SOR-Citrix_Access_Gateway-703636.doc

Statement of Work:

Citrix Access Gateway (NetScaler) August 6, 2014 Prepared by:

United States Department of Agriculture Office of the Chief Financial Officer National Finance Center Information Technology Services Division

Table of Contents 11.0 Background

12.0 Objectives

13.0 Scope

4.0 Tasks…………………………………………………………………………………………………1

14.1 Deliverable 1: Specification Plan / Kickoff Brief

4.2 DELIVERABLE 2: CONFIGURATION . … ..….…………………………………………………2

4.3 DELIVERABLE 3: DOCUMENTATION ……….…………………………………………………...2

25.0 Security Requirements

35.1 SECURITY Personnel iDENTITY

45.2 Physical Security

46.0 Non-Disclosure Requirements

47.0 Quality Assurance

58.0 Invoices

59.0 Deliveries & Packing

610.0 Period of Performance

11.0 LOCATION…………………………………………….……………………………………..………5

1.0 Background

The United States Department of Agriculture (USDA) National Finance Center (NFC) is the operations component of the United States Department of Agriculture’s Office of the Chief Financial Officer (OCFO). The NFC provides administrative payments and collection information system services to over 120 Federal Departments, Agencies, Offices, and Bureaus.

The NFC provides payroll and personnel services to over 700,000 Federal employees. Services include biweekly payments via EFT or checks, current personnel records, and both system generated and ad-hoc reporting.

2.0 Objectives

As part of the enterprise VPN project the department has determined that the Citrix Access Gateway (NetScaler) will be the solutions for Non-Government Furnishes Equipment (GFE) access. This will provide contractual support to configure and verify the validation of non GFE equipment to NFC Network.

3.0 Scope

The scope of this Statement of Work is support to ensure that the NetScaler functions correctly in the Citrix environment. The NetScaler will need to be configured to allow Non-GFE equipment to connect to the NFC Network. It will also ensure the workstations meet the minimum virus and patch levels.

4.0 Deliverables

The NFC maintains the sole right to issue deliverable orders against this contract. The vendor may be required to provide none, any, or all of the requirements identified as deliverables in the SOW over the life of this contract.

The selected vendor/contractor will perform and work with NFC to accomplish the following Deliverables:

4.1 Deliverable 1: Specification Plan / Kickoff Brief

The kickoff meeting will be held on the first day of the engagement at NFC’s facility. The contractor’s presentation and discussions shall contain how the NetScalers are to be configured, how the equipment will meet minimum software requirements and what type of audit logs will be developed to monitor Non-GFE equipment connections.

4.2 Deliverable 2: Configuration Configure NetScaler hardware and software so that Non-GFE equipment can connect to the NFC Network. Also, validate that the workstations have the latest virus and software patches on them. All install and configuration instructions will need to be documented and a knowledge transfer to OSB.

4.3 Deliverable 2: Documentation

The Contractor shall provide technical documentation (literature, manuals, publications, etc.) provided by the OEM to any other customer for the series of components acquired under this contract.

All documentation and deliverables will be provided to the Contracting Officer’s Representative (COR) in electronic format along with one paper copy. Tables, text and drawings will be provided in Microsoft Office, Microsoft Project, or Visio readable formats.

COR: Debbie Barras www.debbie.barras@usda.gov

5.0 Security Requirements

The component parts of this effort and reports are expected to contain highly sensitive information that could act as a guide for hostile entities to cause harm to the Department’s critical infrastructure. Any such information made available in any format shall be used only for the purpose of carrying out the provisions of this agreement. Such information shall not be divulged or made known in any manner to any person. The contractor shall immediately notify the COR upon discovery of any inadvertent disclosures of information. The contractor shall not retain any information regarding vulnerabilities, to include summaries, the actual vulnerability report, etc., at the end of the task order. All information arising from this task, both hard copy and electronic, shall be returned to the government at task conclusion.

All contractor personnel working at the NFC will be subject to the same security clearances as other contractors who supply products and services. Personnel security clearances are required of all support personnel that will be working at the NFC in support of this contract. U.S. citizenship is required for all personnel working on-site. The contractor shall be responsible for obtaining the proper security clearances for its employees and/or support personnel. The USDA will accept personnel with current National Agency Check and Inquiries (NACI) clearances or comparable level clearances. The Government will not reimburse the Contractor for the preparation and processing of required security clearances.

The contractor shall not disclose sensitive or proprietary information of, or in the possession of, the United States Department of Agriculture or any of its operating units, contractors or business partners to unauthorized persons. The contractor shall be subject to any and all penalties imposed by law for unlawful disclosure of Department information.

5.1 Security – Personal Identity Verification of Contractor Employee (Oct 2007)

(a) The contractor shall comply with the personal identity verification (PIV) policies and procedures established by the Department of Agriculture (USDA) Directives 4620-002 series.

(b) Should the results of the PIV process require the exclusion of a contractor’s employee; the contracting officer will notify the contractor in writing.

(c) The contractor must appoint a representative to manage compliance with the PIV policies established by the USDA Directives 4620-002 series and to maintain a list of employees eligible for a USDA LincPass required for performance of the work.

(d) The responsibility of maintaining a sufficient workforce remains with the contractor. Employees may be barred by the Government from performance of work should they be found ineligible or to have lost eligibility for a USDA LincPass. Failure to maintain a sufficient workforce of employees eligible for a USDA LincPass may be grounds for termination of the contract.

(e) The contractor shall insert this clause in all subcontracts when the subcontractor is required to have routine physical access to a Federally-controlled facility and/or routine access to a Federally-controlled information system.

(f) The PIV Sponsor for this contract is a designated program point of contact, which in most cases is the Contracting Officer Representative (COR), unless otherwise specified in this contract. The PIV Sponsor will be available to receive contractor identity information from * (hours and days) to * (hours and days) at * (office address for registration). The Government will notify the contractor if there is a change in the PIV Sponsor, the office address, or the office hours for registration; however, it is the contractor’s responsibility to meet all aspects of paragraphs (c), (d), and (e).

5.2 Physical Security

The Contractor must be responsible for safeguarding all government property provided for the Contractor use. At the end of each work period, all government facilities, equipment, and materials must be secured.

If any Contractor-provided equipment proposed requires a modem for call back, upgrade, or troubleshooting purposes; the proposal shall include a modem's security features, including password protection, to access the system and any security measures to protect the equipment from hackers or intrusion.

6.0 Non-Disclosure Requirements

The contractor personnel assisting NFC with the activities described above may be exposed to business sensitive information regarding NFC system development efforts or data. The contractor agrees in performing work under this order not to disclose any data or information related to this effort outside official NFC channels without prior written approval of the Contracting Officer.

7.0 Quality Assurance

The Contractor shall be solely responsible for the supervision, management, and inspection of its employees under this Work Statement. The Contractor will monitor and ensure its employees meet the requirements of this Work Statement. The Contractor shall provide and maintain an inspection system acceptable to the Government covering services provided under this Work Statement.

Any incidents that cannot be resolved by the Contractor in a timely manner will be identified and referred to the COTR.

The Program Manager will provide for technical monitoring on an on-going basis and accept or recommend rejection of services and deliverables.

8.0 Invoices

Invoice Instructions:

All invoices must be submitted via the electronic Invoice Processing Platform. This is a mandatory requirement initiated by the U.S. Department of Treasury and you can find more information at this website https://www.ipp.gov/index.htm. Please make sure that your company register at https://www.ipp.gov/vendors/enrollment-vendors.htm to establish your account.

Payment Status:

NFC’s Vendor Payment department at 1-504-426-6510 All travel will be pre-approved by NFC’s COR. Travel expenses will be reimbursed in accordance with Federal Travel Regulations. Travel vouchers and receipts shall be submitted with invoices. Invoices may be submitted as contract line items and associated deliverables are accepted by the COR. All invoices will be submitted electronically via email to the COR with a concurrent copy transmitted to the CO. Email addresses will be provided to the contractor on an as needed basis.

IPP Approver: Debbie Barras www.debbie.barras@usda.gov

9.0 Deliveries & Packing

All packages, regardless of the number of packages in the shipment, shall contain a packing slip identifying the contents of that package, how many packages are in the shipment, and the contract/order number, as well as, the ITACQ number. Shipments that do not adhere to these packing instructions may be returned to sender at the sender’s expense.

The Contractor shall notify the USDA COR at least one day in advance to provide the following required information:

· ETA for arrival at the site (Shipments are only accepted Monday – Friday 6 AM to 6 PM.)

· Transportation company's name

Shipping Instructions:

Ship goods to: USDA/National Finance Center

Attn: ITSD/CRMB/Leroi Stovall

4301 Poche Court, West

New Orleans, LA 70129

10.0 Period of Performance

The period of performance will be from date of award plus 60 days.

11.0 Location

The work will occur at the following located at:

National Finance Center Building 350 13800 Old Gentilly Road, New Orleans, LA 70129

Attn: Debbie Barras

PAGE