Attachment 01 Draft FPCS Performance Work Statement.pdf

PERFORMANCE WORK STATEMENT (PWS)

DLA ENTERPRISE FIRE PROTECTION CONTROL SYSTEMS (FPCS)

1. BACKGROUND

The Defense Logistics Agency (DLA) is a United States (U.S.) Department of Defense (DoD) agency providing worldwide logistics support to the missions of the Military Departments and the Combatant Commands.

DLA Information Operations (J6) executes program management responsibility through their Enterprise Capabilities Portfolio, Installation Support Program Management Office (PMO), providing enterprise-wide policy, program and worldwide operational support for DLA’s Fire Protection Control Systems (FPCS).

In support of these missions, DLA Installation Management (DM) maintains DLA life, health, and safety systems including fire and life safety equipment/systems. DM serves as the functional and doctrinal proponent for all fire and life safety system requirements, policy, and procedures including industry standards, United Facilities Criteria (UFC) and National Fire Protection Association (NFPA) and DoD installation policy. DLA is the Authority Having Jurisdiction (AHJ) at Richmond, VA; New Cumberland, PA; Columbus, OH; and San Joaquin/ Tracy, CA. For other locations the AHJ will be determined in accordance with UFC 1-200-01 and the DLA site adheres to the applicable host site requirements.

FPCS encompass a wide array of fire and life safety systems that are installed at DoD real property facilities and include the control systems that ensure the proper function of the systems. FPCS vary in size and type depending on the intended service. There may be multiple systems of the same or different types within a single building. FPCS are operated and managed on a site-by-site basis with unique hardware, firmware, and software requirements and may include Operational Technology (OT) and some Information Technology (IT) related components. Sites currently operate multiple disparate fire and life safety systems requiring varying levels of support including some legacy systems; “legacy” meaning manufacturer obsolesce and/or unsupported hardware/ firmware.

This performance work statement (PWS) contains broad requirements for supporting the numerous sites and disparate systems throughout DLA. In support of these numerous sites and systems, DLA intends to award a firm fixed price Indefinite Delivery Indefinite Quantity (IDIQ) contract against which DLA will issue separate Task Orders (TOs) to provide specific tailored site-level requirements. This intended Enterprise approach to FPCS allows for the appropriate level of DoD-required cybersecurity measures to be integrated throughout the planning, design and construction, renovation, and repair of new and existing fire and life safety systems based on the Cybersecurity (CS) architecture of the equipment/systems.

Each TO will have detailed PWS outlining the requirements for the specific details of each site including but not limited to the system type, product brand, current/desired network configuration DLA Production, OT, Test Development (T&D), and other DLA network or non- networked/stand-alone) and other details as required. The TO PWS will align with the requirements and scope of the IDIQ PWS.

2. OBJECTIVE

This Performance Work Statement (PWS) is for a firm fixed price Indefinite Delivery Indefinite Quantity (IDIQ) contract with Task Orders (TOs) supporting Life Cycle Program/Project, Acquisition and Customer support for the DLA FPCS systems at the DLA-hosted installations, the DLA Headquarters Complex (HQC) as well as other DLA facilities at various locations throughout CONUS. (reference Table 2) DLA estimates seven (7) or more TOs to result from this IDIQ over the contract life which contains: Base plus four 1-year option periods.

The objective of this contract is to support Fire Protection Systems (FPS) located throughout the Defense Logistics Agency facilities in a fully operational manner to ensure a high level of confidence. These systems will perform as intended to preserve life, reduce property damage and adhere to applicable regulations, codes, and standards. This contract is a “non-personal services contract” as defined in FAR 37.101. It is, therefore, understood and agreed that the Contractor and/or the Contractor’s employees: 1) shall perform the services specified herein as independent Contractors, not as employees of the Government; 2) shall be responsible for their own management and administration of work required and bear sole responsibility for complying with any and all technical, schedule, or financial requirements or constraints attendant to the performance of this contract; 3) shall be free from supervision or control by any Government employee with respect to the manner or method of performance of the services specified; but 4) shall, pursuant to the Government’s right and obligation to inspect, accept, or reject the work, comply with such general direction of the KO, or the duly authorized representative of the KO as is necessary to ensure accomplishment of the contract requirements.

The below non-inclusive list provides a sample of some typical current fire and life safety systems at the DLA host and tenant sites that may be supported under the resultant TO awards. This is a sample list but does not include all potential systems/manufacturers. Specificity about buildings, equipment, and manufacturer brands specific to the geographic site(s) shall be provided in each

TO PWS.

Table 1 – Sample Fire Protection Infrastructure

Current Fire Alarm / Fire Control Infrastructure

Associated Interfaces, Sub-Systems and Tools / Utilities

1. Honeywell

a. Fire Control Instrument (FCI)

b. FCI E3 with Mass Notification

System (MNS)

1. Signal Communications Corporation (Sigcom) narrow-band RF link transmitter and transceivers-

2. Sigcom supervising station/dispatch

c. Notifier

d. Honeywell XLS

e. Silent Knight

f. Gamewell

g. Fire Lite Alarms

h. Fire Burglary Instruments, Inc. (FBI)

2. Edwards Signal

a. (EST 2, 3 and 4)

b. EST Analog

c. Fireshield

3. Simplex (Johnson Controls)

4. Siemens

a. Siemens

b. Cereberus

c. Pyrotronics

5. American District Telegraph (ADT)

a. EST 3 panel

b. ADT Firewatch

6. Harrington Fire (Potter Signal)

7. Mircom /FX-2000

3. MNS subsystems

a. Notifier

b. Whelen (Giant Voice)

c. Honeywell

d. Sigcom Vision 21 and AudioSone

(Giant Voice)

4. Simplex Supervising Station with

Integrated MNS

a. Network Display and True Site

Workstations

b. Fiber network

c. Automated messages

d. Microphone controls

5. American Signal Wide Area MNS integrated to Simplex Supervising Station

6. King Fisher narrow band RF transmitter

7. King Fisher supervising station/dispatch

8. Federal Signal RF link MNS

9. Kidde Fire Suppression Control Panels

(Releasing)

10. Xtralis

11. APS Firehouse Alerting

12. US Digital Phoenix G2

13. ComTech Communications ComTech

10 Fire Station Alerting

3. SCOPE

Specifically, the effort(s) includes tasks for project management; site assessments; operations, maintenance and sustainment support; restoration, modifications and modernization; and for support for OT and IT, and cybersecurity, radio frequency and Spectrum Management. Only includes the "smart" components of the system. These are the devices that detect, control, and report on the status of our fire protection capabilities which include the Fire Alarm Control Panel (FACP), smoke, heat, and flame detectors, network infrastructure, software and firmware, human-machine interfaces (HMI), and monitoring and reporting systems.

For this IDIQ PWS and resultant TO PWSs, FPCS includes but is not limited to:

a. Fire detection and alarm system

1. Initiating devices e.g., smoke detectors, heat detectors, flame detectors, duct detectors, carbon monoxide detectors, water flow switches, pressure switches, manual pull stations, monitor modules, valve tamper switches for all types of fire detection and suppression systems.

2. Signaling Line Circuits (SLC), Wiring for multiplexed field data bus, input, and output processing.

3. Initiating Device Circuits (IDC). Wiring for non-addressable fire initiating devices

4. FACP, also called Fire Alarm Control Units (FACU)

5. Peripheral field devices including control modules and other devices for interface with other systems. Module interfaces include but are not limited to the following functions: initiate shutdown of Heating Ventilation and Air Conditioning (HVAC) systems, elevator recall, fire door hold open release, release of door security locks, initiate fire suppression, and other related items.

6. Notification Appliance Circuits (NAC). Wiring for strobes, sound horns, bells and / or provide voice evacuation mass notification signals.

7. Notification appliances e.g., strobes, horns, speakers, bells, textual visual notification appliances (signs)

8. NAC boosters e.g., extender panels and Amplifiers

9. Remote annunciator panels and local operating consoles (LOC).

10. Wire or fiber SLC links to the fire and emergency services dispatcher (fire reporting system)

11. Licensed narrow-band Very High Frequency (VHF) dedicated Radio Frequency

(RF) link approved by the Federal Communications Commission (FCC) *Note: NOT Wi-Fi, Bluetooth, cell nor frequency agile

12. Radio transmitters/transceivers

13. Workstations (laptop / desktop computers)

Note: While not strictly Fire Alarms, Fire Suppression releasing and control systems that are required to comply with NFPA 72 shall be treated as a fire alarm system.

b. Fire Station Alerting Systems which may integrate with Computer Aided Dispatching (CAD) and/or Control System (CS) within the fire station which operate bay doors, lights, message boards, and other related items. Integrated systems, not a part of the fire station alerting manufactured system, will be the responsibility of others.

c. Mass [Warning] Notification Systems (MNS); specifically, (MWNS or Giant Voice) and building voice systems (normally integrated with the fire alarm system) including Automated Enunciating System (AES), voice alerting systems, mass notification control panels, local operating console, amplifiers, and other related items.

d. Installation Fire Alarm Reporting systems and Supervising station hardware and software *Note: Based on National Fire Alarm and Signaling Code (NFPA 72) the fire and emergency services dispatcher is considered to be a proprietary supervising station service.

e. Fire suppression includes all electronic and networked components of the system and explicitly excludes strictly mechanical elements not limited to:

1. Wet-pipe Automatic Sprinkler Systems

2. Dry-pipe Automatic Sprinkler Systems

3. Pre-action and Deluge Sprinkler Systems

4. Antifreeze Systems

5. Fire Suppression Control Panels (FSCP)

6. Nitrogen Generation Systems and Air Compressors for Fire Suppression Systems

7. Fire Pumps and Fire Pump Systems

8. Water Supply Tank Systems

9. Foam and Foam-Water Systems

10. Water spray and water mist systems

f. Kitchen Hood Fire Suppression Systems

1. Wet Chemical systems

2. Dry Chemical Systems

g. Clean Agent Suppression Systems

1. Carbon Dioxide

2. Halocarbon Agent

3. Inert Gas

This PWS identifies the general service areas. The resulting TO(s) are intended to satisfy the specific geographic site requirements and DLA is seeking a single Contractor to provide integrated support for all the tasks listed below. The Contractor is expected to have the ability to support all tasks listed below and provide the full range of services defined within the task.

All TO(s) issued will be performance-based acquisitions utilizing a PWS. The specific scope of each effort will be based on the specific tasks to be set forth in individual TO(s) but may include tasks in one or more of the areas listed below. Task 5 support is often required in conjunction with other Tasks and will be included on every TO that has cybersecurity requirements.

a. TASK 1 – Program / Project Management

b. TASK 2 – FPCS design support / Site Assessment(s)

c. TASK 3 – Maintenance, and Sustainment Support

d. TASK 4 – Expansion and additions

e. TASK 5 – Support Radio Frequency and Spectrum Management

f. TASK 6 – Support OT/ IT Cybersecurity

In accordance with Federal Acquisition Regulation (FAR) Part 7.503(d) and Office of Federal Procurement Policy (OFPP) Policy Letter 11 01, TO(s) issued for any Task that involves functions closely associated with inherently Governmental functions shall include measures to ensure that sufficient internal capability to maintain control over functions that are central to DLA’s mission and operations and that appropriate levels of Government oversight exist in the TO-level PWS.

Each TO will have a COR designated from DLA J6 Information Operations or DM, as applicable, and the TO PWS will detail the COR responsibilities.

The place of performance for these tasks shall be stated in the specific TO(s).

4. TASK REQUIREMENTS

The Contractor shall provide on-site support as needed to perform designated Tasks Areas in the TO PWS resulting from this IDIQ. The Contractor shall follow all applicable regulations, codes and standards for all tasks. Attachments may be provided in individual TO PWS as necessary.

4.1 TASK 1 – Program/Project Management

The Contractor shall provide various program and project management support for the IDIQ and TOs. This support includes providing planning, direction, coordination, control, monitoring, and reporting necessary for effective and efficient accomplishment of all Tasks In Accordance With (IAW) the PWS requirements. The Contractor shall provide support for contract matters; senior subject matter expert; management of contract personnel; reporting on status on cost, schedule, and performance; collaboration with the COR and/or, Government PMO, and DLA technical, functional, and user representatives; managing contract deliverables; and other support as needed.

The Contractor Program and Project Manager shall be available as required Monday through Friday during business hours, excluding Federal holidays. The Contractor’s Project Manager shall ensure compliance with the required service call response times IAW section 4.3.

Upon request of the Contracting Officer (KO) or COR, the Contractor shall provide personnel to meet on the installation as required to discuss problem areas. When working at DLA locations or other Government locations, the Contractor shall work the business hours of that location.

The Contractor shall provide program management performing day-to-day management of overall contract support operations for multiple TO’s and groups of personnel at multiple locations;

engaging with the KO, COR and/or, PMO, and others as needed; and supporting other activities for the IDIQ contract.

The Contractor shall provide project management for each TO, ensuring that technical solutions and schedules are implemented in a timely manner; assisting the Program Manager in working with the KO, TO COR and other DLA management personnel and customer representatives; and supporting other activities for the TO contract.

4.1.1 Program and Project Management Plans

Program Management Plan: The Contractor shall provide and maintain Program Management Plan with an Integrated Master Schedule (IMS) showing outlining high-level milestones for the IDIQ and Period of Performance (POP) timelines for all TOs awarded under the IDIQ. Contractor shall submit to COR for duration of IDIQ POP IAW PWS 15.2 Table 5 - Contract Deliverables.

Project Management Plan: The Contractor shall provide and maintain a detailed and consolidated Project Management Plan/Project Schedule for each TO with comprehensive, implementable timelines and milestones for all Tasks and deliverables included the TO PWS scope. The Contractor shall create, submit, and maintain/update the Project Plan/Project Schedule showing timelines and Work Breakdown Structure (WBS) for personnel needed to support tasks, deliverables, systems, and plans applicable to the PWS scope and IAW PWS 15.2 Table 5 - Contract Deliverables. This may include but is not limited to assessments, design, installation, deployment, migration, upgrade/technology refresh, testing, inspections, preventative maintenance, correction/remedial maintenance, emergency maintenance, sustainment, patching, cybersecurity, transitions, and other tasks.

Microsoft Project is the software/format for project plans/schedules and shall include Task ID, Task Name, Baseline Start, Baseline Finish, Start (current projected), Finish (current projected), Actual Start, Actual Finish, % Complete, Resource name/title, Predecessors and/or Successors, and critical path.

Communication and Escalation Plan: The Contractor shall provide and maintain a plan that describes the procedures for communication and escalation. This plan should include details of Contractor and Government communications process for normal and high priority scenarios with Points of Contacts.

4.1.2 Meetings

The Contractor shall coordinate with the KO or Contract Specialist (CS) and conduct an IDIQ Post Award Conference (PAC) meeting and as needed, IDIQ In Process Review (IPR) meetings throughout the POP and provide meeting minutes IAW PWS 15.2, Table 5 - Contract Deliverables.

These meetings will be held with the Contractor, KO, CS, COR, , and other designated personnel to discuss an overview of Contractor’s plans to support scope, schedule, and resources for the

IDIQ.

The Contractor shall conduct a TO Kick-off meeting and monthly In Process Review (IPR) meetings for all awarded TOs and provide minutes (IAW PWS 15.2, Table 5 - Contract Deliverables). These meetings will be held with the Contractor, KO, CS, COR, , and other designated personnel to discuss an overview of Contractor’s plans to manage scope, schedule, and resources for the TO. The Contractor will discuss stakeholders’ expectations, details of TO execution including as applicable incident management, triage support, technology road map plans including current and future software/hardware landscape, general conditions, project schedule/plan, work schedules, coordination, security, safety, deliverables, permits, and other matters pertinent to work accomplishments shall be discussed in this meeting. Contractor shall attend other meetings and provide minutes as required in support of the TOs and/or the IDIQ.

4.1.3 Status Reports

IDIQ Status Reports: The Contractor shall provide a monthly report with overall status and financials for all awarded TOs to COR.

TO Status Reports (template will be provided) For each TO, the Contractor shall provide a monthly status report to the COR. Status Report shall include TO/project description, work accomplished, planned work, potential problems or issues that may affect ability of the Contractor to perform, whether Contractor is on schedule and percentage complete, financial, and other related items. The Status Report shall also include system availability reporting for the previous month including a list of outages, description, timeframes, root cause impacting factors and other pertinent details. The Contractor shall inform the COR immediately if an issue arises that affects the performance or continuance of work.

4.1.4 Staffing

Contractor shall maintain a certified work force to complete work IAW the time and quality standards specified in section 10 of the PWS. The Contractor shall provide fully qualified personnel with the necessary management expertise, training, and certifications to assure the performance of the work is in accordance with sound and efficient management practices. Contractor shall provide a monthly Contractor Personnel Roster listing all personnel working on the contract/TO and various administrative information (template will be provided by COR), also see PWS 9.2.14 and include as applicable.

4.1.5 Phase-In Training

A phase-in period shall be established to allow the Contractor sufficient time to integrate and transition personnel into duties required for the TO PWS and ensure those that require access to OT/IT systems, obtain a Common Access Card (CAC) IAW PWS 9.2 Common Access Card Procedures.

a. The phase-in period shall begin at the effective date of the TO and shall not exceed one (1) month, at which time full performance shall commence.

b. The Contractor shall ensure that all Contractor personnel are ready to begin working on the first day of full performance including obtaining any account access, permissions, and/or roles required to administer the application software/hardware. Training and documentation such as rules of behavior and cyber awareness are required for accesses.

c. During the phase-in period, Contractor personnel shall complete security and safety training on-site. Training shall be scheduled through the DLA site’s training office and will at a minimum include the following classes (or current training as listed in the TO PWS). Estimated time to complete is three (3) hours.

1. Active Shooter Briefing

2. Safety Briefing

3. Shelter in Place/Evacuation Awareness Briefing

d. During the one-month phase-in period ensure all Contractor personnel know and understand regulations and policy pertaining to physical, information, operations, and personnel security. The Contractor shall provide security and antiterrorism training to all employees in accordance with applicable DoD regulatory requirements. Training, as required by the DLA Issuances and other applicable DoD guidance, shall be completed annually for the following on-line (or current training as listed in the TO PWS).

1. Cyber Awareness Challenge

2. Antiterrorism (AT) Level 1

3. Operations Security (OPSEC)

4. Counterintelligence Awareness Training

5. Personally Identifiable Information Awareness

6. Trafficking in Persons

e. The security training is web-based, and access will be provided by the Government. The Contractor shall ensure Contractor personnel have taken the required security training to meet DoD guidance and that the personnel continue to maintain their certifications. The Government may add, delete, or change the annual training requirements and will list those in the TO PWS.

f. The Contractor shall provide status and confirmation of completion of Phase-In tasks/training in the TO Status Report and provide certificates as needed.

4.1.6 Work Effort and Control

The Contractor shall manage total work effort to assure timely completion items including, but not limited to planning, developing, and implementing project plans, scheduling, report preparation, communication and coordinating with stakeholders, escalation procedures, establishing and maintaining records, monitoring, and quality control. The Contractor shall implement all necessary work control procedures to ensure timely accomplishment of work requirements, as well as to permit tracking of work in progress. The Contractor shall plan and schedule work to assure material, labor and equipment of all contracted items are available to complete work requirements within the specified time limits and in conformance with the quality standards.

4.1.7 Work Schedule

The Contractor shall schedule and arrange work to cause the least interference with the normal occurrence of DLA business and mission. In those cases where some interference may be essentially unavoidable, the Contractor shall make every effort to minimize the impact of the interference, inconvenience, equipment downtime, interrupted service, and/or customer discomfort. Non-scheduled visits will be coordinated with the COR in advance and notify the COR if the work being performed may cause interference. Notification shall include the type of work to be done and the estimated completion date/time. The Contractor shall reschedule any work that the KO/COR deems necessary to avoid unacceptable disruptions in the Government's business.

4.1.8 Work Records/Reports

The Contractor shall maintain management, maintenance, repair records, and reports. All records and copies of reports shall be turned over to the COR. The Contractor shall maintain management, maintenance, and repair records and prepare management, maintenance, and repair reports as set forth herein. The Contractor shall maintain a comprehensive work (history) file for each fire protection system to be identified by Building Number and System.

The Contractor shall prepare detailed files for each system individually. Files must be maintained in electronic format unless paper copies are requested in the TO. Each file shall contain a listing of all equipment in each system in each building and structure. The list shall include the specific name of all components within the system; the manufacturer’s make and model number. The file shall also contain all manufacturer's literature, brochures, pamphlets, maintenance instructions, operator's instructions, and parts list manuals; warranty information; a copy of all completed service information, impairments, fire watch logs; final system test reports and preventive maintenance inspection records. All proposed forms are to be submitted for approval at the start of the TO prior to commencing work.

Separate files are also to be maintained for TOs to document equipment and components that are kept in stock at all times for preventive maintenance work and any other pertinent information relative to the fire protection systems.

The Government will have access to these files at any time upon request. All record forms shall be filed and submitted to the government within 7 days of completion of the services. The entire file set shall be turned over to the Government upon completion of the TO within 10 working days after the TO expiration date. Final payment will not be issued until receipt of all documentation.

4.1.9 Enterprise Configuration Management

The Contractor shall provide a Configuration Management (CM) Plan to the J6 COR for approval.

The Contractor shall follow the DLA CM/ Configuration Control Working Group (CCWG) process to address product management and version control for software (changes), hardware, business processes documentation and all other control items; and recreate all baseline deliveries from any point in time. The Contractor shall support the Configuration Control governance structure; evaluate all changes to the approved system requirements baseline for risk to security, and for schedule and cost impact; provide evaluations in writing and with sufficient detail to allow for review and approval by the Configuration Control governance structure as required.

As applicable for Tasks, the Contractor shall ensure all system, hardware, and software changes are approved in advance by the J6 COR. The Contractor shall use the DLA Business Capability Management (BCM) ServiceNow (or the current DLA system in use) and provide technical expertise to develop Enterprise Change Requests (ECRs) that addresses product management and version control for software (changes) and hardware (changes), Change Implementation Plans (CIPs), and other associated documentation. The Contractor shall support DLA business processes documentation such as Scheduled Maintenance Requests and Information Technology Operations Center (ITOC) notice (INFOSPOT) and all other control items such as customer notifications.

The Contractor shall conduct CM for all incidents, tickets, and requests for change using DLA BCM ServiceNow (or the current DLA system in use) IAW DLA’s CM/CCWG process. The Contractor shall update and track efforts by submission, review, and level of effort (LOE), funding, approval, delivery, testing, and applying of the enhancement to production.

The Contractor shall create, maintain, and provide technical documentation and revisions for the application as approved by the J6 COR. The Contractor shall accept input from COR, , DLA PMO, and Functional Representatives for base level user issues/problems and update technical documentation as required. The Contractor shall provide the necessary controls and data gathering capabilities to assemble, verify, and validate requirements for various ongoing efforts and assist with documentation and Beta testing, as required.

4.1.10 Risk and Interface Management

a. The Contractor shall provide risk management to include:

1. Support the overarching risk process that includes identification, analysis, mitigation planning, mitigation plan implementation and tracking.

2. Aid the Government in integrating risk management with systems engineering and program management processes.

3. Identify risk drivers, dependencies and root causes and perform consequence management.

b. The Contractor shall provide interface management such as:

1. Provide interface definition and compliance support among the elements that compose the system, as well as with other systems with which the system or system elements interoperate.

2. Provide support to document all internal and external interface requirements in accordance with the Configuration Management (CM) plan and communicate these to all affected configuration items.

4.1.11 Configuration Audit

In support of configuration management, the Contractor shall conduct a configuration audit as needed IAW timeline in the TO PWS and provide an inventory of all existing hardware, software, drawings, and technical documentation.

The Contractor and J62 COR shall agree upon in advance the criteria to be collected and provided by the Contractor. The criteria may include but is not limited to:

a. Manufacturer

b. Model Number

c. Item Nomenclature (Common Name)

d. Serial Number

e. System Type (Reference PWS Section 3)

f. Quantity

g. Location, Bldg. Floor, Room

h. Licenses, Version Numbers, and Documentation for Software/Firmware/Operating

Systems

i. Media Access Control Address (MAC) and Internet Protocol (IP) Addresses

j. Warranties and Expiration Dates

The Contractor performs configuration audit, provides information to the Government in agreed upon format(s), and performs updates as needed. This could be on a spreadsheet, online tracking system provided by DLA, or another via another format. The Contractor shall summarize actions taken to support this in the Contractor’s monthly status report and provide all Configuration Audit Documentation.

The configuration audit and documentation may include but is not limited to:

a. Validate and maintain the inventory of system hardware.

b. Validate and maintain an inventory of all systems software, license information, versions, system and security patches, and documentation.

c. Review and validate technical and as-built drawings. The Contractor shall redline drawings to indicate the actual configuration of the system, subsystem, equipment, device, or component. The Contractor shall update all drawings as changes occur and finalize before the POP end date IAW TO PWS.

d. Validate the existence of technical manuals as part of Preventative Maintenance. Replace or update any manuals that are outdated or nonexistent.

4.1.12 Transition Support

The Contractor shall provide knowledge transfer to Government and any follow-on provider to include all necessary documentation for landscape and assets, orientation, collaboration, status of any work planned or in-process, lessons learned, recommendations, and training to facilitate the comprehensive understanding and execution of tasks, processes, procedures, schedules, and deliverables. Contractor shall provide a plan and timeline in the Project Schedule for all transition activities to COR for approval to ensure continuity and continuation of services without interruption. This may start up to ninety (90) days before the IDIQ POP end date.

This support is critical to the DLA mission and vital to ensure continuation of services without interruption or dramatic effort be provided. The Contractor shall provide the following:

a. Continue to perform all services as prescribed within the PWS and existing TO without reduction of manpower, quality of services and interruption to customers.

b. Provide a transition plan and timeline/schedule may include but is not limited to:

1. Provide current active project transition services associated with any break/fix, upgrade, migration, and/or enhancements planned or in-process.

2. Assist secure required permissions, roles, and account accesses required for administration of software/hardware.

3. Provide landscape and asset documentation, service account passwords and expiration dates, and other documentation for DLA equipment, hardware, software, processes, and overall environment.

4. Any current risks being tracked and mitigations.

4.1.13 System Documentation

The Contractor shall develop and provide documentation for all capabilities delivered/supported and provide documents in the specified/agreed upon format. The Contractor shall provide installation instructions and detailed drawings. This includes but is not limited to system manuals;

installation guidelines; integration requirements; instructions on operation and usage of the system;

and other required documentation listed in the Tasks.

4.1.14 Training

The Contractor shall conduct on-site or virtual training sessions, training materials, and instruction to DLA functional users in a format and timeframe/date(s) agreed upon between the KO and Contractor. The training must allow for rescheduling for unforeseen maintenance and/or fire department responses. The Contractor shall provide lesson plans and training manuals for the training phases, including description of training and a list of reference material to the COR for approval in advance. Manuals should be written in non-technical, easy to understand language.

No formal in-residence training post initial fielding training should be required to operate these systems.

The Contractor shall facilitate training as required including, but not limited to:

a. Provide user level training for new and existing or reassigned authorized personnel.

b. Develop, document, maintain, manage, archive, and provide all training materials.

c. Provide all training facilities as required by the TO.

d. Establish, maintain, schedule, and manage delivery of continuous training programs.

e. Provide functional use and operation of each of the application components / modules.

f. Provide Train-the-Trainer classes for personnel designated by DLA.

g. Perform the appropriate skills development and knowledge transfer in the most efficient manner.

4.2 TASK 2 – FPCS design support / Site Assessment(s)

The Contractor shall provide site assessments to the COR which identify and document the existing FPCS landscape at DLA Headquarters, the four (4) DLA host sites and other DLA tenant locations in CONUS as specified in the TO. Initial assessments should be completed within six

(6) months of TO award. Additional follow-up assessments may also be required as specified in individual TOs.

The site assessment will evaluate systems for compliance with applicable United Facilities Criteria (UFC) 3-600-1, UFC 3-601-02 criteria, applicable National Fire Protection Association (NFPA) Codes and Standards and any specific TO requirements.

The site assessment shall include inspection and testing of existing equipment specified in the TO PWS (e.g., initiating devices, notification appliances, piping, valves, doors, and local control loops and functions). Contractor shall identify and document all inoperable/damaged equipment that must function properly for a complete and useable system.

As required and when listed in the TO PWS, the contractor shall evaluate system cybersecurity posture and vulnerabilities and/or provide cybersecurity support and deliverables in support of or in conjunction with Task 2. Reference PWS 4.5 Task 5 – Support for OT and IT, Cybersecurity, and Radio Frequency and Spectrum Management.

Prior to the site assessment, the Contractor will provide a proposed schedule (to be included in the TO Project Schedule), list of planned personnel performing the assessment and planned methodology for the assessment. Upon completion of the site visit, the Contractor shall provide a draft report submitted for Government review and final report. The Government shall complete review of the draft site assessment within 20 business days. The Contractor shall provide a written report noting all identified discrepancies to include a cost estimate for repair/replacement.

Additionally, the Contractor shall create a Site Assessment Narrative Report with several attachments. The report will include:

a. An introduction which indicates who conducted the assessment, where the assessment occurred and the timeframe of the assessment.

b. A scope which outlines details of what was assessed and why per the TO PWS.

c. A personnel listing which provides names, qualifications, agency, company, phone and email information for assessment persons and stakeholders.

d. A list of applicable documents used in the assessment.

e. A facility overview which describes the type of structures assessed, building specifics such as building numbers, floors, , geographic or other information specified in the TO PWS.

f. A description of existing systems by system name, system type, manufacturer, model, system/equipment age, warranty information, status (mission capable or non-mission capable), OS details, interface details, software/firmware, hardware, physical security details, access control details, maintenance, and service information.

g. A list of recommendations for existing items, systems, sub-systems, components, and security (cyber and physical) enhancements. The recommendation includes details about remaining usability of existing infrastructure and upgrades/replacements recommended including any incremental transitions recommendation.

h. A cost estimate for repairs and replacements needed to provide functioning life safety and fire protection features.

i. A cost estimate for recommendations, design support and/or maintenance and sustainment support. Cost estimates for recommendations are to include life cycle costs.

j. A summary of existing cybersecurity posture and status such as existing documentation (Reference PWS 4.5 Task 5 - Support for OT and IT, Cybersecurity, and Radio Frequency and Spectrum Management).

1. Cybersecurity posture includes:

i. Does the fire protection or life safety system include a computer workstation or utilize an OS on a maintenance cycle?

ii. Does the fire protection or life safety system have connectivity to a network

(IP based or non-IP based), installation data, or telecom networks i.e., head end location?

iii. Does the fire protection system require spectrum management i.e., use regulated radio frequency from 3kHz to 300 GHz?

iv. Are RF components encrypted?

v. What is the User Account support level?

vi. Does the fire protection system have another type of User Interface?

vii. Does the fire protection system have a favorable Assessment and

Authorization (A&A), Assessment and Incorporate (A&I), Facility Related Control System Lean Cybersecurity Risk Assessment (FRCS LCRA), or Authority to Connect (ATC) to a Government network?

viii. Is there currently coordination/support from an Information System Security Manager (ISSM)

ix. Is any local cybersecurity office aware of the systems or consulted?

x. Do the FPCS’ control DLA mission critical property or mission-related facilities?

xi. Does the organization implement a security plan and plan continuous security improvements?

xii. Does the organization implement an effective defense-in-depth strategy?

xiii. Does the organization implement policies and procedures governing access to fire panels, control centers, field devices, portable devices, media, and other fire protection components?

xiv. Does role-based access control to restrict fire panel user privileges to include only those that are required to perform their job responsibilities (i.e., configuring each role based on the principle of least privilege)?

xv. How closely is the system meeting the DoD password requirements and are DoD password policies implemented to identify when they are to be used, how strong they must be, and how to securely use them, considering fire protection hardware availability? Are default factory PINS including Admin pins reset?

xvi. Are data flow controls tested to ensure that other systems cannot directly access devices within the fire protection environment?

xvii. Does work performed e.g., firmware installation occurs on equipment (laptops) specifically approved by the DLA J6?

xviii. Are maintenance laptops and media containing diagnostic and test programs checked for malicious code prior to connecting?

xix. Does the fire protection system have trained and certified administrators Including persons implementing firmware updates?

xx. Do all firmware/software patches and updates get approved under the governance of a formal configuration control board?

xxi. Are patches researched and tested before implementation?

xxii. Does the fire protection system employ current malicious logic protection software?

xxiii. Are the fire protection systems following published guidance e.g., UFC 4-

010-06 and Unified Facilities Guide Specification (UFGS) 25 05 11?

xxiv. Are all unneeded services and ports disabled?

xxv. Is the fire alarm firmware/software reviewed and updated annually?

xxvi. Are selected security controls based on the security categorization documented?

xxvii. Does the organization implement and manage a secure interface to the extent possible with the system?

xxviii. Is remote access allowed?

xxix. Are any IP based connections or modems utilized for access to the system?

a. If yes, are firewalls implemented to enforce security policies?

b. If yes, are whitelist-style firewall rules utilized?

xxx. Is written justification, inventory, and required management-level approval incorporated?

xxxi. Is access to fire protection system configuration information and firmware/software controlled to ensure that they are not available to those not requiring access?

xxxii. The incident response/system recovery plan is essential to continued availability. Does the plan include response to events, restore procedures, roles, and procedures?

xxxiii. Do the fire protection systems have complete and up-to-date logical network diagram(s)?

xxxiv. Has a personnel list for authorized physical and cyber access been completed and signed?

xxxv. Have communication procedures and a list of personnel to contact in the case of an emergency, including vendors, network administrators, support personnel, and others as applicable been created?

xxxvi. Does the organization implement consolidated, real-time monitoring of sensors, logs, patch management, policy management software, and other security mechanisms?

xxxvii. Is the system manned 24/7?

xxxviii. Are control panels locked and/or alarmed?

xxxix. Does the organization have appropriate measures to ensure continuous monitoring of the network is maintained to identify any potential security breaches?

2. Any other cybersecurity support and documentation required in conjunction with Task 2 shall be detailed in the TO PWS 4.5 (Task 5 - Support for OT and IT, Cybersecurity, and Radio Frequency and Spectrum Management) and in section 15.2, Table 5

3. Contract Deliverables, and Table 6, Cybersecurity Deliverables.

k. Spectrum Supportability Risk Assessment (SSRA) for electromagnetic spectrum analysis / status

l. A summary of the overall site assessment and key recommendations.

Assessments shall be provided as follows:

Assessment Recipient(s)

Quantity Submittal Format Media

Local DLA Installation Management POC

2 11 x 17 (B-Size) Drawings Hardcopy 2 24 x 36 (D-Size) Drawings Hardcopy

2 Entire Package (Adobe PDF, or another format specified in TO PWS)

Electronic

DLA Installation Management (DM), OT Fire Pillar Lead

Entire Package (Adobe PDF, or another format specified in TO PWS) Electronic

11 x 17 (B-Size) Drawings Hardcopy

DLA Information Operations (J62B)

Entire Package (Adobe PDF, or another format specified in TO PWS) Electronic

11 x 17 (B-Size) Drawings Hardcopy

4.2.1 Design

When required in the TO, the Contractor will provide a design for the planned restoration, modification, modernization, or addition as fire protection and life safety systems as described in the TO PWS. Design shall be in accordance with TO requirements, UFC 1-200-01, UFC 3-600- 01, and applicable NFPA documents. Design will also comply with applicable cybersecurity requirements. Design of major projects, as defined in UFC 3-600-01, shall be performed by a QFPE or NICET certified system designer. Contractor designs shall utilize current applicable UFGS.QFPE would require a NICET Level 3 designer.

Design packages shall be submitted at 65%, final and backcheck stages, unless otherwise specified in the TO. Distribution of the design package in both electronic and paper format will be specified in the TO. The design package shall meet the NFPA standard for “Minimum Required Documentation”, as provided for in the corresponding system NFPA manual. Plans issued for construction shall be original drawings, not overlays, and provided in both Adobe pdf and the Computer Aided Design and Drafting (CADD) format specified in the TO.

Several additional requirements and/or specifications may be provided within TO PWS if, during a remedial maintenance effort, the Contractor would require further direction on specific issues.

These areas could include, but are not limited to, mechanical systems, unique cybersecurity requirements, asbestos containing materials, fire stopping where new or existing wall or floor penetrations need to be protected with a listed firestop system, sealed, painting of any piping or components to match existing systems and any fire protection related signs that may be damaged or require addition to a sprinkler riser or other part of a fire protection system.

Some TOs may be issued with Government furnished designs.

4.2.2 Systems Engineering Sustainment Support

The Contractor shall support the lifecycle planning and systems engineering sustainment support providing technical fire engineering services by a Qualified Fire Protection Engineer (QFPE) as defined by UFC 3-600-01. Support shall include, but is not limited to:

a. The Contractor shall gather and manage stakeholder’s requirements and provide engineering expertise and support for systems engineering related to lifecycle management.

b. The Contractor shall conduct technical planning including:

1. Create / maintain program related documentation.

2. Assist in the planning of technical processes to develop, field, and sustain fire protection and life safety systems in compliance with the DoD 5000 Series guidance, UFC, NFPA and other DoD regulations and industry best practices.

3. Assist the Government in ensuring that system engineering processes are applied throughout the systems lifecycle.

4. Support process development / improvements and related documentation for systems engineering processes.

c. The Contractor shall support decision analysis including recommending, implementing, and monitoring systems engineering processes, procedures, methods, and tools to ensure that decision analysis has identified, represented, and formally assessed the alternative options to select an optimum decision.

d. The Contractor shall provide Configure Management CM and plan related to the system engineering process - including:

1. Establish and control product attributes and the technical baseline across the total system lifecycle.

2. Identify, document, audit and control the functional and physical characteristics of the system design including hardware and software/firmware; track any changes;

provide an audit trail of program design decisions and design modifications. This includes model, make, serial, machine address, physical location, licenses, and other product data.

e. The Contractor shall provide technical data management including assisting the Government in ensuring that systems engineering discipline is applied to the policies, procedures and information technology including planning, acquiring, accessing, managing, protecting, and using data of a technical nature to support the total lifecycle of the fire systems.

f. The Contractor shall provide the architecture design and documentation including assisting the Government in ensuring that systems engineering discipline is applied to the translation of the requirements definition processes into alternative design solutions and the selection of a final solution.

1. Architecture for fire protection is an explicit description and documentation of the current (as-is) and desired (to-be) relationships.

2. Architecture support includes standardizing manufacturer products, systems, sub-systems, and application software/firmware. It also includes a roadmap to migrate the agency from the current to the target fire system architecture. Fire systems architecture refers to specific current site products or brands, recognizing that within DLA a strategy exists to standardize products when feasible.

3. Fire protection architecture shall be documented in architectural products that comply with the DoD framework and DoD facilities engineering standards.

g. The Contractor shall implement the design including assisting the Government in ensuring that adequate testing and configuration control occurs during the implementation process (e.g., software/firmware coding, network configurations, initiating devices, signaling line circuits, peripheral field devices, notification circuits, radio frequency links, MNS connections/links, and other related items.).

Est. Material Cost (Not to Exceed) CUTN on the TO.

h. The Contractor shall provide integration support and assist the Government in ensuring that individually developed components (proprietary items) are correctly licensed, tested, documented, and integrated into programs/projects.

i. The Contractor shall provide verification support for programs/projects which includes:

1. Provide support to confirm that adequate verification processes exist to ensure that the system element meets the design-to or build-to specifications as defined in the functional, allocated and product baselines.

2. Assist the Government in ensuring that the following verification activities occur throughout the lifecycle and are phase appropriate: verification planning, verification execution, and verification reporting.

j. The Contractor shall validate…