Publication FOIA - Freedom of Information Act IAW – In Accordance With ISO - International Organization for Standardization JWICS - Joint Worldwide Intelligence Communications System MIL-STD - Military Standard OCA - Original Classification Authority OPSEC - Operations Security PCO - Procurement Contracting Officer RMF - Risk Management Framework SIPRNET - Secret Internet Protocol Router Network SOW - Statement of Work USAF - United States Air Force SSP - System Security Plan TS/SCI - Top Secret/Sensitive Compartmented Information

P a g e | 11

REFERENCE TABLE (manuals, AFMAN, AFI, etc.):

DODM 5220.22/AFMAN 16-1406, National Industrial Security Program: Industrial Security Procedures for Government Activities.

DODM 5200.01/AFMAN 16-1404, Vol 4, Information Security Program: Protection of Classified Information.

DODM 5200.01/AFMAN 16-1404, Vol 1, Information Security Program: Overview, Classification, and Declassification.

DODM 5200.01/AFMAN 16-1404, Vol 2, Information Security Program: Marking of Information.

DODM 5200.01/AFMAN 16-1404, Vol 3, Information Security Program: Protection of Classified Information 32 Code of Federal Regulation, Part 117 and Industrial Security Letter 2021-02.

AFI 17-130: Air Force Instruction 17-130, Cybersecurity Program Management AFI 17-101: Air Force Instruction 17-101, Risk Management Framework (RMF) for Air Force Information Technology (IT) AFI 33-332: Air Force Instruction 33-332, The Air Force Privacy and Civil Liberties Program AFMAN 17-1302: Air Force Manual, Communications Security (COMSEC) Operations AFMAN 17-1303: Air Force Manual GM 17-1303, Cybersecurity Workforce Improvement Program AFMAN 17-1301: Air Force Manual 17-1301, Computer Security (COMPUSEC) AFSSI 7700: Air Force Special Security Instruction 7700, Emission Security (EMSEC) DoDI 8500.01: Department of Defense Instruction 8500.01, Cybersecurity DoDI 8510.01: Department of Defense Instruction 8510.01, Risk Management Framework (RMF) for DoD Information Technology (IT) DoDI 8582.01: Department of Defense Instruction 8582.01, Security of Unclassified DoD Information on Non-DoD Information Systems DoDD 8140.01: Department of Defense Directive 8140.01, Cyberspace Workforce Management DoDM 8570.01: Department of Defense Manual 8570.01, Information Assurance Workforce Improvement Program (Replaced with DoDD 8140.01) FIPS PUB 199: Federal Information Processing Standards Publication 199, Standards for Security Categorization of Federal Information and Information Systems CJCSI 6211.02D: Chairman of the Joint Chiefs of Staff Instruction 6211.02D, Defense Information Systems Network (DISN) Responsibilities CNSSI 1253: Committee on National Security Systems Instruction 1253, Security Categorization and Control Selection for National Security Systems DoD 5400.11R: Department of Defense Regulation 5400.11R, Department of Defense Privacy Program DoDM 8570.01: Department of Defense Manual 8570.01, Information Assurance Workforce Improvement Program (Replaced with DoDD 8140.01) NIST 800.30: National Institute of Standards and Technology Special Publication 800.30, Guide for Conducting Risk Assessments NIST 800.37: National Institute of Standards and Technology Special Publication 800.37, Guide for Applying the Risk Management Framework to Federal Information Systems NIST 800.53: National Institute of Standards and Technology Special Publication 800.53, Security and Privacy Controls for Federal Information Systems and Organizations ISO 10005: International Organization for Standardization 10005, Quality Management Systems