Attachment 0001 ICIDS-V SOW.pdf

W911QY-16-D-0025

P00006

1.0 INTRODUCTION

The objective of this acquisition is to provide Integrated Commercial Intrusion Detection System-V (ICIDS-V) hardware and software for multiple Military Installations. ICIDS-V provides intrusion detection capabilities for Installation Commanders to protect Government assets and information. ICIDS-V consists of Commercial off the Shelf (COTS) equipment, interior and exterior sensors, Primary Monitor Consoles (PMC), Remote Status Monitors (RSM), Remote Area Data Collectors (RADC), Closed Circuit Television (CCTV) and Entry Control Equipment

(ECE).

1.1 ICIDS-V Performance Capabilities

The Contractor shall install an ICIDS-V Alarm System that integrates the Contractor Furnished

Equipment (CFE) and existing Government Furnished Property (GFP) to meet the requirements of this SOW and System Performance Specification (SPS). This effort includes:

Engineering Support Test Laboratory (ESTL) Intrusion Detection System (IDS) Site Survey (SS) Site Specific Design (SSD) Site Preparation Installation Materials One Year Warranty Operator, Systems Administrator, Sensitive Compartmented Information Facility (SCIF) and Maintainer

Training System Performance Verification (SPV) and Government Endurance Testing (ET) Technical Manual (TM)

The system shall be a reliable, modular, scalable, open architecture for system and subsystem design supporting lifecycle supportability and capability growth. The ICIDS-V solution shall be based on integrated system performance, industry best practices, long-term availability and supportability. The Contractor shall also be responsible for maintenance and cybersecurity for ICIDS-III and ICIDS-IV lab systems.

1.2 Concept of Operations (CONOPS)

Shown below in Figure 1, is the notional concept of how the system is integrated and connected to support the SPS requirements. (See Section J, Attachment 1.1 System Performance Specification for additional details.)

1.3 ICIDS-V Sites

ICIDS-V shall be delivered and installed inside Continental United States (CONUS). The ICIDS-V

Fielding Schedule is listed in Section J, Attachment 2.1, subject to funding and priority for execution.

Potential ICIDS-V Air Force and Navy Installations are To Be Determined (TBD). If delivery and installation Outside Continental United States (OCONUS) is necessary, it will be as directed by a Delivery Order. The Contractor shall coordinate theater clearance or Status of Forces Agreement (SOFA) requirements for OCONUS sites as necessary, see paragraph 4.13.

1.3.1 ICIDS-V Delivery Order (DO)

The Contractor shall propose and execute individual DOs after contract award to include management, survey, design, installation, testing, training, manuals and modifications.

2.0 APPLICABLE DOCUMENTS

References are shown in Section J, Attachment 1.6. If a document is referenced in this SOW without indicating any specific paragraph as applicable, the entire document applies.

2.1 Order of Precedence

In event of a conflict between the SOW text and references, the SOW text takes precedence followed by the SPS. This SOW does not supersede applicable laws and regulations.

3.0 REQUIREMENTS

3.1 General

The Contractor shall deliver fully functional ICIDS-V Alarm Systems to designated Installations In Accordance With (IAW) the ICIDS-V Contract and resulting DOs. The Contractor shall provide and maintain an ESTL. The Contractor is responsible for the delivery and installation of all equipment as required by this contract and subsequent Delivery Orders. The contractor shall allow the Installation site personnel to operate and use the installed system during the installation and transition to full ICIDS-V operations. The contractor is responsible for the operation and maintenance during the installation period of each Delivery Order until the Government and the Installation sign a DA Form 4604, Security Construction Statement, therefore providing for the Government Acceptance of the installed ICIDS-V.

3.2 Program Management

The Contractor shall implement, manage, update and maintain an Integrated Master Schedule (IMS).

This information shall be presented for discussion at each Program Status Review (PSR) and delivered in the Contractor’s Progress, Status and Management Report IAW Contract Data Requirements List (CDRL) A001. The Contractor shall produce and install ICIDS-V IAW the Contractor's Government-approved plan and schedule. The plan and schedule shall be used as a management tool to assess progress and status. The Contractor shall report on work-in-progress at the monthly PSR and in CDRL A001. The contractor shall provide the names, work location and current security clearance or National Agency Check (NAC) status of all personnel working on the contract, including training and certifications in CDRL A001. The location for each PSR shall be at JPdM-FPS, Ft. Belvoir, VA or the Contractor provided ESTL.

The Contractor shall participate in a weekly meeting via telephone conference with JPdM-FPS to review status of cost, schedule and performance. The Contractor shall host a start of work meeting within 30 days after contract award. The Contractor shall provide the Government an agenda for approval seven calendar days prior to scheduled meetings. The Contractor shall be responsible for recording the minutes of meetings conducted with the Government. The Contractor shall submit Report, Record of Meetings IAW

CDRL A002.

3.3 Engineering Support

Engineering Support consists of SS, SSD, installation, software/hardware engineering, Cybersecurity for Installations and the ESTL as defined in the following paragraphs.

3.3.1 ESTL

The Contractor shall establish, maintain and administer an ICIDS ESTL through end of the last warranty period.

The Contractor shall provide space in ESTL for ICIDS-III and ICIDS-IV GFP; see Section J, Attachment 1.9, ICIDS-III/IV Equipment for ESTL. The computer and communications network devices exclusive of the RADCs and sensors shall be installed, operated and maintained by the Contractor. All other equipment will be stored and used as needed during the contract period. The Government does not intend to provide any ICIDS-V GFP for use in the ESTL. The Contractor shall use the ESTL for Performance Verification Test (PVT)-1 IAW paragraph 3.16.2. The ESTL will also be used for training and demonstration purposes IAW paragraph 3.13.6.2, baseline validation and Cybersecurity assessment. The ESTL shall be used as a facility to test upgrades or modifications to the ICIDS prior to fielding changes at an operational site. The ESTL shall have a current baseline configuration to resolve issues that arise during fielding. The preferred location of the ESTL shall be no more than 30 miles radius from JPdM-FPS, Fort Belvoir, VA. All component hardware, software, labor and facilities for the ESTL shall be provided by the Contractor. Upon completion of PVT-1, equipment shall remain for Contractor and Government use in the ESTL for the life of the contract. The Government will take possession of ESTL equipment upon end of the last warranty period. The Government will witness all testing and evaluation as required.

3.3.2 Interface Requirements

The system shall provide an Interface that permits other IDS sensors and other Department of Defense

(DoD) data bases to provide input for display. The ICIDS-V shall bi-directionally communicate data via the Security Equipment Integration Working Group (SEIWG) 0101-series Interface Control Document (ICD) and the Ozone Widget Framework when required. Potential integration systems include Mobile Detection Assessment Response System (MDARS), Common Operating Picture, Installation Protection Platform and Automated Installation Entry (AIE).

3.4 Configuration Management (CM)

The Government is the CM decision authority. The Government will manage and chair the ICIDS-V System Configuration Control Board (CCB) throughout its lifecycle. The Government will approve Class I or Class II designation for all changes. The Contractor shall participate and support the CCB and conduct configuration control activities IAW the JPdM-FPS Configuration Management Plan, see Section J, Attachment 1.8.

3.4.1 CM Requirements

The Contractor shall provide and execute an ICIDS-V Contractor's Configuration Management Plan

IAW CDRL A003. The Contractor shall comply with the JPdM-FPS CM procedures for all hardware and software changes. The Contractor shall provide configuration item identification and control activities of all ICIDS-V hardware and software as part of the CM process. All changes will be approved or disapproved by the CCB IAW the JPdM-FPS CM Plan.

The initial configuration shall consist of materials as identified by the Contractor in the proposed solution. The Contractor shall notify the Contracting Officer (KO) within 60 days of product availability changes and provide alternate courses of action if the initial configuration will no longer be supportable.

All recommended ICIDS-V changes shall be submitted by Computer Software Product End Items, CDRL A004 or Commercial Drawings/Models and Associated Lists, CDRL A005. All change requests shall be submitted with complete supporting documentation, including the need or reason for change and the price/schedule impact. Prior approval by the KO is required before any changes are implemented. If a reoccurring need is identified for a specific hardware and/or software item, the Contractor shall recommend the Government incorporate the item into the contract. The Government reserves the right to require the Contractor to provide additional supporting technical analysis and to specify additional testing to verify proposed change prior to approval. The price of configuration changes, other than hardware upgrades or those requested by the Government shall be the responsibility of the Contractor.

3.4.2 Physical Configuration Audit (PCA)

The PCA shall confirm proper execution of the Installation Engineering Plan, CDRL A006 and accuracy of the Commercial Drawings/Models and Associated Lists, CDRL A008. The Contractor shall provide and execute a Configuration Audit Plan, IAW CDRL A009.

The Contractor shall conduct a PCA witnessed by the Government. The PCA shall be conducted after PVT-1, PVT-2, System Acceptance Testing (SAT) at Installations and any configuration changes. Upon completion of testing and correction of all failures, the system site configuration shall either confirm the baseline or identify corrections to the baseline for the ESTL and Installations. The results of the PCA shall be included in the Test Report for each testing event. The Contractor shall provide the PCA on 5% of installed RADCs and 100% of the PMCs, Operator Work Stations and RSMs.

3.4.3 Regression Testing.

The contractor shall identify the extent of regression testing required before a system or equipment change is implemented and documented in accordance with the JPdM-FPS CM Plan process.

3.5 Information System Security Engineering (ISSE)

The Contractor shall provide system level support IAW references, provisions of Department of Defense Instruction (DoDI) 8500.01, DoDI 8510.01, Army Regulation (AR) 25-1 and 25-2, Army Knowledge Management and Information Technology.

The Contractor shall conduct Security Test and Evaluations (ST&Es) to assess the system’s security posture when performing accreditation or during major changes impacting computing environment or accreditation boundary. The ST&Es shall be conducted to uncover design, implementation and operational flaws that may affect the confidentiality, integrity and availability of the system. The Contractor shall support the Federal Information Security Management Act (FISMA) yearly assessments. The Contractor shall provide documents, data, certification tests results and access for major changes and recertification.

The Contractor shall continuously assess and monitor security policies and procedures to incorporate an Information Assurance Vulnerability Management (IAVM) program as referenced under Enclosure 6 of DoDI O- 8530.2, Support to Computer Network Defense, dated 09 March 2001 and Chairman Joint Chiefs of Staff Instruction (CJCSI) 6510.01F, dated 09 February 2011, Information Assurance (IA) and Computer Network Defense (CND) and National Institute for Standards and Technology (NIST) SP800-40v2, Creating the Patch and Vulnerability Management Program, into the ICIDS-V deployment and production environments. The Contractor shall comply with the requirement for IA Vulnerability Alerts. The Contractor shall include in the CM plan how the ICIDS-V systems delivered to the Installations shall be updated as a result of changes to the baseline configuration.

The Contractor shall continuously maintain, review and assess the status of the system as it relates to the certification and accreditation security posture. The Contractor shall identify any changes that would change the accreditation boundary, impact current operation procedures, impact current content of technical manuals or require extended development or testing.

3.6 Information Assurance (IA)/Cybersecurity

The Contractor shall ensure ICIDS-V obtains a Department of Defense (DoD) system accreditation for connection to an Installation's Virtual Local Area Network (VLAN). The ICIDS-V is classified as Mission Assurance Category (MAC) Level II and Classified Level (CL) as Sensitive and operates in a "closed" restricted VLAN environment.

The Contractor shall ensure the ICIDS-V System, if operational requirement arises, is capable of obtaining an Army Networthiness Certification for connection to an Installation’s Non-secure Internet Protocol Router Network (NIPRNET) IAW DoDI 8500.2, Information Assurance Implementation and DoDI 8510.01, Risk Management Framework (RMF) for DoD Information Technology (IT). The Contractor shall account for and address all DoD IA Controls assigned to a MAC II/CL Sensitive DoD IT system or the equivalent Risk Management Framework designation. The Contractor shall develop, track and resolve assigned IA controls including inherited IA controls via a Defense Information Assurance Certification and Accreditation Process (DIACAP) Scorecard and IT Security Plan of Action and Milestone(s) (POA&M). The contractor shall develop, track and resolve DIACAP Implementation Plan (DIP) IA controls if RMF is implemented or Army Networthiness Certification is required. The accreditation documentation shall be developed and delivered according to Information Systems Accreditation Documentation, CDRL A010, Information Assurance Test Report, CDRL A011, Vulnerability Scan Compliance Report, CDRL A012, Information Assurance (IA) Design Review Information Package, CDRL A013 and Information Assurance Test Report, CDRL A014. The plan(s) shall include the IA control implementation status, responsible entities, resources and the estimated completion date for each assigned IA control. Plans shall identify quarterly requirements to ensure IA controls are corrected when new scans are run and how the updated baselines are sent to the field during the contract performance period.

The Contractor shall be familiar with the DoD RMF for DoD IT policy guidance through the transition from DIACAP. The RMF replaces the DIACAP and manages the life-cycle cybersecurity risk to DoD IT.

The cybersecurity requirements for DoD IT shall be managed through the RMF consistent with the principles established in National Institute of Standards and Technology (NIST) Special Publication (SP)

800-37. All DoD Information Systems must be categorized IAW Committee on National Security Systems Instruction (CNSSI) 1253 and implement a corresponding set of security controls from NIST SP 800-53.

The assessment procedures from NIST SP 800-53A and DoD-specific assignment values, overlays, implementation guidance and assessment procedures shall be used. The Contractor shall be prepared to implement the Army’s RMF processes and procedures upon receiving policy guidance.

The Contractor shall configure the ICIDS-V IAW applicable Defense Information System Agency (DISA) Security Technical Implementation Guides (STIGs). STIGs should be identified for specific components, Operating System, Database, Metadata Technologies and document applicable DoD policies, security requirements, best practices and configuration guidelines. STIGs are associated with security controls through Control Correlation Identifiers (CCIs) which are decompositions of NIST SP 800-53 security controls into single, actionable and measurable items. Security Requirements Guides (SRGs) are developed by DISA to provide general security compliance guidelines and serve as source guidance documents for STIGs. When a STIG is not available for a product, an SRG may be used. STIGs, SRGs, and CCIs shall be executed at least annually to ensure system security posture remains consistent with the accreditation baseline and are available on the IA Support Environment website (http://iase.disa.mil).

The Contractor shall use Security Content Automation Protocol (SCAP), appropriate STIG and benchmarks, Security Readiness Review (SRR) scripts and retina until Assured Compliance Assessment Solution (ACAS) is required to validate ICIDS-V Baseline. STIG and SRG compliance results for products shall be documented as security control assessment results within a product-level Security Assessment Report (SAR) and reviewed by the responsible Government Information System Security Manager (ISSM) and Security Control Assessor (SCA), formerly the Agent for the Certification Authority (ACA), for acceptance or connection into an authorized computing environment. This review ensures products will not introduce vulnerabilities into the hosting DoD Information System. The SCA’s risk assessment will be used by the SCA to determine the level of overall system cybersecurity risk and a basis for recommendation of risk acceptance or denial to the Authorizing Official (AO), formerly the Designated Accrediting Authority (DAA). The SCA’s risk assessment considers threats, vulnerabilities and potential impacts as well as existing and planned risk mitigation. The risk assessment will address all Non- Compliant (NC) controls and clearly communicate the SCA’s conclusion on system cybersecurity risk and any recommendations for special instructions to accompany the authorization decision.

Actual results of the SCA’s risk assessment are recorded in the SAR, formerly the DIACAP Scorecard and Plan of Action and Milestones (POA&M), as part of the security authorization package along with any artifacts produced during the assessment such as output from automated test tools or screen shots that depict aspects of system configuration.

After RMF implementation is defined and required by the DoD’s transition from DIACAP to RMF for DoD IT, the Contractor shall submit for Government approval an overarching security plan IAW DoDI

8510.01 which describes their strategy for implementation of IA/Cybersecurity requirements throughout the life of the contract.

The security plan shall address the security controls described in NIST SP 800-53 and should be tailored in scope and depth appropriate to the effort and the specific unclassified DoD information. The Contractor shall include updates to all installed ICIDS-V systems as a result of changes to the baseline configuration to support RMF through the end of the final warranty period.

The Contractor shall provide and execute an ICIDS-V Information Systems Accreditation Documentation IAW CDRL A010. The plan provides an overview of security solutions for the system and describes security controls in place or planned. The security plan shall include implementation status, responsible entities, resources and estimated completion dates. The security plan shall include a compiled list of system characteristics required for system registration and key security-related ICIDS-V documents such as a risk assessment, privacy impact assessment, system interconnection agreements, contingency plan, security configurations, configuration management plan and incident response plan. Government approval of the security plan, prior to implementation, also establishes the level of effort required to successfully complete the remainder of the steps in the RMF and provides the basis of the security specification for the acquisition of the system, subsystems or components. The AO’s approval of the security plan must be documented in the security plan.

The Contractor shall deliver an ICIDS-V solution that will achieve an Authority to Operate (ATO) accreditation decision for operation on a Closed Restricted Network in the Army’s LandWarNet which is based on achieving and maintaining an acceptable risk posture. The ICIDS-V shall be characterized as a “type authorization” which is used to deploy identical copies of a DoD Information System in specified environments. This method allows a single security authorization package to be developed for an archetype (common) version of a system. The system can then be deployed to multiple locations with a set of installation, security control and configuration requirements or operational security needs that will be provided by the hosting enclave.

A certification test and evaluation (CT&E) shall be conducted in the ESTL and the results validated by an agent of the certifying authority (ACA) or the Security Control Assessor (SCA). An Information Assurance Test Report shall be delivered IAW CDRL A011. Following a successful CT&E, a security test and evaluation (ST&E) will be conducted at a predetermined deployment site and results verified by the ACA or the SCA. Upon completion of the ST&E, an Information Assurance Test Report shall be delivered

IAW CDRL A014.

The Contractor shall execute corrective actions to resolve or mitigate all security weaknesses identified during the Certification and Accreditation (C&A) process associated with the design, engineering, integration, configuration, implementation and documentation of the ICIDS-V solution. This information will be recorded and tracked in an IT Security POA&M. The Contractor shall prepare the POA&M based on the vulnerabilities identified during the security control assessment. Inherited vulnerabilities must be addressed in the POA&Ms. POA&Ms must be active throughout a system’s lifecycle as vulnerabilities remain or are remediated. Any required security controls that are not explicit in the contract or otherwise covered by a Service Level Agreement (SLA) must be assessed as NC. All such NC security controls must be documented in a POA&M with an explanation as to why accepting the risk of operating the system in a NC status is acceptable.

The Contractor shall continuously maintain, review and assess the status of the system as it relates to the C&A security posture. The Contractor shall adhere to IA controls that relate to configuration and vulnerability management, performance monitoring and implement capabilities to continuously monitor the system and information environment for security relevant events and configuration changes that negatively affect security posture. The system level continuous monitoring strategy must conform to all applicable published DoD enterprise level or Army continuous monitoring strategies. The Contractor shall report significant changes in the security posture of the system and recommended mitigations, immediately to the Government. At the direction of the SCA or AO, the Government may schedule a revalidation of any or all IA controls at any time.

3.7 Site Survey (SS), Site Survey Design (SSD) and Installation

3.7.1 Site Survey (SS)

JPdM-FPS will provide the Contractor the following for each Installation:

A. Available Installation drawings B. Contact information for the Government Installation Point Of Contact (POC) C. Security Office POC for verifying security clearances of Contractor personnel D. List of remote areas currently installed with IDS E. List of remote areas that require IDS

The Contractor shall use the Government-provided information to develop the proposed schedule for

DO award. Within ten days of receipt of the draft DO, the Contractor shall submit a proposal with supporting rationale for the schedule to accomplish: SS, SSD including Design Review, alarm system installation, material disposition, interface with GFP, training, testing, warranty, timeline for scheduled maintenance at each Installation and proposed travel for DO completion. Upon acceptance of the proposal, the KO will issue a DO and the Contractor shall proceed with schedule coordination for the site survey.

3.7.2 Performance of Site Survey (SS)

The SS is a critical factor toward successful completion of ICIDS installation. The SS team shall be qualified in all aspects of the SS process including management, technical and previous IDS SS experience.

The Contractor shall perform the SS and deliver a Site Survey Report (SSR), CDRL A015.

The Contractor shall conduct a SS using a Contractor checklist to determine equipment, quantities and locations necessary for a complete ICIDS-V installation. The SS shall identify Installation preparation requirements and define hardware/software interfaces with existing IDS or other security equipment. All Government provided Installation documentation shall be verified with existing conditions. The Contractor shall verify availability and quality of any Government furnished Data Transmission Media (DTM), low voltage transmission lines and electrical grounding systems. All DTM and radio links shall be tested to determine suitability for use. The contractor shall report differing site conditions immediately to the KO.

The SS shall document any differing site conditions. If the SS identifies more or less zones than the Government provided information, the Contractor shall immediately notify the KO. If authorized by the KO, the Contractor shall complete the SS of all zones identified and provide a revised proposal. The proposal shall provide supporting rationale for the changes, to include travel/subsistence estimates to accomplish the SS. Upon Government approval of the proposal, the KO will issue a contract modification to adjust the price and scope of the DO.

Each Installation will provide the Contractor with suitable storage and office workspace IAW agreed terms and conditions set forth in the Memorandum Of Notification (MON)/Material Fielding Agreement (MFA) between the JPdM-FPS and the gaining Commander. If the Government cannot provide suitable storage and office space as determined prior to arrival of the SS Team, the Contractor shall identify and propose an alternate plan to include possible off site location. If directed by the Installation physical security office, the Contractor shall coordinate with the Installation public works activity manager to obtain approval from the Garrison Commander before facilities on a garrison are made available. This action is IAW AR 420-1 where contractors are required to have agreements with the Installation and the servicing utilities. The Contractor is responsible for daily clean up and shall be in compliance with all safety regulations and codes.

3.7.3 Site Survey Report (SSR)

The Contractor shall deliver an SSR to report findings of the SS. Installation conditions, new facilities or other changed requirements shall be documented in detail. Zone drawings, changed equipment layouts, revised block diagrams, preliminary price data for the equipment and installation and other data shall be included. The Contractor shall identify any environmental conditions that would exceed the operational limits of equipment to be installed.

3.7.4 Site Preparation Requirements and Installation Plan (SPRIP)

The Contractor shall submit a Site Preparation Requirements and Installation Plan IAW CDRL A016.

This document shall denote installation preparation requirements and required completion dates. The plan shall provide the results of DTM tests for use in ICIDS-V. Should unsuitable DTM be identified, the plan shall make recommendations for using alternative DTM or re-conditioning/replacing existing DTM.

The SPRIP shall identify a schedule for installation, mobilization, facility access, planned utility interruptions, system startup, checkout, projected test schedules and other tasks required to accomplish the ICIDS-V installation. The Installation will be responsible for site preparation. If the Installation cannot resolve site preparation issues, JPdM-FPS will coordinate with the Installation for resolution.

3.7.5 Site Survey Design (SSD)

The SSD shall provide a complete description of the ICIDS-V Installation design IAW CDRL A006, Installation Engineering Plan and Commercial Drawings/Models and Associated Lists, CDRL A007.

Design documentation package shall include required drawings, design analysis and other data required to support the design. Design shall include executive summary, site description, fielding schedule, building and utility system diagrams, Bill of Materials, drawings, Installation maps and system integration diagrams.

System design shall include integration of the alarm system with the Installation's network and existing Installation IDS.

The Contractor shall conduct SSD review not later than 15 calendar days after receipt of Government comments on CDRLs A006 and A007. The SSD review shall take place at the gaining Installation or via teleconference at the Government discretion. The Contractor shall discuss technical issues requiring Government guidance.

3.7.5.1 Drawings

The Contractor shall deliver a drawing package IAW CDRL A007 to include:

A. Title sheet B. Index of abbreviations and symbols along with definitions C. Index of all software, to include version number to be installed D. Site plan E. ICIDS-V block diagram, including data link interface between all data collectors via the Installation’s DTM to the PMC F. ICIDS-V zones and sensor installation design by building and room number including definition of existing equipment to be removed and equipment to be interfaced with ICIDS-V G. Site Security Center equipment layout and arrangement H. CCTV block diagram, if applicable I. Entry Control System block diagram, if applicable

3.7.5.2 Installation Engineering Plan

The SSD shall be IAW CDRL A006 to include a narrative discussion of design philosophy, assumptions, reference sources and calculations.

3.7.5.3 Design Review and Final Design Documentation

Upon Government review of design and completion of Design Review, the Contractor shall provide final IEP and SSD for Government approval IAW CDRLs A006 and A007.

3.8 Site Installation

The date of installation initiation shall be determined by the Government upon final acceptance of the Contractor’s SSD and completion of any required site preparation. During installation, the existing IDS must remain operational for each zone until that zone is replaced. During transition of operations from existing IDS to ICIDS-V, the Contractor shall not disrupt system operations for more than 24 hours. No more than 10 percent of the system shall be inoperable at any time. The Contractor shall maintain ICIDS-V during transition until Government acceptance, at which time the warranty period will commence.

Installation shall be completed within the time set forth in the DO. ICIDS-V shall be installed IAW the Government approved IEP and SSD. Prior to Government acceptance of the installed system, the Contractor shall revise SSD drawings to reflect actual installed design IAW CDRL A008. The drawings shall reflect all field changes.

All interruptions of utility services shall be scheduled with the Government POC. The Contractor shall minimize interruption of services.

3.9 Equipment Delivery and Storage

The Contractor shall prepare and deliver required materials and equipment. The Contractor shall perform loading, unloading, packing, unpacking, inventory and inspection of equipment at each Installation. The Contractor shall ensure proper storage and security of materials and equipment during contract performance. If the Installation cannot provide storage, the Contractor shall include cost/price in the final Delivery Order proposal.

3.10 Removal of Installation Debris

The Contractor shall ensure removal and disposal of all debris generated as a result of the installation including removed equipment IAW the DO.

3.11 Software Requirements

3.11.1 System Application Software

The Contractor shall provide system and application software. System software shall support application software programs IAW the SPS. If a software license is required, a one-time Installation license shall be provided.

3.11.2 Software Defect Corrections

Corrections to software defects shall be made available and installed at no change in contract price or

Period of Performance (PoP) extension.

3.11.3 System Software

Upon successful completion of PVT and subsequent System Acceptance Test (SAT) IAW paragraph

3.16.5, the Contractor shall provide a copy of software and data installed at the Installation, Computer Software Product End Items, IAW CDRL A017.

3.12 Documentation Requirements

3.12.1 Product Bulletins

The Contractor shall provide any product bulletins that impact ICIDS to the Contracting Officer’s

Representative (COR).

3.13 Supportability

The Contractor shall implement reliability and maintainability programs to meet all ICIDS-V SPS reliability requirements.

The Contractor shall identify all failures, determine the causes of all failures, correct all failures and deliver to the Government a written report, Failure Analysis and Corrective Action Report (FACAR), IAW

CDRL A018.

3.13.1 Contractor Logistics Support (CLS)

A one year warranty, beginning upon Government acceptance, including all parts and labor for all supplies delivered under this contract is required. Warranty shall include quarterly maintenance visits. The Contractor shall provide warranty response help desk service 24 hours per day, seven days per week during the Warranty PoP. Call response time will be less than 30 minutes. Maintenance Service Reports detailing maintenance problem(s) and corrective action(s) shall be delivered IAW CDRL A019.

3.13.1.1 Warranty Repair

The Contractor shall plan for repair actions on items that fail during the one year warranty period.

Specific tasks to be performed shall be provided in the Maintenance Support Plan, CDRL A020. The Maintenance Support Plan shall define the process for documenting failed Contractor installed equipment, repair, replacement, modification and test and reporting corrective actions to JPdM-FPS. The Contractor shall provide a timeline identifying when scheduled warranty maintenance will be performed at each Installation.

3.13.1.2 Warranty Repair Time

Contractor scheduled maintenance shall not interrupt system operations. Repair time for unscheduled warranty repair of an operational mission failure shall not exceed the time of eight or 24 hours as specified in the DO. An operational mission failure is defined as a malfunction of the system that results in loss of system performance requiring deployment of a guard force to 1/16th or greater of the protected zones. For other failures, response and repair time shall not exceed 24 hours. Warranty repair time for service calls is measured from the time the Contractor is notified to the time Contractor’s work force has completed repair.

3.13.2 Manpower and Personnel

The Contractor shall provide Original Equipment Manufacturer (OEM) equipment certified personnel for the installation, maintenance, training, and administration of ICIDS-V during the life of the contract.

3.13.3 Requirements for Unique Item Identification (UID)

The Government does not anticipate any components to exceed $5,000. However, if any component exceeds $5,000, Contractor shall mark all contract deliverables IAW the following requirements.

3.13.3.1 UID Marking

The Contractor shall provide UID or DoD recognized equivalent, for components delivered with an acquisition cost of $5,000 or more. For long term contracts, components with range quantity prices exceeding the $5,000 unit price shall have UID markings from the beginning of the contract. Contractor shall apply UID markings to all other components identified by the Government in this contract as requiring UID markings. UID markings shall be IAW MIL-STD-130M.

3.13.3.2 Commercial Markings

All other components shall have acceptable commercial markings that meet guidelines in DoD Guide to Uniquely Identifying Items http://www.acq.osd.mil/dpap/UID/.

3.13.3.3 Permanency and Legibility

The UID marking and identification plates, tags, etching or labels when used on equipment, parts, assemblies, subassemblies, units, sets, groups or kits shall be as permanent as the normal life expectancy of the component and be capable of withstanding the environment, test, cleaning, repair and rebuild procedures specified for the item. Legibility shall be verified for ready readability per MIL-STD-130M.

3.13.3.4 Deleterious Effect

Marking of components shall be accomplished in a manner not adversely affecting the life and utility of the component. Marking materials or their placement shall not create hazardous conditions.

3.13.4 Support Equipment

The Contractor shall identify equipment required to meet Operational Readiness IAW the SPS. A list identifying required support equipment for all systems shall be included in the MSP and TM.

3.13.5 Technical Data

The Contractor shall deliver information to operate, maintain and train on the System. ICIDS has requirements for a Department of the Army (DA) Technical Manual (TM). The Contractor shall deliver the Manual as stated in requirements of SOW Attachment A for development and production of equipment publications. The TM shall be delivered IAW Scientific and Technical Reports, CDRL A021. The initial TM meeting shall take place at the ESTL to discuss all TM requirements. In Process Reviews (IPR) shall be conducted when TM is 30% and 70% complete.

3.13.6 Training and Training Support

An Executive Training Course for JPdM-FPS personnel shall provide an overview of all training. The

Contractor shall provide this training at the ESTL. Installation training shall include hands on classroom training using Contractor provided equipment. Training shall include Operator, System Administrator, SCIF Administrator and Maintenance Technician courses. Training courses shall be tailored to each Installation according to the type and quantity of equipment being installed. Contractor shall not use the installed system for training. Contractor shall comply with training requirements stated below and award a training certificate to each attendee upon successful completion.

3.13.6.1 General

The Contractor shall develop a training package and conduct training IAW paragraph 3.13.6.2. The Contractor shall provide the training plan, execution and test IAW Training Program Development and Management Plan, CDRL A022, Training Conduct Support Document, CDRL A023 and Test Package, CDRL A024.

3.13.6.2 Requirements

The Contractor shall provide training as described below:

A. Government Executive Training: The Contractor shall provide an eight hour Executive Training Course as required and IAW CLINs X039. First course shall be presented prior to PVT-1 for up to 20 JPdM- FPS personnel. Additional Executive Training and demonstrations shall be provided IAW CLIN X039 upon request by the Government.

B. Installation Training: Combined Installation Training (Operator, System Administrator and Maintainer) shall not exceed 80 hours for Installation personnel. In addition, SCIF training shall not exceed eight hours.

Course breakdown shall be:

i. Operator Training for 12 students; maximum of 16 hours

ii. System Administrator Training for four students; maximum of 24 hours

iii. Maintenance Technician Training for two students; maximum of 40 hours

iv. SCIF Training for 12 students; maximum of eight hours

Instruction for Operator, System Administrator, SCIF and Maintenance Technician personnel shall be provided at each Installation. The Contractor shall provide each of these training packages as standalone courses. The Contractor shall structure courses for hands on classroom training. Training shall include all equipment operations and functions including Operator Preventive Maintenance Checks and Services (PMCS). Operators must complete only Operator training. System Administrators must complete Operator training prior to the System Administrator training. Maintenance Technician personnel must receive Operator and System Administrator training prior to learning maintenance tasks.

C. Training, Testing Materials and Equipment: Training and testing materials will be approved by the Government prior to Contractor conducting training. The Contractor shall provide training, testing materials and equipment. Contractor shall provide each student a copy of training materials. Equipment shall provide for classroom instruction of all training. The installed ICIDS-V shall not be used for training except for the maintenance training. The maintenance training shall include reading the design drawing, location of all communications hubs and use of any system aids for trouble shooting.

D. Conduct of Courses:

i. Scope of Training. Maintenance Technician Training shall be conducted in the classroom and all areas where maintenance is required/performed. Following completion of each course, students shall be given a test to assess knowledge gained. System Operators shall be tested on their ability to successfully accomplish all of the operational actions. System Administrators shall be tested on their ability to accomplish operational actions and PMCS functions. SCIF personnel shall be tested on their ability to perform Operator and System Administrator tasks. System Maintenance Technicians shall be tested on their ability to identify, remove, replace and perform prescribed maintenance of major components specified in the TM.

ii. Length of Course. The Combined Operator, System Administrator and Maintenance Technician courses shall not exceed 80 hours. The SCIF course shall not exceed eight hours.

iii. Dates of Installation Classes. Dates for classes are determined by coordination between Contractor and the Government, based on Installation schedule and availability of equipment.

iv. Safety. The Contractor shall include in the training material detailed procedures to ensure safety of all individuals. Safety procedures shall include relevant notices, warnings, cautions and notes extracted from the TMs and from any other source of information pertinent to the safety of personnel.

v. Facilities. Classroom and practical exercise facilities will be furnished by the Installation POC who will coordinate availability and adequate facilities.

vi. Training Material. Training materials shall be furnished by the Contractor.

vii. Instructor Qualifications. Instructor(s), selected by the Contractor shall be experienced and have complete knowledge of the end item and its components.

viii. Special Instructions.

a. The Government reserves the right to record any or all training. Training material becomes the sole property of the Government and no additional copyright or individual release shall be required.

b. All visual aids, materials and test packages developed or specifically produced for use in the conduct of training courses shall become the property of the Government.

3.13.7 Computer Resources Support

The Contractor shall provide all available hardware and software upgrades IAW with CM requirements.

3.13.8 Facilities

Facilities used by the Contractor during installation, testing and training will be identified during SS by the Installation POC. Facilities where the ICIDS-V is installed shall be identified in the IEP.

3.13.9 Packaging, Handling, Storage and Transportation (PHS&T) The Contractor shall identify resources and processes required for the PHS&T to maximize availability and usability of the materiel. The Contractor shall perform PHS&T processes during DO execution.

3.13.10 Design Influence/Interface

The Contractor shall incorporate logistics in the systems engineering process IAW Integrated Product

Support, AR 700-127, Table 3-1 to maximize the availability, effectiveness and capability of the System.

3.13.11 Integrated Logistics Support Plan (ILSP)

The Contractor shall provide a tailored ILSP. The document will be IAW Integrated Logistics Support

Plan (ILSP), CDRL A042.

3.14 Security

The Contractor shall comply with the security regulations and procedures set forth in the National

Industrial Security Program Operating Manual (NISPOM) and DD Form 254, Contract Security Classification

Guide. Contractor shall provide personnel with appropriate clearance levels to fulfill requirements in each DO. Most of the contract will be UNCLASSIFIED, For Official Use Only (FOUO). Contractor personnel shall be required to access, view, possess, process and/or use information designated as FOUO. Contractor personnel must possess and maintain a SECRET security clearance and/or be eligible for immediate adjudication by the appropriate cognizant security authority upon award of the contract. Contractor personnel shall have a National Agency Check (NAC) and be a US Citizen.

Before performing and upon completion of any on site work, Contractor shall report to the Installation

Security Officer or designated representative. Contractor personnel shall possess and transmit appropriate clearances prior to arrival at the Installation. Pursuant to AR 190-11 and AR 190-13, Contractor personnel whose duties involve design, operation, test, installation or maintenance of unclassified IDS require completion of a favorable NAC or NAC with written inquiries prior to appointment to such non critical, sensitive positions. Pursuant to installation of SCIFs and Special Access Programs (SAP), design and installation should be performed by U.S. companies using U.S. citizens to reduce risk, but may be performed by U.S. companies using U.S. persons as defined in 8 U.S.C. 1 101(a)(20) or who are protected individuals as defined by Title 8 U.S.C. 1 324b (a)(3). The current clearance/citizenship status of all personnel shall be reported in CDRL A001 by duty position.

3.15 Quality Assurance Requirements

3.15.1 Responsibility for Inspection

Quality Control is an overall system of activities, including inspection whose purpose is to provide a quality of product or service that meets contract requirements.

Unless otherwise specified in the contract, the Contractor is responsible for the performance of inspection requirements. The Contractor shall provide and maintain an inspection system that shall assure that all supplies and services submitted to the Government for acceptance conform to contract requirements, whether manufactured or procured by the Contractor, or procured from subcontractors or vendors. The Contractor shall perform or have performed the inspections and tests required to substantiate product conformance to drawings, specifications and contract requirements and shall also perform all inspections and tests as required by the contract. The Contractor's inspection system shall be documented and shall be available for review by the Government throughout the life of the contract.

The Contractor shall ensure that the services, equipment, material and installation processes are completed in the same manner for each installation whether in the ESTL or the installation sites. The Contractor shall develop typical drawings for all install activities that shall be maintained as part of the Contractor’s system. The typical drawings shall be one basis for inspection of installation efforts showing placement of wiring and components of the system in containers, racks and enclosures.

3.16 Test and Evaluation

3.16.1 General

The Contractor shall develop and execute a test process that supports verification of the system. The test program shall include planning, executing and assessing system performance against the requirements.

Testing objectives include determination and execution of corrective actions and subsequent demonstrations necessary for the system to meet requirements, performance of tests to support additional capabilities, support of maintenance testing and validation of system level training. The Contractor’s testing methodologies shall address how future system changes will be tested and validated. The Contractor shall perform the tests described in the following paragraphs. The Contractor shall provide personnel, equipment and supplies necessary to perform or support testing activities. The Contractor shall notify the Government of all testing and evaluations. The Government will witness all testing and evaluation as required.

Contractor shall attend test meetings, prepare minutes, provide required documentation and assist in the resolution of issues or concerns. Discrepancies in the documentation, design or training shall be corrected prior to the conduct of all test events and may involve re-testing and re-training of personnel at Contractor’s expense.

Government may terminate testing at any time when the system fails to perform. Upon termination of testing, the Contractor shall commence an assessment period. The Contractor shall deliver a report that identifies the failure and the cause. The Contractor’s report shall include corrective actions. All these actions are reported IAW Failure Analysis and Corrective Action Report (FACAR), CDRL A025.

After delivering a written report, Contractor shall convene a test review meeting at the Installation to present results and recommendations to the Government. Based on the Contractor's report and test review meeting, Government will approve a test restart date, which may include a component re-test or a complete system re-test.

The cost of any re-starts or re-tests shall be borne by the Contractor.

The Contractor shall consider the following in developing/executing the test process:

A. The Government will conduct a Test Readiness Review (TRR) before any testing event whether at the

ESTL or an Installation. The contractor shall provide briefing information three business days…