Attachment 01e Sample Task Order 2 PWS.pdf
PDF 587 KB Posted
- Solicitation number
- HQ003421R0130
- Issued by
-
DOD Washington Headquarters Service
About this file
This performance work statement outlines requirements for a pilot program to evaluate and implement an enterprise biometric solution. Key requirements include testing and evaluating commercially available biometric solutions that can store at least 100,000 cardholder records with multiple biometrics each, and support 1,000 biometric enabled access points. The solution must integrate with various communication protocols and systems. The contractor will deploy the solution at 10 pilot locations in the Pentagon over a 300 day period of performance. The contractor must complete all tasks including obtaining necessary approvals, producing evaluation reports, developing implementation plans, conducting testing, and providing required documentation, inventories and closeout materials. The biometric solution must meet various technical and security standards and receive an Authority to Operate.
View the file
Other files
Show all 38
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
INTEGRATED SECURITY SERVICES CONTRACT (ISSC)
INDIVIDUAL TASK ORDER (TO) PERFORMANCE WORK STATEMENT (PWS)
SAMPLE TASK ORDER 2
1. GENERAL: This is a non-personnel services contract to evaluate and implement an Enterprise Biometric (EntBio) solution in the ISSC environment. The Government shall not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the
Contractor who, in turn is responsible to the Government.
2. DESCRIPTION OF SERVICES: The ISSC Service Provider, herein known as the Contractor, shall provide all required services, materials, equipment, software and licenses to develop and/or deploy an EntBIO product onto
Pentagon Force Protection Agency (PFPA) production systems.
3. BACKGROUND: In March 2020, PFPA’s current EntBio solution has been identified by its vendor as a product that will no longer be manufactured or supported. Without vendor support for new installations, replacement, or repairs, PFPA must seek a suitable replacement for multi-modal biometric authentication. This solution will ultimately replace all existing EntBio readers and will be the product that will be used for future installations that require the additional factor of biometric authentication. The solution must meet or exceed the requirements detailed throughout this PWS.
4. OBJECTIVES: To evaluate, test, and implement a pilot program, which provides biometrics for existing systems.
5. SCOPE: The Contactor shall ensure all steps listed in Section 6, Tasks are completed. The Contractor shall be responsible for testing, evaluation, as well as reporting findings and evaluation to the Government. Possible biometric solutions must meet performance requirements listed in Section 8.1. Once test and evaluation is complete and the Government concurs with the vendor of choice, the Contractor will deploy the pilot biometric program.
6. TASKS:
6.1. Successful deployment of an EntBIO pilot program, consisting of ten (10) locations identified within this PWS, while achieving all necessary accreditations, approvals, permits, and certifications of relevant guidelines, requirements, and policies. All ten (10) locations are located within a single hallway of the Pentagon spanning 150 yards in length. The telecommunications closet is located at the end of the hallway. The hallway is enclosed with dropped-ceiling. The access point for each space are 15 yards apart and are all entryways to ICD-705 compliant work spaces.
6.2. The ISSC Service Provider, herein known as the Contractor, shall provide all required services, materials, equipment, software and licenses to develop and or deploy an EntBIO product onto PFPA production systems.
6.3. In addition to performance and cybersecurity requirements listed in Section 8 , the Contractor shall ensure the solution also meets:
6.3.1. The EntBio solution shall be a currently commercially available, commercial-off-the-shelf product specifically designed for providing or denying access at an access point via biometric authentication
6.3.2. The EntBio solution shall be procurable commercially today from the vendor
6.3.3. The EntBio solution’s vendor shall be an exhibitor at relevant industry trade shows such as ISC West or ASIS
6.3.4. The EntBio solution shall be have a portfolio of at least two public or private sector organizations with a commensurate scale to the Government’s Production Environment
6.4. The Contractor shall produce a report to the Government Project Officer, detailing both cost and performance of the solutions being considered. [Deliverable]
6.4.1. The Government Project Officer must decide which vendor PFPA will utilize prior to any hardware or software procurement intended for production deployment.
7. PERIOD OF PERFORMANCE (PoP):
7.1. Period of performance (PoP) ends 300 calendar days after award.
8. GENERAL INFORMATION:
8.1. Performance Requirements:
8.2. Storage – no less than 100,000 cardholders, where each biometric package shall include:
8.2.1. One (1) FIPS compliant CAC/PIV smart card
8.2.2. Two (2) iris images
8.2.3. Ten (10) fingerprint images
8.3. Biometric modalities – cardholders are able to utilize iris or fingerprint
8.4. Edge Device Download – time to download shall not exceed 20 minutes
8.5. Reader modes:
8.5.1. CARD ONLY via free-read CHUID. The Contractor shall determine the vendor’s capability to support CAK-PKI AUTH and PIV GUID
8.5.2. CARD + PIN (4-digit PACS)
8.5.3. CARD + BIO (Iris or Fingerprint)
8.5.4. CARD + PIN (4-digit PACS) + BIO (Iris or Fingerprint)
8.6. Enable or disable the authentication modes or Edge device configurations changes defined in 8.5, 8.10 and
8.11 without needing to be rebooted or taken offline.
8.7. Capable of bypassing the biometric portion of authentication at a reader if:
8.7.1. A cardholder is physically or technically limited
8.7.2. A cardholder is a visitor
8.8. Edge device caches all transactional data during loss of connection and automatically sends its cached data once connectivity has been reestablished.
8.9. Integrations with all relevant and utilized communication protocols, deployed systems and applications within
Privileged Management Program (PMP).
8.10. The vendor provides a singular administrative interface to remotely program, troubleshoot, and configure 1, 2, and 3-factor authentication, along with the ability to create reader groups.
8.11. The vendor provides administrators the ability to adjust matching thresholds for each biometric modality for authentication.
8.12. The vendor provides native-system reports that details both transactional history and device history and statuses.
8.13. Contractor shall provide documentation showing vendor attestation to meet the following:
8.13.1. Ability to support, at a minimum, 1,000 biometric-enabled entry points.
8.13.2. Ability to store, at a minimum, transactional data for at least 1,000 biometric-enabled entry points, each processing 400 transactions an hour for no less than one (1) year.
8.14. IT/CYBER Security. The Contractor shall ensure the solution meets DoD cybersecurity requirements in accordance with DoDI 8500.01 “Cybersecurity,” DoDI 8510.1, “Risk Management Framework for DoD
Information Technology (IT),” and applicable STIG and SRG at the Confidentiality: Moderate, Integrity:
Moderate, and Availability: Moderate levels, culminating in receipt of at least an Authority to Operate (ATO) with Conditions or equivalent approval to operate.
8.15. The Contractor shall accurately complete and submit to the cognizant IT Service Provider the following documentation, and where required any compelling body of evidence, including but not limited to:
8.15.1. Consolidated Design Document and Operations Guide (CDDOG)
8.15.2. Ports, Protocols, and Services Registration Form and Ports documentation
8.15.3. Hardware/Software List
8.15.4. IT Contingency Plan
8.15.5. Boundary Diagram
8.15.6. Information Flow Diagram
8.15.7. System Security Categorization
8.15.8. Server Build Forms
8.15.9. Firewall Request
8.15.10. Request for Change Forms
8.15.11. STIG Checklists
8.15.12. CVE/CCI Compliance
8.16. Compliance Artifacts. The Contractor shall produce up-to-date artifacts for documenting compliance with
NIST 800-53, STIG/SRG, CVE, and CCI requirements. Where required these artifacts shall include the necessary compelling body of evidence.
8.17. Coordination. The Contractor shall coordinate all IT/cyber related actions by, through, and with the cognizant
IT Service Providers. This coordination includes but is not limited to:
8.17.1. Server deployments
8.17.2. Server CVE, CCI, and STIG/SRG compliance verification
8.17.3. HBSS installation
8.17.4. Firewall rule requests
8.17.5. SolarWinds monitoring and alarms configuration
8.17.6. Submission of tickets for fulfillment through IT Service Provider
Production Deployment. The Contractor is responsible for the coordination of deploying and configuring the solution in the production environment.
8.18. The Contractor shall provide a weekly update to the Project Officer of project schedule status. [Deliverable]
The Contractor shall be available for and participate in additional telecommunication or in-person meetings if determined necessary by Project Officer.
8.19. The Contractor shall develop and deliver a System Design and Implementation Plan with a schedule within 30 calendar days of contract award. The System Design and Implementation Plan shall address all hardware, software, server, workstation/end point, cybersecurity, and integration requirements, with a schedule to achieve the upgrade as contained herein. [Deliverable]
8.20. All applicable documents and cut sheets for hardware, software, licensing, warranties, and professional support agreements shall be provided to Project Officer prior to completion of project as part of Close Out documentation. [Deliverable]
8.21. The Contractor shall identify any upcoming milestones in danger of being missed due to failure by either the
Contractor or Project Officer to fulfill a dependency, and the impact to baseline schedule and ultimate completed delivery per the requirements of this PWS.
8.22. Any time extension requested by the Contractor shall include complete costing data for analysis and approval by the Project Officer.
8.23. No overtime or special rates are permitted on this project.
8.24. The Contractor shall not be compensated for any work performed outside the scope of this PWS. Any changes to this PWS, due to unforeseen conditions that may arise throughout the course of this project, must be done in coordination with the Project Officer and with written authorization from the Contracting Officer (KO). Any work done without written authorization from the KO shall be at the Contractor’s risk and expense. The
Contractive Officer’s Representative (COR) does NOT have the authority to make changes to the contract.
8.25. The Contractor shall ensure all purchased equipment has been inventoried, to include Contractor Furnished
Equipment (CFE) and license information associated with this task order and provide this documentation to the
Project Officer as part of the project closeout. [Deliverable] The inventory must include at a minimum:
8.25.1. Barcode number (if available)
8.25.2. Serial number (if available)
8.25.3. Location
8.25.4. Expiration / Good through date
8.25.5. CFE or GFE equipment
8.26. The Contractor shall ensure the following documentation for all purchased equipment covered under this PWS as part of the closeout documentation for this project. [Deliverable]
8.26.1. Manufacturer’s name
System Design and Implementation
Plan Within 120 calendar days of award Digital
Training Documentation Prior to end of PoP Digital
Performance Verification Testing Completion of installs at each Pilot
Location listed in 3.3.
Digital
Inventory Documentation Prior to end of PoP Digital
Close Out Documentation Prior to end of PoP Digital
File details come from the government source that posted it. Updated .