Attachment 01e PWS Sample Task Order 2.docx

ISSC INDIVIDUAL DELIVERY ORDER PERFORMANCE WORK STATEMENT

SAMPLE TASK ORDER 2

1. GENERAL: This is a non-personnel services contract to evaluate and implement an Enterprise Biometric solution in the ISSC environment. The Government shall not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn is responsible to the Government.

2. DESCRIPTION OF SERVICES: The ISSC Service Provider, herein known as the Contractor, shall provide all required services, materials, equipment, software and licenses to develop and or deploy an EntBIO product onto PFPA production systems.

3. BACKGROUND: In March 2020, PFPA’s current Enterprise Biometric (EntBio) solution has been identified by its vendor as a product that will no longer be manufactured or supported. Without vendor support for new installations, replacement, or repairs, PFPA must seek a suitable replacement for multi-modal biometric authentication. This solution will ultimately replace all existing EntBio readers and will be the product that will be used for future installations that require the additional factor of biometric authentication. The solution must meet or exceed the requirements detailed throughout this PWS.

4. OBJECTIVES: To evaluate, test, and implement a pilot program, which provides biometrics for existing systems

5. SCOPE: The Contactor shall ensure all steps listed in Section 6 are completed. The Contractor shall be responsible for testing, evaluation, as well as reporting findings and evaluation to the Government. Possible biometric solutions must meet performance requirements listed in Section 8.1. Once test and evaluation is complete and the Government concurs with the vendor of choice, the Contractor will deploy the pilot biometric program. Evaluation and testing data from the pilot program will be obtained by the Contractor and provided to the Government with suggestions and recommendation.

6. TASKS:

6.1. Successful deployment of an EntBIO pilot program, consisting of ten (10) locations identified within this PWS, while achieving all necessary accreditations, approvals, permits, and certifications of relevant guidelines, requirements, and policies.

6.2. The ISSC Service Provider, herein known as the Contractor, shall provide all required services, materials, equipment, software and licenses to develop and or deploy an EntBIO product onto PFPA production systems.

6.3. Selection Criteria.

6.4. In addition to performance and cybersecurity requirements listed , the Contractor shall ensure the solution also meets:

6.4.1. The EntBio solution shall be a currently commercially available, commercial-off-the-shelf product specifically designed for providing or denying access at an access point via biometric authentication.

6.4.2. The EntBio solution shall be procurable commercially today from the vendor

6.4.3. The EntBio solution’s vendor shall be an exhibitor at relevant industry trade shows such as ISC West or ASIS

6.4.4. The EntBio solution shall be have a portfolio of at least two public or private sector organizations with a commensurate scale to the Government’s Production Environment

6.5. The Contractor shall produce a report to the Project Officer, detailing both cost and performance of the solutions being considered. [Deliverable]

6.5.1. The Project Officer must decide which vendor PFPA will utilize prior to any hardware or software procurement intended for production deployment.

7. PERIOD OF PERFORMANCE:

7.1. Period of performance (PoP) ends 300 calendar days after award.

8. GENERAL INFORMATION:

8.1. Performance Requirements:

8.2. Storage – no less than 100,000 cardholders, where each biometric package shall include:

8.2.1. One (1) FIPS compliant CAC/PIV smart card

8.2.2. Two (2) iris images

8.2.3. Ten (10) fingerprint images

8.3. Biometric modalities – cardholders are able to utilize iris or fingerprint

8.4. Edge Device Download – time to download shall not exceed 20 minutes

8.5. Reader modes –

8.5.1. CARD ONLY via free-read CHUID. The Contractor shall determine the vendor’s capability to support CAK-PKI AUTH and PIV GUID.

8.5.2. CARD + PIN (4-digit PACS)

8.5.3. CARD + BIO (Iris or Fingerprint)

8.5.4. CARD + PIN (4-digit PACS) + BIO (Iris or Fingerprint)

8.6. Enable or disable the authentication modes defined in 2.4 without needing to be rebooted or taken offline.

8.7. Capable of bypassing the biometric portion of authentication at a reader if:

8.7.1. A cardholder is physically or technically limited

8.7.2. A cardholder is a visitor

8.8. Edge device caches all transactional data during loss of connection and automatically sends its cached data once connectivity has been reestablished.

8.9. Integrations with all relevant and utilized communication protocols, deployed systems and applications within Privileged Management Program (PMP).

8.10. The vendor provides a singular administrative interface to remotely program, troubleshoot, and configure 1, 2, and 3-factor authentication, along with the ability to create reader groups.

8.11. The vendor provides administrators the ability to adjust matching thresholds for each biometric modality for authentication.

8.12. The vendor provides native-system reports that details both transactional history and device history and statuses.

8.13. Contractor shall provide documentation showing vendor attestation to meet the following:

8.13.1. Ability to support, at a minimum, 1,000 biometric-enabled entry points.

8.13.2. Ability to store, at a minimum, transactional data for at least 1,000 biometric-enabled entry points, each processing 400 transactions an hour for no less than one (1) year.

8.14. IT/CYBER Security. The Contractor shall ensure the solution meets DoD cybersecurity requirements in accordance with DoDI 8500.01 “Cybersecurity,” DoDI 8510.1, “Risk Management Framework,” and applicable STIG and SRG at the Confidentiality: Moderate, Integrity: Moderate, and Availability: Moderate levels, culminating in receipt of at least an Authority to Operate (ATO) with Conditions or equivalent approval to operate.

8.15. The Contractor shall accurately complete and submit to the cognizant IT Service Provider the following documentation, and where required any compelling body of evidence, including but not limited to:

8.15.1. Consolidated Design Document and Operations Guide (CDDOG)

8.15.2. Ports, Protocols, and Services Registration Form and Ports documentation

8.15.3. Hardware/Software List

8.15.4. IT Contingency Plan

8.15.5. Boundary Diagram

8.15.6. Information Flow Diagram

8.15.7. System Security Categorization

8.15.8. Server Build Forms

8.15.9. Firewall Request

8.15.10. Request for Change Forms

8.15.11. STIG Checklists

8.15.12. CVE/CCI Compliance

8.16. Compliance Artifacts. The Contractor shall produce up-to-date artifacts for documenting compliance with NIST 800-53, STIG/SRG, CVE, and CCI requirements. Where required these artifacts shall include the necessary compelling body of evidence.

8.17. Coordination. The Contractor shall coordinate all IT/cyber related actions by, through, and with the cognizant IT Service Providers. This coordination includes but is not limited to:

8.17.1. Server deployments

8.17.2. Server CVE, CCI, and STIG/SRG compliance verification

8.17.3. HBSS installation

8.17.4. Firewall rule requests

8.17.5. SolarWinds monitoring and alarms configuration

8.17.6. Submission of tickets for fulfillment through IT Service Provider Production Deployment. The Contractor is responsible for the coordination of deploying and configuring the solution in the production environment.

8.18. The Contractor shall provide a weekly update to the Project Officer of project schedule status [Deliverable]. The Contractor shall be available for and participate in additional telecommunication or in-person meetings if determined necessary by Project Officer.

8.19. The Contractor shall develop and deliver a System Design and Implementation Plan with a schedule within 30 calendar days of contract award. The Plan shall address all hardware, software, server, workstation/end point, cybersecurity, and integration requirements, with a schedule to achieve the upgrade as contained herein. [Deliverable].

8.20. All applicable documents and cut sheets for hardware, software, licensing, warranties, and professional support agreements shall be provided to Project Officer prior to completion of project as part of Close Out documentation. [Deliverable]

8.21. The Contractor shall identify any upcoming milestones in danger of being missed due to failure by either the Contractor or Project Officer to fulfill a dependency, and the impact to baseline schedule and ultimate completed delivery per the requirements of this PWS.

8.22. Any time extension requested by the Contractor, shall include complete costing data for analysis and approval by the Project Officer.

8.23. No overtime or special rates are permitted on this project.

8.24. The Contractor shall not be compensated for any work performed outside the scope of this PWS. Any changes to this PWS, due to unforeseen conditions that may arise throughout the course of this project, must be done in coordination with the Project Officer and with written authorization from the contracting officer (KO). Any work done without written authorization from the KO shall be at the Contractor’s risk and expense. The Contractive Officer’s Representative (COR) does NOT have the authority to make changes to the contract.

8.25. The Contractor shall ensure all purchased equipment has been inventoried, to include Contractor Furnished Equipment (CFE) and license information associated with this task order and provide this documentation to the Project Officer as part of the project closeout [Deliverable]. The inventory must include at a minimum:

8.25.1. Barcode number (if available)

8.25.2. Serial number (if available)

8.25.3. Location

8.25.4. Expiration / Good through date

8.25.5. CFE or GFE equipment

8.26. The Contractor shall ensure the following documentation for all purchased equipment covered under this PWS as part of the closeout documentation for this project [Deliverable].

8.26.1. Manufacturer’s name

8.26.2. Manufacturer’s model

8.26.3. Equipment’s serial number

8.26.4. Warranty start and end dates

8.27. Performance Verification Testing. The Contractor shall complete Government witness PVT Testing at each location listed in Section 3.3.

8.28. Training. The Contractor shall produce and provide training material for end user operation, hardware and software installation, and vendor-recommended maintenance [Deliverable].

9. GOVERNMENT FURNISHED ITEMS OR SERVICES: No Government Furnished Equipment will be used in this task order.

10. DELIVERABLES: The Project Officer shall have 14 calendar days to review submitted deliverables and return to the Contractor for improvements.

11. REFERENCES:

11.1. Integrated Security Services Contract (ISSC) Performance Work Statement (PWS)