RFQ_2009-8440_SOW_LMR_Enhancement-HAD_083018.pdf

Statement of Work (SOW)

For Land Mobile Radio (LMR) Enhancement -High Availability Data (HAD)

RFQ 20098440

August 23, 2018

TITLE: Radio IP System High Availability Data Enhancement

Table of Contents

1 BACKGROUND

2 SCOPE

3 APPLICABLE DOCUMENTS

4 SPECIFIC TASKS

Program Management/Planning

4.1.1 Project Manager

4.1.2 Kickoff Meeting

4.1.3 Status Reporting

4.1.4 Schedule Management

Design, Integration, and Test Integration Acceptance Test Burn-in Period Security Logistics and Delivery Schedule Final Documentation Patch Management

5 DELIVERABLES AND DELIVERY SCHEDULE

Equipment and Integration Services Deliverables Other Deliverables Shipping Address Data Delivery Timeframe

6 GOVERNMENT-FURNISHED EQUIPMENT AND INFORMATION

7 PLACE OF PERFORMANCE

8 PERIOD OF PERFORMANCE

9 SECURITY

10 SPECIAL CONSIDERATIONS

Inspection and Acceptance Government Acceptance Period Other Direct Costs / Travel Task Order Administration Invoice Instructions Unique Standards

10.6.1 CBP Requirements

10.6.2 ISO Requirements

10.6.3 CONTRACTOR EMPLOYEE ACCESS (SEP 2012) ............. Error! Bookmark not defined.

10.6.4 SAFEGUARDING OF SENSITIVE INFORMATION (MAR 2015)

10.6.5 OAST / Section 508 Requirement

Accessibility Requirements (Section 508) .................................. Error! Bookmark not defined.

Section 508 Applicable EIT Accessibility Standards ................ Error! Bookmark not defined.

Section 508 Applicable Exceptions ............................................. Error! Bookmark not defined.

Section 508 Compliance Requirements ...................................... Error! Bookmark not defined.

ADDENDUM A – Acronym List

TITLE: Radio IP System High Availability Data Enhancement

1 BACKGROUND

The U.S. Customs and Border Protection (CBP), Office of Information and Technology (OIT), Enterprise Wireless Communications Division’s (EWCD) Infrastructure Management Support’s (IMS) team is responsible for maintaining and managing the operational capability of the infrastructure for the Land Mobile Radio (LMR) Very High Frequency (VHF) network. The primary foundation of the network are the two operatonal Motorola Astro 25 Release 7.17 M3 system cores. The LMR VHF network supports 24/7 mission critical law enforcement secure communications services to over 80,000 federal, state, local and tribal law enforcement agency agents and officers. The IMS requires enhancements that will provide additional fault tolerance to crucial data operation on the two operational Motorola Astro25 Release 7.17 M3 system cores located at the National Law Enforcement Communications Center in Orlando, Florida. Fault tolerance includes eliminating single points of failure within the Astro25 data subsystem.

2 SCOPE

The contractor shall provide a solution that provides fault tolerance (High Availability Data) to the existing Motorola Astro25 Release 7.17 M3 data subsystem equipment located at the National Law Enforcement Communications Center (NLECC) located in Orlando, FL. The solution must provide hardware and software redundancy to existing data subsystem components to provide uninterrupted data operations in the event that any critical component fails. The implementation must integrate with existing system user access control and cybersecurity measures, including software patch management. The contractor will commence the delivery of goods and services within 60-days from date of award.

3 APPLICABLE DOCUMENTS

• DHS 4300A Sensitive Systems Policy Handbook, Version 12 dated 11/15/2015 (available by request)

• The Federal Acquisition Regulation: http://www.acqnet.gov/FAR/

• Section 508 of the Rehabilitation Act: http://www.section508.gov/

• Homeland Security Acquisition Regulation (HSAR) http://www.dhs.gov/xlibrary/assets/opnbiz/cpo-acquisition-regulation-0606.pdf

• Code of Federal Regulations (CFR): http://www.gpoaccess.gov/cfr/index.html

• CBP Information Systems Security Policies and Procedures Handbook

• DHS Sensitive System Policy Directive 4300A:

http://www.uscg.mil/hq/cg9/NAIS/RFP/SectionJ/dhs-4300A-policy.pdf

• CIS HB 1400-05D – US Customs and Border Protection Security Policies and

Procedures Handbook, Version 5.0 dated 6/17/2014 (available by request)

• National Institute of Standards and Technology, Special Publication 800-53, Revision 4, Security and Privacy Controls for Federal Information Systems and Organizations, April http://www.acqnet.gov/FAR/ http://www.dhs.gov/xlibrary/assets/opnbiz/cpo-acquisition-regulation-0606.pdf http://www.gpoaccess.gov/cfr/index.html http://www.uscg.mil/hq/cg9/NAIS/RFP/SectionJ/dhs-4300A-policy.pdf

• NIST SP 800-47, Security Guide for Interconnecting Information Technology Systems:

http://csrc.nist.gov/publications/nistpubs/800-47/sp800-47.pdf

4 SPECIFIC TASKS

Program Management/Planning

4.1.1 Project Manager

The contractor shall provide a Project Manager (PM) who shall be responsible for all work performed under this contract. The PM shall be the single point of contact for the Contracting Officer (CO) and the Contracting Officer’s Representative (COR).

4.1.2 Kickoff Meeting

4.1.2.1 The Contractor shall attend a Kick-off meeting within ten (10) business day’s post contract award. The Kick-off meeting will be held at the COR’s facility on a date mutually agreed upon between the Contractor and the Government.

4.1.2.2 The Contractor shall prepare all documentation (meeting agenda/presentation) that shall be discussed at the Kick-off meeting and submit it to the COR for review and approval at least five (5) days prior. The COR will request changes to the documentation and/or approve the documentation within three (3) business days.

4.1.2.3 The Kick-off meeting will include the CO, COR, Program Office representatives, and Contractor key project participants. The objectives of the Kick-off meeting include:

• Introduction of all project participants

• Review the roles of the project participants

• Review of the initial Project Management Plan

• Review of the overall project scope, requirements, and deliverables

• Review the resource and scheduling requirements

• Review the proposed standards for design drawings

• Review methodologies for acceptance testing

4.1.3 Status Reporting

The Contractor shall submit monthly status reports in digital copy to the COR beginning twenty (20) business days post contract award in conjunction with the aforementioned status meeting. The Contractor’s report shall summarize significant problems, progress and actions completed by milestone(s) as defined in the Master Project Schedule; it shall include:

http://csrc.nist.gov/publications/nistpubs/800-47/sp800-47.pdf

• A description of work performed during the reporting period and work expected to be performed in the next reporting period, problems and recommendations for correction.

• An action item list identifying the action item, responsible party, target completion date and status, as well as explanatory notes.

• Problems that require Contracting Officer or Program Manager intervention.

• Identification by name and labor category of individuals being added to the task by the Contractor, along with an indication of dedication to the task (full time permanent, full time temporary, part time).

• Anticipated project risks.

4.1.4 Schedule Management

The Contractor shall provide a detailed project schedule (Master Project Schedule) to include a timeline and analysis for all tasks within the project to be approved by the COR within twenty (20) business days after award. The Master Project Schedule shall clarify all the milestones and critical paths of the project. The COR and the Contractor will mutually agree on a baseline Master Project Schedule shall be provided to the COR within ten (10) days after review of initial project schedule.

The Contractor shall maintain the project schedule and present it in the monthly report.

Any changes to the critical path shall be presented to the COR immediately upon identification.

Design, Integration, and Test

The Contractor shall design, integrate, and test a solution that provides fault tolerance to the Motorola Astro25 Release 7.17 M3 data subsystem. The required equipment includes the following:

• Astro25 Release 7.17 Packet Data Gateway (hardware or virtual)

• Fortinet Firewalls – quantity (2)

• Gateway GPRS Support Nodes (GGSN) – quantity (2)

• Conventional Data Encryption Modules (CDEM) – quantity (2)

• Ethernet switches (DMZ) – quantity (2)

• GGM8000 Border Routers (2)

The contractor shall determine the correct model, configuration, and provisioning needed for new equipment and determine the need for any additional equipment and materials needed to implement the required fault tolerance. The solution will integrate into existing two-core system and will support DES-OFB and AES encryption algorithms.

Integration

Integration services are required to ensure the proposed solution meets requirements.

Delivery of these services shall be in accordance with the project schedule. Integration services are needed at the following location:

National Law Enforcement Communications Center (NLECC) 1900 Lakemont Avenue Orlando, FL 32803

The Contractor shall notify the Government of any expected service interruptions on the Motorola Astro25 Release 7.17 M3 system due to the integration work. The Government requires 3 weeks’ notice prior to the expected interruption.

Acceptance Test

Acceptance Testing will demonstrate the assembled solution satisfies the project requirements. The Contractor shall prepare an Acceptance Test Procedure (ATP) that details the tests required to confirm that the solution provided by the contractor is complete and meets the agreed upon requirements. The ATP shall be submitted thirty (30) days prior to test. The Government will have ten (10) business days to accept the ATP or to request modification. The Contractor shall resubmit the ATP to the COR within five (5) business days after receiving the request for modifications.

Testing will be conducted by the Contractor and witnessed by the Government.

All deficiencies found during acceptance testing shall be documented and presented to the Government for review prior to submitting the Acceptance Test Report. The Government will have five (5) business to waive any outstanding deficiencies. The Contractor shall remain responsible for the resolution of any documented deficiencies not waived by the Government. A deficiency is a condition where a test element failed to pass a test.

Satisfactory testing is defined as completion of the accepted ATP where all the test elements were passed, unless waived by the Government. The Acceptance Test Report shall be delivered within ten (10) business days after completion of the testing. This report shall detail each test element and the test result for each element in the ATP. The Government will have ten (10) business days to accept the ATP or to request modification. The Contractor shall resubmit the ATP to the COR within five (5) business days after receiving the request for modifications.

Burn-in Period

The system shall go through a thirty (30) day operational burn-in period to ensure it operates as intended at full capacity over a period of time. The Contractor shall provide subject matter expertise to assist in resolving any issues that arise during the thirty (30) day burn-in period. The Contractor shall document all issues reported by the Government. The system issues shall be categorized as follows:

• Critical – Catastrophic hardware failure with direct impact on the end user. System defect defined as function/feature that does not meet customer requirements and directly impacts the end user.

• Major – Hardware failure that does not impact the end user. System defect defined as any function/feature that does not meet customer requirements.

• Minor – Any issue identified that was not included in the original requirement statement.

The successful completion of the burn-in period will comprise the correction of all critical and major issues (including security related issues) by the Contractor. Upon successful completion of the burn in period, the Government’s PM-designated representative and the Contractor will sign a System Acceptance Certificate.

The Contractor shall catalogue minor issues in a Punch List; and, these issues shall be corrected by the Contractor. The government can issue a waiver before the end of the Period of Performance. The Punch List will be provided to the COR at the beginning of each month, with a schedule for completion.

Security

The design shall comply with the following security requirements:

• Adhere to DHS 4300A Security Policy and DHS 4300 Attachment Q3 for Sensitive Wireless Tactical Systems.

• Adhere to NIST 800-53 Rev 3 requirements.

• Solution must be FIPS 140-2 and FIPS 197 compliant.

• Equipment configurations (IP schema, passwords, and accounts) shall be fully compliant with host system structures

Logistics and Delivery Schedule

The Contractor shall provide and ship equipment, materials, and supplies contained in the proposed solution to the following address:

National Law Enforcement Communications Center (NLECC) 1900 Lakemont Avenue Orlando, FL 32803

Equipment and materials shall be free from damage and defects, including but not limited to manufacturer defects and damage as the result of handling and transport by the manufacturer and/or the Contractor. If equipment or materials are discovered to be damaged or defective, the contractor shall replace the equipment or materials within ten (10) business days of notification.

The Contractor shall provide CBP with a minimum of 24-hours advance notice of shipping in order to coordinate the delivery. Acceptance of these deliveries occurs when the COR or the COR’s designee signs off on the delivered equipment.

Final Documentation

The Contractor shall provide updated documentation related to the introduction of new equipment, software, and configurations and will reflect the system configuration at the end of the task to the COR. The Contractor shall include a copy of the inventory list with the delivered equipment; and, a copy of the delivered inventory list to the COR.

• Design Document, including descriptions and network / system design drawings

• Detailed subsystem interface specifications

• A detailed Bill of Materials (BOM) including each configuration item

• Programming and configuration documentation

• Interconnection / wiring diagrams or cable matrix

• IP Address and Hostname table

• WAN/LAN port assignment tables

• Cabinet and Rack Layout Diagrams

• Power and cooling requirements

• Technical Manuals

Patch Management

The Contractor shall make patches available to CBP.

5 DELIVERABLES AND DELIVERY SCHEDULE

Equipment and Integration Services Deliverables

The contractor shall deliver the following equipment and services with the specifications as outlined in the table below. The equipment shall be shipped to the address provided in section 5.3 and within the timeframe specified in section 5.4.

Item # Part # Product Description QTY

1 SQM01SUM0273 MASTER SITE CONFIGURATION 1

1a CA02837AB ADD: HIGH AVAILABILITY SYSTEM 1

1b CA02632AA ENH: HA CONVENTIONAL INTEGRATED DAT 2

1c CA02629AC ADD: EXPAND 7.17 M CORE 1

2 T8126 FORTINET FIREWALL APPLIANCE 2

3 CLN1856 2620-24 ETHERNET SWITCH 2

4 SQM01SUM0205 GGM 8000 GATEWAY 2

4a CA01616AA ADD: AC POWER 2

4b CA02087AA ADD: ENCRYPTION (7.12 OR LATER) 2

4c CA02134AA ADD: COMMON CRITERIA 2

4d CA02108AA ADD: DIRECT SHIP (NO STAGING) 2

5 T7618 ASTRO 25 CONVENTIONAL DATA ENCRYPTI 2

5a CA01535AA ADD: ASTRO 25 CDEM OPERATION 2

5b CA00182AT ADD: AES DATA ENCRYPTION 2

5c CA00143AD ADD: DES-OFB DATA ENCRYPTION KIT 2

6 TKN8531C CABLE FOR RNC, DIU MGEG 2

7 DLN6693 RS232 CABLE FOR CRYPTR 2

8 SYSTEMS INTEGRATION INTERGRATION SERVICES 1

Other Deliverables

Other Deliverables Item # Deliverable Section Due Date

1 Contract Kickoff Meeting Agenda 4.1.2.2 Five (5) days prior to kickoff meeting

2 Contract Kickoff Meeting Agenda 4.1.2.2 Three (3) days post meeting

3 Contract Kickoff Meeting 4.1.2.1 Ten (10) business day's post contract award

4 Status Reports 4.1.3 Twenty (20) business days post contract award; updates monthly

5 Project Schedule 4.1.4 Twenty (20) business days post contract award.

6 Acceptance Test Plan/Procedures 4.4 Initial Thirty (30) days prior to test.

7 Documented Test Deficiencies 4.4 Provide to government after testing.

8 Acceptance Test Report 4.4 Ten (10) days after test completion;.

9 Burn-In Punch List 4.5 Per Master Schedule

10 Final Documentation 4.8 Per Master Schedule

11 System Acceptance Certificate 4.5 Per Master Schedule

Shipping Address

Customs and Border Protection

NLECC

1900 Lakemont Avenue Orlando, FL 32803 Attn: Mark Gonska Phone Number: 407-975-1984

Data

As referenced in section 4.8 above, the contractor shall provide copies of the documents listed in section 4.8. All copies will be on a CD ROM/disk or thumb drive and be in MS Word or Adobe Acrobat. The documents are deliverables under the contract and shall be delivered to the COR listed in Section 10.2 no later than thirty (30) days after System Acceptance Certificate.

Delivery Timeframe

The contractor shall deliver equipment within 60-days from date of award. Completion of systems integration services within 120- days from date of award.

6 GOVERNMENT-FURNISHED EQUIPMENT AND INFORMATION

The government does not anticipate providing GFE or GFI.

7 PLACE OF PERFORMANCE

Customs and Border Protection

NLECC

1900 Lakemont Avenue Orlando, FL 32803

8 PERIOD OF PERFORMANCE

The period of performance is no longer than 12 months, with delivery and installation to commence no later than 2 months after award.

9 SECURITY

There are no specific security classification level requirements associated with this procurement action. Information is deemed unclassified.

10 SPECIAL CONSIDERATIONS

Inspection and Acceptance

The Contracting Officer’s Representative (COR) or designees review, for completeness, final work products and deliverables that the contractor submits, and may return them to the contractor for correction. Absence of any comments by the COR does not relieve the contractor of the responsibility for complying with the requirements of the Task Order.

Government Acceptance Period

The COR will review deliverables prior to acceptance. In the event that the deliverable is not acceptable, the COR will document and provide reason(s) to the contractor in writing.

The COR will have ten (10) business days to review the deliverables and make comments.

The contractor shall have five (5) business days to make corrections and redeliver. Should the Government fail to complete the review within the review period the deliverable will be considered “Accepted”.

Other Direct Costs / Travel

Travel is not required.

Task Order Administration

Notwithstanding the contractor’s responsibility for management during performance the administration of this task order will require some coordination between the CBP and the contractor. The Contracting Officer (CO) will appoint a Contracting Officer’s Representative (COR) to assure orderly performance of the tasks and provide technical direction. The types of actions within the purview of the COR’s authority are to assure that the contractor performs the technical requirements of the contract; to perform or cause to be performed inspections necessary in connection with performance of the contract; to maintain both written and oral communications with the contractor concerning the aspects of the contract within his/her purview; to issue interpretations of technical requirements; to monitor the contractor’s performance under the task order and notify the contractor and CO of any deficiencies observed; and to coordinate Government-Furnished Property or Data availability and provide for site entry of contractor personnel if required.

The COR will provide no supervision to contractor personnel. The COR is not empowered to make any commitments or changes which affect the task order price or other items and conditions. Any such proposed changes must be brought to the immediate attention of the CO for action. The acceptance of any changes by the contractor without specific approval and written consent of the CO shall be at the contractor’s risk.

COR:

Cynthia R. Clark U.S. Customs and Border Protection, NLECC 1900 Lakemont Ave Orlando, FL 32803 Phone Number: 407-975-1965 Cynthia.R.Clark@cbp.dhs.gov

In-addition to the COR, the Budget Officer and the Program Office’s Technical POC for this contract are:

Budget POC:

Allen Melson 10720 Richmond HWY Lorton, VA 20598 Phone Number: 571-468-3344 Allen.W.Melson@cbp.dhs.gov

Program Office Technical POCs:

Russ Psik mailto:Deborah.Whitman@dhs.gov mailto:Allen.W.Melson@cbp.dhs.gov

U.S. Customs and Border Protection, NLECC 1900 Lakemont Ave Orlando, FL 32803 Phone Number: 407-975-1393 Russell.Psik@cbp.dhs.gov John O’Keefe U.S. Customs and Border Protection, NLECC 1900 Lakemont Ave Orlando, FL 32803 Phone Number: 571-236-0309 john.d.o'keefe@cbp.dhs.gov

Invoice Instructions

The contractor shall invoice CBP in accordance with CBP invoicing clause, “Electronic Invoicing and Payment Requirements – Invoice Processing Platform (IPP) (JAN 2016)”.

Payment requests must be submitted electronically through the U. S. Department of the Treasury's Invoice Processing Platform System (IPP).

"Payment request" means any request for contract financing payment or invoice payment by the contractor. To constitute a proper invoice, the payment request must comply with the requirements identified in FAR 32.905(b), "Payment documentation and process" and the applicable Prompt Payment clause included in this contract. The IPP website address is:

https://www.ipp.gov.

Under this contract, the following documents are required to be submitted as an attachment to the IPP invoice:

- Purchase Order number

- Description of services delivered

- Breakout of services received based on Task structure and labor categories for the labor hour effort.

- Total amount for services / tasks delivered

- Invoice period

- Company name, telephone number, taxpayer’s identification number, and complete mailing address to which payment will be mailed.

Invoice shall be electronically transmitted to the COR, Technical Point of Contact, and the Budget Officer as listed in section 10.4.

Unique Standards

10.6.1 CBP Requirements

CBP Enterprise Architecture Compliance mailto:Russell.Psik@cbp.dhs.gov mailto:john.d.o'keefe@cbp.dhs.gov

The Offeror shall ensure that the design conforms to the Department of Homeland Security (DHS) and Customs and Border Protection (CBP) Enterprise Architecture (EA), the DHS and CBP Technical Reference Models (TRM), and all DHS and CBP policies and guidelines (such as the CBP Information Technology Enterprise Principles and the DHS Service Oriented Architecture - Technical Framework), as promulgated by the DHS and CBP Chief Information Officers (CIO), Chief Technology Officers (CTO) and Chief Architects (CA).

The Offeror shall conform to the Federal Enterprise Architecture (FEA) model and the DHS and CBP versions of the FEA model, as described in their respective EAs. All models will be submitted using Business Process Modeling Notation (BPMN 1.1 or BPMN 2.0 when available) and the CBP Architectural Modeling Standards. Universal Modeling Language (UML2) may be used for infrastructure only. Data semantics shall be in conformance with the National Information Exchange Model (NIEM). Development solutions will also ensure compliance with the current version of the DHS and CBP target architectures.

Where possible, the Offeror shall use DHS/CBP approved products, standards, services, and profiles, as reflected by the hardware, software, application, and infrastructure components of the DHS/CBP TRM/standards profile. If new hardware, software, or infrastructure components are required to develop, test, or implement the program, these products will be coordinated through the DHS and CBP formal Technology Insertion (TI) process (to include a trade study with no less than four alternatives, one of which reflecting the status quo and another reflecting multi-agency collaboration). The DHS/CBP TRM/standards profile will be updated as TIs are resolved.

All developed solutions shall be compliant with the Homeland Security (HLS) EA.

All IT hardware and software shall be compliant with the HLS EA.

Compliance with the HLS EA shall be derived from and aligned through the CBP EA.

Description information for all data assets, information exchanges and data standards, whether adopted or developed, shall be submitted to the Enterprise Data Management Office (EDMO) for review, approval, and insertion into the DHS Data Reference Model and Enterprise Architecture Information Repository.

Development of data assets, information exchanges, and data standards will comply with the DHS Data Management Policy MD 103-01. All data-related artifacts will be developed and validated according to DHS Data Management Architectural Guidelines.

Applicability of Internet Protocol version 6 (IPv6) to DHS-related components (networks, infrastructure, and applications) specific to individual acquisitions shall be in accordance with the DHS EA (per OMB Memorandum M-05-22, August 2, 2005), regardless of whether the acquisition is for modification, upgrade, or replacement. All EA related component acquisitions shall be IPv6 compliant, as defined in the USGv6 Profile (NIST http://cbpnet.cbp.dhs.gov/linkhandler/cbpnet/oit/edme/soa.ctt/soa.pdf http://cbpnet.cbp.dhs.gov/linkhandler/cbpnet/oit/edme/soa.ctt/soa.pdf

Special Publication 500-267) and the corresponding declarations of conformance, defined in the USGv6 Test Program.

Personal Identifiable Information (PII) When a contractor, on behalf of CBP, handles Sensitive PII data, stores and transmits, the contractor will Accredit (ATO) this information system to the (HHM) FIPS level.

10.6.2 ISO Requirements

DHS Security Policy Requirement All hardware, software, and services provided under this task order must be compliant with DHS 4300A DHS Sensitive System Policy and the DHS 4300A Sensitive Systems Handbook.

Encryption Compliance Requirement

1. FIPS 197 (Advanced Encryption Standard (AES)) 256 algorithm and cryptographic modules that have been validated under FIPS 140-2.

2. National Security Agency (NSA) Type 2 or Type 1 encryption.

3. Public Key Infrastructure (PKI) (see paragraph 5.5.2.1 of the Department of

Homeland Security (DHS) IT Security Program Handbook (DHS Management Directive (MD) 4300A) for Sensitive Systems).

Security Review Terms and Conditions

The Government may elect to conduct periodic reviews to ensure that the security requirements contained in this contract are being implemented and enforced. The Contractor shall afford DHS, including the organization of the DHS Office of the Chief Information Officer, the Office of the Inspector General, authorized Contracting Officer’s Technical Representative (COTR), and other government oversight organizations, access to the Contractor’s facilities, installations, operations, documentation, databases and personnel used in the performance of this contract. The Contractor will contact the DHS Chief Information Security Officer to coordinate and participate in the review and inspection activity of government oversight organizations external to the DHS. Access shall be provided to the extent necessary for the government to carry out a program of inspection, investigation, and audit to safeguard against threats and hazards to the integrity, availability and confidentiality of DHS data or the function of computer systems operated on behalf of DHS, and to preserve evidence of computer crime.

Additionally, the Contractor shall make patches available to CBP.

Supply Chain Risk Management

The Contractors supplying the Government hardware and software shall provide the manufacture’s name, address, state and/or domain of registration, and the Data Universal Numbering System (DUNS) number for all components comprising the hardware and software. If subcontractors or subcomponents are used, the name, address, state and/or domain of registration and DUNs number of those suppliers must also be provided.

Subcontractors are subject to the same general requirements and standards as prime contractors. Contractors employing subcontractors shall perform due diligence to ensure that these standards are met.

The Government shall be notified when a new contractor/subcontractor/service provider is introduced to the supply chain, or when suppliers of parts or subcomponents are changed.

Contractors shall provide, implement, and maintain a Supply Chain Risk Management Plan that addresses internal and external practices and controls employed to minimize the risk posed by counterfeits and vulnerabilities in systems, components, and software.

The Plan shall describe the processes and procedures that will be followed to ensure appropriate supply chain protection of information system resources developed, processed, or used under this contract.

The Supply Chain Risk Management Plan shall address the following elements:

1. How risks from the supply chain will be identified,

2. What processes and security measures will be adopted to manage these risks to the system or system components, and

3. How the risks and associated security measures will be updated and monitored.

The Supply Chain Risk Management Plan shall remain current through the life of the contract or period of performance. The Supply Chain Risk Management Plan shall be provided to the Contracting Officer Technical Representative (COTR) 30 days post award.

The Contractor acknowledges the Government's requirement to assess the Contractors Supply Chain Risk posture. The Contractor understands and agrees that the Government retains the right to cancel or terminate the contract, if the Government determines that continuing the contract presents an unacceptable risk to national security.

The Contractor shall disclose, and the Government will consider, relevant industry standards certifications, recognitions and awards, and acknowledgments.

The Contractor shall provide only new equipment unless otherwise expressly approved, in writing, by the Contracting Officer (CO). Contractors shall only provide Original Equipment Manufacturers (OEM) parts to the Government. In the event that a shipped OEM part fails, all replacement parts must be OEM parts.

The Contractor shall be excused from using new OEM (i.e. “grey market,” previously used) components only with formal Government approval. Such components shall be procured from their original genuine source and have the components shipped only from manufacturers authorized shipment points.

For software products, the contractor shall provide all OEM software updates to correct defects for the life of the product (i.e. until the “end of life.”). Software updates and patches must be made available to the government for all products procured under this contract.

Contractors shall employ formal and accountable transit, storage, and delivery procedures (i.e., the possession of the component is documented at all times from initial shipping point to final destination, and every transfer of the component from one custodian to another is fully documented and accountable) for all shipments to fulfill contract obligations with the Government.

All records pertaining to the transit, storage, and delivery will be maintained and available for inspection for the lessor of the term of the contract, the period of performance, or one calendar year from the date the activity occurred.

These records must be readily available for inspection by any agent designated by the US Government as having the authority to examine them.

This transit process shall minimize the number of times en route components undergo a change of custody and make use tamper-proof or tamper-evident packaging for all shipments. The supplier, at the Government’s request, shall be able to provide shipping status at any time during transit.

The Contractor is fully liable for all damage, deterioration, or losses incurred during shipment and handling, unless the damage, deterioration, or loss is due to the Government.

The Contractor shall provide a packing slip which shall accompany each container or package with the information identifying the contract number, the order number, a description of the hardware/software enclosed (Manufacturer name, model number, serial number), and the customer point of contact. The contractor shall send a shipping notification to the intended government recipient or contracting officer. This shipping notification shall be sent electronically and will state the contract number, the order number, a description of the hardware/software being shipped (manufacturer name, model number, serial number), initial shipper, shipping date and identifying (tracking) number.

Personal Identification Verification (PIV) Credential Compliance Requirements Procurements for products, systems, services, hardware, or software involving controlled facility or information system shall be PIV-enabled by accepting HSPD-12 PIV credentials as a method of identity verification and authentication.

Procurements for software products or software developments shall be compliant by PIV by accepting PIV credentials as the common means of authentication for access for federal employees and contractors.

PIV-enabled information systems must demonstrate that they can correctly work with PIV credentials by responding to the cryptographic challenge in the authentication protocol before granting access.

If a system is identified to be non-compliant with HSPD-12 for PIV credential enablement, a remediation plan for achieving HSPD-12 compliance shall be required for review, evaluation, and approval by the CISO.

10.6.3 Section 508 Requirements

Section 508 of the Rehabilitation Act, as amended by the Workforce Investment Act of 1998 (P.L. 105-220) (codified at 29 U.S.C. § 794d) requires that when Federal agencies develop, procure, maintain, or use information and communications technology (ICT), it shall be accessible to people with disabilities. Federal employees and members of the public with disabilities must be afforded access to and use of information and data comparable to that of Federal employees and members of the public without disabilities.

1. All products, platforms and services delivered as part of this work statement that, by definition, are deemed ICT or that contain ICT shall conform to the revised regulatory implementation of Section 508 Standards, which are located at 36 C.F.R. § 1194.1 & Apps. A, C & D, and available at https://www.gpo.gov/fdsys/pkg/CFR-2017-title36-vol3/pdf/CFR-2017-title36-vol3-part1194.pdf. In the revised regulation, ICT replaced the term electronic and information technology (EIT) used in the original 508 standards.

Item that contains Information and Communications Technology (ICT): LMR equipment

Applicable Exception: National Security Authorization #: HQ-20110510-001

Applicable Functional Performance Criteria: Does not apply

Applicable requirements for electronic content features and components: Does not apply

Applicable requirements for software features and components: Does not apply

Applicable requirements for hardware features and components: Does not apply

Applicable Support Services and Documentation Requirements: Does not apply

2. When providing installation, configuration or integration services for ICT, the contractor shall not reduce the original ICT item’s level of Section 508 conformance prior to the services being performed.

3. When developing or modifying ICT for the government, the contractor shall ensure the ICT fully conforms to the applicable Section 508 Standards. When modifying a commercially available or government-owned ICT, the contractor shall not reduce the original ICT Item’s level of Section 508 conformance.

https://www.gpo.gov/fdsys/pkg/CFR-2017-title36-vol3/pdf/CFR-2017-title36-vol3-part1194.pdf https://www.gpo.gov/fdsys/pkg/CFR-2017-title36-vol3/pdf/CFR-2017-title36-vol3-part1194.pdf

4. When developing or modifying ICT that are delivered in an electronic Microsoft Office or Adobe PDF format, the contractor shall demonstrate conformance by providing Section 508 test results based on the Accessible Electronic Documents

– Community of Practice (AED COP) Harmonized Testing Guidance at https://www.dhs.gov/compliance-test-processes.

5. Exceptions for this work statement have been determined by DHS and only the exceptions described herein may be applied. Any request for additional exceptions shall be sent to the Contracting Officer and a determination will be made according to DHS Directive 139-05, Office of Accessible Systems and Technology, dated January 29, 2016 and DHS Instruction 139-05-001, Managing the Accessible Systems and Technology Program, dated January 11, 2017.

6. Where ICT conforming to one or more requirements in the Revised 508 Standards is not commercially available, the agency shall procure the ICT that best meets the Revised 508 Standards consistent with the agency’s business needs, in accordance with 36 CFR E202.7. Any selection of a product or service that meets less accessibility standards due to a significant difficulty or expense shall only be permitted under an undue burden claim and requires authorization from the DHS Office of Accessible Systems and Technology (OAST) according to DHS Directive 139-05, Office of Accessible Systems and Technology, dated January 29, 2016 and DHS Instruction 139-05-001, Managing the Accessible Systems and Technology Program, dated January 11, 2017 and 36 CFR E202.6.

ADDENDUM A – ACRONYM LIST

CBP Customs and Border Protection CFR Code of Federal Regulations CO Contracting Officer COR Contracting Officer’s Representative DHS Department of Homeland Security EWCD Enterprise Wireless Communications Division FAR Federal Acquisitions Regulations HSAR Homeland Security Acquisition Regulation IMS Infrastructure Management Support NLECC National Law Enforcement Communications Center OEM Original Equipment Manufacturer POC Point of Contact SOW Statement of Work VHF Very High Frequency https://www.dhs.gov/compliance-test-processes

ADDENDUM B-CLAUSES

NOT INCLUDED IN THE SOW

ADDENDUM C-508 SUPPLEMENT

Instructions to Offerors

1. For each commercially available Information and Communications Technology (ICT) item offered through this contract, the Offeror shall provide an Accessibility Conformance Report (ACR). The ACR shall be created using the Voluntary Product Accessibility Template Version 2.1 or later. The template can be found at https://www.itic.org/policy/accessibility/vpat. Each ACR shall be completed in accordance with all the instructions provided in the VPAT 2. template. Each ACR must address the applicable Section 508 requirements referenced in the Work Statement. Each ACR shall state exactly how the ICT meets the applicable standards in the remarks/explanations column, or through additional narrative. All “Supports”, “Supports with Exceptions”, “Does Not Support”, and “Not Applicable” (N/A) responses must be explained in the remarks/explanations column or through additional narrative. The offeror is cautioned to address each standard individually and with specificity, and to be clear whether conformance is achieved throughout the entire ICT Item (for example - user functionality, administrator functionality, and reporting), or only in limited areas of the ICT Item. The ACR shall provide a description of the evaluation methods used to support Section 508 conformance claims. The agency reserves the right, prior to making an award decision, to perform testing on some or all of the Offeror’s proposed ICT items to validate Section 508 conformance claims made in the

ACR.

2. The offeror shall provide describe accessibility remediation plans for features that don’t fully conform to the Section 508 Standards.

Instructions: Insert the following language into the Acceptance Criteria section of the solicitation. If the solicitation uses the FAR Uniform Contract Format (UCF), this text would be placed in Section E., Inspection and acceptance. (See FAR 14.201-1, et. seq.

and FAR 15.204-1, et. seq.)

Acceptance Criteria

1. Before accepting items that contain Information and Communications Technology (ICT) that are developed, modified, or configured according to this contract, the government reserves the right to require the contractor to provide the following:

o Accessibility test results based on the required test methods.

https://www.itic.org/policy/accessibility/vpat o Documentation of features provided to help achieve accessibility and usability for people with disabilities.

o Documentation of core functions that cannot be accessed by persons with disabilities.

o Documentation on how to configure and install the ICT Item to support accessibility.

o Demonstration of the ICT Item’s conformance to the applicable Section 508 Standards, (including the ability of the ICT Item to create electronic content – where applicable).

2. Before accepting ICT required under the contract, the government reserves the right to perform testing on required ICT items to validate the offeror’s Section 508 conformance claims. If the government determines that Section 508 conformance claims provided by the offeror represent a higher level of conformance than what is actually provided to the agency, the government shall, at its option, require the offeror to remediate the item to align with the offeror’s original Section 508 conformance claims prior to acceptance.