TESS RFP HSTS04-09-R-CT4005 6.09.09.pdf

mak

SOLICITATION, OFFER AND AWARD

1. THIS CONTRACT IS A RATED ORDER

UNDER DPAS (15 CFR 350)

RATING

PAGE OF PAGES

2. CONTRACT NO.

3. SOLICITATION NO.

HSTS04-09-R-CT4005

4. TYPE OF SOLICITATION

[ ] SEALED BID (IFB)

[X] NEGOTIATED (RFP)

5. DATE ISSUED

See Block 28

6. REQUISITION/PURCHASE

NO.

See Schedule G.3

7. ISSUED BY

8. ADDRESS OFFER TO (If other than Item 7)

Transportation Security Administration

Office of Acquisition TSA-25

701 South 12 th

Street

Arlington, VA 20598-6025

ATTN: Robyn D. Towles

See Block 7

NOTE: In sealed bid solicitations "offer" and "offeror" mean "bid" and "bidder"

SOLICITATION

9. Sealed offers in original and copies for furnishing the supplies or services in the Schedule will be received at the place specified in item 8, or if hand carried, in the depository located in item 7 until local time

(Hour) (Date) SEE SECTION L.

CAUTION - LATE Submissions, Modifications, and Withdrawals: See Section L, Provision No. 52.214-7 or 52.215-10 All offers are subject to all terms and conditions contained in this solicitation.

10. FOR INFORMATION

CALL:

A. NAME

Robyn D. Towles

B. TELEPHONE NO. (Include area code) (NO COLLECT CALLS)

(571) 227-3839

11. TABLE OF CONTENTS

SEC.

DESCRIPTION

PAGE (S)

SEC.

DESCRIPTION

PAGE (S)

PART I - THE SCHEDULE

PART II - CONTRACT CLAUSES

X

A

SOLICITATION/CONTRACT FORM

I

CONTRACT CLAUSES

B

SUPPLIES OR SERVICES AND PRICES/COSTS

PART III - LIST OF DOCUMENTS, EXHIBITS AND OTHER ATTACH.

C

DESCRIPTION/SPECS./WORK STATEMENT

J

LIST OF ATTACHMENTS

D

PACKAGING AND MARKING

PART IV - REPRESENTATIONS AND INSTRUCTIONS

E

INSPECTION AND ACCEPTANCE

K

REPRESENTATIONS, CERTIFICATIONS, AND OTHER

STATEMENTS OF OFFERORS

F

DELIVERIES OR PERFORMANCE

G

CONTRACT ADMINISTRATION DATA

L

INSTRS., CONDS., AND NOTICES TO OFFERORS

H

SPECIAL CONTRACT REQUIREMENTS

M

EVALUATION FACTORS FOR AWARD

OFFER (Must be fully completed by offeror)

NOTE: Item 12 does not apply if the solicitation includes the provisions in 52.214-16, MInimum Bid Acceptance Period.

12. In compliance with the above, the undersigned agrees, if this offer is accepted within calender days (60 calendar days unless a different period is inserted by the offeror) from the date for receipt of offers specified above, to furnish any or all items upon which prices are offered at the price set opposite each item, delivered at the designated point(s), within the time specified in the schedule.

13. DISCOUNT FOR

PROMPT

PAYMENT

10 CALENDAR DAYS

20 CALENDAR DAYS

30 CALENDAR DAYS

CALENDAR DAYS

(See Section I, Clause 52-232-8)

14. ACKNOWLEDGMENT OF

AMENDMENTS

(The offeror acknowledges receipt of amendments to the

SOLICITATION for offerors and related documents numbered and dated:)

AMENDMENT NO.

DATE

AMENDMENT NO.

DATE

15A. NAME

AND

CODE

FACILITY

16 NAME AND TITLE OF PERSON AUTHORIZED TO SIGN OFFER (Type or print)

ADDRESS

OF

OFFEROR

15B. TELEPHONE NO. (Include area code)

15C. CHECK IF REMITTANCE ADDRESS

IS DIFFERENT FROM ABOVE. ENTER

[ ] SUCH ADDRESS IN SCHEDULE

17. SIGNATURE

18. OFFER DATE

AWARD (To be completed by Government)

19. ACCEPTED AS TO ITEMS NUMBERED

See Schedule

20. AMOUNT

21. ACCOUNTING AND APPROPRIATION

See Schedule G.

22. AUTHORITY FOR USING OTHER THAN FULL AND OPEN COMPETITION:

[ ] 10 U.S.C. 2304(c)( ) [ ] 41 U.S.C. 253(c)( )

23. SUBMIT INVOICES TO ADDRESS SHOWN IN

(4 copies unless otherwise specified)

See Schedule G.

ITEM

24. ADMINISTERED BY (If other than item 7) CODE

25. PAYMENT WILL BE MADE BY CODE:

Commanding Officer

CG Finance Center

1430A Kristina Way

Chesapeake VA 23326-0624

51800

26. NAME OF CONTRACTING OFFICER (Type or print)

27. UNITED STATES OF AMERICA

(Signature of Contracting Officer)

28. AWARD DATE

IMPORTANT - Award will be made on this Form, or on Standard Form 26, or by other authorized official written notice

NSN 7540-01-152-8064

33-134

STANDARD FORM 33 (REV. 4-85)

Section B- Supplies or Services and Prices/Costs

B.1 General

The Contractor shall provide Test and Evaluation Support Services (TESS) services in accordance with the General Scope contained in Section C. The Government intends with this solicitation to make two or more Indefinite Delivery Indefinite Quantity (IDIQ) contract awards and one Task Order (TO) award, with more TO awards to follow over the term of the contract.

The initial Task Order will be awarded cost plus fixed fee (CPFF) completion form including firm-fixed price (FFP) tasking associated with Program Management.

Individual TOs will be issued in accordance with the terms and conditions stated in Section H and I. All services provided under this contract will be purchased through the issuance of either

FFP or CPFF orders. To the maximum extent practicable, orders under this contract will be on a firm-fixed-price basis and should also include any travel costs or other direct charges related to performance of the services ordered, unless the order provides for reimbursement of travel costs at the rates provided in the Federal Travel Regulations. The firm fixed unit prices are the contractor‘s fully loaded labor rates.

B.2 Term of Contract

The term of this IDIQ contract is five years. Task orders may be issued at any time during the five -year ordering period at the rates established for the corresponding contract year.

B.3 Contract Pricing

B.3.1 Firm Fixed Price Rates

All task orders issued on a FFP basis will be priced in accordance with the pricing set forth in

Section B.4, Labor Rate Tables, and Attachment 3, Labor Category Descriptions. Attachment 3 is meant to provide a general understanding of the anticipated labor category descriptions and is not intended to be the cumulative list of labor categories. Offerors are instructed to use this list as guidance for proposing labor categories. The labor rates in this section will reflect the full-burdened rates for each labor category and will apply to all direct labor hours. The labor rates are detailed in Section B.4 (to be filled in by the offeror in Table 1) under labor categories. The application of these rates to the work required under each FFP task order shall result in the issuance of a FFP task order reflecting a total price for performance of the work. No labor hour or time and material task orders will be issued under this contract. The loaded hourly rates are ceiling price rates and the Contractor may, at its discretion, elect to propose lower hourly rates on a task by task basis. The contractor shall "map" their proposed labor categories to the

Government provided Labor Categories in Table 2 in Section B.4.

(a) Labor. The Section B.4 Labor Rate Tables represents fully-loaded hourly rates for each skill classification. The fully-burdened labor rates include all direct, indirect, general and administrative costs and profit associated with providing the required skill.

PREVIOUS EDITION NOT USABLE Prescribed by GSA

FAR (48 CFR) 53.214(c)

The fully-burdened labor rates include all labor and labor-related costs, such as, but not limited to, the following list of representative labor-related costs: salaries, wages, bonuses to include stock bonuses, incentive awards, employee stock options, stock appreciation rights, employee stock ownership plans, employee insurance, fringe benefits, contributions to pension, other post-retirement benefits, annuity, employee incentive compensation plans, incentive pay, shift differentials, overtime, vacation time, sick pay, holidays, and all other allowances based upon a comprehensive employee compensation plan. All hourly rates are based on a 40-hour work-week (ex. 1,920 hours per year or in accordance with the Contractor‘s corporate policy).

Contractor Rates: During the performance of this contract, the Contractor shall furnish fully-burdened labor rates which include loads for office space and all normal supplies and services required to support the work. This includes, but is not limited to, telephones, faxes, copiers, personal computers, postage (to include courier services such as Federal Express), ordinary business software (e.g., word processing, spreadsheets, graphics, etc.), normal copying and reproduction costs.

(b) Program Management Support Costs. Contract-level program management support costs are included as a percentage of each individual labor category rate, and encompass support for contract-level management, reporting requirements and related travel and meeting attendance costs associated with the Contractor‘s program management staff, as it relates to overall management of the contract. As a result, these program management support costs are allocated across all of the task orders issued under this contract. These

―program management‖ support costs are differentiated from individual task order ―Task

Order Manager‖ or ―Project Manager‖ support costs, which are billed as hourly labor rates against individual task orders for direct support to the effort performed under those task orders. This will result in direct billings at the task order level for labor hours in the

―Task Order Manager‖ or ―Project Manager‖ categories, to specifically support project management for the task order.

B. 3.1.2 For FFP type task orders, the quantity of each item or labor category ordered will be multiplied against the rate(s) listed in this schedule, and the cumulative extended total of all items ordered will define the lump sum fixed price for the TO. Travel costs will be in accordance with the Federal Travel Regulations (FTR), if applicable, and may be estimated for each TO and will be funded on a NTE basis. Travel shall remain separate from the total fixed price for labor and ODCs.

B.3.1.3 Additional Labor Categories

At any time and throughout the life of the contract, at the request of either the Contractor or the Government, the Contractor may propose additional labor categories, rates and descriptions in addition to the labor categories identified in Section B.4, Table 2. These additional labor categories, rates and descriptions will be negotiated on a case-by-case basis. The additional categories, rates and descriptions proposed, upon determination by the Government that they are necessary for contract performance and both fair and reasonable, will be incorporated by modification into the Section B.4, Table 1, of this contract.

B.3.2 Cost Reimbursement Pricing

All TOs issued on a Cost Reimbursement basis will be priced in accordance with approved

DCAA rates. Direct and indirect cost rates will be established on a TO basis. The offeror shall also submit their approved Forward Pricing Rate Agreement (FPRA) if applicable. For Cost

Reimbursement task orders, the Contractor will provide complete supporting schedules identifying all applicable direct and indirect rate estimates building up to the TO cost. Cost

Reimbursement Pricing shall include Direct rates, Indirect rates, G&A, Overhead, Fixed Fee, Escalation rate, FPRA if applicable and a narrative discussion of the Estimating System, Purchasing System and Accounting System. Contractors with approved DCAA rates should submit their most recent provisional indirect billing and actual rates for both direct and indirect rates. Contractors without audited rates shall propose indirect rates in accordance with FAR Part

31. For CPFF task orders the statutory fee limitation is 10%.

For Cost Plus Fixed Fee task orders the offerors shall propose a fixed fee percentage which may be subject to negotiation.

Description %

Fixed Fee percentage. Fixed Fee is only applicable to prime and subcontractor labor. The offeror shall propose one fixed fee percentage in the cell to the right. This fee percentage is applicable to all CPFF task orders.

The proposed fixed fee shall be considered a ceiling fixed fee which may be negotiated down to more accurately reflect the level of effort at the task order level. The Government reserves the right to negotiate the proposed fixed fee percentage at its discretion.

B.4 Labor Rate Tables

The Labor Rate Tables provide labor category descriptions, labor rates, and markup percentages for performance of the requirements as specified in individual Task Orders. Fully loaded hourly labor rates are included for each labor category. The fully-loaded hourly labor rates are the ceiling rates representing the maximum rates allowable for Prime and Subcontractors.

The contract type of a Task Order will be determined at the time of issuance of each Task Order.

Specific CLINS will be established at the Task Order level on a FFP or CPFF basis.

Offerors shall add rows and categories as necessary to propose all labor rates associated with the services to be contracted for each year of the five year ordering period. Table 1 is provided as a sample format. The Table 2 suggested labor categories required to perform the work are listed.

The contractor shall map the suggested labor categories to the contractors proposed labor categories in Table 1. Task Orders will be issued during the five year ordering period of the contract utilizing the CLIN structure specified in B.4.1 below.

Table 1

Labor Category Fully Burdened Rate

- Base Year -

- Year 1 -

- Year 2 -

- Year 3 -

- Year 4 -

Note: Offeror should price as if the rates are for off-site only. Government will not be providing any on site facilities.

Table 2

Labor Category

Technical Analyst I

Technical Analyst II

Technical Analyst III

Technical Analyst IV

Tester

Functional Specialist

Manager I

Manager II

Senior Manager

Technical Writer

The total level of effort estimated to be ordered during the five year ordering period is

$2,389,880 man-hours of direct labor. Individual task orders to be issued will separately identify level of effort that cannot be exceeded.

B.4.1 CLINs for issuance of Task Orders

CLIN No. Schedule of Supplies/Services Contract Type

0001 Program Management FFP

(SOW 3.0 – 3.10.3)

0002 Test Evaluation Support Services FFP

(SOW 4.0 – 4.410)

0003 Test Evaluation Support Services CPFF

(SOW 4.0 – 4.4.10)

ESTIMATED COST $

FIXED FEE $

TOTAL EST COST+FEE $

0004 Travel ESTIMATED COST $

(SOW 5.0)

B.5 Contract Minimum/Maximum

(a) The Government intends to make multiple awards or to not make an award if deemed to be in the best interest of the Government. The minimum guarantee for the base IDIQ contract will be one million dollars ($1,000,000) over the entire contract term/period.

(b) The specific products and quantities will be identified on each Task Order issued under the base contract.

(c) A combined maximum ceiling of three hundred fifty million dollars ($350,000,000) is established as the cumulative total of all orders for the life of the contract.

Section C- Descriptions and Specifications

STATEMENT OF WORK

Test and Evaluation Support Services (TESS)

1.0 INTRODUCTION

1.1 Background

The Transportation Security Administration (TSA) is charged with the mission of protecting the

Nation's transportation systems to ensure freedom of movement for people and commerce. The mission of TSA‘s Office of Security Technology (OST) is to safeguard the Nation‘s transportation systems by providing efficient and effective security technology solutions through applied research, development, operational testing, deployment and life cycle management to ensure the free movement of people and commerce.

There are three key overall activities that must be accomplished to ensure success throughout the acquisition cycle, and to support the operational requirements of the TSA. First, is the ability to rapidly integrate, test, evaluate, model and simulate as required, and conduct recurring analyses and surveillance throughout the life-cycle of a variety of technologies, processes, and procedures in operational environments in a variety of locations; as well as redesign, modify, and update security installations to accommodate security operations.

Second, is the requirement to obtain and synthesize data, information, and reports from multiple sources and all phases of the acquisition cycle into one overall assessment of effectiveness and suitability of the system; and to assess and fully represent the level of risk associated with acquisition and use throughout the life-cycle.

Third, is the requirement to independently assess the readiness of technologies and systems that may pertain to TSA‘s missions.

TSA supports airports, common carriers, ports and terminals associated with all mean of transportation and commerce, as well as law enforcement and governmental operations, policy, and research and development entities. TSA is responsible for the deployment of security technology equipment to ensure: (1) new technologies are deployed as they become available based on a risk based model; (2) old technologies are removed from service when they are at the end of their life cycle; and (3) systems are relocated as necessary to meet security needs.

In addition to its responsibilities for deployment of security equipment for aviation, TSA is also responsible for enhancing surface transportation security by developing requirements for and evaluating security technologies that protect employees and travelers, eliminate vulnerabilities, mitigate damages, identify potential threats, provide decision support, and facilitate recovery from intentional assault on commercial surface transportation modes and related infrastructure.

DHS appropriation acts have provided direct funding for installation and implementation of technologies for support of equipment for both aviation and non-aviation infrastructure. With the implementation of Public Law 110.53 (9/11 Act), significant interest in strengthening the security effort in the transportation of cargo is expected. This is expected to increase the testing and deployment of security equipment in support of the cargo program.

1.2 Scope.

This contract encompasses TSA‘s needs for test and evaluation (T&E) in support of TSA‘s responsibilities in all modes of transportation, and in support of stakeholders and organizations associated with transportation security. The Contractor is responsible for an integrated evaluation strategy, including all data collection and analysis services required that will support overall Government objectives. This strategy will identify necessary data sources, including field testing, modeling and simulation, special studies, and any other relevant sources (i.e., commercial standards, testing by other US government agencies, foreign governments, etc.) to ensure credible, timely, adequately scoped evaluation products that maximize use of test resources.

The supplies and services required by this contract shall be performed per this SOW, task orders, and the technical instructions issued for the work required under this contract. The Contractor shall provide sufficient personnel, both in number and qualification to perform work described in this SOW and each individual Task Order. The contractor may be required to perform work at up to 30 sites simultaneously within both CONUS and OCONUS.

2.0 APPLICABLE DOCUMENTS

The following specifications, handbooks, orders, standards, and drawings form a part of this

SOW and are applicable to the extent specified herein or by relevant Task Order. The latest version of these documents as of the contract date shall apply.

2.1 Government Documents

Executive Order 12356 National Security Information

Title 14, Code of Federal Regulations, Withholding Security Information from

Part 191 Disclosure Under the Air Transportation

Security Act of 1974

5 U.S.C. section 552a Sensitive but Unclassified (SBU)

49 CFR Part 1520 Protection of Sensitive Security Information

U.S. Department of Homeland Security

DHS SCG TSA-002

February 17, 2005

Department of Homeland Security

Explosive Detection Systems

Information and Data Security

Classification Guide

DoD 5220-22-M, February 28, 2006 National Industrial Security Program

Operating Manual

Executive Order 12958, Classified National Security Information dated April 20, 1995, as amended by

Executive Order 13292, dated March 28, 2003.

TSA MD 2800.71 Pre-Employment Investigative Standards for

TSA Non-Screener Employees and

Contractors

DHS MD 4300A Sensitive Systems Handbook

TSA MD 1400.3 Information Security Policy

Military Standards

MIL-HDBK-61A Military Handbook, Configuration

Management Guidance

DA PAM 73-1 Test and Evaluation in Support of Systems

Acquisition

Other Documents

DD Form 254 Contract Security Classification

Specification

DHS AD 102-01 Department of Homeland Security

Acquisition Directive 102-01

TSA MD 200.55 Accountability, Management and Control of

TSA Property in the Hands of a Contractor

ANSI/ISO 9001:2008 Quality Management Systems

DI-ENG-047A Site Survey Report

DI-ENG-005A Site Installation Plan

The Planning and Design Guidelines for

Checked Baggage Inspection Systems

Guide for system design and testing http://www.tsa.gov/research/asac/index.shtm

ANSI/EIA 649A, Configuration Management

ISO 10007: 2003 Quality Management - Guidelines for

Configuration Management

2.4 Source of Documents

Copies of Government specifications and interface documents are widely available on the

Internet.

http://www.tsa.gov/research/asac/index.shtm

Requests for copies of documents that are not available on the Internet should be addressed to the

Contracting Officer (CO). Requests should fully identify material desired and cite the solicitation or contract number.

Military Standards and Specifications can be ordered from the Department of Defense Single

Stock Point (DODSSP), Building 4/Section D, 700 Robbins Avenue, Philadelphia, PA 19111-

5098. Information is available at their website, http://www.dodssp.daps.mil.

Copies of ANSI/ASQC Q9000 series standards can be obtained from the following source:

American Society for Quality P.O. Box 3005; Milwaukee, Wisconsin 53201-3005 or 600 North

Plankinton Avenue; Milwaukee, WI 53203. http://www.asq.org.

Copies of the Acquisition Management System Test and Evaluation Process Guidelines and documents providing guidance concerning technology and systems readiness evaluation and readiness levels are available at https://akss.dau.mil.

2.5 Order of Precedence

In the event of conflict between this SOW, Task Orders and any of the applicable documents herein, the provisions of the Task Order shall apply, followed by this SOW.

General Requirements

3.1 General Program Management Requirements

The Contractor shall establish and maintain a formal organization to manage the contract and any associated subcontracts. A clear line of project authority shall exist among all organizational elements. The contractor shall be fully responsible for the integration and coordination of the work described in the SOW. The Contractor shall develop and implement a Management

Program to efficiently and effectively execute the requirements of this contract required to perform all the activities successfully as required in this SOW and each individual task orders.

The Contractor‘s management program shall be fully documented in a Program Management

Plan (PMP).

The Contractor shall provide a draft PMP within thirty (30) calendar days after contract award.

The TSA review comments shall be given to the Contractor within seven (7) calendar days after receipt; and the document shall be finalized by the Contractor within five (5) calendar days thereafter. Once the PMP is finalized, the contractor shall perform in accordance with the approved plan.

The contractor shall provide a program manager who shall be responsible for all work performed under this contract and shall be a single point of contact for the Contracting Officer and designated representatives of the contracting officer. The program management offices shall be located within 50 miles of TSA Headquarters. The name of this person and the name of any alternate who shall act for the contractor when the program manager is absent shall be submitted in writing to the Contracting Officer five (5) working days prior to contract start date. During any absence of the program manager, only one alternate shall serve as the Government contact http://www.dodssp.daps.mil/ https://akss.dau.mil/ point. The program manager, and any designated alternate(s), shall have full authority to act for the contractor on all contract matters relating to daily operation of this contract.

The contractor may be required to provide personnel to work on-site at locations designated by task order. The Government will provide facilities for contractor employees assigned to work on-site at the designated location. Personnel assigned to work on-site shall be knowledgeable of the work being performed, and have access to all work products under this contract. At the discretion of the COTR, on-site personnel may obtain access to TSA email and IT systems.

The Contractor shall ensure that assignments are completed in a manner that is thorough and within schedule and document all accomplishments that are directly relevant to the contract or awarded Task Order schedule(s). The TSA requirements in performing this contract demand that the Contractor's engineering, technical, analytical, and administrative support and the level of expertise, experience, and demonstrated performance of the Contractor personnel providing the services must be commensurate with the scope and complexity of the contract or awarded Task

Order(s) to ensure quality support.

CDRL A001 Program Management Plan

3.1.1 Key Personnel

The personnel specified as key personnel are essential to the work being performed in this contract. These personnel, unless otherwise unavoidable, shall not be changed from their designated assignment until at least 12 months have lapsed. Unavoidable situations include sudden illness, death or termination of employment Key personnel shall be fully dedicated to this contract.

If a need arises for a change in key personnel, the contractor shall provide 30 day written notice to the contracting officer for the necessity of the change, the reason for the change, and provide the nomination of the replacement. Within 10 days, the Contracting Officer will review the

Contractor‘s change notification, and either accept or reject the proposed change. Only those substitutions that are of equal or greater experience levels will be accepted by the contracting officer. Key personnel are listed in section G of the contract.

3.1.2 Subcontractor Management

The Contractor shall review each subcontractor's technical progress on all assigned tasks and include such technical progress and status information in monthly Program Management

Reviews.

3.1.3 Program Status Report

The Contractor shall report on cost, schedule, and technical progress in meeting reviews/status reports. Program Status Reports shall address cost, schedule, performance and status of deliverables. Cost information is not required on firm fixed price orders. The reports shall address problems/risks in the Contractor‘s Task Orders, and provide recommended solutions. In particular, the contractor shall identify opportunities for savings and efficiencies as soon as they become known. The report shall describe the work accomplished during the reporting period, and discuss problems encountered and corrective action taken, pending issues and work planned for the next period. In particular, the report shall address the extent to which any problems or circumstances will cause conflicts with program schedules.

The report shall present detailed progress information on specified Task Orders, to include technical progress presented in terms of performance goals, exit criteria, schedule progress and/or cost impact. Thresholds for variance reporting may be established in individual Task

Order requirements. The report shall specifically address reported elements that fall outside specified thresholds.

CDRL A002 Program Status Report (PSR)

3.1.4 Program Document Library

The Contractor shall maintain a digital Program Document Library (PDL) that contains all documents/data generated by the Contractor or provided to the Contractor by the government during the performance of this contract. The PDL shall be a program management centric section of the Analytic Data Archive (ADA) required by Paragraph 8.0 of this SOW. The

Contractor shall provide authorized government personnel access to the PDL. The list of documents included in the PDL shall be listed in the Document Library Index (DLI).

Documents/data provided by Government in paper only formats are exempt from digital storage requirement. The contractor may be required to support transition of and provide a fully functional copy or ―mirror‖ of the entire ADA to a Government central depository.

CDRL A003 Document Library Index (DLI)

3.2 Schedule Management

For some Task Orders issued under the contract, the Contractor shall be required to develop and maintain a Task Order schedule. The Contractor shall provide sufficient detail to demonstrate that the tasked effort is appropriately resourced, thoroughly planned, and proceeding according to contract requirements. Such schedule(s) shall be consistent with formats established by the

Contractor‘s PMP and the associated Contract Work Breakdown Schedule (CWBS), fully integrated with OST master schedules, and shall be developed using Microsoft Project or other approved commercial-off-the-shelf (COTS) application software. Individual task order schedules shall be able to be consolidated into one overall schedule of all activities being performed under this contract.

The schedule(s) shall identify subordinate-tier activities, dependencies between task activities, and milestones required to demonstrate successful completion of the Task Order. The schedule(s) shall identify the exit criteria required to satisfy milestone requirements that enable the Contractor to proceed with follow-on activities. The schedule(s) shall be baselined and updated periodically, as required.

The contractor shall thoroughly review the list of projects and update the schedule as new information becomes available. The government will rely on the contractor to keep them abreast of delays in schedule, so that the government can timely mitigate any other costs that may result from delays. Because technologies from different programs will be subject to services provided under this contract simultaneously, the contractor shall make recommendations to the

Government where changes to the schedule may reduce cost and disruption to operations. When the contractor provides recommendations for changes to the schedule, the contractor shall address any risk, advantages, and changes in cost that will be associated with the schedule change

Required routine reporting on Task Order schedules and updates shall occur at least monthly, to coincide with Program Management Reviews. The schedule(s) briefed shall be current as of the date of the reporting period. Changes to scheduled baseline milestones must be authorized by the COTR prior to any change.

3.3 Financial Management

For other than firm fixed price task orders, the Contractor shall establish a uniform cost/financial control methodology for each Task Order that is consistent with the PMP, Task Order schedules and the level of management required to fully prepare required reports. The Contractor‘s cost control methodology shall provide the Government with insight of monthly expenditures against performance requirements. The cost control system shall identify Budgeted Cost of Work

Scheduled (BCWS), Budgeted Cost of Work Performed (BCWP), and Actual Cost of Work

Performed (ACWP) for the overall Task Order and its primary subordinate-tier activities that are required to complete the task.

The Contractor shall provide a monthly detailed breakdown of expenditures as specified by Task

Order. This shall include a breakdown of labor hours used by the Contractor and any subcontractors, associated labor costs, material costs and any other direct costs incurred. The report shall include both reporting period and cumulative expenditures, presented in both tabular and graphical forms.

The Contractor shall notify the CO and the COTR by letter when Task Order funds expended reach 75% of award value as specified by task order.

Financial status shall be an agenda item at the monthly Program Management Reviews.

CDRL A004 Contract Funds Status Report

3.4 Risk Management/Assessment

The Contractor shall identify cost, schedule and technical risks and describe how it will effectively manage these risks throughout the performance of this contract. Significant risks shall be identified and discussed in the PMP.

The Contractor shall quantify risks with respect to the impact on integration, performance, technical parameters, schedule, and cost. The Contractor shall identify risks and assign a priority for developing a recommended course of action. The Contractor shall develop and maintain a list identifying, analyzing, and classifying program risks. Program risks shall be classified as low, medium, or high. The Contractor shall conduct risk mitigation planning for risks considered medium or high. The Contractor shall provide the status of and mitigation actions for identified program risks at Program Management Reviews (PMRs) and in the Program Status

Reports (PSRs).

3.5 Data Management

The Contractor shall establish and maintain a library of all formally delivered products under all

Task Orders. Where practical, products maintained in the library shall be maintained in both hardcopy and electronic formats. The Contractor shall make the products produced under this contract available for Government review and use. The contractor may be required to support transition of and provide a fully functional copy or ―mirror‖ of the entire ADA to a Government central depository.

3.6 Quality Program

The Contractor shall establish, implement and maintain a documented quality system in accordance with section E of the contract as a means of assuring compliance with all requirements of the contract. The Contractor shall document the quality program in a Quality

System Plan (QSP) tailored for services.

The Contractor shall require that sub-suppliers have an appropriate documented quality system that controls the quality of the services and supplies provided.

CDRL A005 Quality System Plan (QSP)

3.7 Meetings, Conferences and Reviews

Meetings may be held to ensure effective program management, and efficient and effective resolution of problems throughout the life of the contract. The types of these meetings shall include, as a minimum, those described in the following subparagraphs. Where practical, at least five (5) business days before any meeting, the hosting office shall notify the other offices of the time, date, location and proposed agenda of the meeting.

Periodically, the Contractor shall be required to attend conferences, technical interchange meetings, formally scheduled conference calls, video teleconferences, and other meetings. After attending a required conference, the Contractor shall prepare a trip report that summarizes the conference and describes the pertinent information gathered at the conference. After attending a review meeting, the Contractor shall prepare meeting minutes or a summary of the meeting, as directed by the COTR.

The Contractor shall conduct meetings and reviews in accordance with the Government approved PMP and this SOW. The Contractor shall prepare and submit meeting agendas and presentation materials as specified by task order. The Contractor shall be prepared to substantiate assumptions made and methodologies used in arriving at recommendations or conclusions. The Contractor shall record meeting minutes during all meetings. The Contractor shall prepare formal written minutes, accompanied by a summary of action items and all presentation materials used, for Government approval. Meetings and reviews shall not be considered finalized until the Government has approved the minutes.

Support provided by the Contractor shall include, but is not limited to, facilities, materials, office equipment, clerical personnel, mockups, technical data, and subcontractor participation (when appropriate).

CDRL A006 Meeting Minutes

3.7.1 Post-Award Conference

A Post-Award Conference shall be held at a location designated by the Contracting Officer within ten (10) calendar days after contract award. At the Post-Award Conference, the

Contractor shall present their understanding of the contract and identify any issues or questions about contract execution. The Government will designate conference attendees and will identify any unique conference support requirements. The Contractor shall provide the minutes for the conference.

CDRL A007 Post Award Meeting Minutes

3.7.2 Program Management Reviews (PMRs)

The Contractor shall conduct quarterly PMRs at the Government‘s office or the Contractor‘s facility beginning with the Post Award Conference. The purpose of the PMRs shall be for the

Contractor to present a detailed contract status, review outstanding action items, review potential and actual performance and programmatic problem areas, evaluate performance relative to cost ceilings set forth in task orders and milestones set forth in the Program Schedule, and provide a forum for highlighting activities planned for the next period. The Contractor shall graph expenditures vs. work effort accomplished by task order and summary level, with future projections. Hard copies and electronic copies of presentation materials shall be made available at the PMR for all participants.

The Contractor shall prepare and submit an agenda for Government review at least five (5) business days prior to the PMR. The PMR agenda shall include, as a minimum, accomplishments, action items, issues/problems, schedule, planned activities, and financial reporting. The Contractor shall prepare and submit minutes of each PMR to the Government within five (5) business days following the meeting.

3.8 Security Requirements

The Contractor shall possess the capability to store and safeguard from unauthorized disclosure information of national security concern pursuant to Executive Order 12356, National Security

Information, and unclassified information determined to be sensitive security information or sensitive but unclassified information in accordance with regulations and documents listed in

Paragraph 2.

The government will require security clearances up to secret for personnel as designated by individual task orders, and may require clearances up to top secret/SCI for selected personnel.

The Contractor shall complete Sections 6, 7, and 8 of DD-254 in its entirety. See Attachment J for a copy of the DD-254.

The Contractor shall develop, apply and maintain effective security practices in accordance with the requirements of appropriate documents in Paragraph 2.

The Contractor must request written government approval prior to release of any data, information, text, work products, images, video, or any other media associated with this contract.

The Contractor shall document all incidents through the Physical and Communications Security

Breach/Incident Report. The Contractor shall notify the COTR of such incidents; including actual or suspected unauthorized attempts to penetrate the Contractor‘s facilities or information systems through the remote workstation or remote functions.

3.8.1 Use and Sensitivity of Records

All TSA and other government forms, records, reports, and data to which contractor personnel shall have access are the property of TSA and are to be used solely for performing the work described in this SOW. Contractor personnel shall not use, disclose, or retain any materials except as described in this SOW or as directed by the Contracting Officer‘s Representative

(COR).

3.8.2 Security and Privacy

When required, data base firewalls and protections shall conform to Federal information security standards regarding access and protection of classified information.

Any TSA information made available or to which access is provided, and which is marked or shall be marked ―Official Use Only,‖ shall be used only for the purpose of carrying out the provisions of this contract and shall not be divulged or made known in any manner to any person except as may be necessary in the performance of the contract. Disclosure to anyone other than an officer or employee of the contractor or subcontractor at any tier shall require prior written approval of the TSA. Requests to make such disclosure should be addressed to the TSA contracting officer.

Each Officer or employee of the contractor or subcontractor at any tier to whom ―Official Use

Only‖ information may be made available or disclosed shall be notified in writing by the contractor that ―Official Use Only‖ information disclosed to such officer or employee can be used only for the purpose and to the extent authorized herein, and that further disclosure of any such ―Official Use Only‖ information, by any means, for a purpose or to an extent unauthorized herein, may subject the offender to criminal sanctions imposed by 18 U.S.C. Sections 641 and

3571. Section 641 of 18 U.S.C. provides, in pertinent part, that whoever knowingly converts to his use or the use of another, or without authority sells, conveys, or disposes of any record of the

United States or whoever receives the same with the intent to convert it to his use or gain, knowing it to have been converted, shall be guilty of a crime punishable by a fine or imprisoned up to 10 years or both.

3.8.3 Security Controls

The Contractor shall comply with Department of Homeland Security (DHS) and Transportation

Security Administration (TSA) technical, management and operational security controls to ensure that the Government's security requirements are met. These controls are described in DHS

MD 4300A and TSA MD 1400 series security policy documents and are based on the NIST 800-

53 standards.

The Contractor shall include this prospective clause in all subcontracts at any tier where the subcontractor may have access to ―sensitive information‖ as defined in this prospective clause.

3.8.4 Security Policy

The Contractor shall ensure that its employees follow all policies and procedures governing physical, environmental, and information security described in the various TSA regulations pertaining thereto, good business practices, and the specifications, directives, and manuals for conducting work to generate the products as required by this contract. Personnel will be responsible for the physical security of their area and government furnished equipment (GFE) issued to them under the provisions of the contract.

TSA Security Policies shall be adhered to for development of all applications, data bases and data integrity. Additionally, contractors must satisfy requirements to work with and safeguard

Security Sensitive Information (SSI).

All TSA contractors and consultants must execute a DHS Form 11000-6, Sensitive But

Unclassified Information Non-Disclosure Agreement (NDA), upon initial assignment to TSA and before being provided access to TSA ―sensitive information.‖

All support personnel must understand and rigorously follow all TSA and DHS policies, procedures, guidelines, and standards including but not limited to:

DHS MD 4300 Information Technology Systems Security

DHS MD 1050.1, Personnel Security Program

DHS MD 11056.1, Sensitive Security Information (SSI)

DHS IT Security Architecture Guidance Volumes 1, 2 and 3

DHS/TSA System Development Lifecycle (SDLC)

TSA Information Technology Security Policy

These publications shall be adhered to in support of Media Protection, Access Control, Auditing, Network Security, Rules of Behavior, Personnel Security, Physical Security, Training and

Awareness, Security Incident Reporting, Contingency Planning, Security Review and Reporting and Contract Close Out.

Each site may have different security requirements. The contractor shall coordinate in advance with all sites to ensure all contractor personnel are familiar and comply with the security requirements. Work delays that are caused by contractor personnel security issues will be considered inexcusable delays in performance.

Certain airport sites require extensive security processing of contractor personnel before they will be allowed access to areas where work will be performed. Individual task orders will provide direction concerning those requirements. The Contractor is required to be knowledgeable of methods and procedures associated with this processing, and the length of time required to gain this special access. The Contractor‘s cost proposals for those task orders shall specifically address costs for this processing.

3.8.5 Certification and Accreditation (C&A)

Certification and Accreditation (C&A) in accordance with the National Institute of Standards and

Technology (NIST) 800-37 for unclassified systems, or the Department of Defense Information

Technology Security Certification and Accreditation Process (DITSCAP) for classified systems, is a requirement for TSA information systems, including general support systems (e.g., standard

TSA desktop, general network infrastructure, electronic mail, etc.), major applications and pilot systems (if connected to the operational network or processing, storing, or transmitting government data). All NIST and DITSCAP guidance are publicly available; TSA security policy is disclosed upon contract award. A written authority to operate (ATO), granted by the TSA

Designated Accrediting Authority (DAA), is required prior to processing operational data or connecting to any TSA network. The contractor shall provide all necessary system information for the C&A effort.

The Security Certification Package contains documentation required for C&A. The package will contain the following security documentation: an Initial Risk Assessment, System Security Plan

(SSP) or System Security Authorization Agreement (SSAA), System Design Document - if security architecture and information flows and network topology information in the SSP needs augmentation, Contingency Plan and results, Self-Assessment results, Federal Information

Processing Standards (FIPS) 199 Assessment, Privacy Impact Assessment, and E-Authentication as required. The C&A package shall document the specific procedures, training, and accountability measures in place for systems that process personally identifiable information

(PII). All security compliance documents – such as the Security Program Plan - will be reviewed and approved by the Chief Information Security Officer (CISO) and IT Security, and accepted by the Contracting Officer upon creation and after any subsequent changes, before they go into effect.

The Contracting Officer‘s Technical Representative (COTR) and IT Security will conduct reviews and/or audits to ensure that the security requirements in the contract are implemented and enforced. The Contractor shall comply with requests to be audited and provide timely responses to requests for data, information, and analysis from the Department of Homeland

Security (DHS) Office of Inspector General (OIG), General Accounting Office (GAO), and TSA

IT Security and management. Each group will have their own timescale per the type of audit performed; TSA IT Security audits require a 10 day response time. The Contractor shall not, however, provide data and information to any agency external to TSA without specific approval by either the CO or the COTR, and then only after review and approval.

3.8.6 Data Security

The Contractor shall be responsible for the security of: i) all data that is generated by the contractor on behalf of the TSA, ii) TSA data transmitted by the contractor, and iii) TSA data otherwise stored or processed by the contractor, regardless of who owns or controls the underlying systems while that data is under the contractor‘s control. All TSA data, including but not limited to PII, sensitive security information (SSI), and sensitive but unclassified (SBU), critical infrastructure information (CII), shall be protected according to DHS and TSA security policies and mandates.

At the expiration of the contract, the contractor shall return all TSA information and IT resources provided to the contractor during the contract, and provide a certification that all assets containing or used to process TSA information have been sanitized or destroyed in accordance with the TSA security policy. The contractor will certify in writing to that sanitization and/or destruction has been performed.

3.8.7 Program Performance

The Contractor shall provide, implement, and maintain a Security Program Plan (SPP) based on the templates provided by TSA IT Security as part of the required security compliance documentation. This plan shall describe the processes and procedures that will be followed to ensure appropriate security of IT resources that are developed, processed, or used under this contract. The security controls contained in the plan shall meet the requirements listed in the

TSA, Security Policy Handbook -- Chapter 3, Section 21, Information Security Documentation and the DHS Sensitive Systems Policy and Handbook 4300A (current version).

The SPP shall be submitted within 30 days after contract award. The SPP shall be considered a living document; it will be reviewed and updated semi-annually to address new processes, procedures, technical or federally mandated security controls and other contract changes that affect the security of IT resources under contract. It shall be consistent with and further detail the approach contained in the offerors proposal or quote that resulted in the award of the contract and be in compliance with the requirements stated in the security clause(s) in the contract.

Hardware or software configuration changes shall be in accordance with TSAs Configuration

Management policy, TSA Enterprise and Security Architecture standards. The TSA Chief

Information Security Officer (CISO)/ IT Security must be informed of and involved in all configuration changes to the TSA IT environment including systems, software, infrastructure architecture, infrastructure assets, and end user assets. The contractor shall comply with requests to be audited and support audit activities (such as requests for system access for penetration testing, vulnerability scanning, incident response, forensic response, etc.).

4.0 Specific Tasks

4.1 Test and Evaluation Policies and Standards

The contractor shall support OST development of policies and standards. This shall include but is not limited to:

Review of DHS and TSA-wide policy for…