STATEMENT_OF_WORK.pdf

STATEMENT OF WORK

1.1 BACKGROUND

This requirement is in support of the Federal Emergency Management Agency (FEMA), Office of the Chief Administrative Office (OCAO), Support Services and Facilities Management Division, for Multi-functional Devices (MFDs) (i.e. Copier/All-in-One machines) using the DHS Blanket Purchase Agreements (BPAs). The purpose of this acquisition is to provide Federal Emergency Management Agency (FEMA) with the ability to purchase and lease MFDs.

This effort shall replace the current inventory of copiers and add new MFDs as existing purchase agreements expire, disposal of obsolete equipment occurs, and customers add new requirements for all FEMA locations in the U.S., District of Columbia, and U.S. territories.

For the purpose of this SOW, the terms MFDs, device, model, machine, and equipment are used interchangeably.

1.2 SCOPE OF WORK

The Contractor shall provide the following services:

Product Training Maintenance Services Meter Reads Consumables Relocation and Disposal of Equipment

1.3 GOVERNMENT TERMS & DEFINITIONS

Active Directory: A central component of the Windows platform, Active Directory service provides the means to manage the identities and relationships that make up network environments. Windows Server 2003 makes Active Directory simpler to manage, easing migration and deployment. Integrated with Windows Server 2008 R2, Active Directory gives the organization out-of-the-box functionality needed to centrally configure and administer system, user, and application settings.

Classified Information: Means any knowledge that can be communicated or any documentary material, regardless of its physical form or characteristics, that— (1)(i) Is owned by, is produced by or for, or is under the control of the United States

Government; or

(ii) Has been classified by the Department of Energy as privately generated restricted data following the procedures in 10 CFR 1045.21; and

(2) Shall be protected against unauthorized disclosure according to Executive Order 12958, Classified National Security Information, April 17, 1995, or classified in accordance with the Atomic Energy Act of 1954.

HSPD-12 PIV Cards: Homeland Security Presidential Directive 12 (HSPD-12) dated August 27, 2004, entitled “Policy for a Common Identification Standard for Federal Employees and Contractors,” directed the promulgation of a Federal standard for secure and reliable forms of identification for Federal employees and Contractors. It further specified secure and reliable identification that is issued based on sound criteria for verifying an individual employee’s identity, strongly resistant to identity fraud, tampering, counterfeiting, and terrorist exploitation, can be rapidly authenticated electronically and is issued only by providers whose reliability has been established by an official accreditation process.

Key Operator: A Government designee of the requiring activity assigned to order supplies, place service calls, and manage the operation and administrative settings for each MFD to which they are assigned. They shall also be the primary contact for service calls and supply reordering.

National Institutes of Standards and Technology (NIST): A non-regulatory federal agency within the U.S. Department of Commerce. NIST's mission is to promote U.S. innovation and industrial competitiveness by advancing measurement science, standards, and technology in ways that enhance economic security and improve our quality of life.

5.4 REQUIREMENTS

5.4.1 Product

The Contractor shall provide Multi-Functional Devices (MFDs) and ancillary products with the following specifications:

• Ability to print, scan, copy, fax, and e-mail both color and black and white documents;

• Ability to connect to the FEMA network;

• Two or Three Drawer paper storage;

• Functional Separation (physical and logical separation of facsimile functions from copy, scan, self-contained document server/repository and e-mail functions.);

• Automatic document feeder;

• Keypad or Touch Screen;

• Self-diagnostic system which indicates at a minimum, the following conditions: needs toner, needs paper and paper jam

• Energy Star Compliant;

• Printer Control Language (PCL) and Post Script (PS) printer languages;

• Security Data Kits;

• Capability for user authentication from HSPD-12 PIV card readers and user login and password; and

• Capability for data overwrite and controlling user access.

• Ability to handle letter (8 ½ x 11), legal (8 ½ x 14), and the optional accessory 11” x 17” paper sizes, with adjustable paper trays

• Ability to function with recycled paper;

• Optional Hard drive (if needed for machine functionality);

• Optional capability to sort, collate, duplex, staple, hole punch, and make booklet;

• Newly manufactured equipment

The Contractor shall provide MFDs models in accordance with the following Bands levels:

Band Level Black and White Color

Band A (20-29 PPM) X X Band B (30-39 PPM) X X Band C (40-49 PPM) X X Band D (50-59 PPM) X X Band E (60-69 PPM) X

Figure 3: Band Level Chart

5.4.2 Product Documentation

FEMA will provide Sensitive Systems Configuration Guidance, which includes multiple documents, to Contractors that are applicable to their MFD operating systems, unless those systems use a proprietary software or operating system that is not familiar to FEMA.

Networked machines will not be used in classified environments.

The Contractor shall provide security, configuration, specification, and technical information (including the extent of warranty coverage) documentation. The Contractor shall provide a list of proprietary and Contractor-specific software and licenses (i.e., registered, protected by trademark, or copyright). The Contractor shall provide definitions of those terms along with a translation to industry or Government standard terminology. The Contractor shall provide documentation to describe how they provide security features training, inclusive of documentation for all types or names of user identifiers. For example the device may include user identifiers such as “Administrator”, “Admin”, “Supervisor”, “guest” or “visitor”, which come with default passwords.

The Contractor shall provide documentation describing how the MFDs shall:

• Support Government mandated requirements for Role Based Authentication Controls, including but not limited to: the numbers and levels of User IDs and discretionary access controls (Key Operators, Backup Key Operators, System Administrators, Users);

• Comply with and support the DHS Rules of Behavior, Attachment G DHS Sensitive

Systems Handbook, Version 7.1, November 13, 2009 (see Attachment 5);

• Be protected from unauthorized printing as defined by the Ordering Activity;

• Install the most recent version of Firmware, operating system, service, and application security software updates without jeopardizing the security of the machine or network it is attached to;

• Install patches (or document why patching is not necessary); and comply with the technical requirements set forth in NIST SP 800-53 (the document is available at this link: http://csrc.nist.gov/publications/nistpubs/800-53-Rev2/sp800-53-rev2-final.pdf).

http://csrc.nist.gov/publications/nistpubs/800-53-Rev2/sp800-53-rev2-final.pdf

The Contractor shall provide guidance and assist FEMA to comply with NIST SP 800-53 managerial and operational requirements with the proposed machines, including documenting the necessity or lack of necessity to install patches. The Contractor shall provide documentation to describe how DHS may be able to override or disable commonly known and published defaults, including role based authentication codes controls, such as User IDs, passwords and discretionary access controls. The Contractor shall provide documentation describing any unique security features or controls or experience with other Government agencies that enhance the ability to remove or mitigate classified and sensitive document exposures.

5.4.3 Product Hardware and Software

MFDs shall be subject to FEMA specific software/hardware evaluation process. If the MFD(s) fails security evaluations, the Contractor shall select a new technology or mitigate the failed controls to fulfill this requirement. The Contractor shall be available to meet with IT and security personnel at a mutually convenient time during the evaluation process. The Contractor shall provide the necessary equipment or expertise to complete security testing or integration into the existing FEMA Certified and Accredited enclave. Evaluation may take place at the Contractor’s lab or onsite at FEMA location(s).

MFDs shall have hard drive data encryption or automatically erase/overwrite content from the hard drive after each job - print, copy, scan, fax, and e-mail. Overwrite shall include, at a minimum, the capability of a three pass overwrite of the hard drive and overwrite capabilities for Fax ROM, Flash, and any other memory source where data is buffered. The method shall be described by the Contractor when selected by the Ordering Activity.

MFDs shall be capable of processing password and HSPD-12 PIV Cards for user authentication.

MFDs shall have the option of being capable of password protecting and holding jobs until the user releases them. If users do not release the job in order, the MFDs shall be capable of reordering the queue of jobs, if an unreleased job is stopping or slowing the queue.

MFDs shall provide functional separation meaning physical and logical separation of facsimile functions from copy, scan, self-contained document server/repository and e-mail functions.

Contractors shall provide third party documentation that verifies or certifies the separation.

MFDs shall offer the ability to encrypt documents being faxed or e-mailed. Encryption must be compliant with FIPS 140-2 and FIPS 197 Advanced Encryption Standard (AES) 256 encryption.

MFDs shall allow access by only FEMA approved encryption USB devices and shall disable firewire interfaces. MFDs shall be capable of disabling serial connectors and Bluetooth interfaces.

All removable memory chips or cards, optional removable hard drives with locks, and optional physical locks to secure internal parts capable of storing FEMA information shall be surrendered to an appropriate FEMA security official as determined by the Ordering Activity for destruction, upon request. Components will ensure that memory and hard drives do not leave the facility; they are to be replaced and the old part destroyed as sensitive data.

5.4.4 Product Configurations and Settings

MFDs shall retain their configuration state (passwords, service settings, etc.) after a power down or reboot and not reset to default settings. Administrative options and device settings shall be password protected. The default password shall be changed upon installation. New passwords shall comply with FEMA standards for length and complexity. MFDs shall limit the ability to modify administrative settings to FEMA-authorized personnel.

MFDs shall have the optional capability, based on Ordering Activity requirements, to track all jobs performed. Each job shall record the person performing/requesting the job with date and time it was performed. These job logs shall be accessible only to FEMA-authorized personnel.

MFDs shall prevent users from elevating/upgrading their privileges. MFDs shall have the capability to prevent users from viewing, cancelling, or changing other users’ jobs.

The “scan to e-mail” function may be enabled to scan documents from FEMA Federal and Contractor employees with username and password or HSPD-12 access. MFDs shall be capable of requiring the user to enter a username and password before scanning, copying, faxing, or e-mailing documents from their desktop or laptop computer. MFDs shall be capable of prohibiting the anonymous creation or transmission of electronic documents. The fax module shall be configured to only allow point-to-point connections to/from other fax machines.

5.4.5 Product Network Protocol

MFDs shall be capable of preventing downloads from external websites. MFDs shall utilize only HTTPS for any approved web enabled services. Wireless capabilities shall be disabled on all MFDs. MFDs shall connect to the DHS Global Address Directory and automatically update to identify authorized users in Active Directory. MFDs shall be capable of configuring only a static IP address and DNS Server address. The MFDs shall be capable of supporting 802.1x when connecting to DHS networks.

MFDs may have built-in firewalls that limit connections to secure devices or be placed behind FEMA firewalls. MFDs shall be pre-configured to prohibit incoming fax lines from accessing the network and any data on the device, other than what is required to complete the fax.

Any multifunction device connected to a FEMA network or other information system containing sensitive data shall have the inbound dial in capabilities disabled.

5.4.6 Product Delivery and Installation

Delivery and installation shall be coordinated with the Key Operator assigned to each device.

The Contractor shall deliver and install MFDs within thirty (30) calendar days from the date of award for each Delivery Order. The Contractor shall notify the Key Operator by e-mail or phone no less than three (3) business days in advance of each installation.

Each MFD shall be permanently marked by the Contractor on the front frame with unique asset identification, to include, at a minimum: Model Number, Serial Number, and Service Telephone Number. Deliveries and installations shall be conducted Monday through Friday between the hours of 8:00am and 3:00pm (Local Time), excluding Federal holidays. Delivery and/or installation may be necessary during other hours due to building access restrictions. If the

Contractor’s proposed delivery or installation time is not acceptable to the Government, both parties shall negotiate a mutually agreeable alternate time.

Upon initial delivery, the Contractor shall provide one month’s consumable supplies for each MFD. The supplies will be stored by the Government. All Color MFDs shall be set to B&W as default.

The Contractor shall supply all cables, connectors, print servers, receptacles, and any such necessary type of accessories to provide service from available network ports to the location of the machine.

The Contractor shall provide a substitute MFD of equal or superior features/capabilities if for any reason the original model is not available. The substitute shall be approved by the Ordering Activity prior to installation. Upon approval and installation by the Ordering Activity, the substitute MFD shall permanently supersede the original contracted model. If a situation arises in which the Ordering Activity does not accept the substitute MFD to permanently replace the original contracted MFD, the Contractor shall remove the temporary machine and replace it with the originally requested requirement as soon as the requested machine is available. Additional delivery and installation costs resulting from this late delivery and temporary copier placement are the responsibility of the Contractor. Note: Lease time shall not restart for substitute MFDs.

Each Ordering Activity and facility security procedures shall be followed and may require off site screening of equipment and supplies prior to delivery. Specific Ordering Activity and building security screening procedures will be identified, per Delivery Order, prior to award. If security procedures result in an additional cost to the Government, the Contractor shall immediately notify the Delivery Order Contracting Officer in writing.

The Contractor shall provide an Installation Report at the Delivery Order level to the Key Operator and COR within ten (10) calendar days from the date of installation for each MFD. The Installation Report shall include, at a minimum: DHS BPA number, Delivery Order Number, Device Manufacturer, Model Number, Serial Number, and Placement Location (including room number, building number, Component name, office name, customer’s name and phone number, the name and job title of the individual installing the device, and the Key Operator’s signature of installation approval with the date and item number of the Delivery Order).

5.4.7 Product Upgrade

The Contractor shall ensure continuity and availability of all products under the terms and conditions of the BPA. When a Contractors’ device is no longer available (e.g., discontinued production), the Contractor shall propose a replacement device, of equal or greater capabilities/value, consisting of all new parts and current manufacturing production parts.

The Contractor shall be allowed to replace the MFD(s) on the BPA with new technology once per ordering period. The new technology shall be approved by the Contracting Officer and COR. Under no circumstances shall FEMA incur additional costs for product upgrades, unless the cost variance is approved by the Contracting Officer and COR and incorporated via formal contract modification.

Upon approval of a product upgrade, the Contractor shall retain resources necessary to address all Delivery Order requirements for the legacy MFD(s). If resources are not available to address all requirements for the legacy MFD(s), the legacy MFD(s) shall be replaced with the Contractors’ new MFD to meet the requirements of the existing Delivery Order, at no additional cost to the Government.

Equipment that is upgraded shall not be assessed a termination penalty, nor be subject to any terms and conditions less favorable than those under the lease for the current MFD(s).

5.4.8 Training

The Contractor shall provide training to the Key Operator for each device within five (5) business days of delivery and installation of equipment. If the Key Operator is not available during this time period, the Contractor is required to establish a mutually agreed upon alternate time to provide training at no additional cost to the Government. If a Key Operator has previously received training for a specific device, the training requirement has been fulfilled and no additional training shall be required.

Training shall include, at a minimum: how to operate the basic function keys of the MFD; location and procedures for installing consumable parts, paper, toner, staples, etc.; how to operate special features, including but not limited to: duplexing, enlarging, reducing, etc.; multiple job queues; diagnosis and resolution of basic machine malfunctions, etc. In addition, the training shall give the Key Operator the necessary knowledge on how to sanitize their devices after classified information has been exposed (copied, e-mailed, scanned, and printed) or “spilled”.

The Contractor shall provide additional training to all new Key Operators within three (3) business days of being notified of a replacement Key Operator or a new Key Operator. The Contractor shall provide access to training materials that meet the initial FEMA Key Operator training requirements for the training of new Key Operators within thirty (30) business days of contract award. Acceptable training methods include CD-ROM, web-based, and/or in-person training at no additional cost to the government. Any CD-ROM or web-based training shall be posted to the DHS intranet and accessible by all DHS personnel. The Contractor shall submit a request to the COR for approval to update any training materials for placement on the FEMA intranet.

5.4.9 Maintenance Services

For all machines covered by a maintenance agreement, the Contractor shall be responsible for maintaining these machines at a minimum of 95% monthly availability/uptime based on the 9- hour Government business day and industry standards. The Key Operator will monitor and measure availability based on data obtained through online reporting. The Contractor shall replace any MFD that operates at less than 95% availability/uptime for two (2) consecutive months with a MFD of equal or greater capabilities, at no cost to the Government.

The Key Operator will be the POC regarding preventive maintenance, service calls, and re- ordered consumables. The Contractor shall provide a toll-free number to process request(s) for service, training, supplies (consumables), and device support (this number shall not be an answering machine). This number shall be available during normal business hours from 8:00am to 5:00pm with respect to the time zone in which the device is located.

The Contractor shall provide maintenance service to leased, and purchased devices to include at a minimum, installation, troubleshooting, service calls, repairs including parts and labor, scheduled preventive maintenance, and connectivity throughout the term of each Delivery Order.

The Contractor shall provide at a minimum, yearly service calls as a preventive maintenance service for machines covered by a maintenance agreement to ensure that the machines furnished are maintained in good working condition at no additional cost to the Government. Such preventive maintenance shall be in accordance with the manufacturer’s recommendations and shall be equal to maintenance which is provided to commercial customers for the same models of MFDs.

The Contractor shall dispatch a technician within four (30) minutes to respond to all non-critical devices requiring onsite service. Response time on a service call begins when the call (placed by phone) is received by the technician. Service calls received after normal hours of operation shall begin the following business day at 8:00am. Upon determining that an MFD cannot be repaired, the Contractor shall provide a temporary device of equal or greater capabilities within two (2) business days, at no additional cost to the Government. After the call is completed, the service technician shall contact the Key Operator to notify whether or not service was completed satisfactory.

If the original MFD is not repaired within fourteen (14) calendar days, the Contractor shall provide a permanent replacement MFD of equal or greater capabilities.

Devices for “critical use” shall be identified in the Request for Delivery Order Quotation by the Delivery Order Contracting Officer. The Contractor shall dispatch a technician within two (2) hours for devices designated for “critical use” requiring onsite service, at an additional cost. If a device for “critical use” cannot be restored to its fully operational state, the Contractor shall install a substitute device within one (1) business day of the service response, at an additional cost to the Government. Devices for “critical use” may require maintenance on Government holidays. The Contractor may be required to interact with personnel that provide Information Technology help desk support.

5.4.10 Repairs

The Contractor shall propose discounts for repairs for purchased equipment offered under this BPA and not covered under a maintenance service agreement. This includes related attachments, supplies and accessories.

The Contractor shall dispatch a repair technician within thirty (30) minutes to respond to all non-critical purchased devices requiring onsite repair service. Response time on a service call begins when the call (placed by phone) is received by the

Contractor. Service calls received after normal hours of operation shall begin the following business day at 8:00am. The Contractor shall dispatch a repair technician within two (2) hours for purchased devices designated for “critical use” requiring onsite repair service, at an additional cost.

5.4.11 Meter Reads

The Contractor shall collect and submit all meter reads for leased machines. The ordering activity will monitor the monthly usage of their devices.

5.4.12 Consumables

For machines that are leased or fall under a consumable agreement, the Contractor shall provide all consumable supplies (excluding paper) necessary for the continuous operation of the equipment throughout the duration of the lease or consumable agreement. Supplies shall be delivered to the destination location within three (3) to five (5) business days of receipt of the consumable request. The Contractor shall also provide FEMA the option to have supplies delivered to the destination location within two (2) business days of receipt of the consumable request, at an additional cost. Supplies shall be delivered to the designated locations listed in the Delivery Order and coordinated by the Key Operator or designated FEMA-authorized personnel.

5.4.13 Relocation, Removal and Disposal of Equipment

The Contractor shall provide one (1) relocation per year within twenty-five (25) miles of the previous installed location when the equipment is located in the 50 states of the United States and in the District of Columbia. The Delivery Order Contracting Officer will notify the Contractor of the new location and requirements (i.e. special rigging) via contract modification. Upon receipt of the contract modification, the Contractor shall relocate leased MFDs within five (5) business days, at no additional cost to the Government. Relocations shall be coordinated with the Key Operator/DHS-authorized personnel.

The Contractor shall remove leased MFDs within five (5) business days of the Delivery Order expiration date, at no additional cost to the Government. Removals shall be coordinated with the Key Operator/DHS-authorized personnel. The Contractor should notify the Key Operator/DHS- authorized personnel of a removal one (1) month before the end of the rental or lease. The Government will not assume any responsibility for leased devices left at the facility beyond the Delivery Order expiration date.

The Contractor shall provide a removal report to the COR and Key Operator upon removal of each leased device. This report shall include at a minimum: serial number(s), model, BPA number, Delivery Order number and expiration date, and a description of how the device was sanitized to remove residual FEMA information.

The Contractor shall assess the salvage value of purchased equipment at the end of its useful life based on its current retail value. This equipment can be returned to the Contractor and the assessed salvage value can be used to offset the purchase price of a new machine.

5.5 CONTRACTOR PERSONNEL

5.5.1 Key Personnel Account Manager (or Equivalent)

The Contractor shall provide an Account Manager (or equivalent) designated as Key Personnel that shall act as the central point of contact with the Government for all program-wide technical issues, and will represent the Contractor at all post-award status meetings. The Account Manager shall be responsible for all issue resolution, program management, and other contract support including providing comprehensive account support for the BPA. The Account Manager shall be a single point of contact for the FEMA Contracting Officer and the Contracting Officer’s Representative (COR). The Account Manager shall have a minimum of five (5) years of experience. Requirements for this key position are to:

• Manage and oversee work performance of one or more delivery orders;

• Plan, manage and oversee the work efforts of team personnel;

• Interface with the Government to ensure client satisfaction;

• Determine and monitor delivery order schedules;

• Ensure compliance with all BPA and subsequent delivery order requirements and quality standards;

• Provide guidance, direction and ultimate management for the Purchase Order, and reviews all products and services for conformance to Government requirements.

The Account Manager shall be available to the COR via telephone between the hours of 8:00am and 5:00pm (EDT), Monday through Friday, and shall respond to a request for discussion or resolution of technical problems within twenty-four (24) hours of notification.

The name of the Account Manager, and the name(s) of any alternate(s) who shall act for the Contractor in the absence of the Account Manager, shall be provided to the Government. The Account Manager is further designated as Key by the Government.

During any absence of the Account Manager, only one alternate shall have full authority to act for the Contractor on all matters relating to work performed under this contract. Additionally, the Contractor shall not replace the Account Manager without prior approval from the Contracting Officer.

5.5.2 Replacement of Key Personnel

Before replacing any individual designated as Key by the Government, the Contractor shall notify the FEMA Contracting Officer no less than fifteen (15) business days in advance, submit written justification for replacement, and provide the name and qualifications of any proposed substitute. All proposed substitutes shall possess qualifications equal to or superior to those of the Key person being replaced.

The Contractor shall not replace Key Contractor personnel without approval from the FEMA Contracting Officer.

5.5.3 Employee Identification

Contractor employees visiting Government facilities shall wear an identification badge that, at a minimum, displays the Contractor name, the employee’s photo, name, clearance-level and badge expiration date. Visiting Contractor employees shall comply with all Government escort rules and requirements. All Contractor employees shall identify themselves as Contractors when their status is not readily apparent and display all identification and visitor badges in plain view above the waist at all times.

5.5.4 Employee Conduct

Contractor’s employees shall comply with all applicable Government regulations, policies and procedures (e.g., fire, safety, sanitation, environmental protection, security, “off limits” areas, wearing of parts of FEMA uniforms, and possession of weapons) when visiting or working at Government facilities. The Contractor shall ensure Contractor employees present a professional appearance at all times and that their conduct shall not reflect discredit on the United States or the Federal Emergency Management Agency. The Project Manager shall ensure Contractor employees understand and abide by Federal Emergency Management Agency established rules, regulations and policies concerning safety and security.

5.5.5 Removing Employees for Misconduct or Security Reasons

The Government may, at its sole discretion (via the Delivery Order Contracting Officer), direct the Contractor to remove any Contractor employee from DHS facilities for misconduct or security reasons. Removal does not relieve the Contractor of the responsibility to continue providing the services required under the contract. The Delivery Order Contracting Officer will provide the Contractor with a written explanation to support any request to remove an employee.

LOCATIONS: