CAPABILITY_STATEMENT.pdf

STATEMENT OF WORK

BACKGROUND

This requirement is for rental of Multi-functional Devices (MFDs) (i.e. Copier/All-in-One machines) in support of the Federal Emergency Management Agency (FEMA) Hurricane Maria response and recovery.

Definition:

Key Operator: A Government designee at each location assigned to order supplies, place service calls, and manage the operation and administrative settings for each MFD to which they are assigned. They shall also be the primary contact for service calls and supply reordering.

COR: Contracting Officer’s Representative.

SCOPE OF WORK

The Contractor shall provide the following services:

Product, Training, Maintenance Services Meter Reads Consumables Relocation and Disposal of Equipment

MINIMUM REQUIREMENTS

The Contractor shall provide Multi-Functional Devices (MFDs) and ancillary products with the following capabilities:

• Ability to print, scan, copy, fax, and e-mail both color and black and white documents;

• Ability to connect to the FEMA network. Networked machines will not be used in classified environments.);

• Minimum Two Drawer paper storage;

• Functional Separation (physical and logical separation of facsimile functions from copy, scan, self-contained document server/repository and e-mail functions.);

• Automatic document feeder;

• Keypad or Touch Screen;

• Self-diagnostic system which indicates at a minimum, the following conditions: needs toner, needs paper and paper jam

• Energy Star Compliant;

• Printer Control Language (PCL) and Post Script (PS) printer languages;

• Security Data Kits;

• Capability for user authentication from HSPD-12 PIV card readers and user login and password;

and

• Capability for data overwrite and controlling user access.

• Ability to handle minimum letter (8 ½ x 11), legal (8 ½ x 14) paper sizes, with adjustable paper trays.

• Ability to function with recycled paper;

• Removable hard drive

• Capability to sort, collate, duplex, staple, hole punch, and make booklet.

To meet the requirements of the Homeland Security Presidential Directive 12 (HSPD-12), the Department of Homeland Security requires Federal agency employees—both civilian and military (DoD)—and their contractors to use standardized Common Access Card (CAC)/Personal Identity Verification (PIV) identification to gain access to the MFDs. before a user can access the document. Federal employees are required to authenticate using their CAC/PIV prior to sending potentially sensitive information using the scan-to-e-mail, scan-to-fax, and scan-to-folder document distribution features on MFDs.

MFDs shall be capable of processing password and HSPD-12 PIV Cards for user authentication.

MFDs shall have the option of being capable of password protecting and holding jobs until the user releases them. If users do not release the job in order, the MFDs shall be capable of reordering the queue of jobs, if an unreleased job is stopping or slowing the queue.

MFDs shall have hard drive data encryption or automatically erase/overwrite content from the hard drive after each job - print, copy, scan, fax, and e-mail. Overwrite shall include, at a minimum, the capability of a three pass overwrite of the hard drive and overwrite capabilities for Fax ROM, Flash, and any other memory source where data is buffered. The method shall be described by the Contractor when selected by the Contracting Officer.

MFDs shall provide functional separation meaning physical and logical separation of facsimile functions from copy, scan, self-contained document server/repository and e-mail functions.

Contractors shall provide third party documentation that verifies or certifies the separation.

MFDs shall offer the ability to encrypt documents being faxed or e-mailed. Encryption must be compliant with FIPS 140-2 and FIPS 197 Advanced Encryption Standard (AES) 256 encryption.

MFDs shall allow access by only FEMA- approved encryption USB devices and shall disable firewire interfaces. MFDs shall be capable of disabling serial connectors and Bluetooth interfaces.

All removable memory chips or cards, optional removable hard drives with locks, and optional physical locks to secure internal parts capable of storing FEMA information shall be surrendered to an appropriate FEMA security official as determined by the Contracting Officer for destruction, upon request. Components will ensure that memory and hard drives do not leave the facility; they are to be replaced and the old part destroyed as sensitive data.

Product Configurations and Settings

MFDs shall retain their configuration state (passwords, service settings, etc.) after a power down or reboot and not reset to default settings. Administrative options and device settings shall be password protected. The default password shall be changed upon installation. New passwords shall comply with FEMA standards for length and complexity. MFDs shall limit the ability to modify administrative settings to FEMA-authorized personnel.

MFDs shall have the capability to track all jobs performed. Each job shall record the person performing/requesting the job with date and time it was performed. These job logs shall be accessible only to FEMA-authorized personnel. MFDs shall prevent users from elevating/upgrading their privileges. MFDs shall have the capability to prevent users from viewing, cancelling, or changing other users’ jobs.

The “scan to e-mail” function may be enabled to scan documents from FEMA Federal and Contractor employees with username and password or HSPD-12 access. MFDs shall be capable of requiring the user to enter a username and password before scanning, copying, faxing, or e-mailing documents from their desktop or laptop computer. MFDs shall be capable of prohibiting the anonymous creation or transmission of electronic documents. The fax module shall be configured to only allow point-to-point connections to/from other fax machines.

Product Network Protocol

MFDs shall be capable of preventing downloads from external websites. MFDs shall utilize only HTTPS for any approved web enabled services. Wireless capabilities shall be disabled on all MFDs. MFDs shall connect to the FEMA Global Address Directory and automatically update to identify authorized users in Active Directory. MFDs shall be capable of configuring only a static IP address and DNS Server address. The MFDs shall be capable of supporting 802.1x when connecting to FEMA networks.

MFDs may have built-in firewalls that limit connections to secure devices or be placed behind FEMA firewalls. MFDs shall be pre-configured to prohibit incoming fax lines from accessing the network and any data on the device, other than what is required to complete the fax.

Any multifunction device connected to a FEMA network or other information system containing sensitive data shall have the inbound dial in capabilities disabled.

Product Delivery and Installation

Delivery and installation shall be coordinated with the FEMA-designated Key Operator assigned to each location. The Contractor shall deliver and install MFDs within two weeks from the date of contract award. The Contractor shall notify the Key Operator by e-mail or phone no less than three (3) business days in advance of each installation.

Each MFD shall be permanently marked by the Contractor on the front frame with unique asset identification, to include, at a minimum: Model Number, Serial Number, and Service Telephone Number. Deliveries and installations shall be conducted Monday through Friday between the hours of 8:00am and 3:00pm (Local Time), excluding Federal holidays. Delivery and/or installation may be necessary during other hours due to building access restrictions. If the

Contractor’s proposed delivery or installation time is not acceptable to the Government, both parties shall negotiate a mutually agreeable alternate time.

Upon initial delivery, the Contractor shall provide one month’s consumable supplies for each MFD. The supplies will be stored by the Government. All Color MFDs shall be set to B&W as default.

The Contractor shall supply all cables, connectors, print servers, receptacles, and any such necessary type of accessories to provide service from available network ports to the location of the machine.

The Contractor shall provide a substitute MFD of equal or superior features/capabilities if for any reason the original model is not available. The substitute shall be approved by the Contracting Officer prior to installation. Upon approval and installation by the Contracting Officer, the substitute MFD shall permanently supersede the original contracted model. If a situation arises in which the Contracting Officer does not accept the substitute MFD to permanently replace the original contracted MFD, the Contractor shall remove the temporary machine and replace it with the MFD originally requested requirement as soon as the requested machine is available. Additional delivery and installation costs resulting from this late delivery and temporary copier placement are the responsibility of the Contractor. Note: Lease time shall not restart for substitute MFDs.

Each facility security procedures shall be followed and may require off site screening of equipment and supplies prior to delivery.

The Contractor shall be allowed to replace the MFD(s) on the contract with new technology once per ordering period. The new technology shall be approved by the Contracting Officer and COR. Under no circumstances shall FEMA incur additional costs for product upgrades, unless the cost variance is approved by the Contracting Officer and COR and incorporated via formal contract modification.

Upon approval of a product upgrade, the Contractor shall retain resources necessary to address all contract requirements for the legacy MFD(s). If resources are not available to address all requirements for the legacy MFD(s), the legacy MFD(s) shall be replaced with the Contractors’ new MFD to meet the requirements of the existing contract, at no additional cost to the Government.

Training

The Contractor shall provide training to the Key Operator for each device within five (5) business days of delivery and installation of equipment. If the Key Operator is not available during this time period, the Contractor is required to establish a mutually agreed upon alternate time to provide training at no additional cost to the Government. If a Key Operator has previously received training for a specific device, the training requirement has been fulfilled and no additional training shall be required.

Training shall include, at a minimum: how to operate the basic function keys of the MFD; location and procedures for installing consumable parts, paper, toner, staples, etc.; how to operate special features, including but not limited to: duplexing, enlarging, reducing, etc.; multiple job queues; diagnosis and resolution of basic machine malfunctions, etc. In addition, the training shall give the Key Operator the necessary knowledge on how to sanitize their devices after classified information has been exposed (copied, e-mailed, scanned, and printed) or “spilled”.

The Contractor shall provide additional training to all new Key Operators within three (3) business days of being notified of a replacement Key Operator or a new Key Operator. The Contractor shall provide access to training materials that meet the initial FEMA Key Operator training requirements for the training of new Key Operators within thirty (30) business days of contract award. Acceptable training methods include CD-ROM, web-based, and/or in-person training at no additional cost to the government. Any CD-ROM or web-based training shall be posted to the FEMA intranet and accessible by all FEMA personnel. The Contractor shall submit a request to the COR for approval to update any training materials for placement on the FEMA intranet.

Maintenance Services

The Contractor shall be responsible for maintaining these machines at a minimum of 95% availability/uptime based on the 9- hour Government business day and industry standards. The Contractor shall replace any MFD that operates at less than 95% availability/uptime for two (2) consecutive months with a MFD of equal or greater capabilities, at no cost to the Government.

The Key Operator will be the POC regarding preventive maintenance, service calls, and re- ordered consumables. The Contractor shall provide a toll-free number to process request(s) for service, training, supplies (consumables), and device support (this number shall not be an answering machine). This number shall be available during normal business hours from 8:00am to 5:00pm with respect to the time zone in which the device is located.

The Contractor shall provide maintenance service include at a minimum, installation, troubleshooting, service calls, repairs including parts and labor, scheduled preventive maintenance, and connectivity throughout the term of the contract.

The Contractor shall dispatch a technician within (30) minutes to respond to all non-critical devices requiring onsite service. Response time on a service call begins when the call (placed by phone) is received by the technician. Service calls received after normal hours of operation shall begin the following business day at 8:00am. Upon determining that an MFD cannot be repaired, the Contractor shall provide a temporary device of equal or greater capabilities within two (2) business days, at no additional cost to the Government. After the call is completed, the service technician shall contact the Key Operator to notify whether or not service was completed satisfactory. If the original MFD is not repaired within fourteen (14) calendar days, the Contractor shall provide a permanent replacement MFD of equal or greater capabilities. The Contractor shall dispatch a repair technician within thirty (30) minutes to respond to all devices requiring onsite repair service. Response time on a service call begins when the call (placed by phone) is received by the Contractor. Service calls received after normal hours of operation shall begin the following business day at 8:00am.

Meter Reads

The Contractor shall collect and submit all meter reads for leased machines and monitor monthly usage of their devices.

Consumables

The Contractor shall provide all consumable supplies (excluding paper) necessary for the continuous operation of the equipment throughout the duration of the lease. Supplies shall be delivered to the destination location within three (3) business days of receipt of the consumable request. The Contractor shall also provide FEMA the option to have supplies delivered to the destination location within two (2) business days of receipt of the consumable request, at an additional cost. Supplies shall be coordinated by the Key Operator or designated FEMA-authorized personnel.

Relocation, Removal and Disposal of Equipment

The Contractor shall provide up to one (1) relocation within twenty-five (25) miles of the previous installed location as required. The Contracting Officer will notify the Contractor of the new location and requirements (i.e. special handling.

The Contractor shall relocate leased MFDs within five (5) business days, at no additional cost to the Government. Relocations shall be coordinated with the Key Operator/FEMA-authorized personnel.

The Contractor shall remove leased MFDs within five (5) business days of the contract expiration date. Removals shall be coordinated with the Key Operator/FEMA-authorized personnel. The Contractor should notify the Key Operator/ one (1) week before the end of the rental or lease. The Government will not assume any responsibility for leased devices left at the facility beyond the contract expiration date.

CONTRACTOR PERSONNEL

Key Personnel Account Manager (or Equivalent)

The Contractor shall provide an Account Manager (or equivalent) designated as Key Personnel that shall act as the central point of contact with the Government for all program-wide technical issues. The Account Manager shall be responsible for all issue resolution, program management, and other contract support including providing comprehensive account support. The Account Manager shall be a single point of contact for the FEMA Contracting Officer and the Contracting Officer’s Representative (COR).

The Account Manager shall be available to the COR via telephone between the hours of 8:00am and 5:00pm (EDT), Monday through Friday, and shall respond to a request for discussion or resolution of technical problems within twenty-four (24) hours of notification.

Employee Identification

Contractor employees visiting Government facilities shall wear an identification badge that, at a minimum, displays the Contractor name, the employee’s photo, name, clearance-level and badge expiration date. Visiting Contractor employees shall comply with all Government escort rules and requirements. All Contractor employees shall identify themselves as Contractors when their status is not readily apparent and display all identification and visitor badges in plain view above the waist at all times.

Employee Conduct

Contractor’s employees shall comply with all applicable Government regulations, policies and procedures (e.g., fire, safety, sanitation, environmental protection, security, “off limits” areas, wearing of parts of FEMA uniforms, and possession of weapons) when visiting or working at Government facilities. The Contractor shall ensure Contractor employees present a professional appearance at all times and that their conduct shall not reflect discredit on the United States or the Federal Emergency Management Agency. The Project Manager shall ensure Contractor employees understand and abide by Federal Emergency Management Agency established rules, regulations and policies concerning safety and security.

HSAR Clause 3052.204-71 Contractor employee access.

The Contracting Officer may require the Contractor to prohibit individuals from working on the contract if the Government deems their initial or continued employment contrary to the public interest for any reason, including, but not limited to, carelessness, insubordination, incompetence, or security concerns.

(e) Work under this contract may involve access to sensitive information. Therefore, the Contractor shall not disclose, orally or in writing, any sensitive information to any person unless authorized in writing by the Contracting Officer. For those Contractor employees authorized access to sensitive information, the Contractor shall ensure that these persons receive training concerning the protection and disclosure of sensitive information both during and after contract performance.

(f) The Contractor shall include the substance of this clause in all subcontracts at any tier where the subcontractor may have access to Government facilities, sensitive information, or resources.

(End of clause)

(g) Each individual employed under the contract shall be a citizen of the United States of America, or an alien who has been lawfully admitted for permanent residence as evidenced by a Permanent Resident Card (USCIS I-551). Any exceptions must be approved by the Department’s Chief Security Officer or designee.

(h) Contractors shall identify in their proposals, the names and citizenship of all non-U.S. citizens proposed to work under the contract. Any additions or deletions of non-U.S. citizens after contract award shall also be reported to the contracting officer.

(End of clause) 3052.205-

LOCATIONS: