Att 7 - Standards and AQL Spreadsheet.xlsx

Sheet1 PWS Para PWS Requirement STD AQL

C.5.2.1.1.5 Respond to, determine action to be taken, and take appropriate action to resolve customer problems dealing with hardware, software, and communications or escalate problems to a higher level IT representative IAW each organization’s IT policy or test mission requirement. The Very Important Persons (VIP) list will be provided by the COR on TO start date. Accurate and timely technical assistance with hardware, software, and communications Acceptable performance of task requires the contractor to respond to non-VIPs 75% of the time within two work hours and provide solutions or work- arounds within eight work hours. Acceptable performance of task requires the contractor to respond to VIPs 90% of the time within 60 minutes and provide solutions or work-arounds within two clock hours

C.5.2.1.9.3 Provide remediation of all VTC components following release of vulnerability notifications, within the mandated compliance window. Provide instructions and accurate and timely technical assistance to users for VTC systems and components. Acceptable performance of task requires the contractor to respond and/or provide work-arounds 95% of the time within 30 minutes for VIPs. For non-VIPs, respond and/or provide work-arounds 90% of the time within one work hour.

C.5.2.2.2 Network Improvement Management. The contractor shall be responsible for assisting the Government in improving network configuration, capacity, performance and management. The contract shall participate in change management processes, problem solving, capacity planning and deployments of equipment and software to the network. This responsibility requires that the contractor be able to effectively coordinate and communicate both horizontally and vertically with all ATEC organizational elements. The contractor is responsible for supporting remote access services, intranet services, internet access, network communications infrastructure (e.g. hubs, switches, routers, dedicated long-haul circuits, web and application proxies, firewalls, intrusion detection, virtual private network (VPN) configuration and communication, as well as and file and print services. The contractor may be required to lay wiring/cable above and below ground, in conduits and manholes, to support and improve network operations. Monitor current network operations and deploy changes in accordance with local policy Acceptable performance of task requires the contractor to monitor network availability 100% of the time. Provide outage reports to the Government within 30 minutes of initial identification during business hours and 12 hours during non-duty hours. Also notify the Government within 30 minutes of issue resolution during business hours or 12 hours during non-duty hours.

C.5.2.4.1 The contractor shall configure and operate a centrally managed network consisting of Government-furnished communication circuits, communication equipment, network software, and certain diagnostic equipment. The contractor shall, as a minimum, diagnose problems on the network, ensure timely resolution of problems, monitor the network for connectivity to LANs/Wide Area Networks (WANs), maintain all network system software configurations, etc. Accurate and timely configuration management services on all hardware, software and communications 100% of changes documented and executed IAW local CM policy/procedures.

C.5.2.5.4.1 UPS. The contractor shall provide routine checks on the UPS. The contractor shall monitor the serviceability of the UPS, to include battery life cycle. Routine checks include periodically reviewing the battery management monitoring system to identify faulty batteries, conducting quarterly visual checks on the overall health of the battery system, and immediately reporting any deficiencies that may cause the batteries to fail. Examples of deficiencies are the ambient temperature being above 77 degrees in the UPS room or a chemical/acid smell is coming from the batteries. The contractor shall alert the Government when monitoring alerts indicate any of the following: Communication lost with the UPS is greater than two (2) minutes, the UPS is switched to battery power, Utility power has failed length of time till the AC power has been restored, he UPS bypass is unavailable, a "UPS Notice Condition" exists, a "Replace Battery Warning Condition" exists. Monitor routine checks on the UPS Acceptable performance of task requires the contractor to maintain records of test results/corrective actions and provide results of these checks within three (3) work days 90% of the time

C.5.3.13.2 Manage and administer Storage Area Network (SAN), file application, and database servers as directed by Government. Accurate and timely management and administration of SAN, file, application, and database servers. Acceptable performance of task requires the contractor to ensure system availability with 95% of the time for operational uptime. Any outage under the 95% threshold will be reported to the Government "within 30 minutes during business hours and within 12 hours during non-duty hours as to notifying the user community.

C.5.3.13.16.4 Cybersecurity Risk Management Framework Accreditation Management. The contractor shall support the ISSM-O in the creation and maintenance all required policies, procedures, diagrams, hardware/software listings, and all other necessary artifacts required to obtain and maintain ATOs for at least two ATEC HQ system accreditations. All ATEC HQ system accreditations will be created and maintained in accordance with all DoD, Army, ARCYBER, NETCOM, and ATEC EXORDS, OPORDS, FRAGORDS, policies, standards, regulations, guidance, BBPs, and TTPs. ATEC HQ system artifacts created will pass all assessments with no critical, high, or moderate level findings.

C.5.3.13.16.5 Provide support to the ATEC ISSM-P, as required, in reviewing approval packages for all ATEC systems present in eMASS. Packages submitted for ISSM-P approval that require review will be provided to the ISSM-P for approval only when Assessment and Authorization Approval packages, Security Plan Approval packages, and POA&M Approval packages are compliant with all DoD, Army, ARCYBER, NETCOM, and ATEC EXORDS, OPORDS, FRAGORDS, policies, standards, regulations, guidance, BBPs, and TTPs. Timeline for review completion will be dictated by the ISSM-P, but at a maximum shall not exceed three working days for A&A packages or Security Plan packages, and one working day for POA&M packages.

C.5.3.13.16.6 LAN/System Management. The contractor shall perform all compliance activities in support of all ATEC HQ systems to include, but not limited to: Incident Response, Vulnerability Scanning/Audits, STIG compliance checking, Configuration Management, Host Based Security Solution/Endpoint Security Solution, Network Access Control, POA&M creation. All activities are completed in accordance with all DoD, Army, ARCYBER, NETCOM, and ATEC EXORDS, OPORDS, FRAGORDS, policies, standards, regulations, guidance, BBPs, and TTPs. System compliance in all areas meets requirements set forth in all DoD, Army, ARCYBER, NETCOM, and ATEC EXORDS, OPORDS, FRAGORDS, policies, timelines, standards, regulations, guidance, BBPs, and TTPs. An audit of these areas would not result in any critical, high, or medium deficiencies.

C.5.3.13.17.2 Develop threat models to assist developers with identifying mitigations/remediations. Applications are assessed and code is scanned, reviewed, and mitigated/remediated in accordance with all DoD, Army, ARCYBER, NETCOM, and ATEC EXORDS, OPORDS, FRAGORDS, policies, standards, regulations, guidance, BBPs, and TTPs. Application assessments are required within 2 weeks of assignment and code reviews, to include mitigation/remediation recommendations, must occur within 1 week of assignment. Assess all applications prior to installation onto ATEC systems for misconfigurations, vulnerabilities, and other potential risks.

C.5.3.13.18 Cybersecurity Assessment Team. The contractor shall participate on the Cybersecurity Assessment Team to assess systems and network security for ATEC’s open networks, standalone information systems, closed restricted networks, and, as part of the Organizational Inspection Program. The contractor shall perform assessments and provide evidence to support a certifier’s recommendation based on impact and severity to determine operational risk. The contractor shall prepare validation artifacts to support the scorecard and test results, and base all findings on DoD, Army, ARCYBER, NETCOM, ATEC, or other applicable standard, to include laws, regulations, policies, [etc.]. All assessments and compliance standards are in accordance with all DoD, Army, ARCYBER, NETCOM, and ATEC EXORDS, OPORDS, FRAGORDS, policies, timelines, standards, regulations, guidance, BBPs, and TTPs. 100% of ATEC systems/networks are assessed as required by regulation or at the direction of the government. Compliance determinations align with requirement and supporting artifacts reviewed when validated by the government lead.

C.5.3.13.19 Workforce In-Processing/Training and Certification Management. The contractor shall do a compliance review along with approval or rejection of requests for all ATEC HQ account creation, modification, and deletion requests. The contractor shall manage and audit all ATEC user accounts within the Army mandated training and certification tool. Account creation, modification, deletion, and management will be in accordance with all DoD, Army, ARCYBER, NETCOM, and ATEC EXORDS, OPORDS, FRAGORDS, policies, standards, regulations, guidance, BBPs, and TTPs. Audits of user accounts will not result in any critical, high, or medium deficiencies as defined in DoD, Army, ARCYBER, NETCOM, and ATEC EXORDS, OPORDS, FRAGORDS, policies, timelines, standards, regulations, guidance, BBPs, and TTPs. Account creation, modification, and deletion requests are closed within 24 hours of receipt

C.5.3.13.20 Cybersecurity Hygiene Reporting. The contractor shall provide the government with the ATEC HQ asset, user, and compliance data required for completion of the ATEC HQ portion of the DoD Cybersecurity Hygiene Scorecard utilizing the Army mandated reporting portal Data is provided monthly to the government on a date determined by the government. Data provided is consistent with actual assets, users, and compliance present on ATEC HQ systems and networks. The provided data will match actuals when validated by the government 100% of the time

C.5.3.13.21 Removable Media Management. The contractor shall manage the issuance, distribution, and tracking of all removable media being used at ATEC HQ, AEC. Data logs will be collected from all ATEC HQ, AEC (ATEC as required) users issued removable media. The issuance, distribution, tracking, and data log collection will be done in accordance with all DoD, Army, ARCYBER, NETCOM, and ATEC EXORDS, OPORDS, FRAGORDS, policies, standards, regulations, guidance, BBPs, and TTPs Government audit of the processes and records will not reveal any deficiencies against the standard.

C.5.3.13.22 Official Tasking Responses. The contractor shall Support the Government action officer, as required, in response to guidance/tasks on OPORDs/Fragmentary Orders/Directives Tasking responses will be prepared in accordance with all DoD, Army, ARCYBER, NETCOM, and ATEC EXORDS, OPORDS, FRAGORDS, policies, standards, regulations, guidance, BBPs, and TTPs Required data is accurate and provided prior to the due date supplied by the government 100% of the time

C.5.3.13.23 Surge Support. The contractor shall, as required, support the planning, execution, administration, and maintenance of ATEC HQ and ATEC enterprise cybersecurity initiatives. Tasks and deliverables will be prepared in accordance with all DoD, Army, ARCYBER, NETCOM, and ATEC EXORDS, OPORDS, FRAGORDS, policies, standards, regulations, guidance, BBPs, and TTPs Deliverable requested by the government is provided within the timeline established by the government 100% of the time

C.5.4.1.3 Property Accountability. The Contractor shall maintain hand receipt and property accountability records as defined in applicable regulations, directives and local procedures. The Contractor shall maintain accountability of non-expendable items in a Government provided property accountability system (PAS). The contractor shall process issues, lateral transfers, turn-ins and asset adjustments. Review and print hand receipt inventories, hand receipt reviews and sensitive inventories as required. Identify material and correctly catalog items to be picked up on hand receipt. The contractor shall assist customers with property accountability issues; this may involve research using various methods. The contractor shall maintain document registers and all supporting files. The contractor shall review, verify and process all procurements, assigning appropriate document number. The contractor shall monitor the Logistics Center email account and disperse information as appropriate to applicable personnel. The contractor shall perform required inventories and implement causative research and adjustment documents when required. The contractor shall use a Government provided property accountability system (PAS). Contractor shall process issues, lateral transfers, turn-ins, and asset adjustments. Review and print hand receipt inventories and sensitive inventories as required. Identify material and correctly catalog items to be picked up on hand receipt. Active monitoring and coordination of tasks. Process all transactions IAW AR 710-2, AR 735-5, other applicable regulations, directives and local procedures. Process inventories IAW inventory schedule set by Government. Acceptable performance of this task requires contractor accuracy and attention to detail 98% of the time.

C.5.4.1.4.5 The contractor shall work up all new receipts within two (2) days of delivery. The contractor shall: a) compare the received quantity and the requested quantity, b) verify the item description is correct, c) complete a quality check for deficiencies, and d) process the receiving paperwork IAW with the local receiving procedures. Hand receipt items should be received on a Form DD250 and given to the PBO within three (3) days of receipt. Any deficiencies found during the work up of the DD250 shall be reported to the PBO immediately. Accurate and timely reporting for documenting delivery of hand receipt items. Acceptable performance requires the contractor to provide written documentation to the Government 99% of the time within three (3) days of receipt of the equipment. Any deficiencies or other issues with the receipt must be provided to the Government within two (2) working days.

C.5.4.1.4.6 Upon the receipt of expendable or durable property at the CRP, the contractor shall: a) verify the received quantity and the requested quantity, b) the item description is correct, c) complete a quality check for deficiencies, and d) process the receiving paperwork IAW with the local receiving procedures. If there is any damage the PBO must be notified immediately. The contractor shall process the receiving report of the equipment IAW the local procedures. The contractor shall update the Government Ordering Official’s tracking system within two (2) working days of delivery. A signed receiving report will be uploaded to the tracking system and a copy will be uploaded to the shared drive on the Logistic Center drive by the Julian date for reference. Accurate and timely receipt of expendable and durable property.

Acceptable performance requires the contractor to provide the processed receiving report to the Ordering Official within two (2) working days of receipt of the equipment at the Logistics Center. The delivery must immediately be checked for damages when received and if found the PBO or Ordering Official must be notified to determine outcome. Only the Government can reject a shipment.

C.5.4.1.5 The contractor shall check each day for completed paperwork to determine the delivery schedule for the day. The contractor shall contact the POC to set up a time and location for the delivery prior to leaving the CRP. The contractor shall ensure that once the delivery is made to the POC/receiving personnel the appropriate paperwork is signed and returned to the PBO for reconciliation and filing. The contractor shall deliver property to the hand receipt holder, obtain signature and process paperwork with the appropriate office, within three (3) workdays of receipt. Any property delivered to personnel must be signed for by the receiving personnel on either a DA Form 3161, the receiving report, or a localized form; and then filed on the share drive following local procedures. Delivery customers receive material in a timely manner IAW with locally produced procedures set by the Government. The contractor will maintain a log of deliveries monthly and provide then to the Government detailing the daily delivery schedule and completion date and time of each delivery. Quarterly and random audits will be done to ensure the contractor is in compliance of this standard by the Government.

C.5.4.1.9.3 The contractor shall be responsible for turning in Class II & VII items to the APG LRC. The contractor shall process the turn-in in the PAS to prepare the DD 1348-1A and IMNE-APG Form 1147. The contractor shall review items for render safe documentation requirements, remove hard drives, batteries, etc. to prepare equipment. The contractor will reconcile paperwork to the item by checking the serial number, nomenclature quantity, serviceability code etc. The contractor will ensure the paperwork is attached to the item, palletize equipment and prepare for turn-in to the APG LRC. The contractor shall accept custodial responsibility during the Turn-in process until accepted at the APG LRC. The contractor shall take the turn-ins to the APG LRC at the designated time as directed by the Government. Upon acceptance at the APG LRC the contractor shall ensure all paperwork is completed accurately and returned to the PBO. All turn-ins are taken to the APG LRC at the designated time as directed by the Government and all paperwork shall completed accurately and returned to the PBO. The accuracy rate for this task is 98%. Excess is a priority to the Government and should be handled as such by the contractor. Any issues should be brought to the Government’s attention immediately

C.5.4.1.9.4 The contractor shall maintain a log of all hard drives removed from any computer like device on a localized form. The contractor will destroy and ensure proper disposal of the hard drives in accordance with Army security regulations and local guidance set by the Government. All hard drives are properly disposed of and a log is maintained in accordance with all regulations and local guidance. The accuracy standard for this task is 100% tracking of hard drive at all times. Quarterly and random audits will be done to ensure the contractor is in compliance of this standard by the Government.

C.5.4.1.9.5 The contractor shall ensure any batteries removed from devices or turned in are properly stored in the Log Center for no more than thirty (30) from the date of receipt. The contractor will dispose of all batteries in accordance with local policies and procedures. Batteries shall only be stored in a location for up to thirty days and must be stored properly following specific storage regulations. The accuracy for the standard is 100%. Random audits will be conducted by the Government to ensure the contractor is within 98% compliance of the tasker.

C.5.4.1.10 STORAGE OF MATERIAL. The contractor shall maintain storage areas for equipment and material being maintained for ATEC HQ support. Safeguard all supplies, equipment, materials, and/or furniture with appropriate storage supplies. The contractor shall notify the PBO immediately of any damages or deteriorated materiel upon discovery. The contractor shall keep a log of items stored in the respective Logistic warehouse locations. The contractor shall issue material to customers at the direction of the Government or IAW approved distribution plans. Contractor shall maintain material is properly stored as defined in AR 710-2, AR 735-5, and locally produced procedures. Semi-annually or at the request of the Goernment, the contractor shall supply to the Government a current inventory of the items stored and the status of the items being stored.

C.5.4.1.11.1 The contractor shall issue out the office supplies from the supply room IAW local procedures. The contractor shall deliver any office supplies within the ATEC HQ command buildings as needed. The contractor shall ensure the supply room is covered during the hours of operation as set by the Government with the understanding the hours are subject to change. The contractor will ensure all supplies are accurately signed for and processed in the Government PAS. Acceptable performance of task requires the contractor to ensure accurate issuing of supplies, IAW the local policies and procedures The contractor will provide the Government with a monthly report of the number of walk up customers to the supply room and the number of deliveries made from the supply room before, during or after core supply room hours.

C.5.4.1.11.2 The contractor shall submit and track depot orders as defined in applicable regulations, directives and local procedures. The contractor shall maintain the depot order processing in the provided software program GCSS-Army. Process depot orders based on customer needs and on hand stock of supply room. Maintain at least a 6 month supply of on hand supplies of daily use items as set by the government. Acceptable performance of task requires the contractor to monitor and notify the Government within two (2) working days when the on hand stock falls below the safety stock level.

C.5.4.1.11.3 The contractor shall track the on hand inventory in the Government PAS and assist in maintaining accountability. The contractor shall assist in the identification of additions, deletions, and large changes in the supply room’s inventory. Provide the Government with a physical inventory of on hand counts in comparison with the Government PAS semi-annually as determined by the Government. Ensure new stock is put into the inventory, quantities are updated as required and set by government. Any discrepancies are brought to the government’s attention within two (2) days.

C.5.4.1.11.4 Receive delivery of inventory from outside vendors, post receipts in the provided software program GCSS-Army to close orders and continually follow-up on open orders to provide updated status. Provide updated status of open orders as required to the Government. Post receipts in the provided system within 1 day of receipt from the LRC. Notify the Government of any discrepancies within 1 day of receipt. Update the software program within 3 days of receipt.

C.5.4.2.2 Perform property accountability for Government-furnished IT equipment using a Government-provided PAS that can provide the Government specific information as to the quantities, system components, warranty status (if appropriate), and locations of all items. Accurate accountability of Government-furnished IT equipment using a Government-provided PAS. Acceptable performance of task requires the contractor to be accountable for all items 100% of the time.

C.5.4.2.3 Provide written email notification to the Government ordering official and PBO within one (1) work day of delivery. Within two (2) work days of delivery, the contractor shall: a) verify the requested quantity and item specifications have been met; b) inventory, QC check, and process the equipment using established and Government- approved procedures upon receipt of new equipment; and c) provide an email confirmation that the ordered items have been received and no physical damage has occurred in transit. If any damage is apparent upon delivery or when the item is fully inspected, the contractor shall immediately notify the COR, the PBO, the Government ordering official, and the vendor prior to acceptance for further direction to include fully documenting the condition of item(s). The contractor shall then assist with the return and replacement of the item(s). Notifications shall include an electronic copy of shipping documentation with time and date stamp and receiving official’s signature. The contractor shall provide the Government ordering official with a signed receipt from the acceptor for final delivery of goods. The Government has the final determination regarding acceptance/rejection of all delivered items. Accurate and timely reporting for documenting delivery of items. Acceptable performance of task requires the contractor to provide written documentation to the Government 99% of the time within one (1) work day of receipt of item and for QC checks, 99% of the time for written documentation which must be provided to the Government within two (2) work days.

C.5.4.2.4 Perform inventories IAW applicable regulations and local policies and procedures as required. The contractor shall perform all storage and issue functions related to logistics operations for supply classes consisting of the ASL, NSL, non- standard materiel, and materiel pending customer issue IAW DOD, Army, and ATEC policies and regulations as well as local policies and guidance. The contractor shall maintain storage areas for equipment and material. The contractor shall issue material to customers at the direction of the Government or IAW approved distribution plans. Accurate, timely and accountability of items being inventoried. Acceptable performance of task requires the contractor to perform 100% inventories annually and 100% inventories quarterly for hazardous and sensitive items.

C.5.4.3.4 Perform property accountability using a Government-provided system that can provide the Government specific information as to the quantities, system components, warranty status (if appropriate), and locations of all items. Accurate accountability of Government equipment using a Government-provided PAS. Acceptable performance of task requires the contractor to be accountable for all items 100% of the time.

C.5.5.2.1 C.5.4.3.1. Provide support to the forms management program which includes all forms used by OTC. This effort shall include creating, updating, and modifying forms upon request by the Publications and Forms Control Officer and completing them within three (3) work days of request. Upon approval by the Forms Officer, lock new/revised forms to prevent editing and upload to a Government system within one (1) work day. Accurate and timely forms management program support Acceptable performance of task requires the contractor to provide product 100% of the time within three work days of request and post forms to Government system within one work day 90% of the time.

C.5.5.3.2 Electronically submit all monthly invoices by the 15th work day for the preceding month in WAWF. The invoice shall include up-to-date and current information for the prime and all subcontractors. Accurate and timely submission of invoices in WAWF Acceptable performance of task requires the contractor to submit invoices in WAWF by the 10th work day for the prime and all subcontractors 95% of the time.

C.5.5.3.3 Provide an electronic weekly labor report, in the correct format, to the COR separated by each location for the preceding week for the prime and all subcontractors by COB Tuesday. Specific format will be provided by COR. Accurate and timely submission of weekly electronic labor reports Acceptable performance of task requires the contractor to submit weekly reports separated by location by COB Tuesday for the preceding week for the prime and all subcontractors 95% of the time.

C.5.5.4 Accounting for Contract Services. The Office of the Assistant Secretary of the Army (Manpower & Reserve Affairs) operates and maintains a secure Army data collection site where the contractor shall report all contractor manpower (including subcontractor manpower) required for performance of this contract. The contractor shall completely fill in all the information in the proper format used in the Contractor Manpower Reporting Application (CMRA) at the following web address: https://www.sam.gov. Accurate and timely submission of annual data in CMRA. Acceptable performance of task requires the contractor to submit data in CMRA annually for the prime and all subcontractors by 31 December of each calendar year 100%.

Attachment 8 - Standards and Acceptable Quality Levels