Attachment 0001_DRAFT_BPS PWS_15 APR 2026_RS3-25-0045.pdf

DRAFT

Performance Work Statement for Biometric Procurement and Sustainment

W909MY25RA002

Dated: 15 April 2026

DISTRIBUTION STATEMENT D: Distribution authorized to the Department of War (DoW) and U.S. DoW contractors only by specific authority of AR 380-5. Date of determination is 02 February 2024. Other requests for this document shall be referred to the Product Manager (PM) Biometrics, 10115 Gratiot Road, Building 363, Fort Belvoir, VA 22060; (703) 704-0336.

Product Manager Biometrics i

Table of Contents

1.0 Scope

1.1 Background

1.1.1 PL Biometrics Collection Capability

1.2 Period of Performance

1.3 Places of Performance

2.0 Applicable Documents

3.0 Performance Requirements

3.1 Task 1: Program Management

3.1.1 Post Award Conference

3.1.2 Transition Planning

3.1.3 Configuration Management

3.2 Task 2: System Procurement and Fiedling

3.2.1 System Procurement

3.2.2 System Fielding

3.3 Task 3: System Sustainment

3.3.1 Operational and Field Support Services

3.3.2 Training Support

3.3.3 Product Support

3.3.4 Packaging, Handling, Storage, and Transportation

3.4 Task 4: Software Engineering Services

3.5 Task 5: Cloud Services

3.6 Task 6: Help Desk Services

3.6.1 Help Desk Support

3.7 Task 7: Cybersecurity Services

3.7.1 ISSO Support

3.8 Surge Support

4.0 Deliverables

5.0 Travel

5.1 Travel Notification and Coordination with U.S. Army Materiel Command (AMC)

Commanders and Senior AMC Site Representatives

6.0 Personnel

6.1 Key Personnel

6.2 Contractor Work Hours

7.0 Government Furnished Property

7.1 Contractor Acquired Property (CAP)

7.1.1 CAP Ownership

7.2 Data Rights

7.2.1 Intellectual Property Rights

7.3 GFP/CAP Accountability and Disposition

7.3.1 Rent/loan of Government Property

7.3.2 GFP/CAP Disposition

8.0 Training

9.0 Observance of Legal Holidays

10.0 Performance Issues

11.0 Quality Assurance Surveillance Plan (QASP)

ii

12.0 Security and Privacy

12.1 Security Requirements

12.1.1 AT Level I Training

12.1.2 AT Awareness Training for Official and Unofficial Contractor Personnel

Traveling Overseas

12.1.3 iWATCH Training

12.1.4 OPSEC Plan

12.1.5 OPSEC Training

12.1.6 Army Training Certification Tracking System (ATCTS)

12.1.7 Cybersecurity/Information Technology (IT)

12.1.8 Cybersecurity/Information Technology (IT) Certification

12.1.9 Access and General Protection/Security Policy and Procedures

12.1.10 Handling or Access to Classified Information

12.1.11 Controlled Unclassified Information (CUI) Training

12.1.12 Security Training

12.1.13 Common Access Card (CAC)

12.1.14 DoW Facility or Installation Access

12.1.15 Contractors Authorized to Accompany the Force

12.1.16 Performance of Delivery in a Foreign Country

12.2 Non-Disclosure Agreement and Certificate of No Conflict of Interest

13.0 Contracting Officer Representative (COR)

14.0 Invoices/Vouchers and Payment

15.0 Out-Processing

16.0 Contractor Manpower and Reporting

1.0 SCOPE

This Performance Work Statement (PWS) defines the requirements for Biometric Procurement and Sustainment (BPS) support for Product Manager Biometrics, Product Lead Biometrics Collection Capability (PL BCC) products. It includes all efforts associated program management, system procurement (hardware (HW) and software (SW)), fielding, system sustainment, software engineering, cloud, help desk, and cybersecurity services.

1.1 BACKGROUND

Product Manager Biometrics (PM BIO), under Project Manager Terrestrial Sensors (PM TS), Portfolio Acquisition Executive (PAE) Layered Protection and Chemical, Biological, Radiological, and Nuclear (CBRN) designs, engineers, acquires, deploys, and sustains enterprise biometric solutions in multiple operating environments enabling identity dominance on the battlefield and across the Department of War (DoW). PM Biometrics’ information technology (IT) systems capture, transmit, store, manage, share, retrieve, and display biometric data for timely identification/verification. These systems are mission enablers for force protection, intelligence, physical and logical access control, identity management/credentialing, detention management, and interception operations. PM Biometrics provides HW and SW support to various operations, including counterintelligence (CI), detainee operations, intelligence operations, presence operations, local population control, seizure operations, and base access control.

1.1.1 PL Biometrics Collection Capability

PL BCC provides the Army tactical biometric collection capability to capture biometric data of an adversary or neutral person and enroll them into Department of War Automated Biometric Identification System (DoW ABIS). This enables the data capture and enrollment process for identity verification of actual or potential adversaries. Collection devices include the Biometrics Automated Toolset - Army (BAT-A), Near Real Time Identity Operations (NRTIO), and Next Generation Biometric Collection Capability (NXGBCC).

BAT-A System Overview The BAT-A Program of Record (PoR) has been supporting contingency operations for over twenty (20) years. BAT-A is a biometric system comprised of both hardware and software that can capture, store, match, and disseminate biometric and biographical data on non-U.S.

personnel. BAT-A integrates Commercial Off-The-Shelf (COTS) biometrics subsystems and hardware components (fingerprint, iris, and facial capture) with special purpose Government Off-The-Shelf (GOTS) software for capabilities such as digital dossier creation, biometric searching of the database for matches to Known and Suspected Terrorists (KST) and supporting detainee management.

Currently supported components of the BAT-A system include the following:

• Biometrics Automated Toolset-Army Kit (BAT-A Kit)

– BAT-A Client (PC-based hardware)

– Peripheral devices for enrollment and associated functions

• Biometrics Automated Toolset-Army Handheld (BAT-A HH)

– It should be noted that the BAT-A HH is sometimes referred to as either BAT-HH or as the Secure Electronic Enrollment Kits II (SEEK II). However, the preferred current usage holds that the SEEK II refers to the previously available COTS hardware, wherein the BAT-A HH refers to the hardware/software combination that enables the device to perform the necessary mission functions.

• Biometrics Automated Toolset Web (BAT.Web)

– Provides 24X7 access to BAT-A data without the requirement to have BAT-A hardware.

NRTIO System Overview The NRTIO Quick Reaction Capability (QRC) has been supporting contingency operations since 2016. NRTIO is an identity information system intended to enhance the processing and sharing of biometric data within the United States Central Command (USCENTCOM) AOR. The system ingests biometric records collected by US forces and agencies, partner nations, and other coalition forces; compares them to active watch lists and previously collected biometric records;

and provides rapid identity verification and alerts to support identity operations and inform Anti- Terrorism and Force Protection (AT/FP) decisions. To support in-theater operations, the NRTIO system returns biometric match responses in Near Real Time (NRT), which is defined as less than 3-minutes.

NRTIO is based on an unclassified architecture to facilitate the sharing of identity information between US and coalition partners in the USCENTCOM AOR. Key components of the system include biometric collection devices (Identity Dominance System (IDS) and Jump Kit), data communications platforms, and an Amazon GovCloud with a web portal user interface. The handheld, man-portable biometric collection device support missions that involve security screening, vetting, or force protection, especially those requiring compact or mobile collection solutions. The Jump Kit is a ruggedized collection platform, optimized for fixed-site operations.

Jump Kits are commonly used at checkpoint operations, entry control points, or other static locations where security screening, vetting, or force protection missions are conducted, and subjects are brought to the collector. A Jump Kit is comprised of a waterproof and airtight case, an iris scanner, a digital camera, a fingerprint scanner, a laptop computer, a card scanner, and cleaning and maintenance supplies.

Currently supported components of the NRTIO system include the following:

• NRTIO Static/Jump Kit

– Dell Latitude 5440

– IrisID iCAM R100 Dual Iris and Face Camera

– HID Guardian 200 Fingerprint Device

– USB-C to Ethernet Adapter

– Anker USB-C to 4-port USB Hub

– Pelcian Case, 6700 Series

• NRTIO Mobile Device

– IDS Hand-held Collection Device

– Sapre Visor Assembly (1)

– Lithium ion Battery (4)

– External Battery Charger (1)

– Modified Power Supply (1)

– External Battery Charger (1)

– Hardware Tool Kit (1)

– Spare Mounting Hardware (1)

• NRTIO Medium Maverick Terminal

– Case 1: Reflector

– Case 2: Azimuth Hub and Elevation Jack

– Case 3: Legs and Controller Feed

– Case 4: Indoor Unit (IDU)

• NRTIO Cellular Kit

– Meraki MX67 Router/Security Appliance

– Meraki MR78 Wi-Fi 6 Outdoor AP

– Meraki MG41 Cellular Gateway External Ant

– Meraki MR 802.3at PoE Injector

NXGBCC System Overview The NXGBCC PoR will replace the current BAT-A capability. NXGBCC will support Army force protection and identity dominance missions. It is designed to support access control, identify persons of interest, and provide biometric identities to detainee and intelligence systems through submission to DoW ABIS. NXGBCC collects, matches, stores, and shares biometric, biographical, and contextual data through fingerprint, iris, voice, and facial modalities. The capability will be used for both mobile and static operations in connected and disconnected, intermittent, and limited connectivity environments to inform the Warfighter of potential threats in NRT.

The NXGBCC system is comprised of collection devices and the Ares Gateway Transaction Manager (AGTM) hosted in the Amazon GovCloud. The AGTM along with the mobile (JavelinXL) and static (Javelin Jump Kit Lite) devices and associated peripherals are commercial items. The collection devices will interface with the DoW ABIS via the AGTM. The AGTM will function as a transaction manager, receiving biometric submissions from the JavelinXL and Javelin Jump Kit Lite. Biometric matches will be returned from DoW ABIS to AGTM and automatically transmitted back to the collection device in NRT.

Components of the NXGBCC system include the following:

• Javelin Jump Kit Lite

– Nanuk 915 IP67 Kit Case (PARENT)

– Dell Latitude 5340

– IrisID iCAM R100 Dual Iris and Face Camera

– Integrated Biometrics Five-o Fingerprint Sensor

– USB-C to Ethernet Adapter

– Anker USB-C to 4-port USB Hub

• JavelinXL Mobile Biometric Collection Kit

– JavelinXL Pelican Case

– JavelinXL, Black, S23, Standard Label

– Integrated Biometrics Five-o Fingerprint Sensor

– Four Fingerprint Sensor

– Dual Iris Sensor

– Samsung Galaxy Smart Phone Galaxy S23-128GB

1.2 PERIOD OF PERFORMANCE

The Period of Performance (PoP) shall be sixty (60) months; one (1) twelve (12)-month base period from the date of award with four (4) twelve (12)-month option periods.

1.3 PLACES OF PERFORMANCE

The Contractor shall provide support within the Continental United States (CONUS) at the Contractor’s facility and at various Outside of the Contiguous United States (OCONUS) locations. The Contractor shall have the facilities (i.e., office space, laboratory space, staging and storage areas) necessary to accomplish contract objectives. Travel will be required to various locations for initial fielding and New Equipment Training (NET) as well as continued service/updates for equipment in sustainment. Table 1 below provides the anticipated Combatant Command (COCOM) locations.

CONUS / OCONUS COCOM Description

CONUS

Contractor

Site/National Capital Region

Contractor's facility located in the National Capital Region

OCONUS AFRICOM Africa Command - responsible for military operations in Africa

OCONUS CENTCOM

Central Command - responsible for military operations in the Middle East, North Africa, and Central Asia

OCONUS EUCOM European Command - responsible for military operations in Europe, including Russia

OCONUS INDOPACOM Indo-Pacific Command - responsible for military operations in the Asia-Pacific region

CONUS/OCONUS NORTHCOM

Northern Command - responsible for military operations in North America, including the continental United States, Canada, and Mexico

OCONUS SOUTHCOM

Southern Command - responsible for military operations in Central and South America, and the Caribbean

Table 1: Places of Performance

2.0 APPLICABLE DOCUMENTS

The Contractor shall provide BPS services in accordance with the following regulations, directives, guidance, and documents. Where a policy is revised or updated, the most current version of the policy, directive, or document will apply.

DoW, Army, and Federal References:

• AR 25-1, Army Information Technology

• AR 25-2, Information Assurance

• AR 350-1, Army Training and Leader Development

• AR 380-5, Department of the Army Information Security Program

• AR 381-12, Threat Awareness and Reporting Program (TARP)

• AR 770-3, Type Classification and Materiel Release

• AR 710-1, Centralized Inventory Management of the Army Supply System

• AR 710-4, Inventory Management: Property Accountability AR 735-5, Property

Accountability Policies

• DISA Security Technical Implementation Guides (STIGs)

• DoD Cloud Computing Security Requirements Guide (CC SRG) version 1, release 3,

• DoD Product Support Manager Guidebook

• DoDD 8570.01, Information Assurance (IA) Training, Certification, and Workforce

Management

• DoDI 3020.41, Operational Contract Support (OCS)

• DoDI 5200.48, Controlled Unclassified Information (CUI)

• DoDI 8500.01, Cybersecurity

• DoDI 8510.01, Risk Management Framework RMF for DoD Information Technology

• DoDI 8530, Cybersecurity Activities Support to DoD Information Network Operations

• DoDM 8140.03, Cyberspace Workforce Qualification & Management Program

• Federal Information Processing Standard (FIPS) 199, Standards for Security

Categorization of Federal Information and Information Systems

• National Institute of Standards and Technology (NIST) Special Publications (800 Series)

• MIL-STD-130N Change 1 dtd 16 NOV 2012, DoD Standard Practice Identification

Marking of U.S. Military Property

• MIL-HBDK-61B, Configuration Management Guidance

• National Industrial Security Program Operating Manual (NISPOM)

3.0 PERFORMANCE REQUIREMENTS

The Contractor shall provide fully trained, qualified personnel, supervision, and other items and services necessary to perform the non-personal services described in this PWS. The Contractor shall perform the following tasks:

• Task 1: Program Management

• Task 2: System Procurement and Fielding

• Task 3: System Sustainment

• Task 4: Software Engineering Services

• Task 5: Cloud Services

• Task 6: Help Desk Services

• Task 7: Cybersecurity Services

• Task 8: Surge Support

3.1 Task 1: Program Management

The Contractor shall provide qualified personnel, administrative, and financial resources necessary to successfully execute the requirements of this PWS. The Contractor shall provide a single point of contact through which tasks/requests from the Government are accepted and contractor performance is managed. The Contractor shall ensure all activities and deliverables are identified, documented, and tracked so that the Contractor’s performance can be continuously evaluated and monitored for timeliness and quality of services and deliverables. The Contractor shall report information on system functionality, known issues, resolutions, interfaces, and interoperability (Contract Data Requirements List (CDRL) A001). The Contractor shall apprise the Contracting Officer Representative (COR) of any performance, staffing, or other PWS related issues.

The Contractor shall plan, estimate, budget, and manage costs in accordance with the Contractor’s proposed costs for each year of the contract. The Contractor shall deliver a monthly Contract Status and Cost Report with comprehensive cost reporting (CDRL A001), as well as a monthly Army Contracting Command (ACC) Vendor Report (CDRL A012), required for all cost reimbursable type contracts/task orders. The Contractor will be evaluated on their ability to control costs for each year. Any cost overrun above the Contractor’s proposed costs may result in a negative Contractor Performance Assessment Reporting System (CPARS) rating under “Cost Control”.

3.1.1 Post Award Conference

The Contractor shall coordinate and hold a contract Post Award Conference (PAC) within 10 calendar days of contract award, outlining their approach to meeting the contract requirements, the associated contractor organization, staffing, and execution of the Contractor’s proposed Transition-In Plan. The PAC shall include all corporate and working-level points of contact

(POC).

3.1.2 Transition Planning

3.1.2.1 Transition-In Planning

The Contractor shall ensure a complete and successful transition not later than 45 calendar days after task order award. The Contractor shall execute all activities and milestones for the transition period by the timelines specified for meeting those milestones in its proposed Transition-In Plan.

3.1.2.2 Transition-Out Planning

The Contractor shall perform services in accordance with the contract without reduction of manpower, quality of services, or interruption to customers. The Contractor shall prepare a Transition-Out Plan (CDRL A002), including all steps to handover responsibility and knowledge transfer to the follow-on Contractor, if applicable. The Transition-Out Plan shall address how the Contractor will implement adequate measures to coordinate communications with the follow-on contractor and their staff to ensure uninterrupted workflow and minimal mission impact during the transition process. The Contractor’s Transition-Out Plan shall include a comprehensive plan for the transfer of work control, addressing all security issues, the transfer and accountability of Government Furnished Property (GFP) (to include inspect and acceptance); transfer of training materials (e.g., job aids, operational procedures, knowledge documentation repository), job shadowing, observation/reverse shadowing; monitoring of current operations, delineating the method for processing and assigning tasks; and plan for demobilizing all OCONUS personnel.

3.1.3 Configuration Management

The Contractor shall develop a Configuration Management Plan (CMP) (CDRL A003) IAW the processes in Sections 3.1.3.1 through 3.1.3.3, industry configuration management standards, and DoW standards, directives, and guidance.

3.1.3.1 Configuration Management Processes and Procedures

a) The Contractor shall document the strategy in the CMP to establish and maintain hardware and software configuration management for all system environments; identify, track and control developmental and operational baselines; engineering work products and define and execute a program change management process.

b) The Contractor shall document software release processes in the CMP for sustainment and system engineering activities.

c) The Contractor shall execute release management procedures for all systems in accordance with the CMP.

d) The Contractor shall refine, document, and maintain the currency of its release management processes and procedures in the CMP.

e) The Contractor shall post all release documentation to the CM repository.

f) The Contractor shall provide administrative and technical support to weekly and off-schedule PM Biometrics-led change management forums (e.g., Configuration Control Board (CCB), Technical Review Board (TRB)).

g) The Contractor shall disseminate system change documentation among the members of the CCB and TRB.

h) The Contractor shall provide technical subject matter experts to assist the Government review of baseline documentation during System Verification Reviews (SVR) / Functional Configuration Audits (FCA) and Physical Configuration Audits (PCA).

SVR/FCA and PCA will be conducted by the Government prior to major deployments or as required. SVR/FCA is conducted to verify the system performance meets the requirements in the functional specifications and is documented in the functional and allocated baselines. PCA is conducted to verify the systems as-built configuration against the technical documentation to verify the product baseline.

3.1.3.2 Configuration Management (CM) Repository

The Contractor shall implement and maintain a non-proprietary, web-based Configuration Management (CM) system using MIL-HDBK-61A (System Engineering) as a guide; however, the CM repository must reside on a .mil government domain and be remotely accessible by the Government. The CM system is intended to provide a collaborative CM environment for the Government and the Contractor and a historical repository of Engineering Change Proposals (ECPs). The Contractor shall notify the COR of all licenses required to operate the system and track software baselines to include licenses / license keys, proof of purchase and maintenance agreements / End User License Agreement (EULA) / Terms & Conditions (T&C).

The proposed CM Repository system shall be capable of performing the following:

a) Encompass all systems versions and baselines;

b) Identify the state of development efforts in addressing change requests, system issues, maintenance, management of environments, and release content;

c) Document all system baseline changes, problems and upgrades;

d) Maintain software licenses;

e) Employ automated processes to load and update the repository to reduce errors and cost;

and

f) Leverage discovery tools, inventory and audit tools to maintain, enforce, and report near– real–time system configuration.

3.1.3.3 Configuration Items Control

a) The Contractor shall exercise control of the HW and SW Configuration Items ensuring that only authorized and identifiable Configuration Items are accepted and recorded from receipt to disposal under PM Biometrics direction. The Contractor shall add, modify, replace, and remove Configuration Items only through the processing of appropriate controlling documentation in accordance with the CMP.

b) The Contractor shall monitor all systems, capturing all current and historical lifecycle subsystems data, including tracking of subsystems status (ordered, received, under test, live, under repair, withdrawn or for disposal).

c) The Contractor shall conduct automated discovery and configuration audits of the Configuration Items monthly to ensure approved, standard patches, updates, and configurations are maintained within all systems and report any discrepancies to the Government.

3.2 Task 2: System Procurement and Fielding

The Contractor shall procure and field COTS/GOTS software and hardware in support of PM Biometrics’ collection capability missions.

3.2.1 System Procurement

The Contractor shall procure COTS/GOTS hardware and software including embedded software, software licenses, maintenance agreements, or any combination of these items. Final COR approval shall be obtained prior to the Contractor procuring equipment. The Contractor shall provide all records, to include invoices, receipts, license key notifications, and proofs of purchase in association with the procured item(s).

The Contractor shall procure COTS hardware and software through the Army’s designated primary source for commercial IT, Army’s Computer Hardware, Enterprise Software and Solutions (CHESS) IT e-Mart. A statement of Non-availability (SoNA) is required if any HW or SW purchases are made outside of CHESS and the Contractor shall obtain an Information Technology Approval System (ITAS) waiver.

3.2.1.1 The Contractor shall execute Item Unique Identification (IUID) marking requirements for all operational equipment under this contract (CDRL A004). The Contractor shall capture and enter all IUID required items into the IUID registry prior to shipment. The item marking criteria for development of specific marking requirements and methods for identification of items of military property produced, stocked, stored, and issued by or for the DoW is outlined by MIL- STD-130N Change 1 dtd 16 NOV 2012, DoD Standard Practice Identification Marking of U.S.

Military Property. This standard addresses criteria and data content for both free text and machine-readable information (MRI) applications of item identification marking.

The required marking shall be applied to an identification plate, identification band, identification tag, or identification label securely fastened to the item, or shall be applied directly to the surface of the item and be compliant with the standards of location, size, content, permanency, legibility, deleterious effect and type of lettering. Marking materials that create hazardous conditions shall not be used.

3.2.1.2 All items (HW and SW) shall be kitted in accordance with the associated technical documentation (i.e., TDPs, drawings, Specification Sheets, etc.). All hardware associated with each kit shall be inventoried and documented using the ‘as built’ inventory sheet (CDRL A013) (list of all serialized components) and placed in the kit along with the DD Form 250 prior to shipping.

3.2.1.3 The Contractor shall certify that it purchases supplies from authorized resellers and/or distributers. The Contractor shall warrant that the products are new and in their original box. The Contractor shall procure products from authentic manufacturers or through legal distribution channels only, in accordance with all applicable laws and policies in effect at the time of purchase. The Contractor shall provide the Government with a copy of the EULA warranting that all manufacturer software is licensed to the Government as the original licensee authorized to use the software. The Contractor shall track and report all licensing information (CDRL A001).

3.2.1.4 The Contractor shall not release any equipment without proper authorization from the COR. The Contractor shall ensure security and 100% property accountability of equipment. The

Contractor shall coordinate with the designated Property Manager to reconcile all GFE in the Enterprise Logistics Management System (ELMS) upon receipt of signed DD Form 250(s).

3.2.2 System Fielding

The Contractor shall provide system fielding services consistent with Total Package Fielding (TPF) IAW 770-3. TPF is the Army’s standard materiel fielding process designed to provide Army materiel systems to the gaining units as a coordinated package of end items, support items, spares, and technical documentation. Materiel Fielding Services consists of New Equipment Fielding (NEF), New Equipment Training (NET), Platform Integration (PI), and Technical Field Support.

3.2.2.1 The Contractor shall serve as TPF Leads for fielding missions whose responsibilities include being the single point of contact between the gaining unit and the Product Office, as well as coordinating all logistic needs for the NET and PI teams. The Contractor shall conduct NEF in support of BCC systems in both CONUS and OCONUS locations and may be required in contingency theaters of operation.

3.2.2.2 The Contractor shall conduct NET as part of Materiel Fielding Services IAW AR 350-1 Chapter 6. NET provides the initial transfer of knowledge on the operation and maintenance of new equipment from the Government to the end user and field maintainer(s). NET assists Commanders with achieving operational capability in the shortest time practical by training soldiers how to operate and maintain the new equipment. The Contractor shall conduct NET in support of systems in both CONUS and OCONUS environments per the Government provided NET Plan.

3.3 Task 3: System Sustainment

The Contractor shall provide sustainment services for BCC systems in support of current military operations worldwide. This support includes ongoing and routine operational and field support, training support, product support, and shipping support. This support includes BCC equipment shared with allies and coalition partners.

3.3.1 Operational and Field Support

The Contractor shall provide continuous and routine operational and field level maintenance support. Support includes short (two (2) days or more) or long-term (one (1) year or more) deployment of personnel who will work (and live) in hazardous areas in or near military combat zones as well as other OCONUS COCOMs referenced in Section 1.3, Places of Performance.

For all contractor personnel hired for specified deployment locations, the Contractor shall schedule mandated CONUS Replacement Center (CRC) (or equivalent) attendance.

3.3.1.1 The Contractor shall manage, plan, and coordinate all field service support for BCC system. The Contractor shall ensure operational continuity by allocating resources for staff replacements during leaves, rotations, and special assignments.

3.3.1.2 The Contractor shall provide Multifunctional Field Technical Support (MFTS) Specialists that shall provide day-to-day maintenance and repair of BCC devices and peripherals.

This includes preventative, controlled, emergency, and corrective maintenance.

a) The Contractor shall provide system administration, troubleshooting, and configuration support for communications platforms, and networks. Support shall include field level maintenance, comprehensive and responsive network support services, database administration, security administration, and configuration management.

b) The Contractor shall:

• Schedule, perform, document, and review system maintenance records

• Sanitize equipment prior to offsite maintenance

• Checks security controls following maintenance

• Ensure that personnel performing maintenance on the information system have required access authorizations

• Maintain a list of authorized maintenance personnel including third-party maintenance providers

• Inspect all maintenance tools brought into a facility by maintenance personnel for obvious improper modifications

• Check all diagnostic and test program media for malicious code before use

c) The Contractor shall coordinate with vendors to install and configure software and hardware; monitor system performance; and provide recommendations for improvements to network/configuration security and efficiency.

d) The Contractor shall respond to routine warfighter requests for support within 48 hours and to emergency inquiries within eight (8) hours as per the MFTS Specialist’s routine operating environment. These response times may vary depending on intra-theater transportation availability.

e) The Contractor shall conduct Tier One (1) support and user training at the operator tier on

BCC systems. The Contractor shall coordinate with vendors for support above Tier One (1).

3.3.1.3 The Contractor shall ensure all personnel deploying to theater are supplied with the necessary equipment, such as workstations or tool/test kits and personal protection equipment (PPE) to perform their duties.

3.3.1.4 The Contractor shall provide timely notification to direct support organizations regarding the operability and serviceability of assigned facilities and assets. IAW AR 710-1, AR 710-4, and AR 735-5, the Contractor shall maintain configuration management of all BCC systems’ hardware, software, and equipment and abide by all provisions outlined in Section 7.0, Government Furnished Property of this PWS.

3.3.2 Training Support

The Contractor shall provide Training support for BCC systems in operational use. Training shall focus on the tasks and associated skills necessary to execute biometric collection missions.

3.3.2.1 The Contractor shall provide and maintain targeted training materials for BCC systems

(CDRL A015).

3.3.2.2 The Contractor shall accompany units on missions as required to ensure that personnel are satisfactorily trained to execute their system related tasks to standard in a live environment.

3.3.2.3 The Contractor shall provide training team support at Combat Training Centers (CTCs) during scheduled exercises. Support shall include, but is not limited to, training the staffs of rotating units regarding the technical and network support that is required in theater; providing field support to units during the exercise; provide lessons learned input for training material development as required; provide support to the CTC operations group staff section, as determined by the CTC leadership, in the development of scenarios incorporating and managing the use of biometrics data during rotation training.

3.3.2.4 The Contractor shall coordinate with the Formations & New Systems Training Branch (FNSTB) team to provide the necessary new equipment training to support technical refreshes.

3.3.3 Product Support

Product Support spans the total scope and all aspects of life cycle sustainment. The Contractor shall provide product support guided by the 12 Integrated Product Support Elements in accordance with the DoW Product Support Manager Guidebook.

3.3.3.1 The Contractor shall implement technical refreshes of BCC systems. These shall be documented via an ECP and annotated within the Configuration Management Plan (CDRL A003).

3.3.3.2 The Contractor shall establish procedures to support counterfeit prevention, detection, and reporting for BCC components and equipment. Note: CHESS procurements do not require counterfeit prevention procedures as vendors were pre-vetted.

3.3.3.3 The Contractor shall track the levels of system spares and repair parts (CDRL A013) and ensure all classes of supplies meet a Supply Availability rate as directed by the Government. The Contractor shall be responsible for tracking and shipping of all equipment to original equipment manufacturer (OEM) repair facilities in accordance with the purchased warranty.

3.3.3.4 The Contractor shall provide maintenance planning and management processes to define the tasks, schedule, and resources required to sustain BCC systems. The Contractor shall define the maintenance actions and support necessary to attain the system’s Operational Availability (Ao) objective. The Contractor shall report the status of system(s)’ Ao in the monthly Contract Status Report (CDRL A001).

3.3.3.5 The Contractor shall identify facility needs in support of BCC systems. The Contractor shall ensure the optimal temperature is maintained in the facilities for the system(s) to transmit data within the allotted time. The Contractor shall maintain maintenance facilities/warehousing in support of the systems network equipment. Regardless of type of facility, the Contractor shall maintain a safe work environment and require all personnel to always wear appropriate protective equipment.

3.3.4 Packaging, Handling, Storage, and Transportation

The Government will provide a FedEx account and will bear all shipping costs, unless otherwise directed. The COR may specify or provide special packaging for select systems; all packaging materials not provided by the COR shall be charged to the contract.

3.3.4.1 The Contractor shall coordinate and execute the movement of items between the field support locations and OEM and Depot locations or other locations identified by the COR. This shall entail determining the most economical method of shipping within the constraints of DoW transport system and turn-around times.

3.3.4.2 The Contractor shall ensure all customs documentation, declarations, verification necessary for these shipments are properly completed and submitted. The Contractor shall track shipments, receipts, and returns as applicable.

3.3.4.3 The Contractor shall ensure all Contractor and subcontractor/vendor personnel understand the content of the applicable Security Classification Guide (SCG). The Contractor shall ensure that all personnel properly mark, store, handle, and ship all material they acquire, generate or create in accordance with AR 380-5, and the applicable SCG. The Contractor shall ensure all packaging is properly marked, and that all security classification guidance for marking and handling is followed.

3.3.4.4 The Contractor shall assist the Government as needed to demilitarize and dispose of assets no longer required. The Contractor shall track excess equipment and coordinate with the Government to determine equipment for demilitarization.

3.4 Task 4: Software Engineering Services [NRTIO, NXGBCC]

The Contractor shall provide comprehensive software engineering services required to support BC2 systems. Services include maintaining the current software engineering environments and executing enhancements, upgrades, modifications, and prompt software maintenance and fixes.

3.4.1 The Contractor shall perform assessments/investigations resulting from reported problems or incidents, user requests, or changes to applicable biometric standards, processes and technologies, to determine whether event(s) results in an ECP (CDRL A014).

3.4.1.1 The Contractor shall:

a. Resolve approved System software issues or changes.

b. Resolve approved System integration or interoperability problems with existing COTS or GOTS hardware and software products as documented.

c. Ensure all System deployments are fully interoperable with all other standards compliant systems.

d. Ensure Systems are upgraded as required to meet applicable biometric standards and Information Assurance (IA) findings.

e. Ensure Systems are compatible with the DoW Biometric Enterprise Information Technology infrastructure, and comply with DoW, Army and Local Command policies, processes, regulations, and certifications.

f. Deliver maintenance releases to fix approved problems and implement approved system changes as required.

3.4.2 The Contractor shall develop, implement, and deliver Test Procedures (CDRL A005) to verify the new requirements and support regression testing to ensure original functionality has not been impacted.

3.4.2.1 The Contractor shall prepare and maintain a cross-reference of all requirements to the verification procedures that shall be used to determine successful compliance. The Contractor shall include the COR in the verification of the system, by conducting, and/or participating in software test phases and providing Test Reports (CDRL A006). The Contractor shall provide the COR the opportunity to witness all testing.

3.4.3 The Contractor shall provide the means to construct a system image for biometric collection devices. The complete configuration baseline shall be provided via the Technical Data Package (TDP) (CDRL A015). This shall include the following:

a. Identification of COTS application including version

b. Installation package which includes:

• Installer

• Drivers/libraries

• Executable code of developed applications

c. Determine and document any special installation/configuration requirements

3.5 Task 5: Cloud Services [NRTIO, NXGBCC]

3.5.1 The Contractor shall sustain cloud infrastructure in accordance with the Government Hosted Cloud processes.

3.5.2 The Contractor shall physically maintain all Cloud data solely on equipment located within the legal jurisdiction of the United States in accordance with (IAW) DFARS 239.7602- 2(b). All data, including but not limited to documents, administrative data, support data, and billing data, transmitted via the system or maintained in the system shall reside at all times in data processing and storage equipment located in the United States or in data processing and storage equipment of which the operation and maintenance are subject only to the laws of the United States. Cloud data transmitted must only be subject to disclosure pursuant to U.S. Federal law and not the laws of any other jurisdiction or foreign nation. All DoW information/data placed or created by DoW users in a Cloud Service Provider’s (CSP) Cloud Service Offering

(CSO) is owned by the DoW, the Mission Owner, and/or their Information Owner. The CSP has no rights to the DoW’s information/data. For more information on data storage, data rights, and data ownership requirements refer to Section 5.2, Legal Considerations, in the DoW Cloud Computing Security Reference Guide (SRG).

3.5.3 The Contractor shall provide Cloud application operations, maintenance, and continual enhancement activities such as, (but not limited to):

• Patching Applications, Platforms and Operating System(s), as appropriate

• Fixing Production Defects

• Fixing Cybersecurity Vulnerabilities

• Providing other Application-level CSSP Support: non inherently-Governmental application cybersecurity services as defined in DoD Instruction 8530.01 Cybersecurity Activities Support to DoW Information Network Operations to Protect, Detect, Respond, and Sustain applications and data in the commercial cloud.

3.5.4 The Contractor shall ensure that all current architectures are maintained in the Contractor’s technical documentation deliverables and that all software is appropriately licensed.

The Government will temporarily grant the Contractor Root Access to configure roles and Identity Access Management (IAM). The Contractor shall relinquish Root Access once user access/roles are established.

3.5.5 The Contractor shall provide training on how to operate the migrated application in the cloud. The Government desires the Contractor to use online training to the maximum extent possible. The Contractor shall provide all training material in original and editable formats, to the Government. Training shall include, but is not limited to, Standard Operating Procedures (SOP), automation scripts and processes, security and performance documentation, listings of current deficiencies, and incident ticket data (CDRL A015).

3.5.6 The Contractor shall work with the Government to identify an approach to leverage existing Army Purchased Licensing and Joint Enterprise License Agreements/Enterprise Licensing Agreements (JELA/ELA) to purchase licenses required for DoW ABIS, with a goal of minimizing any software purchased under this contract. All licenses purchased under this contract will be owned by the Government. The Government reserves the right to buy required software licenses outside of this Contract and provide as GFE.

3.5.7 The Contractor shall assist the Government in obtaining a Cybersecurity Service Provider (CSSP) for the Cloud environment(s).

3.5.7.1 The Contractor shall generate and provide Risk Management Framework (RMF) required authorization-related documentation and artifacts to the cARMY Information System Security Owner (ISO) and Manager (ISSM). The Contractor shall support the required Assessment and Authorization (A&A) process by developing and providing all required documentation, implementing and assessing all the appropriate controls for cARMY.

3.5.7.2 The Contractor shall perform Cybersecurity vulnerability scans and address all findings in accordance with DoW and Army directives and policies.

3.5.7.3 The Contractor shall conduct Information Assurance Vulnerability Management (IAVM) Monitoring and Response activities, to include development and production of all necessary documentation to support these activities.

3.5.7.4 The Contractor shall work with the Government’s chosen Cyber Security Service Provider (CSSP) to establish CSSP services (as required by DoDI 8530 and as described by the Defense Information Systems Agency (DISA) Cloud Computing Security Requirements Guide) for Army applications hosted in commercial cloud.

3.5.7.5 The Contractor shall ensure that all data-at-rest and data in-transit is encrypted utilizing NSA-approved encryption.

3.5.7.6 The Contractor shall comply with the DoW Secure Cloud Computing Architecture

(SCCA).

3.5.7.7 The Contractor shall adhere to the DoW Cloud Computing Security Requirements Guide version 1 release 3 (or superseding versions/releases). Contractors shall provide security incident response plans. Updates to the plans are required on an annual basis or when a significant change occurs to the technical or operational environment.

3.6 Task 6: Help Desk Services [NRTIO, NXGBCC]

The Contractor shall provide Tier One (1), Two (2) and Three (3) help desk support for BCC systems. The Contractor shall provide an information security (IT) Service Management tool capable of automating the service management process. The tool shall capture workflows, tasks, change management, and trouble tickets that shall be transferred to the Government.

3.6.1 Help Desk Support

The Contractor shall maintain a three (3) Tier Help Desk in support of field reported issues. Tier 1 (field/theater) is responsible to initiate a trouble ticket and assist users in determining root cause and corrective actions, if possible, within 12 hours of trouble ticket acceptance. If unable to close the trouble ticket, then the trouble ticket shall be escalated to Tier 2, which shall attempt to replicate the reported problem and offer immediate assistance to Tier 1 within 24 hours of receipt of trouble ticket escalation. If problem cannot be corrected at Tier 2 (CONUS based), then it shall be escalated to Tier 3 (CONUS based). Tier 3 shall attempt to replicate the issue and suggest a corrective action, a software patch, or software upgrade depending on complexity of corrective action required. Tier 3 shall report initial findings to the field within 24 hours of escalation from Tier 2. If a software patch or upgrade is required, the COR shall prioritize the effort and determine a mutually agreed to schedule via the Configuration Control Board, for implementation down to the field tier.

3.6.1.1 The Contractor shall provide Tier One (1) help desk support IAW the support level of effort associated with each location. The Contractor shall provide Tier Two (2) help desk support during the normal duty hours of 9-5 pm EST/EDT. The Contractor shall provide Tier Three (3) help desk support during normal duty hours of 9-5 pm EST/EDT.

3.6.1.2 The Contractor shall provide Tier One (1) help desk support at various locations throughout the COCOMs. Tier Two (2) help desk support shall be accomplished within the United States at a Contractor-provided facility. Tier Three (3) help desk support shall be provided at the Contractor’s software engineering services location.

3.6.1.3 The Contractor shall provide Help Desk support for BCC systems’ hardware and software. This shall be made via a toll-free number and webpage (HTTPS). The webpage shall include a current list of Frequently Asked Questions (FAQs).

3.6.1.4 The Contractor shall develop a Help Desk SOP (CDRL A015) to ensure continuity, consistency, and the actions taken on each request from the customers.

3.7 Task 7: Cybersecurity Services [NRTIO, NXGBCC]

The Contractor shall perform cybersecurity activities to support the RMF as defined in the DoW Instruction (DoDI) 8500.01 and DoDI 8510.01 for the system(s). The Contractor shall appoint an Information Systems Security Officer (ISSO) to develop and deliver to the Government’s Information System Security Manager (ISSM) RMF Authority to Operate (ATO) artifacts/deliverables (CDRL A007).

3.7.1 ISSO Support

The Contractor ISSO shall:

a. Perform all requisite activities to obtain and maintain an ATO and/or Assess Only Authorization for all system environments in accordance AR 25–1 and AR 25–2

b. Support PM Biometrics in navigating the RMF authorization process, including preparation for system evaluation by the Security Control Assessor (SCA) and completion of all required authorizations.

c. Ensure all systems are compliant per DISA guidelines, and have all applicable Security Technical Implementation Guides (STIG) applied to the system components prior to implementation.

d. Maintain and analyze audit logs accessible by Government-designated personnel, for a minimum of 12 months in accordance with Army Regulations and NIST Special Publication (SP) 800–53 Audit Controls.

e. Remediate or mitigate all vulnerabilities and security deficiencies and develop in an RMF Plan of Action and Milestones (POA&M) in the authorized PEO IEW&S tool format.

f. Coordinate with the Security Team until all weaknesses are eliminated or mitigated.

g. Furnish all necessary artifacts, including the System Security Plan, Privacy Impact

Assessment, and supporting documentation to fulfill RMF requirements, facilitate the production and deployment of new capabilities and achieve ATO IAW Cyber Security Authorization and Accreditation Artifact Data (CDRL A007).

h. Verify products to include open-source products, against the Approved Product List (APL) and submit APL approval and waiver requests as required by PM Biometrics, Army, and DoW Cybersecurity policy.

i. Provide a STIG Compliance Status Report (WP014 System Technical Implementation Guide (STIG) Compliance Status Report) (CDRL A007).

j. Ensure Information Assurance Vulnerability Alert (IAVA) compliance, protecting all vulnerability information in accordance with the PM Biometrics SCG and handling procedures for Controlled Unclassified Information (CUI).

k. Provide full system vulnerability scans including all information system and network devices using current DoW approved vulnerability scanning tool after each system update (maintenance release or cyber release) at a frequency identified by the Government.

l. Respond to Army Cyber Operations Orders (OPORD).

m. Contribute to the categorization/ Federal Information Processing Standards (FIPS) 199 process.

n. Provide cybersecurity summary reports and periodic information feeds to support PM

Biometrics' situational awareness and decision-making processes (CDRL A007).

o. Implement the necessary cybersecurity mechanisms to support operational security services and conduct regularly scheduled vulnerability assessments to validate the effectiveness of implemented security controls and ensure compliance with the established system security baseline.

p. Provide security services in accordance with applicable Army, DoW, and PM Biometrics cybersecurity policies and procedures, including the PM Biometrics Security SCG and the security controls outlined in NIST SP 800-53 Revision 5, or subsequent applicable NIST publications.

q. Implement U.S. Cyber Command (USCYBERCOM) and PM Biometrics-directed cybersecurity mandates, including compliance with information operations conditions (INFOCONs), IAVAs, and other applicable directives. Provide vulnerability remediation services, including operating system, application, and hardware/firmware updates, and patch management activities.

r. Provide the appropriate RMF artifacts, analyses, test, evaluation…