Attachment 1 - Statement of Work REV.pdf

STATEMENT OF WORK

FOR

PHYSICAL SECURITY CONSULTANT SERVICES

1.0 BACKGROUND

Federal Mediation and Conciliation Service (FMCS) is an independent agency of the Federal Government with approximately 220 full-time equivalent employees spread out among 18 offices (including 2 regions) and Headquarters located in the US. Each office must meet the minimum standards for Physical Security in accordance with the Interagency Security Committee (ISC) which is an organization of the Cybersecurity and Infrastructure Security Agency (CISA). The ISC provides leadership to the nonmilitary federal community supporting physical security programs to enhance the quality and effectiveness of security in and the protection of buildings and nonmilitary federal facilities in the United States.

2.0 SCOPE OF WORK

FMCS intends to award a purchase order for consulting services to support the FMCS Office of Procurement and Operational Support in improving their Physical Security program agency wide. FMCS’ facilities and/or federal leased space should adhere to ISC standards regardless of if the facility or space is government-owned, leased, or managed.

The contractor shall work directly with FMCS staff, with direct guidance from the Contracting Officer’s Representative (COR), to ensure that the following requirements are met.

• Assessment. The contractor shall conduct a gap analysis of FMCS’ Physical Security program to identify the disparity between the status quo and the best possible results based on ISC policies, standards, and best practices. The gap analysis shall identify areas for improvement and identify the resources that are required for FMCS to achieve its goals.

• Develop and/or Update Physical Security Policies and Procedures. After completion of the assessment, the contractor shall develop or modify existing policy and procedures consistent with the standards, policies, and best practices of the ISC.

• Deliver Training and Awareness. The contractor shall develop a Physical Security program guide that will serve as training or instruction to the FMCS Physical Security Specialist, Director of OPS, and Leasing Management Specialist.

• Develop Workplan for Physical Security Assessment (PSA) of FMCS Field Offices.

The contractor shall develop a plan to assess each of FMCS’ 17 field offices so that PSAs can be performed at a future time.

3.0 PERSONNEL REQUIREMENTS

1. The contractor shall have working knowledge of applicable codes, rules, and regulations (e.g., ISC, Federal Information Processing Standard (FIPS), Federal Information Security Management Act of 2014 (FISMA), etc.).

2. The contractor shall have experience identifying gaps, deficiencies, or any problems with established physical security policies and procedures.

3. The contractor shall have experience preparing PSAs and physical security plans.

4. The contractor shall have experience drafting and physical security policies and procedures.

4.0 TASKS

The contractor shall provide a full-time support specialist to assist with assessing, improving and/or developing the FMCS Physical Security program. Tasks under this contract include:

1. Project Development and Technical Support. The contractor shall effectively manage project development and provide technical support to ensure that the requirements are met. Support includes planning, managing, controlling, and communicating activities to bring about the successful completion of specific project goals and objectives. The contractor shall provide the following:

o A project schedule that tracks the milestones and activities for this contract.

o A weekly status report that contains:

Updated project schedule.

Activities worked during the reporting period.

Expected activities for the upcoming reporting period.

List of current action items, status, assignees, and due dates.

List of current risks, including priority, impacts, and mitigation strategy.

Upcoming milestones.

Any other information of interest regarding the project.

o A monthly status report that contains:

A resource utilization for the reporting period, by resource, including hours and total cost.

A cumulative accounting of resource utilization, by resource, including cumulative hours and cost.

2. Physical Security Program Requirements Assessment & Gap Analysis.

3. Physical Security Policy and Procedure. The contractor shall assist in the development and/or update of FMCS’ Physical Security policies and procedures.

4. Deliver Training and Awareness to the FMCS Physical Security Specialist, Director of OPS, and Leasing Management Specialist.

5. Develop Workplan for PSA of FMCS Field Offices.

5.0 DELIVERABLES

All contractor-written deliverables shall be clear and concise, comprehensive with respect to all relevant aspects of the subject matter, and sufficiently detailed to provide a full understanding of the conclusions contained therein. They must be thoughtfully organized and structured to ensure readability, carefully edited and free of grammar, punctuation, and spelling errors, detailed, and containing both functional and technical design requirements as required.

The contractor shall submit all written deliverables to the COR electronically unless otherwise requested to be submitted in hard copy. Additionally, the contractor shall provide an electronic copy of each deliverable to the Contracting Officer. All deliverables are considered “draft” until the contractor receives notification that they are accepted from either the COR or Contracting Officer. Draft deliverables are the initial submission for COR review and comments. The Final deliverables shall contain revisions that address the COR comments prior to submission to a wider group of stakeholders for review. The COR or Contracting Officer will provide the contractor with all approved comments from the stakeholder reviews. The contractor shall incorporate the comments into the deliverables and resubmit to the COR for final approval within two (2) weeks after the receipt of the comments.

If a deliverable due date falls on a Saturday, Sunday, or Federal holiday, the due date for that deliverable shall be the next business day.

The following deliverables are anticipated for the Base Period:

Task Number

Deliverables

1 Project Schedule 1 Weekly Status Report 1 Monthly Status Report 2 FMCS Headquarters PSA 3 FMCS Headquarters Agency Security Plan 3 Security Plan Drawings for FMCS Headquarters 3 Security System Component Spreadsheet for FMCS Headquarters 3 Security Measure Cost estimates for FMCS Headquarters 3 Specification Sheets (Security Components)

6.0 PERFORMANCE DETAILS

The Period of Performance (PoP) shall be a base period of 12 months from task order award, with two (2) 6-month option periods, which may be exercised at the discretion of the Government.

The primary place of performance will be at FMCS Headquarters, located at 250 E Street SW, Washington, DC 20427. Work may be performed at remote locations with prior approval of the Contracting Officer’s Representative (COR).

Typical work hours shall be 8:30 a.m. through 5:00 p.m. Monday through Friday (including a half hour lunch), except Federal holidays and emergency closings. Holidays are currently observed as listed below. Work performed on holidays and other non-work time is not billable unless it is specifically requested by the COR or the Contracting Officer, approved in advance, and performed on these days.

(1) New Year’s Day

(2) Martin Luther King’s Birthday

(3) President’s Day

(4) Memorial Day

(5) Juneteenth

(6) Independence Day

(7) Labor Day

(8) Columbus Day

(9) Veteran’s Day

(10) Thanksgiving Day

(11) Christmas Day

(12) Inauguration Day (every fourth year)

The contractor shall only be paid for time worked in performing the requirements of the contract. The contractor shall not be paid for time when administrative leave is granted to Federal employees and contractor personnel are not performing work for the FMCS. During administrative leave situations, the contractor shall only be paid for time worked if the COR provides advance approval for the onsite contractor performance and provides for onsite oversight by appropriate FMCS personnel at such time. If Federal employees are unavailable due to furlough, the Contracting Officer will issue direction to the contractor as to the effects of the furlough on contract performance.

The Government does not anticipate travel required to perform the tasks associated with the effort. Local travel to the duty location and parking fees will not be reimbursed.

7.0 GOVERNMENT FURNISHED PROPERTY/EQUIPMENT/FACILITIES

FMCS will provide the contractor personnel with workspace, computer, printer, software, and network access necessary to perform the work requirements.

All materials provided by the Government during this purchase order will remain the property of the Government and will be returned on completion of the purchase order. The contractor or their designated representative shall sign the required Government tracking document for the necessary supplied equipment.

8.0 ACCESS TO INFORMATION TECHNOLOGY SYSTEMS

All contractors and contractor personnel shall be subject to the same Federal laws, regulations, standards and FMCS policies as FMCS, and FMCS personnel, regarding information and information systems security. Contractors must follow policies and procedures outlined in FMCS IT Security Program to ensure appropriate security controls are in place.

A contractor shall request logical (technical) and/or physical access to FMCS information and FMCS information systems for employees, subcontractors, and affiliates only to the extent necessary: (1) to perform the services specified in the contract, (2) to perform necessary maintenance functions for electronic storage or transmission media necessary for performance of the contract, and (3) individuals must satisfy the same conditions, requirements and restrictions comparable to FMCS employees in order to access the same type of FMCS information.

9.0 FMCS INFORMATION CUSTODIAL REQUIREMENTS

Information made available to the contractor by FMCS for the performance or administration of this contract or information developed by the contractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the Contracting Officer.

FMCS information shall not be co-mingled with any other data on the contractor’s/subcontractor’s information systems/media storage systems to ensure FMCS requirements related to data protection and media sanitization can be met. FMCS also reserves the right to conduct IT resource inspections to ensure data separation and on-site inspection of information destruction/media sanitization or disposal procedures to ensure they are following FMCS policy requirements.

Prior to termination or completion of this contract, the contractor shall not destroy information received from FMCS or gathered or created by the contractor while performing this contract without prior written approval by the FMCS Contracting Officer. Any data destruction done on behalf of FMCS by a contractor must be done in accordance with National Archives and Records Administration (NARA) requirements.

The contractor shall receive, gather, store, back-up, maintain, use, disclose and dispose of FMCS information only in compliance with the terms of the contract and applicable Federal and FMCS information confidentiality and security laws, regulations, and policies. Applicable Federal information security regulations include all Federal Information Processing Standards (FIPS) and Special Publications (SP) issued by the National Institute of Standards and Technology (NIST). If Federal or FMCS information confidentiality and security laws, regulations and policies become applicable to the FMCS information or information systems after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations, and policies, including FIPS or SP, in the contract.

The contractor shall not make copies of FMCS information except as necessary to perform the terms of the agreement or to preserve electronic information stored on contractor electronic storage media for restoration in case any electronic equipment or data used by the contractor needs to be restored to an operating state.

If FMCS determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for FMCS to terminate the contract for default or terminate for cause under Federal Acquisition Regulation Part 12.

10.0 SECURITY AND CONFIDENTIALITY

The contractor must have a completed background investigation at the Tier 2 moderate risk level (formerly MBI), or higher, with a favorable adjudication. FMCS will verify this information prior to start of the contract.

11.0 PERSONNEL CONFLICTS OF INTEREST

The term "personal conflict of interest" means that a contractor employee assigned to the contract has interests which (i) may diminish his/her capacity to give impartial, technically sound, objective assistance and advice in performing this contract, (ii) may otherwise result in a biased work product under this contract, or (iii) may result in an unfair competitive advantage.

• A contractor employee shall not participate (i.e., recommend, influence, or decide) in any matters that:

• will have a direct and predictable effect on the financial interests of that employee, his/her spouse or minor child, or organization in which he/she serves as officer, director, trustee, general partner, or employee.

• will have a direct and predictable effect on the financial interests of or any person or organization with whom he/she is negotiating or has an arrangement concerning prospective employment.

• may otherwise cause a reasonable person to question his/her impartiality.