18-A2-006_-_ISSO_PWS.docx

PERFORMANCE WORK STATEMENT (PWS)

FOR

INFORMATION SYSTEM SECURITY OFFICER (ISSO) SUPPORT SERVICES

1. General

1.1 Scope of Work. The contractor shall provide all personnel, equipment, tools, materials, supervision, and quality control necessary, except as specified in Paragraph 3.0 as Government Furnished, to perform Information System Security Officer (ISSO) support services as defined in this PWS.

1.2 Background. The ANG is currently enhancing its aligned Intelligence, Surveillance, and Reconnaissance (ISR) and Command and Control (C2) organizations that conduct various missions in support Distributed Common Ground System (DCGS), Remotely Piloted Aircraft (RPA), Distributed Mission Site (DMS) and Air Operations Group (AOG)/Air Defense Sections (ADS) weapon systems to include each organization manages, administers and maintains a Local Area Network (LAN) and mission system equipment on multiple security enclaves and connectivity segments as part of the ISR mission enterprise.

1.3 Period of Performance (PoP). The period of performance shall be one base year of 12 months and four 12-month option years.

1.4 Place of Performance. The service requested is for the following locations:

(DCGS): Locations of service are 102 Intelligence Support Squadron (ISS), Otis ANGB, Mashpee, MA; 152 Intelligence Squadron (IS), Reno-Tahoe IAP, Reno, NV; 188 ISS, Ft. Smith, AR; 117 IS, Birmingham-Shuttlesworth IAP, Birmingham, AL; 184 ISS, McConnell AFB,Wichita, KS; Hulman Field ANGB, Terre Haute,Terre Haute, IN

(RPA): Locations of service are 174 Attack Wing (ATKW), Syracuse, NY; 107 Air Wing (AW), Niagara Falls, NY; 188 Fighter Wing (FW), Ft. Smith, AR; 110 AW, Battle Creek, MI; 118 AW, Nashville, TN; 132 FW, Des Moines, IA; 163 Reconnaissance Wing (RW), Riverside, CA; 111 AW, Horsham, PA; 214 Reconnaissance Group (RG), Tucson, AZ; 147 RW, Houston, TX; 119 WG,Fargo, ND; 178 FW, Springfield, OH.

(DMS): Location of service is 151 ISRG Salt Lake City, UT

(AOG)/(ADS): 224 ADG, Rome, NY; 152 AOG, Syracuse, NY; 157 AOG, Jefferson Barracks, MO; 183 AOG, Springfield, IL; 186 AOG, Meridian, MS; 193 AOG, State College, PA; 217 AOG, Battle Creek, MI; 225 ADG, Tacoma, WA.

1.4.1 Operating Hours. The contractor shall provide services required under this contract within core operating hours (dependent upon site requirements) except on recognized US holidays or when the Government facility/installation is closed due to local or national emergencies, administrative closings, or similar Government-directed facility/installation closings.

1.4.2 Recognized Holidays. The following are recognized US holidays. The contractor shall not perform services on these days.

1.4.2.1 If additional federal holidays or time off is declared by the President of the United States or other Government official, DOD employees may be given “59 minutes” early release. In these events, the contractor employees shall seek appropriate guidance on duty location from his/her contractor supervisor or COR. As a courtesy, the contractor should inform the Program Management Office where support will be provided (i.e., contractor’s site).

1.4.2.2 The contractor shall at all times maintain an adequate work force for the uninterrupted performance of all tasks defined within this PWS when the Government facility/installation is not closed for the above reasons. When hiring personnel, the contractor shall keep in mind that the stability and continuity of the work force are essential.

1.4.3 Telework. Telework is not authorized.

1.4.4 Unscheduled Gate / Base Closures. Unscheduled gate closures by the Security Forces may occur at any time causing all personnel entering or exiting a closed installation to experience a delay. This cannot be predicted or prevented. Contractors are not compensated for unexpected closures or delays. Vehicles operated by contractor personnel are subject to search pursuant to applicable regulations. Any moving violation of any applicable motor vehicle regulation may result in the termination of the contractor employee’s installation driving privileges.

1.4.4.1 Contractor shall not report to work on those days the Government or installation is closed due to inclement weather, national emergencies, or other events requiring installation closure. During periods of closure, the contractor shall work with the Government to determine payment terms; any payments will be subject to Contracting Officer (KO) approval. For official AF or base-level Family Days, or holidays granted by Executive Order, the Government is not liable for the contractor’s costs incurred for work at the locale affected by the shutdown. In all cases (including normal workdays), when Government personnel are not available in the building/location of work to oversee contractor activities, contractor personnel shall leave the premises but are allowed to work at the local contractor’s office. Costs incurred for work will not be reimbursed, unless the option for alternate work locations is coordinated with the Contracting Officer Representative (COR) and approved by the KO prior to performing the work.

1.4.5 Performance of Services during Crisis or Emergency Conditions. In the event of a crisis, services on this contract have been determined as non-essential and do not require continued support during the crisis or emergency.

1.5 General Information

1.5.1 Air Force Privacy Act Program. Contractor personnel may be exposed to data subject to the Privacy Act of 1974. The contractor shall ensure all its personnel assigned to perform work under this PWS take appropriate action to prevent disclosure of this information and follow the guidance provided in AFI 33-332, Air Force Privacy and Civil Liberties Program, 12 January 2015.

1.5.2 Air Force Messaging. Contractor will comply with guidance contained in Air Force Manual (AFMAN) 33-152, User Responsibilities and Guidance for Information Systems, 1 June 2012, specifically:

- Chapter 2, Information Systems and End User Devices (entire section)

- Section 6.2, Air Force Messaging, (entire section)

- Section 6.4, Electronic Message Format, (entire section)

1.5.3 Quality Control (QC). The contractor shall develop, implement, and maintain an internal quality control plan (QCP) to ensure all services are performed in accordance with this PWS. The contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The contractor’s QCP is the means by which it assures itself that its work complies with the requirements of the contract. As a minimum, the contractor shall develop QC procedures that address the areas identified in Technical Exhibit 1, Performance Requirements Summary. After acceptance of the QCP, the contractor shall obtain the Contracting Officer’s (KO) acceptance in writing of any proposed changes to its QCP. The QCP shall be delivered to the KO within 30 days of contract award.

1.5.4 Quality Assurance (QA). The Government shall evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan is primarily focused on what the Government must do to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and acceptable quality level(s) (defect rate(s)).

1.6 Security Requirements. The contractor shall comply with all applicable installation/facility access and local security policies and procedures, which may be obtained from the facility security officer (FSO). The contractor shall provide all information required for background checks to meet installation access requirements to be accomplished by the local installation’s Security Forces, Director of Emergency Services or local Security Office. The contractor shall ensure compliance with all personal identity verification requirements as directed by DOD, HAF and/or local policy. Should the Force Protection Condition (FPCON) change, the Government may require changes in contractor security procedures and/or processes.

The contractor shall:

a. Comply with the Computer Security Act of 1987 and all DOD and Air Force requirements for access to sensitive, but unclassified information and classified systems.

b. Ensure personnel assigned under this PWS shall have at least an Interim Top Secret clearance with SCI eligibility and be entered in the Joint Personnel Adjudication System (JPAS) showing proper access indoctrination before performing any work under this contract effort. Contractor personnel shall have the required clearance and caveat(s) at the service start date. Evidence that the contractor is properly cleared shall be presented to the POC at each location and to the COR prior to the start of the service.

c. Provide properly cleared personnel, providing security briefings, and ensuring compliance by its employees with the Government or contractor security regulations.

d. Comply with all administrative and security requirements to obtain a Common Access Card (CAC).

e. Obtain Non-classified Internet Protocol Routing Network (NIPRNet), Secret Internet Protocol Routing Network (SIPRNet) and Joint Worldwide Intelligence Communications System (JWICS) user accounts, as required by the COR.

f. Return of ALL badges (controlled/restricted area, local access, building, etc.) to include CAC (if necessary) and any other government property upon contract completion or when contract personnel no longer requires access to the installation (e.g., quits, contract termination, etc.) within 14 days.

g. Coordinate with the site POC or sponsoring organization on all security issues and to gain access to the base and all areas necessary to execute this project.

h. Submit a Visit Request via JPAS to the Chief, Information Protection and/or Security Management Office (SMO) no later than two weeks prior to installation commencement, to allow for JPAS crosscheck of all contractor personnel being granted access to any work location. New visit request will be submitted each time there is a change of personnel (additions/deletions) and at each contract renewal (Option Year).

i. Comply with established security procedures for entering an installation and its facilities, including special security procedures for entry to restricted or controlled areas. The government reserves the right to refuse entry to any individual at any work location.

j. Protect DOD information technology resources (e.g., installations, personnel, equipment, electronic media, documents, etc.) from damage, loss, theft or unauthorized physical access. The contractor shall ensure physical security is in accordance with DoDI 8500.01.

k. The contractor’s employees shall become familiar with and obey the regulations of the installation; including fire, traffic, safety and security regulations while on the installation. All contractor employees shall carry proper identification with them at all times.

1.6.1 COMSEC and IT Security. All communications with DOD organizations are subject to communications security (COMSEC) review. All telephone communications networks are continually subject to intercept by unfriendly intelligence organizations. DOD has authorized the military departments to conduct COMSEC monitoring and recording of telephone calls originating from, or terminating at, DOD organizations. Therefore, the contractor is advised that any time contractor place or receive a call they are subject to COMSEC procedures. The contractor shall ensure wide and frequent dissemination of the above information to all employees dealing with DOD information. The contractor shall abide by all Government regulations concerning the authorized use of the Government's computer network, including the restriction against using the network to recruit Government personnel or advertise job openings.

1.6.2 Use of Government Information Systems. Use of Government Information Systems (IS) and access to Government networks is a revocable privilege, not a right. Users are the foundation of the DOD strategy and their actions affect the most vulnerable portion of the Air Force’s and Air National Guard’s Enterprise Information (EI). Contractor employees shall have a favorable background investigation or hold a security clearance and access approvals commensurate with the level of information processed or available on the system. Contractor employees shall:

a. Comply with the command's Acceptable Use Policy (AUP) for Government owned IS and sign an AUP prior to or upon account activation.

b. Complete initial and/or annual Information Assurance (IA) training IAW AFPD 33-2.

c. Mark and safeguard files, output products, and storage media per classification level and disseminate them only to individuals authorized to receive them with a valid need to know.

d. Protect IS and IS peripherals located in their respective areas in accordance with physical security and data protection requirements.

e. Practice safe network and Internet operating principles and take no actions that threaten the integrity of the system or network.

1.6.3 Protection of Personally Identifiable Information (PII). The contractor shall protect all Personally Identifiable Information (PII) encountered in the performance of services in accordance with DFARS 224.103 and DoDD 5400.11, Department of Defense Privacy Program, and DOD 5400.11-R. If a PII breach results from the contractor’s violation of the aforementioned policies, the contractor shall bear all notification costs, call-center support costs, and credit monitoring service costs for all individuals whose PII has been compromised.

1.6.4 CAC Requirements. The Common Access Card (CAC) is the Department of Defense’s (DOD) Federal Personal Identity Verification (PIV) credential. The issuance of a CAC will be based on four criteria; (a) eligibility for a CAC and (b) verification of DoD affiliation from an authoritative data source IAW DoDM 1000.13, V1, DoD Identification (ID) Cards: ID Card Life Cycle, January 2014; (c) completion of background vetting requirements according to the Federal Information Processing Standards Publication 201-2, Personal Identity Verification (PIV) of Federal Employees and contractors, August 2013, and DoD 5200.2-R, Department of Defense Personnel Security Program, January 1987; and (d) verification of a claimed identity. CAC eligible personnel must be registered in the Defense Enrollment Eligibility Reporting System (DEERS) through either an authoritative personnel data feed from the appropriate Service or Agency or Trusted Associate Sponsorship System (TASS).

a. For contractors requiring Common Access Card (CAC). Before CAC issuance, the contractor employee requires, at a minimum, a favorably adjudicated National Agency Check with Inquiries (NACI/Tier 1) or higher investigation IAW DoDI 5200.46. The contractor employee will be issued a CAC only if duties involve one of the following: (1) Both physical access to a DOD facility and access, via logon, to DOD networks on-site or remotely; (2) Remote access, via logon, to a DOD network using DOD-approved remote access procedures; or (3) Physical access to multiple DOD facilities or multiple non-DOD federally controlled facilities on behalf of the DOD on a recurring basis for a period of 6 months or more. At the discretion of the sponsoring activity, an initial/interim CAC may be issued based on a successfully scheduled NACI with the Office of Personnel Management and a favorable completion of an FBI fingerprint check.

1.6.4.1. HSPD-12 Background Investigation Requirements. The contractor will ensure Common Access Cards (CACs) are obtained by all contract or subcontract personnel assigned to work on the Government site and/or requiring access to a DOD network. In accordance with DoDI 5200.46, DOD Investigative and Adjudicative Guidance for Issuing the Common Access Card (CAC), September 2014, a favorably adjudicated National Agency Check with Inquiries (NACI) or equivalent in accordance with revised Federal Investigative Standards is the minimum investigation required for a final credentialing determination for a CAC. The contractor shall make all reasonable efforts to ensure that contractor employees meet CAC eligibility standards upon assignment to the contract and shall be held responsible for delays, failure to meet performance requirements or decreases in efficiency in accordance with the applicable inspection clause. With this contract requiring members to have a minimum adjudicated Top Secret, their investigation requirements will exceed the HSPD-12 requirement for a CAC.

1.6.4.2. Trusted Associate Sponsorship System (TASS). The contractor is responsible for coordinating with the Trusted Agent (TA) for processing applications for Common Access Cards (CAC) for every contractor employee who deploys with the military force OR who has needs to access any government computer network in accordance with FAR 52.204-9, "Personal Identity Verification of Contractor Personnel."

The contractor is responsible for managing requests for new or renewal CAC cards in sufficient time to ensure that all contractor employees have them when needed to perform work under this contract. The norm is at least ten calendar days advance notice to the TA, unless there are extenuating circumstances approved by the Contracting Officer's Representative (COR) or Contracting Officer.

It is recommend that a corporate Facility Security Officer (FSO) be designated to serve as the contractor's single point of contact for the TASS application process and other security related matters. If an FSO is not established, each contractor employee requiring a CAC will be required to process their own applications.

CAC applications shall be processed through the TASS. The contractor's FSO or contractor employee shall submit requests for a CAC via email to the designated TASS Trusted Agent before accessing the TASS website.

The government will establish a TASS application account for each CAC request and will provide each contractor employee a USER ID and Password, via email, to the FSO or member direct. The FSO or contractor employee shall access the TASS account and complete the CAC application (entering/editing contractor information as applicable) at: https://www.dmdc.osd.mil/tass/. The FSO or contractor employee will submit completed applications in TASS and will follow up to ensure that the TA is processing the request.

A CAC cannot be issued without evidence that the sponsoring agency has initiated a National Agency Check with Written Inquires (NACI/Tier 1 Investigation) or, the FSO has submitted a personnel security investigation (PSI) greater in scope than a Tier 1. If the contract employee already has a favorable/adjudicated Tier 1 or higher investigation, then reciprocity can be used.

The government will inform the contractor's applicant, via email, of one of the following:

a. Approved.* Upon approval, the information is transferred to the Defense Enrollment Eligibility Reporting System (DEERS) database and an email notification is sent to the contractor with instructions on obtaining their CAC. The contractor proceeds to a Real-Time Automated Personnel Identification System (RAPIDS) station (RAPIDS Site Locator: http://www.dmdc.osd.mil/rsl/).

b. Rejected.* The Government, in separate correspondence, will provide reason(s) for rejection.

c. Returned. Additional information or correction to the application required by the contractor employee.

*The contractor shall maintain records of all approved and rejected applications.

At the RAPIDS station, the RAPIDS Verification Officer will verify the contractor by SSN and two forms of identification. Identity source Documents must come from the list of acceptable documents included in Form I-9, OMB No. 115-0136, "Employment Eligibility Verification." Consistent with applicable law, at least one document from the Form I-9 list shall be a valid (unexpired) State or Federal Government-issued picture identification (ID). The Identity documents will be inspected for authenticity and scanned and stored in the DEERS upon issuance of an ID. The photo ID requirement cannot be waived, consistent with applicable statutory requirements. The Verification Officer will capture primary and alternate fingerprints, picture, and updates to DEERS and will then issue a CAC.

Issued CACs shall be issued for the period of performance (current contract year), not the contract end date (inclusive of any options). CACs are validated by the acceptance and issuance of the new Option Year.

The contractor shall return issued CAC's to the TA, COR or DEERS office upon departure or dismissal of each contractor employee. Obtain a receipt for each card and provide to the TA/COR if returned to a DEERS office.

1.6.5 Advanced Distributed Learning Service (ADLS). All contractor employees and associated sub-contractor employees assigned to work on a government site and/or requiring access to a DOD network will be required to register with ADLS at commencement of services in order to complete the necessary training required of them initially and annually for the duration of the contract (e.g., DOD IAA Cyber Awareness, Protecting Sensitive Information, Force Protection, etc.). ADLS website: https://golearn.csd.disa.mil/kc/rso/login/ADLS_login.asp

1.6.6 Classified Information. This contract includes services that require access to and handling of classified information. The contractor shall comply with FAR Clause 52.204-2, Security Requirements, including the National Industrial Security Program Operating Manual (DOD 5220.22-M) and applicable updates/changes. This clause involves access to information classified “Confidential/Secret/Top Secret” and requires contractors to comply with a Visitor Group Security Agreement (VGSA) when designated as a Visitor Group at all contractor operations located on Air Force/Air National Guard installations in accordance with this PWS. Contract personnel must be entered in the Joint Personnel Adjudication System (JPAS) and vendor will comply with paragraph 1.6h above. A DD Form 254, DoD Contract Security Classification Specification, is required for all classified contracts. Completion of local security training (information protection-related material) will be accomplished at the wing/unit level. Derivative Classification and Marking Classified computer-based training (CBT) may also be required as per assigned duties (i.e., access to SIPRNet). The contract DD 254 will be kept on file by the COR, host CIP and ANG Information Protection (IP), and will be an attachment to this PWS upon contract implementation.

1.6.7 Visitor Group Security Agreement (VGSA). If designated as a Visitor Group, the contractor shall enter into a long-term visitor group security agreement at each location where contract performance is on an Air Force/Air National Guard installation. This agreement shall outline how the contractor integrates security requirements for contract operations with the Air Force to ensure effective and economical operation on the installation. The agreement shall be executed within the phase-in period by way of the Information Protection Office at each location and include:

a. Security support provided by the Air Force to the contractor shall include but not limited to storage containers for classified information/material, use of base destruction facilities, classified reproduction facilities, use of base classified mail services, security badges, base visitor control, investigation of security incidents, training, base traffic regulations and the use of security forms and conducting inspections required by DOD 5220.22-R, Industrial Security Regulation; Air Force Policy Directive 16-14, Security Enterprise Governance; and Air Force Instruction 16-1406, AF Industrial Security Program.

1.6.8 Antiterrorism (AT) Level 1 Awareness Training. All contractor employees, to include subcontractor employees, requiring access to US Government installations, facilities and controlled access areas shall complete AT Level I training within 10 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable. AT Level I may be accomplished by a Level I qualified instructor; completing the Force Protection computer-based training (CBT) course on the Advanced Distributed Learning System (ADLS), or Joint Knowledge Online at http://jko.jten.mil. Tracking for each contractor or subcontractor employee is the responsibility of the COR or unit AT Representative.

1.6.9 Information Assurance (IA) / Information Technology (IT) Training and/or Certification. All contractor employees and associated sub-contractor employees shall complete the DOD Cyber Awareness Challenge before issuance of network access and annually thereafter. All contractor employees performing services involving IA/IT functions shall comply with Level 1 certification requirements in DoDD 8140.01, DOD 8570.01-M and AFPD 33-2 within 10 days of the start of contract performance. In accordance with DOD 8570.01-M, DFARS 252.239.7001 and AFM 33-282, contractor employees performing services supporting IA/IT functions shall be appropriately certified upon contract award. An acceptable baseline certification for IAM Level I as stipulated in DOD 8570.01-M shall be completed upon contract award.

1.6.10 OPSEC Requirements/Plan. The contractor shall develop an OPSEC Plan and provide it to the COR or KO within 10 calendar days of contract award to be reviewed and approved by the responsible Government OPSEC officer, per AFI 10-701, Operations Security. This Plan shall include the government's critical information, why it needs to be protected, where it is located, who is responsible for it, and how to protect it. For the contractor to effectively comply with OPSEC provisions of the contract, the organization will provide the following guidance: (1) Organization’s Critical Information; (2) Adversaries’ collection threat information as it applies to the organization’s mission and the contract; (3) Operations Security guidance; and (4) Specific OPSEC measures the organization requires (as appropriate).

1.6.10.1. OPSEC Training. In accordance with AFI 10-701, Operations Security, OPSEC PMs/SMO/SMNCOs/Coordinators will provide OPSEC training or training materials to contract employees within 90 days of employees’ initial assignment to the contract and annually thereafter. The contractor shall provide a certificate of training completed to the COR within 15 calendar days. General organizational orientations may need to be supplemented by duty-related orientations in the work center targeted toward specific critical information and vulnerabilities associated with the work. Initial training (OPSE 1301 – OPSEC Fundamentals) and refresher training (Protecting Sensitive Information) are both available on the ADLS website.

1.6.11 Physical Security. Areas controlled by contractor employees shall comply with base Operations Plans/Instructions for Force Protection Conditions (FPCON) procedures, Random Anti-Terrorism Measures (RAMs) and local search/identification requirements. The contractor shall safeguard all government property including controlled forms provided for contractor use. At the close of each work period, Government facilities, equipment and materials shall be secured.

1.7 Key Control. The contractor shall establish and implement methods to ensure all keys and key cards issued by the Government are not lost or misplaced, and are used only by authorized persons. No keys issued by the Government shall be duplicated. Such procedures shall include turn-in of any issued keys by contractors who no longer require access to locked areas.

1.7.1 Lost / Duplicated Keys. The contractor shall immediately report any occurrences of lost or duplicated keys/key cards to the COR. In the event keys other than master keys are lost or duplicated, the contractor shall, upon direction by the KO, re-key or replace the affected lock or locks; however, the Government, at its option, may replace the affected lock or locks or perform re-keying. When the replacement of locks or re-keying is performed by the Government, the total cost of re-key or replacement of the lock or locks shall be deducted from the monthly payment due the contractor. In the event a master key is lost or duplicated, all locks and keys for that system shall be replaced by the Government and the total cost deducted from the monthly payment due the contractor.

1.7.2 Limit Access. The contactor shall prohibit the use of the Government-issued keys/key cards by any persons other than the contractor’s employees. The contractor shall prohibit the opening of locked areas by contractor employees to permit entrance of persons other than contactor employees engaged in the performance of services in those areas, or personnel authorized entrance by the KO.

1.7.3 Lock Combinations. The contractor shall establish and implement methods to ensure all lock combinations are not revealed to unauthorized persons. The contractor shall ensure lock combinations are changed when personnel having access to the combinations no longer have a need to know such combinations.

1.8 Special Qualifications. The contractor shall possess and maintain, at a minimum, the specified Information Assurance certification as identified in the DoD 8570.01-M listing for IAM Level II Information Assurance professionals (currently Security+ CE, GSLC, or CAP certifications).

1.8.1 The contractor shall have a minimum of five years’ experience in the field—four of which must be in SCI systems administration and/or computer security management.

1.8.2 The contractor shall possess expertise in the supported weapon system, Solaris system security, Solaris network security, Department of Defense and AF IC computer security regulations and requirements, SUN, CISCO, UNIX, and Microsoft hardware and software proficiency. Furthermore, the contractor shall be familiar with the six-step Risk Management Framework (RMF) process for obtaining and maintaining the authority to operate (ATO) for information systems under their purview as well as familiarity with the Telos Xacta governance, risk, and compliance (GRC) software.

1.9 Post Award Conference / Periodic Progress Meetings. The contractor agrees to attend any post award conference convened by the KO in accordance with Federal Acquisition Regulations Subpart 42.5. The KO, COR, and other Government personnel, as appropriate, may meet periodically with the contractor to review the contactor’s performance. At these meetings, the KO will apprise the contractor of how the Government views the contractor’s performance and the contractor shall apprise the Government of problems, if any, being experienced. The contractor shall resolve outstanding issues raised by the Government. Contractor attendance at these meetings shall be at no additional cost to the Government.

1.10 Contract Manager (CM). The contactor shall designate a CM who shall ensure performance under this contract. The name of this person, and an alternate who shall act for the contractor when the CM is absent, shall be designated in writing to the KO. The CM or alternate shall have full authority to act for the contractor on all contract matters relating to daily operation of this contract. The CM shall work through the COR, (or the KO if a COR is not assigned), to resolve issues, receive technical instructions, and ensure adequate performance of services. The CM shall ensure that contractor employees do not perform any services outside the scope of the contract without an official modification issued by the KO. The CM shall ensure contractor employees understand that services performed outside the scope of the contract are performed wholly at the expense of the contractor.

1.11 Identification of Contractor Employees. All contractor personnel attending meetings, answering Government telephones and working in other situations where their contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression that they are Government employees. The contractor shall ensure that all documents or reports produced by contractor personnel are suitably marked as contractor products or that contractor participation is appropriately disclosed. The contractor’s status as a “contractor” shall be predominantly displayed in all correspondence types (to include signature blocks on e-mail) and dealings with Government or non-Government entities. Where necessary, the government shall provide onsite contractor with access badge for controlled areas.

1.12 Combating Trafficking in Persons. The United States Government has adopted a zero-tolerance policy regarding trafficking in persons. Contractors and contractor employees shall not engage in severe forms of trafficking in persons during the period of performance of the contract; procure commercial sex acts during the period of performance of the contract; or use forced labor in the performance of the contract. The contractor shall notify its employees of the United States Government’s zero-tolerance policy, the actions that will be taken against employees for violations of this policy. Such actions may include, but are not limited to, removal from the contract, reduction in benefits, or termination of employment. The contractor shall take appropriate action, up to and including termination, against employees or subcontractors that violate the US Government policy as described at FAR 22.17.

1.13 Contractor Travel. The contractor shall travel to various locations within the United States as directed by the government during the performance of this contract to attend meetings. Locations will vary depending on host and topic.

1.13.1 The contractor shall be authorized travel expenses consistent with the substantive provisions of the Joint Travel Regulation (JTR) and the limitation of funds specified in this contract. All travel requires COR recommendation for approval and authorization by the KO prior to travel arrangements being made.

1.14 Data Rights. The Government has unlimited rights to all documents/material produced under this contract. All documents and materials, to include the source codes of any software, produced under this contract shall be Government owned and are the property of the Government with all rights and privileges of ownership/copyright belonging exclusively to the Government. These documents and materials may not be used or sold by the contractor without written permission from the KO. All materials supplied to the Government shall be the sole property of the Government and may not be used for any other purpose. This right does not abrogate any other Government rights.

1.15 Organizational Conflicts of Interest (OCI). The contractor and subcontractor personnel performing services under this contract may receive, have access to or participate in the development of proprietary or source-selection information (e.g., cost or pricing information, budget information or analyses, specifications or work statements, etc.), or perform evaluation services which may create a current or subsequent OCIs, as defined in FAR Subpart 9.5. The contractor shall notify the KO immediately whenever it becomes aware that such access or participation may result in any actual or potential OCI and shall promptly submit a plan to the KO to avoid or mitigate any such OCI. The contractor’s mitigation plan will be determined to be acceptable solely at the discretion of the KO. In the event the KO unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the KO may affect other remedies as he or she deems necessary, including prohibiting the contractor from participation in subsequent contracted requirements which may be affected by the OCI.

1.16. Phase-in / Phase-out Periods. Not Applicable.

2. Definitions and Acronyms.

2.1. Definitions.

CONTRACTOR. A supplier or vendor awarded a contract to provide specific supplies or service to the government. The term used in this contract refers to the prime.

CONTRACTING OFFICER (KO). A person with authority to enter into, administer, and or terminate contracts, and make related determinations and findings on behalf of the government. Note: The only individual who can legally bind the government.

CONTRACTING OFFICER'S REPRESENTATIVE (COR). An employee of the U.S. Government designated by the KO to monitor contractor performance. Such appointment shall be in writing and shall state the scope of authority and limitations. This individual has authority to provide technical direction to the contractor as long as that direction is within the scope of the contract, does not constitute a change, and has no funding implications. This individual does NOT have authority to change the terms and conditions of the contract.

DEFECTIVE SERVICE. A service output that does not meet the standard of performance associated with the Performance Work Statement.

DELIVERABLE. Anything that can be physically delivered and includes non-manufactured things such as meeting minutes or reports.

KEY PERSONNEL. Contractor personnel that are evaluated in a source selection process and that may be required to be used in the performance of a contract by the Key Personnel listed in the PWS. When key personnel are used as an evaluation factor in best value procurement, an offer can be rejected if it does not have a firm commitment from the persons that are listed in the proposal.

PHYSICAL SECURITY. Actions that prevent the loss or damage of Government property.

QUALITY ASSURANCE. The government procedures to verify that services being performed by the contractor are performed according to acceptable standards.

QUALITY ASSURANCE SURVEILLANCE PLAN (QASP). An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance.

QUALITY CONTROL. All necessary measures taken by the contractor to assure that the quality of an end product or service shall meet contract requirements.

SUBCONTRACTOR. One that enters into a contract with a prime contractor. The Government does not have privity of contract with the subcontractor.

WORK DAY. The number of hours per day the contractor provides services in accordance with the contract.

WORK WEEK. Monday through Friday, unless specified otherwise.

2.2. Acronyms.

CI

3. Government Furnished Property, Material, Equipment and Services (GFP/M/E/S). The Government will provide the property, material, equipment, and/or services listed below solely for the purpose of performance under this contract.

3.1. Property. The Government will furnish the necessary workspace for the contractor to perform services outlined in this PWS to include desk space, telephones, computers and other items necessary to maintain an office environment.

3.2. Materials. Access badge (where required), adequate facilities at each location; to include a complete workstation and chair, computer, telephone, expendable supplies, computer hardware and software (and support), internet/intranet/Local Area Network (LAN) (and support) and use of a fax machine, copier and printer, mail service and postage. All Government furnished supplies and equipment shall be for official use only.

3.3. Equipment. Any government-furnished equipment shall be used for official use only.

3.4. Services. Certain government-furnished services are available to contractor employees during performance of this contract. This includes local facilities maintenance and IT help-desk services for government-supplied property and equipment.

3.5. Utilities: All utilities in the facility will be available for the contactor’s use in the performance of this contract. The contractor shall instruct employees in utilities conservation practices. The contractor shall operate under conditions that preclude the waste of utilities, which include turning off the water faucets or valves after using the required amount.

4. Contractor Furnished Property, Materials, and Equipment (CFP/M/E)

4.1. General: Not Applicable

5.0 Overall Description of the Task: Overall Description of the Task: The Air National Guard (ANG) requires Information Systems Security Officer (ISSO) support services at 27 ANG unit locations. ISSO services include administration and maintenance of a reliable operation of an intelligence, surveillance and reconnaissance (ISR) unit's mission systems; especially multi-user computers, such as servers.

5.0.1The contractor shall support the ISSM in the registration, completion, and maintenance of the Xacta projects/packages for the information system(s) and/or weapon system(s).

5.0.2 The contractor shall assist site system administrators and configuration managers in the daily secure operation of the unit’s mission systems.

5.0.3 The contractor shall comply with pertinent information systems security guidance and checklist processes.

5.0.4 The contractor shall ensure audit logs are reviewed and conduct regular audits of mission IT systems to ensure security and accountability on an as needed basis.

5.0.5 The contractor shall ensure all systems have a valid Authority to Operate (ATO), and assist systems administrators and ISSM with ATO compliance requirements.

5.1. Administrative. The contractor shall provide copies of all required IAM Level II (minimum level) training certifications to the site ISSM. Higher level IAM certifications satisfy lower level requirements. Certifications listed in IAM Level I or II cells can be used to qualify for IAM Level II.

5.1.1 Project Kick-Off Meeting: The contractor shall schedule and coordinate a Project Kick-Off Meeting at the ANGRC, Bldg. 3501, Joint Base Andrews, MD. The meeting shall provide and introduction between the contractor personnel and Government personnel who will be involved with the contract. The meeting shall provide the opportunity to discuss technical, management, and reporting procedures. The attendees shall include key contractor personnel, representative from the ANGRC, C2, COR and the Contracting Officer. The contractor shall provide the following at the Kick-Off meeting:

a. Final Staffing Plan

b. Final Quality Control Plan (QCP)

5.1.2 Staffing Plan: The contractor shall develop and provide a staffing plan that discuss the methods and assumptions used to derive and/or determine personnel assignment for the contract. The staffing plan shall address staff training to ensure credentials and skills are current and shows the required staffing at the 27 ANG locations that the support the ISSO.

5.1.3 Monthly Report: The contractor shall provide monthly reports that include reports, analysis and related documentation management, and intelligence squadron’s information systems to the COR.

5.2. Training Support. Annual Security Awareness and Role-based Training. The contractor shall ensure all users (federal, military, and contractor) understand their roles and responsibilities for IT enterprise security and are adequately trained to perform on the job.

5.2.1 The contractor shall coordinate with the ISSM to determine how annual security awareness training and role-based training are conducted and documented. The contractor shall ensure the following:

a. All system users receive security awareness before being granted system access.

b. All system users receive security awareness annually.

c. All system users receive additional security awareness whenever system security changes occur, or when the user’s responsibilities change.

d. Personnel with significant security responsibilities receive annual specialized role-based training specific to their security responsibilities; these positions include ISSO, network administrators, system administrators, Special Security Office, database administrators, IT project managers, and action officers.

e. User accounts, including access to email, are disabled for users who do not complete the annual security refresher course.

f. A record of security awareness and role-based training is maintained to include the name and position of the person trained, the type of training, the date of the training, and the cost of the training.

g. Statistics on initial and refresher security awareness are submitted to the Component CI Training requirement summary.

h. Personnel with contingency plan responsibilities receive annual refresher training for high and moderate availability systems (no training is required for low availability systems).

i. All personnel receive Incident Response Training at least annually; incident response training should be coordinated with the Component SOC and local training office and may be incorporated into annual refresher training.

5.3. Operational Requirements:

5.3.1 The contractor shall provide ISSO services for ANG organizations' ISR common user communications computer systems and mission systems, regardless of classification level to provide network and computer system security oversight of all aspects of day-to-day operations, ensuring the security posture is sustained and the residual level of risk is always at an acceptable level as determined by the 25th Air Force (25 AF), ACC/A2Y, and the 625th Air Communications Squadron (625 ACOMS)—the only authorities that can determine security posture and acceptable level of risk.

5.3.1.1 The contractor shall provide support to the unit's commander, chief information security officer (CISO) and/or information system security manager (ISSM) on all matters, technical and otherwise, involving the security of the unit's ISR mission information systems, regardless of classification level.

5.3.1.2 The contractor shall support site ISSMs and system administrators in the daily secure operation of the unit’s mission systems.

5.3.1.3 The contractor shall comply with pertinent information systems security guidance and checklist processes. Each site will determine its specific ISSO needs and shall task the contractor accordingly. See paragraph 1.4 for locations of performance.

5.3.1.4 The contractor shall provide support to manage the security aspects of…