Statement of Work (SOW) V5.pdf

STATEMENT OF WORK (SOW)

FOR

309TH SOFTWARE ENGINEERING GROUP (SWEG)

CYBER SECURITY/CYBER OPERATIONS (CYBEROPS)

SYSTEM SUPPORT OF CLOSED-CIRUIT TELEVISION (CCTV) CAMERAS

Hill Air Force Base, Utah

03 September 2025/V5.0

1.0 INTRODUCTION

1.1 Purpose

The purpose of this requirement is to provide the 309 SWEG, CyberOps Squadron with support for the stand-alone Closed-Circuit Television (CCTV) system and server within the boundaries of building 1515, which is a secured facility.

1.2 Scope

The scope of this requirement will cover system administrative services and cyber defense network analysis as well as system patches, updates and upgrades as required.

1.3 Background

The original installation and service contract, contract number FA822823C0002, was awarded in November of 2022 with the service period ending in 2023.

2.0 DESCRIPTION OF SERVICES

The Contractor shall provide system administrative service support and cyber defense network analysis for all stand-alone CCTV camera system as well as the servers utilized for the storage of the data collected from the cameras (i.e., video footage recorded, live monitoring feeds and audio).

The contractor shall provide the services described within this SOW. Any changes in these processes will be communicated in writing to the contractor, and the contractor will have 30 days to comply with the change, or respond in writing with any questions, comments or concerns.

2.1 System Admin Services

2.1.1 Contractor shall provide network access management

2.1.1.1 Account Creation

2.1.1.2 Account Deletion

2.1.1.3 Permissions Management

2.1.2 Contractor shall provide network Infrastructure Management (VLAN)

2.1.3 Contractor shall provide information protection, ensuring all data is always properly encrypted.

2.1.4 Contractor shall patch and upgrade network (OS, Software and

Hardware)

2.1.4.1 Windows/Linux Updates

2.1.4.2 Antivirus Updates

2.1.4.3 Software updates as required.

2.1.5 Contractor shall scan network for patch verification/vulnerabilities to patch (Must use ACAS) and provide scans to Cybersecurity.

2.1.6 Contractor shall run the Security Technical Implementation Guide (STIG) on network devices and provide completed STIG checklists.

2.1.7 Contractor shall write a Plan of Action and Milestones (POA&Ms) for non-compliant security controls when discovered. The POA&M will be submitted to the 309th CyberOperations within 30 days of the detection

(CDRL A005).

2.1.8 Contractor shall perform lifecycle management of user accounts, to include account creation, permissions modifications, account terminations, images, hardware and software backups.

2.1.9 Data transfers – data originating outside the 309th network shall be scanned and approved by the 309th CyberSecurity before going on the network.

2.1.10 Help Desk Support

2.1.10.1 Access issues

2.1.10.2 Performance Issues

2.1.11 Risk Management Framework (RMF) Testing

2.1.11.1 Periodic Testing as documented in section 2.3.

2.1.11.2 Annual Authority to Operate (ATO) support

2.1.12 Equipment Custodian Duties

2.1.12.1 Maintain equipment lists

2.2 Cyber Defense Network Analysis

2.2.1 Contractor shall analyze network traffic, audit user activity for anomalies, and provides support to incident response team.

2.2.2 Contractor shall provide digital forensics for possible incidents when requested.

2.2.3 Contractor shall provide monthly reports of any anomalies to 309th

CyberSecurity (CDRL A001)

2.3 Required System Testing and Intervals

2.3.1 Account Management Audit Trail – Monthly Audit Log Transfers

2.3.1.1 Audit trail for account creation, deletion, etc. Notifications generated by the audit trail.

2.3.2 Audit Trail Compliance – Monthly Audit Log Transfers

2.3.2.1 All audit logs shall be collected and reviewed for anomalies and reported to Cybersecurity monthly.

2.3.3 STIG Compliance – Continual/Monthly

2.3.3.1 All machines shall comply with applicable Security Technical

Implementation Guides (STIGs). Findings shall be collected, reported, and remediated per Standard Operating Procedures (SOPs).

2.3.4 Vulnerability Scanning – Continual/Monthly

2.3.4.1 Assured Compliance Assessment Solutions (ACAS) scans

performed and reported monthly and remediated within 30 days.

2.3.5 Patching Process – Continual/Monthly

2.3.5.1 Includes updates prompted by ACAS, STIGs, and major application updates for the video software. Update and report all changes made.

2.3.6 System Monitoring – Continual/Monthly

2.3.6.1 Log reviews monthly for any anomalies. Report anomalies to

Cybersecurity.

2.3.7 Change Management Records – Monthly Reporting

2.3.7.1 All changes to the system need to be requested, approved, and documented before taking place.

2.3.8 Password Policy checks – Bi-Annual Testing

2.3.8.1 Password policies have many requirements such as a minimum password complexity of 15 characters composed of at least one

(1) of each of the following character sets; An upper-case, lower-case, numeric and special characters. A bi-annual review shall be conducted by the contractor to ensure all requirements have been included and enforced.

2.3.9 Account Creation Approval – Bi-Annual Testing

2.3.9.1 Maintain record of how each account is approved and by who, as well as what access is granted for the role.

2.3.10 Account Termination – Bi-Annual Testing

2.3.10.1 Notification, reporting and timeliness of termination of access.

2.3.11 Access Reviews – Bi-Annual Testing

2.3.11.1 Review records of accounts for proper rights and access based on role and a need-to-know.

2.3.12 Incident Reporting Records – Bi-Annual Testing

2.3.12.1 Shall be able to leverage existing process and records via Cybersecurity and CLM.

2.3.13 McAfee HIDS – Annual

2.3.13.1 This control specifies that this tool shall be used by the contractor and the contractor shall ensure it is running and configured correctly.

2.3.14 Baseline Configurations Review – Annual

2.3.14.1 Baseline configurations shall be reviewed and approved annually. Specifically, ports and protocols for networking.

2.3.15 Contingency Plan Annual Review Cycle – Annual

2.3.15.1 Shall include annual reviews, updates, trainings, and tests of plan.

2.3.16 Physical Port Removal – Annual

2.3.16.1 One time activity and annual verification.

2.3.17 Continuous Monitoring Plan and Results – Annual Report of Testing

2.3.17.1 Plan shall be written to include the activities on this list and how we will test them.

3.0 PROGRAM MANAGEMENT

3.1 Management of Personnel

The Contractor shall establish processes and assign appropriate resources to effectively administer the requirement. The Contractor shall provide a list of all personnel performing under this requirement within 30 business days after receipt of award (ARO) (CDRL A002). All personnel shall be required to have a secret security clearance as well as complete a DD Form 254, Contract Security Classification Specifications, and a Nondisclosure Agreement.

The Contractor shall assign tasks and maintain proper and accurate time keeping records of personnel assigned to work on this requirement.

The Contractor shall ensure continuation of services during extended personnel absences due to sickness, leave, and voluntary or involuntary termination from employment such that there is no negative impact to the Government mission.

The CO may direct removal (permanent or temporary) of personnel for security, safety, or health reasons, upon discovery of fraudulent credentials/qualifications, or when Contractor personnel behave in an unprofessional manner which would be considered unacceptable by a reasonable person.

3.1.1 Technical Lead

The Contractor Technical Lead shall serve as the focal point to work with the assigned Government Leads, Program Manager (PM), and/or Contracting Officer Representative (COR). The Technical Lead shall be identified on the Personnel Roster (CDRL A002). This individual typically has a detailed knowledge of daily activities associated with the SOW and is responsible for day-to-day communication with the Government Leads, PM’s and/or CORs. This person shall also be a prime provider of the required services. Contractor Lead shall notify Government Leads, PMs and/or CORs daily of any manpower shortages.

3.1.2 Contractor Employees

Contractor shall not employ persons for work on this contract if such employee is identified to the contractor by the SWEG Security Office as a potential threat to the health, safety, security, general well-being, or operational mission of the installation and its population.

Contractor’s employees shall be required to identify themselves as contractor personnel by introducing themselves or being introduced as contractor personnel and displaying distinguishing badges or other visible identification for meetings with Government personnel. Contractor’s employees shall identify themselves as contractor employees in telephone conversations and in formal and informal written correspondence. The contractor shall be required to provide proof of certification for each employee working on the project.

3.1.3 Required Certifications

3.1.3.1 DoD 8570 IAM Level I

3.1.4 Employee Training

The Contractor shall employ fully qualified employees with the ability to accomplish the work described in this SOW. The Contractor shall ensure all employees have been properly trained to effectively perform their assigned duties.

Government-unique training may be required from time to time, and will be communicated either through the Govt PM, CO or COR. Any such communication of training will be considered mandatory to retain employment under this contract.

If Government- unique training is required to perform Contractor personnel duties, the contractor’s employee shall obtain written approval from the PM prior to attending the training.

3.1.5 Briefing

The contractor shall verbally present reports, charts, or other analyzed data to management or other management representatives on a monthly basis or as directed by the PM. Briefings shall accurately summarize pertinent/relevant data.

(CDRL A001, A003).

3.1.6 Federal Holidays

The following Federal holidays are observed under this contract:

New Year’s Day 1 January Martin Luther King’s Birthday Third Monday in January President’s Day Third Monday in February Memorial Day Last Monday in May Independence Day 4 July Labor Day First Monday in September Columbus Day Second Monday in October Veteran’s Day 11 November Thanksgiving Day Fourth Thursday in November Christmas Day 25 December Juneteenth 19 June

If the contractor is prevented from performance as the result of an Executive Order or an Administrative leave determination that applies to the using activity, such time may not be charged to the contract. NOTE: Individual state holidays are not observed by the Federal Government and the Government facilities will be open for work on those days. The Contractor shall plan accordingly to have employees work business as usual on those days.

3.1.7 Schedule

The Contractor shall be allotted 216 hours a year, broken down to 18 hours a month (2 working days), to complete the requirements within this SOW. The Contractor shall respond to Government requests for contractual actions in a timely fashion, hereby defined as 5 business days unless otherwise specified within this SOW. The Contractor shall adhere to all schedule timelines, milestones, delivery schedules and administrative requirements that contribute to or effect schedule variance, to include scheduled on-time delivery of reports, data products, billing invoices, staffing of personnel, and action items.

3.1.8 Business Relations

The Contractor shall successfully integrate and coordinate all activity needed to execute:

1. The task order

2. The timeliness

3. The completeness and quality of problem identification

4. The corrective action plans

5. The proposal submittals

6. The timely identification of issues in controversy

7. The effective/responsive management of subcontractors

8. The customer satisfaction

9. The professional and ethical behavior of the contractor management personnel.

4.0 DELIVERABLES

Documentation deliverables shall be delivered IAW this SOW and the Department of Defense (DD) Forms 1423 (CDRLs) attached to the contract unless otherwise specified by the CO through a contract modification or CO letter. If there is a discrepancy in due dates between the SOW and the DD Forms 1423, this SOW shall take precedence. Due dates falling on non-working days (Saturdays, Sundays, and recognized national (legal) holidays) shall be construed to mean the next regular working day. All due dates (i.e., 30 Days ARO) are calendar counted unless designated otherwise.

The Government has the inherent right to disapprove any data item. Therefore, the Government COR will have the right to reject or require correction of any deficiencies found in deliverables. In the event of rejection of any deliverable, the COR, in coordination with the CO, will notify the Contractor in writing of the specific reasons why the deliverable was rejected. Rejected deliverables shall be resubmitted to the COR for re-inspection no later than COR suspense date. The Government must approve final versions of data deliverables.

4.1 Required Technical Deliverables shall include:

4.1.1 Monthly Status Report (CDRL A001)

4.1.2 Personnel Roster (CDRL A002)

4.1.3 Activity Status Reporting (CDRL A003)

4.1.4 Quality Control Plan (CDRL A004)

4.1.5 POA&Ms for non-compliant security controls (CDRL A005)

4.2 Table of Contract Data Requirements List (CDRL)

SOW

Paragraph Description CDRL Data Item

Number Frequency As of

Date

Date of First

Submission

Date of Subsequent Submission

2.2.3, 3.1.5

Monthly Status Report

A001 Monthly 30 Days

ARO

Monthly

3.1, 3.1.1 Contractor’s Personnel Roster

A002 Monthly and as

Required

30 Days

ARO

Monthly and as

Required

3.1.5 Activity Status

Reporting A003 As

Required As Required

6.2 Quality Control

Plan

A004 One Time 30 Days

ARO

As Required

2.1.7 POA&Ms for

non-compliant security controls

A005 As Required

As Required

5.0 GENERAL INFORMATION

5.1 Place of Performance

The Primary place of performance shall be:

309th Software Engineering Group 6137 Wardleigh Rd.

Building 1515 Hill AFB, UT 84056

5.2 Period of Performance

The PoP Shall be one (1) year after receipt of order (ARO).

5.2.1 Options

The contract shall include four (4) option years to extend service.

5.3 Inherently Governmental Functions

The Contractor shall not perform any inherently Governmental functions as defined by Federal Acquisition Regulation (FAR) Subpart 7.5, Inherently Government Functions. All program decisions shall be the sole responsibility of the Government.

The Contractor shall not counsel, mentor, make judgments and/or discretionary decisions or perform any other activities related to supervision of Government personnel.

If the Contractor believes that any actions constitute or are perceived to constitute inherently Governmental functions, the Contractor shall notify the CO immediately.

5.4 Data Rights

The Government shall retain unlimited rights to all data and deliverables developed at the Government’s expense. At any time and per Government request, any records, documents, and associated papers shall be available for review.

6.0 QUALITY ASSURANCE

6.1 Quality Control

The Contractor shall develop, implement, and maintain a comprehensive inspection system that assures compliance with all requirements of this contract IAW FAR part 46, Quality Assurance.

6.2 Quality Control Plan (QCP)

The Contractor shall develop a QCP that demonstrates how the Contractor shall maintain an inspection system acceptable to the Government regarding the services under this task order.

The Contractor shall provide the Quality Control Plan (QCP) to the COR within fifteen (15) business days after receipt of award. The CO will notify the contractor of acceptance or required modifications to the plan before the contract start date.

Modifications shall be made within fifteen (15) calendar days of start (CDRL A004).

6.3 Contractor’s QCP Requirements

The QCP shall provide procedures for an independent inspection program to cover tasks and services listed in the SOW. Independent means the inspector doing the quality control inspections does not perform the work and is not under direct supervision of personnel directly responsible for the work. Contractor’s Quality Control inspectors shall have expert SOW knowledge and be qualified regarding the subject matter/area to be inspected.

The QCP shall include a requirement to ensure all submittals, reports, etc., required by the SOW are provided to the appropriate Government organization. The plan shall include specifics as to the areas to be inspected, on a scheduled and unscheduled basis. Procedures for determining inspection schedules, procedures for submission of quality control inspection reports to the Government CORs, and the organizational structure of the Quality Control office and how it relates to the rest of the contractor's organization. Contractor shall provide the Government COR and CO unlimited, full access to quality control records, inspection sheets, records, databases, tracking logs, and working documents. The Contractor shall capture all Quality Control inspection requirements in a Quality Control Database. The inspection shall capture as a minimum: date of Quality Control, time of Quality Control, building number, post location/door number, SOW Paragraph, detail observation (with photo if any taken), Point of Contact responsible for that item and any other item that identifies where and at what location inspection was performed. The Contractor shall report any non- compliance of the SOW to the Government COR and CO within three (3) business days of their findings and corrective action plans to correct the non- compliance. The Quality Control Database shall be updated within twenty-four (24) hours of the inspection performed. The Quality Control Database shall be accessible to all Government CORs and Quality Assurance (QA) personnel. The QCP shall provide a description of the methods to be used for identifying and preventing defects in the quality of service performed and means to collect data that shows compliance with the performance thresholds listed in the Service Summary.

The QCP shall include procedures for a customer feedback program to collect customer input and address customer complaints.

The plan shall develop procedures covering key and badge control that includes the turn- in of issued keys and badges by personnel who no longer require access to locked areas or base entry, and control procedures for physical security of Government property.

7.0 GOVERNMENT QUALITY

7.1 Government Provided Service Plan

When work is to be performed at the Government’s location, the Government will prioritize service requirements based on operating requirements and provide the contractor with a service plan. The Government will provide the Contractor’s Technical Lead a generalized projected service plan that may be reviewed or revised by the Government Program Manger as necessary. The purpose of the plan is to prioritize Government service requirements and provide the contractor with the information required to effectively manage their personnel.

7.2 Contractor Performance Assessment Reporting System (CPARS) Applicability This is not applicable due to contract amount being less than $1 million dollars.

7.3 Government Inspection

Contractor performance is subject to surveillance by the COR to ensure compliance with this task order to include all elements of the Services Summary.

All records of non- conformance and corrective actions will be documented IAW the Quality Assurance Surveillance Plan (QASP).

7.4 Qualification Reviews

The Government reserves the option to audit the qualifications of any contractor personnel providing services to the Government under this task order.

7.5 Program Manager (PM)

The PM provides primary program oversight and management of the contract. The PM ensures the COR is trained before performing any COR duties and supports the COR’s performance assessment activities. Additionally, the PM will also review contractor’s performance periodically.

7.6 Contracting Officer (CO)

The CO is the individual designated by the AF to direct and/or redirect the efforts of the Contractor or modify any of the items of this contract.

7.7 Contracting Officer’s Representative (COR)

The COR is the Government representative appointed by the CO responsible for monitoring, evaluating and reporting Contractor performance on all applicable contracts, or under this contract. The CORs will interface with the Customer, the Contractor, and the Program Management Office (PMO).

ATTACHMENT 01

CONTRACTOR NONDISCLOSURE AGREEMENT

CONTRACTOR

NONDISCLOSURE AGREEMENT

Contract # _____________________________________ Task Order # ___________________________________

I, __________________________________, an employee of ______________________________________, (Contractor) in order to support the United States Air Force (USAF) and in consideration of the USAF granting me access to Confidential, Proprietary and/or Sensitive Information held by the USAF relating to the tasks to be performed under the Task Order, intending to be legally bound, hereby agree to the following terms and conditions:

1. I understand that my assignment to support the Contractor in its contractual duties under the Task Order (the “Effort”) will involve access to Confidential, Proprietary and/or Sensitive Information belonging to other contractors, other third parties, or the USAF. The sharing of Confidential, Proprietary and/or Sensitive Information is necessary to effectively perform the mission of the USAF.

2. Except as expressly authorized in writing by the USAF, I agree to hold Confidential, Proprietary and/or Sensitive Information in trust and confidence and agree that it shall be used only for my performance of duties in support of the Contractor’s performance of the Effort, shall not be used for any other purpose, or disclosed to any third party outside the USAF. I agree that I shall not, except as expressly authorized in writing by the USAF, at any time during or after my performance of duties in support of the Contractor’s performance of the Effort, directly or indirectly, disclose, publish or disseminate, to any other person or entity, any Confidential, Proprietary and/or Sensitive Information I have access to by reason of my performance of duties in support of the Contractor’s performance of the Effort, nor shall I use any such Confidential, Proprietary and/or Sensitive Information for my personal use or advantage, or make it available to others not cleared for access to Confidential, Proprietary and/or Sensitive Information by the USAF or lacking a need-to-know for performance of the Effort. I will hold all Confidential, Proprietary and/or Sensitive Information I have access to by reason of my performance of duties in support of the Contractor’s performance of the Effort in confidence and use it solely for the benefit of the USAF and the performance of Effort. I shall not retain any Confidential, Proprietary and/or Sensitive Information, including written notes, photographs, sketches, models, memoranda or any tangible representation of the Confidential, Proprietary and/or Sensitive Information except as required in my performance of duties in support of the

Contractor’s performance of the Effort. Without limiting the generality of the foregoing statements, I agree that Confidential, Proprietary and/or Sensitive Information shall not be released to the media, press, competing firms, individuals, or Government officials outside the USAF for any purpose. I further understand and agree that all Confidential, Proprietary and/or Sensitive Information shall be retained, disseminated, released, and destroyed in accordance with the requirements of law and applicable Department of Defense or USAF directives, regulations, instructions, policies and guidance.

3. All information that I receive or obtain in performance of my duties in support of the Contractor’s performance of the Effort shall be deemed to be Confidential, Proprietary and/or Sensitive Information, including, without limitation, visual, verbal and written information, in whatever form or medium, including, but not limited to, personal, business or financial information, or intellectual property, or technical information in the form of discussions, communications, designs, concepts, requirements, specifications, software, interfaces, components, processes, or similar things. I understand and agree that any work product related to the Effort, including, but not limited to, final documents and products, drafts, feeder documents, briefings, notes, and any other related oral or written communication shall constitute Confidential, Proprietary and/or Sensitive Information for purposes of this Agreement. Confidential, Proprietary and/or Sensitive Information shall not include information that I or the Contractor can demonstrate (A) was known by me or the Contractor without restriction as to further disclosure when received or was developed independently by the Contractor by individuals who had no direct or indirect access to such information,

(B) was obtained from a source other than the USAF, its employees, agents, or contractors through no breach of confidence, (C) was in the public domain when received or thereafter enters the public domain through no breach of confidence by Contractor or myself, or (D) was used or disclosed with the prior written approval of the USAF.

4. I have been advised and understand that my violation of this agreement could cause irreparable injury to the United States. I understand that the United States Government may seek any remedy available to it to enforce this Agreement, including, but not limited to, application for a court order prohibiting disclosure of information in breach of this Agreement. I have been advised that the action can be brought against me in any of the several appropriate United States District Courts where the United States Government may elect to file the action. Court costs and reasonable attorneys’ fees incurred by the United States Government may be assessed against me if I lose such action. I understand that my violation of this Agreement may result in criminal action. I recognize that nothing in this Agreement constitutes a waiver by the United States of the right to prosecute me for any statutory violation.

5. Any questions I have regarding this agreement that I desire to direct to the USAF shall be in writing to _____________________________ [Insert name & address of USAF POC].

6. I hereby assign to the USAF all royalties, remunerations, and emoluments that have resulted, will result or may result from any disclosure, publication, or revelation of Confidential, Proprietary and/or Sensitive Information not consistent with the terms of this Agreement.

7. Unless and until I am released in writing by an authorized representative of the USAF, I understand that all conditions and obligations imposed upon me by this Agreement apply during the time that I am granted access to the Confidential, Proprietary and/or Sensitive Information, and at all times thereafter. Each provision of this Agreement is severable. If a court should find any provision of this Agreement to be unenforceable, all other provisions of this Agreement shall remain in full force and effect. This Agreement shall be interpreted under and in conformance with the laws of the United States.

By:_________________________________________

Print Name:__________________________________

Date:_______________________________________