Attachment 1 - ELMR Performance Work Statement.pdf

PERFORMANCE WORK STATEMENT (PWS)

Enterprise Land Mobile Radio (ELMR) System Lifecycle Management and Sustainment Services

07 Apr 2020

ELMR System Lifecycle Management and Sustainment

Services

TABLE OF CONTENTS:

1. INTRODUCTION

2. GENERAL REQUIREMENTS:

3. SPECIFIC REQUIREMENTS

3.1. OVERALL REQUIREMENTS:

3.2. LIFECYCLE MANAGEMENT:

3.3. CYBERSECURITY / RISK MANAGEMENT:

3.4. SUSTAINMENT:

4. SERVICE SUMMARY (SS)

4.1. SIGNIFICANT PERFORMANCE OBJECTIVES

5. GOVERNMENT FURNISHED PROPERTY AND SERVICES:

6. REFERENCES:

7. DEFINITIONS:

8. ACRONYMS:

9. TECHNICAL EXHIBITS:

10. BILLING

ELMR Lifecycle Management and Sustainment Services

1. INTRODUCTION

This is a non-personnel services contract to purchase the turn-key delivery of services and products included within the Motorola Solutions Inc. Advanced Plus offerings to sustain and support lifecycle management of ASTRO25 systems.

1.1. Description of Services/Introduction: The Contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, products and all other items and non-personal services necessary to deliver turnkey services included within the Motorola Solutions Inc. Advanced Plus offerings except for those items specified as Government furnished property and services within this document. The Contractor shall perform to commercial best practice and standards as well as specific technical references within this document. The Contractor shall identify any other references used.

Standards within this document shall take precedence.

1.2. Background: Air Mobility Command (AMC), and Air Combat Command (ACC) bases require turnkey sustainment and lifecycle mangement services for the Enterprise Land Mobile Radio (ELMR) system. The ELMR system delivers critical radio voice communications in support of emergency response capabilities and mission operations across two commands and for partner agencies. All locations supported by the ELMR system are identified in Technical Exhibit 2. The security, availability, reliability, and supportability of the ELMR system must be maintained relevant with current technologies. The current ELMR system version is the Motorola ASTRO25 v7.17.

ELMR system must be maintained within two versions of the latest manufacturer’s release to ensure the network remains secure and reliable to support assigned missions across the command.

1.3. Objectives: The purpose of this contract is to maintain existing operational radio voice communication capabilities for all users throughout the period of performance, extend the manufacturer lifecycle support and sustainment schedules, maintain relevance with progressing Information Technology (IT) modernizations, ensure network security, and maximize the availability and reliability of the ELMR system.

1.4. Scope: Turn-key delivery of all products, services and technical solutions within the Motorola Solutions Inc. Advanced Plus offerings. Delivered services shall support sustainment and lifecycle management of the ELMR system to include the ASTRO25 system core, located at Travis AFB (TAFB) CA., the remote site infrastructure and backhaul connectivity equipment, and third party solutions as defined in Technical Exhibit 2.

After the Base contract year, the ELMR system shall be tech refreshed to the latest manufacturer’s ASTRO25 system version release. Maintaining the ELMR system within two versions of the latest manufacturers release is critical to network security, ensuring the availability of repair services, and maximizing the system’s lifecycle. The ELMR system requires Network Event Monitoring services to detect abnormalities and initiate technical solutions before users are impacted, Remote Software Update Services (RSUS) to patch system software and comply with cybersecurity accreditation requirements, Preventive Maintenance Inspection (PMI) services to maintain system components within manufacturer specifications, on-site maintenance response and helpdesk technical support services for issue resolution, and depot hardware repair services for items that cannot be fully serviced on-site. The ELMR system shall be maintained to support all existing operational capabilities and feature sets to include, but not limited to secure wide area radio communications, Integrated Voice & Data (IV&D), Over-the-Air-Rekey (OTAR), Over-the-Air-Programming (OTAP/PoP25), centralized audio recording, and network connectivity (i.e. Backhaul) to support wide area communications for remote sites and partner agencies (as defined in Technical Exhibit2).

All delivered hardware and software must support the latest Association of Public Safety Communications 25 (APCO25/P25) interoperability standards. Any systems that radiate radio frequency (RF) energy must have approved JF12 spectrum certifications from the National Telecommunications and Information Administration (NTIA).

2. GENERAL REQUIREMENTS:

2.1. Period of Performance: The period of performance shall be for one (1) Base Year of 12 months and one (1) 12-month option year. The Period of Performance reads as follows:

Base Year Option Year I

30 Sept 2020 – 29 Sept 2021 30 Sept 2021 – 29 Sept 2022

2.2. Deliverables: The Contractor shall submit all deliverables in accordance with the Contract Deliverable Requirements List (CDRL) items are identified in Technical Exhibit

1. Email and electronic file transfer of deliverables shall be electronically encrypted IAW FIPS 140-2 standards. A Contracting Officer’s Representative (COR) shall be appointed and contact information provided to the Contractor upon contract award.

2.3. Contractor’s Quality Control Plan (QCP): The Contractor shall deliver only Motorola certified equipment and technical services to include support for inherited third party warranties. The Contractor shall develop and maintain an effective quality control program to ensure services are delivered in accordance with this PWS. The Contractor’s quality control program is the means by which to comply with the requirements of the contract. The Contractor shall develop and deliver a quality control plan (CDRL A001) in accordance with Technical Exhibit 1 for Government acceptance. The quality control plan shall implement procedures to identify, prevent, and ensure non-recurrence of defective services. The quality control plan shall describe the actions (measurements, inspections, quality checks or monitoring of process parameters) required to assure Advanced Plus service outputs conform to the requirements in this document. The Contractor shall submit updates to the quality control plan to the COR for acceptance 10 business days prior to implementation of any changes. The COR shall have 10 business days to accept the quality control plan and any changes.

2.4. Quality Assurance: The COR shall evaluate the Contractor’s performance under this contract in accordance with the Service Summary (SS) items as defined in section 4 of this PWS. The SS is primarily focused on Government surveillance of Contractor performance in accordance with the performance standards. The SS defines how performance standards shall be applied, the frequency of surveillance, and the minimum acceptable defect rate(s). The Government may unilaterally change items in the SS based on the Government’s oversight of Contractor’s performance. The Government will provide a minimum of 60 days’ notice to the contractor for any changes to the SS. The Contractor must satisfactorily perform all PWS requirements, even if not listed in the SS.

2.5. Recognized Holidays: USAF follows the established Federal Government schedule for holidays provided during each calendar year. AMC Down-days (i.e., Family Day) declared by the AMC Commander are considered business days and are not included in the definition of a federal holiday but may be observed at the discretion of the Government. The COR shall coordinate with the Contractor PM no less than 30 days prior to the observance any AMC down-days. In addition to the days designated as federal holidays, the Government observes any other days as designated by Federal Statute or Executive Order.

2.6. Hours of Operation: The Contractor is responsible for conducting any scheduled on-site services during normal business hours, Monday - Friday except Federal holidays or when Government facilities are closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. Unscheduled Critical and High priority on-site services for repairs shall be conducted 24-hours per day, 7 days per week, and 365 days a year in accordance with paragraph 3.4.8. of this

PWS.

2.7. Type of Contract: The Government shall award a Firm-Fixed Price, Sole Source Contract.

2.8. Security Requirements: The Contractor shall only employ US citizens for the delivery of all contracted services. Contractor personnel performing work under this contract must qualify to obtain access military installations with the issuance of a temporary visitor pass. Contractors shall present government Real ID compliant (state or federal) issued ID, before being issued a visitor pass. A criminal history check shall be conducted for every individual requesting a pass. Personnel employed by the contractor and operating a motor vehicle on the installation must also possess proof of the following:

(1) Liability Insurance

(2) Current License Plates

(3) Current State Inspection Sticker (If Required)

(4) Valid State Driver License

2.8.1. All vehicles entering military installations are subject to search.

2.8.2. If a Contractor employee has been terminated, the visitor pass shall be retrieved and returned to the issuing activity so that employee no longer has access to the installation. If the visitor pass is not retrieved then the installation Visitor Center and COR shall be notified within 24 hours of the employee’s termination so access is no longer permitted.

2.8.3. Contractor personnel in possession of valid DoD identification shall not use inherent privileges to access ELMR sites or conduct services related to this document without prior coordination and approval from the appointed COR.

2.8.4. Contractor personnel shall present a neat appearance and be easily recognized.

This may be accomplished by wearing distinctive clothing bearing the name of the company or by wearing appropriate badges, which contain the company name and employee name.

2.8.5. Contractor employees shall not have access to classified information and do not require a security clearance.

2.8.6. Failure to comply with these security requirements may result in the withholding of payments.

2.9. Contracting Officer Representative (COR): The Government will provide a copy of the COR letter of designation to the Contractor, stating the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR monitors all technical aspects of the contract and assists in contract administration. The COR is authorized to perform the following functions:

assure that the Contractor performs the technical requirements of the contract: perform inspections necessary in connection with contract performance: maintain written and oral communications with the Contractor concerning technical aspects of the contract: issue written interpretations of technical requirements, including Government drawings, designs, and specifications: monitor Contractor's performance and notifies both the Contracting Officer and Contractor of any deficiencies; coordinate availability of Government furnished property and define site entry requirements. The COR is not authorized to change any of the terms and conditions of the resulting order.

2.10. Contractor Key Personnel: The following are considered key personnel by the Government for delivering contracted services:

2.10.1. Contractor Program Manager (PgM) – Contractor shall appoint a qualified primary point of contact to perform PgM services and provide notification (CDRL A002) to the Government in accordance with Technical Exhibit 1. The PgM is responsible for managing all resources, deliverables, and services as defined within this document. The PgM ensures system integration processes identify and support ELMR users operational requirements throughout the design, installation, optimization, testing, and acceptance phases. Additionally, the PgM ensures all sustainment and cybersecurity activities are well managed and available as defined within this document. The Program Manager shall advise the COR of all available technical, design, or system operations that improve system capabilities, add add efficiencies, or reduce lifecycle service requirements.

2.10.2. Contractor System Engineer – System engineering services shall be provided from system design through the completion of implementation and testing for all tech refresh and cybersecurity activities. The Contractor shall appoint a Motorola qualified Systems Engineer to be responsible for all system design and technical issues related to design implementation upon the initiation of all tech-refresh service projects intended to deliver a new system version release. The Systems Engineer contact information shall be provided to the Government (CDRL A003) in accordance with Technical Exhibit 1. The engineer shall design solutions that reduce existing system infrastructure and minimize backhaul connectivity bandwidth and circuit requirements. Engineering services shall include at a minimum:

• Site Surveys

• Government System Manager Interviews

• System design

• Architecture development

• Frequency analysis and planning

• Coverage design

• Traffic (loading) design

• Fleetmap development

• Implementation support (design synthesis)

• Acceptance testing

• Final (as-built) system documentation

• Change Management

2.10.3. Contractor Project Manager (PM) – Contractor shall appoint a primary point of contact to perform as the PM upon initiation of all tech-refresh service projects intended to deliver a new system version release. The PM contact information shall be provided to the Government (CDRL A003) in accordance with Technical Exhibit

1. The PM plans, organizes, leads, and controls implementation of all assigned projects to deliver contract solutions. The PM shall coordinate with the COR to schedule onsite activities and manage stakeholder expectations.

2.11. Warranty: The Contractor shall deliver any original equipment manufacturer (OEM) pass through warranty and standard commercial warranties applicable to the products being purchased at no cost to the Government. This shall apply to all new and upgraded equipment delivered as part of either the lifecycle and sustainment services.

2.12. Customer Support: The Contractor shall provide 24x7x365 live telephone technical support during the service period to assist in isolating, identifying, and repairing software and hardware failures. Within 10 business days after contract award, the Contractor shall email contact information (CDRL A004) to the Government in accordance with Technical Exhibit 1. Customer support shall be made available to all installations and supported by the ELMR system.

2.13. Technical Requirements: The Contractor shall ensure that all applicable Commercial-Off- The-Shelf (COTS) IA and IA-enabled products comply with AFI 17-130, Cybersecurity Program Management. All IT hardware, firmware, and software components or products incorporated into DoDIN must comply with evaluation and validation requirements in DoDI 8500.01 and CNSSP-11, National Policy Governing Acquisition of IA Products.

Refer to CNSSP No. 11 for the latest process and policy guidance on this subject.

2.13.1. Special Asset Tagging: The Contractor shall provide special asset tags IAW MIL STD-130, DODI 8320.04, Item Unique Identification (IUID) Standards for Tangible Personal Property and DFARS 252.211-7703, Item Identification and Valuation.

The current list of accepted unique item identifier types is maintained at http://www.acq.osd.mil/dpap/pdi/uid/uii_types.html. All DoD recognized unique identification equivalents are listed at http://www.acq.osd.mil/dpap/pdi/uid/iuid_equivalents.html.

2.13.2. Energy Star Mandate: The Contractor shall ensure the product meets Energy Star guidelines.

2.13.3. IPV6 Mandate: The Contractor shall ensure the product meets IPV6 capabilities per UCR 2013 and certified by the DoDIN Approved Products List.

2.13.4. Unified Capabilities (UC) 2013 Mandate: The Contractor shall provide UC approved products. The DoDIN Approved Products List is a consolidated list of products that have completed interoperability and information assurance certification and is managed by Defense Information Systems Agency (DISA).

2.13.5. BIOS Mandate: Per DoD CIO, the Contractor shall ensure that all x86 and x64 laptops and desktops are BIOS protection compliant IAW Section 3.1 of NIST Special Publication 800-147 (BIOS Protection Guidelines).

2.13.6. Trusted Platform Module (TPM) Mandate: In accordance with DoDI 8500.01, computer assets will include a Trusted Platform Module (TPM) version 2.0 or higher. TPMs must be in conformance with Trusted Computing Group standards and ISO/IEC 11889-1:2009 through ISO/IEC 11889-4:2009.

2.13.7. FIPS 140-2 Encryption Mandate: The Contractor shall ensure that all cryptographic products have FIPS 140-1 or 140-2 security certification through the FIPS 140-1 and 140-2 approved products list.

http://static.e-publishing.af.mil/production/1/saf_cio_a6/publication/afi17-130/afi33-200.pdf http://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/850001_2014.pdf http://www.acq.osd.mil/dpap/pdi/uid/uii_types.html http://www.acq.osd.mil/dpap/pdi/uid/iuid_equivalents.html http://energy.gov/eere/femp/covered-product-categories http://energy.gov/eere/femp/covered-product-categories http://www.disa.mil/%7E/media/Files/DISA/Services/UCCO/UCR-2013-Change2/UCR-2013-Change2.pdf http://www.disa.mil/Services/Network-Services/UCCO http://www.disa.mil/Services/Network-Services/UCCO http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-147.pdf http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-147.pdf http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-147.pdf http://www.trustedcomputinggroup.org/ http://csrc.nist.gov/publications/PubsFIPS.html http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/1401val2014.htm

2.13.8. FIPS 201 Federal Identity Credentialing and Management (FICAM) Mandate:

The Contractor shall ensure that products used to create, print or read smart cards are FIPS 201 compliant and certified by the FICAM approved product list.

2.13.9. Software Tagging Mandate: The Contractor shall ensure COTS software items support International Standard for Software Tagging and Identification, ISO/IEC 19770-2, Software Tags when designated as mandatory by the standard. Further guidance can be found at: http://tagvault.org/.

2.13.10. Section 508 of the Rehabilitation Act Mandate: The Contractor shall meet the requirements of the U.S. Access Board’s regulations at 36 CFR Part 1194 which implements Section 508 of the Rehabilitation Act of 1973, as amended. For more information about DoD Section 508 specific responsibilities, see the DoD CIO website.

2.13.11. Electronic Products Environmental Assessment Tool (EPEAT): In accordance with Executive Orders 13423 and 13514, and FAR Part 39.1, when acquiring an electronic product, an EPEAT® registered electronic product should be acquired unless the agency determines, in accordance with agency procedures, that the EPEAT® registered product will not be cost effective over the life of the product. EPEAT® electronic products are designated “bronze,” “silver,” or “gold” registered. Agencies shall, at a minimum, acquire EPEAT® bronze-registered products. Agencies are encouraged to acquire EPEAT® silver or gold registered products. Visit the EPEAT website to see if your product is registered.

2.13.12. Technical Refresh: In order to ensure new design enhancements and technological updates or advances, the contractor shall offer hardware and software components available to the contractor's commercial customers. Furthermore, the contractor shall make available any commercially available updates to the hardware and software. If such updates are available to other customers without charge, then they shall also be made available to the Government without additional charge. The contractor shall ship these updates to existing customers who have acquired the hardware/software being updated. Vendor commercial product offerings shall include “state of the art” technology, i.e., the most current proven level of development available in each product category.

2.13.13. Non-Personal Services: The Government shall neither supervise contractor employees nor control the method by which the contractor performs the required tasks. Under no circumstances shall the prepare work schedules for individual contractor employees. It shall be the responsibility of the contractor to manage its employees and to guard against any actions that are of the nature of personal services or give the perception of personal services. If the contractor feels that any actions constitute, or are perceived to constitute personal services, it shall be the contractor’s responsibility to notify the Contracting Officers (CO) immediately.

These services shall not be used to perform work of a policy/decision making or management nature, i.e., inherently Governmental http://www.idmanagement.gov/approved-products-list http://tagvault.org/ http://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-section-508-standards/section-508-standards http://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-section-508-standards/section-508-standards http://section508.gov/Section-508-Of-The-Rehabilitation-Act http://dodcio.defense.gov/DoDSection508.aspx http://dodcio.defense.gov/DoDSection508.aspx https://www.epeat.net/ functions. All decisions relative to programs supported by the contractor shall be the sole responsibility of the Government.

2.13.14. Freedom of Information Act Program (FOIA): The contractor shall comply with DoD Regulation 5400.7-R/Air Force Supplement, DoD Freedom of Information Act Program, requirements. The regulation sets policy and procedures for the disclosure of records to the public and for marking, handling, transmitting, and safeguarding For Official Use Only (FOUO) material. The contractor shall comply with AFI 33-332, Air Force Privacy and Civil Liberties Program, when collecting and maintaining information protected by the Privacy Act of 1974 authorized by Title 10, United States Code, Section 8013. The contractor shall remove or destroy official records only in accordance with AFMAN 33-363, Management of Records, or other directives authorized in AFI 33-364, Records Disposition—Procedures and Responsibilities.

3. SPECIFIC REQUIREMENTS

3.1.OVERALL REQUIREMENTS:

3.1.1. Contractor shall deliver all equipment, materials, hardware, software, software licenses and other miscellaneous items required to install, integrate, program, apply cybersecurity controls, test and certify all purchased equipment and software for turn-key technical solutions and services in accordance with this document.

3.1.2. Contractor PM shall instruct employees in utilities conservation practices. The Contractor shall be responsible for operating under conditions that preclude the waste of utilities such as keeping facility doors closed, turning off lights, and unplugging equipment when not being used.

3.1.3. Contractor shall confine operations at the site to areas permitted by law, ordinances, permits, and the contract documents and shall not encumber the site with any materials or equipment without prior written authorization.

3.1.4. Contractor is responsible for any damage caused and site repairs. Any items touched shall be restored to their original conditions, to include, but not limited to patching holes, sealing wall penetrations, touch-up paint, and the replacement of ceiling tiles.

3.1.5. Contractor shall be responsible for removing and properly disposing of all debris, cardboard and other trash resulting from delivery of all associated Contractor provided equipment, materials, and supplies, or other items used onsite. This includes general clean-up of material, packaging, and cleaning of work areas (vacuum, wipe clean desks) at the end of each workday (as a minimum) to minimize unacceptable job site appearance. In effort to maintain a safe work area for all personnel, the Government may direct the cleaning of the work site at any time.

3.1.6. Contractor shall keep onsite equipment and materials from blocking access to adjacent building facilities. If, however, conflict with normal personnel access occurs, the Contractor shall coordinate a temporary bypass route with the designated Government PM and COR, until such temporary work is completed.

3.1.7. Contractor shall be responsible for on/off-loading and transporting of all equipment and materials between authorized Government delivery storage facilities and work sites as part of the turn-key services.

3.1.8. Contractor is responsible for validating all ELMR system configurations and technical requirements prior to performing any work.

3.1.9. All equipment, hardware and software purchases shall only be sourced by the OEM. The Contractor shall certify that they are an OEM Registered Partner as of the date of the submission of their offer, and that they have the certification/ specialization level required by the OEM to support both the product sale and product pricing. The Contractor shall source all products directly from the OEM or through the US authorized distribution channels only. Products must be warranted, licensed and supported by the OEM. Further, TAFB must be the original licensee of all OEM software. In the event there are questions pertaining to the validity of the OEM products, TAFB reserves the right to verify the origin of the OEM products direct with the OEM. In the event the OEM products have been acquired from un-authorized channels, TAFB further reserves the right to return the products for a full refund.

3.1.10. Contractor shall minimize changes to Key Personnel (i.e. PgM, PM, and engineers) and technicians wherever possible to maintain continuity throughout the period of performance and specifically when directly supporting ELMR system major version release tech refresh projects.

3.1.11. Contractor shall employ change management processes to accurately track system configurations and mitigate negative impact to system operations. The ELMR system is comprised of highly sophisticated equipment and hardware to integrate several subsystems onto a single operating IT platform. It is critical to maintain continuity and systematically track all configuration changes to ensure delivered services are as efficient and productive as possible and maximize the ELMR system reliability and availability.

3.2.LIFECYCLE MANAGEMENT:

3.2.1. Contractor shall use a comprehensive approach to integrate ELMR system technical solutions for applied Motorola ASTRO25 version release tech refresh in accordance with this document. Scheduled tech refresh is required to maintain relevance with manufacture’s support capabilities that ensure lifecycle sustainability and compatibility with IA network security patch updates. The ELMR system must continue to support all remote sites bases. At a minimum, the Contractor shall provide system lifecycle management services that support the following:

• Biannually Tech refresh Motorola and third-party networking and computing hardware to maintain the ELMR system within two versions of the latest manufacturer’s release

• Tech refresh Motorola and third-party software to optimize operations and sustain IA compliance capabilities throughout the PoP

• Maintain 100 percent interoperability and 100 percent functionality with all existing system hardware, software, capabilities, and features

• Zero impact to operations of the current LMR subscriber inventory, including non-Motorola manufactured assets such as EF Johnson, Harris, or Relm radios

• Comply with applicable NTIA, Federal Communications Commission (FCC), and TIA/EIA-102 standards

• Promote sound continuity, configuration management, and system recovery principles

• Support interoperability and mutual aid capabilities

• Centralized LMR voice traffic recording from the ELMR Core with remote playback at each site

• P25 Advanced Encryption Standard (AES) Encryption Management

• P25 OTAR and OTAP Management

• Sustain system licenses for ZoneWatch, Affiliation Display, and Historical

Reports to support existing system management capabilities

3.2.2. Contractor shall review ELMR network connectivity designs and integrate engineered solutions that reduce Government GFE circuit requirements, migrates to Ethernet, reduces infrastructure, increases bandwidth, and improves overall system operations as part of each tech refresh project. The Contractor shall provide notification for connectivity requirement to the Government (CDRL A005) in accordance with Technical Exhibit 1.

3.2.3. Contractor shall identify limitations to the current site/infrastructure designs with the potential to impact or limit future upgrade/expansion options. Such limitations are, but not limited to, power distribution (outlets, breakers, and cable supports/ice-bridge), facility generator and uninterrupted power supply (UPS) capacity, circuit bandwidth, environmental controls, and rack/floor space.

3.2.4. Contractor shall initiate a project kick-off meeting with the COR and notify the CO upon the start of each ASTRO25 major version release tech-refresh project.

Scheduling of the project kick-off meeting shall be such that project implementation can be supported to deliver all required services, to include acceptance testing, cybersecurity, and as-built-documents, and complete the project within the contract PoP.

3.2.5. Contractor shall provide meeting minutes (CDRL A006) in accordance with Technical Exhibit 1. Meetings shall be scheduled and conducted by the Contractor PM. The COR and CO reserve the right to increase the frequency of meetings.

Meetings may be either in-person or teleconference. All in-person meetings shall be scheduled at least 15 business days in advance with the COR at no additional cost to the Government. The Contractor PM shall provide the conference bridge for all teleconferences. The COR and CO reserve the right to request the Contractor PM schedule brief (5-15 minute) daily teleconferences with locations affected by project activities to manage stakeholder expectations. Contractor PM, or designated representative, shall participate in all meetings to maintain situational awareness, provide guidance, and answer questions.

3.2.6. Contractor shall have 30 business days following the project kick-off meeting to conduct Critical Design Review (CDR) meeting and deliver 80% technical design information (CDRL A007) in accordance with Technical Exhibit 1. Following the CDR meeting, the COR shall have 5 business days to review any documents and provide comments. The Contractor PM shall have 5 business days to respond to any COR comments. Contractor will keep CO apprised.

3.2.7. After receiving Government approval of the proposed solution design, the Contractor shall submit a complete project schedule (CDRL A008) in accordance with Technical Exhibit 1. The project schedule shall identify all major milestones, and project tasks/sub-tasks associated with delivering turn-key solutions. The project schedule shall be submitted in the latest MS Project and PDF file formats to the COR for approval. All schedule changes must be coordinated and approved by the COR. An updated project schedule shall be delivered to the COR within two

(2) business days after approved schedule changes. The Contractor PM shall reference the latest approved project schedule when managing resources and project activities. Contractor will keep CO apprised.

3.2.8. Contractor PM shall provide email notification (CDRL A009) to the Government in accordance with Technical Exhibit 1 prior to starting any high risk tasks with the potential to impact ELMR system users. The email shall include a description of work, estimated task timelines, associated risks, and fall back procedures. AMC reserves the right to reschedule high risk activities with potential to disrupt ELMR operations to low system utilization time periods which may require some tasks to be accomplished outside the normal business work schedule, to include nights and weekends.

3.2.9. Contractor shall develop and submit an Acceptance Test Plan (ATP) (CDRL A010) in accordance with Technical Exhibit 1. The ATP shall be used to define and conduct all scheduled acceptance testing activities. Inherent ELMR core capabilities available to all system users shall be tested for 20 percent of the remote sites. Site unique capabilities shall be tested at 100 percent. The COR shall approve the sites to be tested. The Contractor shall have 10 business days after testing is completed to research, develop, and document the planned resolution of all discrepancies. Upon coordination and approval from the COR, the Contractor shall have 10 business days to implement the proposed resolution and repeat any portions of the System Acceptance Test that previously failed. The same timelines and process shall be supported for any new issues. Contractor will keep CO apprised.

3.2.10. A 30-day Operational Test (burn-in) of the system shall be performed following the delivery of each ASTRO25 major version release. The burn-in shall not start until the system has successfully passed all of the tests in the system ATP, all discrepancies have been resolved, any required Information Assurance (IA) efforts are complete, and approval has been provided from the COR. The Contractor shall notify the COR of all discrepancies that occur during burn-in upon discovery. The Government shall define discrepancies as either major or minor. The burn-in shall be terminated for any major discrepancies that occur. Corrective actions shall be taken for major discrepancies only as approved by the COR and the entire 30 day burn-in period shall be restarted. The burn-in shall be interrupted and may resume after resolution of any minor discrepancies. AMC reserves the right to refuse restart of the burn-in until all discrepancies are resolved to the satisfaction of the Government. Contractor shall submit a detailed list of all discrepancies and resolutions (CDRL A011) identified within the burn-in period in accordance with Technical Exhibit 1. Contractor will keep CO apprised.

3.2.11. Final “As Built” document files (i.e. Test results/reports, topology/rack drawings, Hardware/Software lists, etc.) shall be delivered (CDRL A012) to the Government in accordance with Technical Exhibit 1. Text files shall be delivered in MS Word format, data files shall be delivered in MS Excel format, and drawings shall be submitted in both MS Visio and PDF file formats.

3.2.12. Contractor PM shall provide the COR with at least 5 business days’ notice prior to the scheduled arrival of field service technicians for onsite work activities.

3.2.13. Contractor shall label all patch panels, controls, audio inputs/outputs and switcher/router inputs/outputs. Labels shall be used to identify the patch panel information, the respective end equipment, equipment jacks, their related wall plates or other fiber optic patch panels at the distant end to include building, room number, rack, and other termination specifications. All cable references shall be to the cable destination. Contractor shall use mechanically printed labels and affix to the front of equipment cabinet or wrap around labels near the cable ends. All equipment with a unit price over $5,000 must be marked IAW DFARS 252.211-7703.

3.2.14. Government furnished equipment (GFE) that is no longer needed, or superseded, due to system replacements shall be removed and relocated to an on-site storage facility as determined by the COR. All associated cables/connectors that are no longer needed shall also be removed from cable racks and system trays.

3.2.15. Contractor PM shall coordinate and request utility outages through the designated COR no less than 10 business days prior to the required date.

3.2.16. Contractor PM shall request physical inspections of onsite work upon completion at each site location. It is not necessary for physical inspections to be delayed until the end of the project and may be supported throughout the project schedule. The COR shall submit any findings to the Contractor PM for resolution and inclusion in final acceptance documents. All work not meeting criteria specified in this document shall be re-accomplished within 10 business days after discovery, to include rework for replacement of equipment and materials, at no additional cost to the Government.

3.2.17. Contractor PM shall contact the COR to validate delivery destination addresses and available storage space prior to the shipment of any equipment and materials.

Shipments should be scheduled to deliver materials and equipment in time to sustain the project schedule but also not to require long term (more than 15 business days after receipt) storage by the Government.

3.2.18. Contractor shall submit to the Government, in accordance with Technical Exhibit 1, a list of materials (CDRL A021) to be delivered and shall include the mode(s) of shipment, scheduled delivery dates/times, weights and dimensions. A joint Contractor and Government inspection and inventory of shipped equipment and materials shall be completed within 10 business days after delivery.

3.3. CYBERSECURITY / RISK MANAGEMENT:

3.3.1. Cybersecurity Requirements Stated by DoDD 8500.1.

3.3.1.1. “Cybersecurity requirements shall be identified and included in the design, acquisition, installation and operation, upgrade, or replacement of all DoD information systems in accordance with 10 U.S.C. Section 2224, Office of Management and Budget Circular A-130, Appendix III, DoD Directive 5000.1 (reference (a), (j) and (k)), DoD 8500.1 and DoDI 8500.2, and other IA related DOD regulations and guidance as issued.

All DoD information systems shall maintain an appropriate level of confidentiality, integrity, authentication, non-repudiation, and availability that reflect a balance among the importance and sensitivity of the information and information assets; documented threats and vulnerabilities, the trustworthiness of users and interconnecting systems; the impact of impairment or destruction to the DoD information system; and cost effectiveness.

Interoperability and integration of IA solutions within supporting the Department of Defense shall be achieved through adherence to an architecture that will enable the evolution to network centric warfare by remaining consistent with the Command, Control, Communications, Computers, Intelligence, Surveillance, Reconnaissance Architecture Framework, and a defense-in-depth approach. This combination produces layers of technical and non-technical solutions that provide appropriate level of confidentiality, integrity, authentication, non-repudiation, and availability; defend the perimeters of enclaves; provide appropriate degrees of protection to all enclaves and computing environments; and make appropriate use of supporting IA infrastructures, to include robust key management and incident detection and response.”

3.3.2. Support IA Services – Risk Management Framework (RMF) Cybersecurity Accreditation. The Government Information Systems Security Manager (ISSM) shall facilitate the RMF cybersecurity accreditation, gather system information provided by the Contractor, and enter information into eMASS. The Contractor shall incorporate all applicable technical, procedural, and system documentation associated with federal and DoD IA policy and requirements for non-tactical LMR systems that transmit and manage Controlled Unclassified Information (CUI) voice and data traffic. The Contractor shall prepare and deliver RMF support documents and artifacts (CDRL A013) to the Government in accordance with Technical Exhibit 1. As DoD and Air Force IA policies require continuous updates, the Government ISSM shall provide the latest templates and policy guidance references upon request to the Contractor cybersecurity team.

3.3.3. General IA Requirements. The Contractor shall provide support to the following IA requirements:

3.3.3.1. Field upgradable operating systems and upgrade legacy software prior to scheduled end-of-life. Contractor shall follow and comply with RMF policies and procedures throughout the system lifecycle IAW AFI 17-101, Risk Management Framework (RMF) for Air Force Information Technology

(IT).

3.3.3.2. Provide Software Update Service (SUS) automated IA security patches and updates to support the system as required to maintain RMF authorizations and sustain operational capabilities. System updates must be vetted by the Motorola support center to ensure compatibility and supportability with ASTRO operations and shall not impact ELMR users. At a minimum, the Contractor shall provide automated anti-virus definition updates, minor release patches, and IA remediation. The Contractor shall obtain Information Assurance Vulnerability Management (IAVM) Alerts released by the Department of Defense Computer Emergency Response Center (DoD-CERT), and OEM Bulletins and Technical Tips (Microsoft, Oracle, Solaris, RedHat, Adobe, etc.) to identify and address new vulnerabilities identified. Unless approved by the COR, remote updates should be scheduled as follows:

At a minimum, apply:

• Microsoft: Monthly

• UNIX, Linux and Third Party Patches: Quarterly

• Antivirus Patches/definition updates: Weekly

3.3.3.3. Provide notifications (CDRL A014) to the Government in accordance with Technical Exhibit 1 for each IA or RSUS update pushed to the system.

3.3.3.4. Ensure that all applicable COTS IA and IA-enabled products comply with AFI 17-130, Air Force Cybersecurity Program Management and AFMAN 17- 1301, Computer Security. These products must be Committee on National Security Systems Policy 11 (CNSSP-11) compliant, requiring them to be validated by accredited labs under the National Information Assurance Partnership (NIAP) Common Criteria Evaluation and Validation Scheme or National Institute of Standards and Technology (NIST) Federal Information Processing Standards (FIPS) Cryptographic Module Validation Program

(CMVP).

3.3.3.5. Provide Security Technical Implementation Guide (STIG) validation and Benchmarking (Security Content Application Protocol – SCAP) on 100 percent of the ELMR system. The Contractor shall analyze results and submit reports to the Government in accordance with Technical Exhibit 1

(CDRL A015).

A STIG is a comprehensive list of configuration validations based on the content being scanned and includes both automated and manual review process of controls. A security technician possessing at least one of the following certifications, CySA+, GICSP, GSEC, Security+ CE, or SSCP, shall validate security updates are applied within required timelines. The security technician shall apply proper integrity controls as needed to ensure updates are successful and have not negatively impacted the ELMR system. The frequency of these services shall be provided in accordance with DoD and Air Force cybersecurity policies as follows:

STIG validations shall be completed:

• When upgraded to a new system release

STIG Benchmarking shall be applied:

• When upgraded to a new system release

3.3.3.6. Perform system cybersecurity scans to identify and address vulnerabilities and validate policy compliance. Vulnerability scans are required to be automated per RMF Configuration Control Item (CCI)/Controls.

Cybersecurity scans shall be completed in accordance with DoD and Air Force cybersecurity policies. The Contractor shall analyze cybersecurity scan results and submit findings to the Government in accordance with Technical Exhibit 1

(CDRL A015).

DoD has identified approved enterprise scanning tools that meets requirements. The Contractor shall use only approved DoD scanning tools.

Approved DoD scanning tools are:

• Tenable/Nessus

• Assured Compliance Assessment Solution (ACAS)

• SCAP Compliance Checker (SCC)

At a minimum, vulnerability scans are required:

• When upgraded to a new system release

3.3.3.7. Implement technical security controls and settings to fix or mitigate vulnerabilities identified by the system cybersecurity scans and Government ISSM within 10 business days after findings.

3.3.3.8. Incorporate all applicable technical, procedural, and system documentation associated with federal, DoD, and Air Force IA policy and requirements for non-tactical LMR systems that transmit and manage CUI voice and data traffic. The Contractor shall also provide support to the following IA requirements:

3.3.3.8.1. All supporting artifacts shall be updated whenever the system is upgraded to a new system release to include the vulnerability/ cybersecurity scan results and other supporting documents.

3.3.3.8.2. Provide requisite system security assessment(s), and catalog identified risks and mitigating security controls to assist in development for a plan of action and milestones (POA&M). TAFB shall create and manage the POA&M with technical assistance and input provided by the Contractor. Any POA&Ms that cannot be resolved for various reasons (i.e., risk of breaking a system capability, severe degradation to operational functionality, limited resources, etc.) must have supporting Artifacts justifying why the Risk needs to be accepted and justification to mitigate the severity to a lower level (i.e., CAT 1 to CAT 2).

3.3.3.8.3. Provide system information, technical and security assistance to the Government ISSM to support risk assessment/determination and authorization decisions.

3.4. SUSTAINMENT:

3.4.1. Contractor shall provide Motorola certified personnel and equipment, transportation, tools, materials, supervision, and other items and services necessary to perform troubleshooting, repair, PMI, conduct operational checks/adjustments, monitor system performance, provide remote support/maintenance, dispatch technicians, and deliver on-site maintenance repair services in accordance with all manufacturer specifications, to include OEM parts and labor.

3.4.2. Contractor shall provide associated maintenance and services to include remote and on-site maintenance response capabilities, depot level repairs, infrastructure repair, and emergency support to sustain system operations as specified within this document.

3.4.3. Contractor shall provide any OEM pass through warranty and standard commercial warranties applicable to the products being installed as part of lifecycle management or sustainment services at no cost. This shall apply to all new and upgraded equipment and software. Warranty coverages shall not begin until all equipment has been installed and has passed final inspection and acceptance by the Government to include acceptance of repair actions.

3.4.4. Contractor shall utilize calibrated and reliable test equipment to ensure quality adjustments, alignments, and repair of communications systems. This test equipment shall meet all requirements of the National Institute of Standards and Technology Standards and is available for inspection.

3.4.5. Contractor shall provide 24-hours per day, 7 days per week, 365 days a year remote ELMR network monitoring to detect abnormal conditions and initiate support activities to sustain normal system operations. Monitoring services shall be provided by Motorola’s Federal Secure Support Center and all systems and software integrating with the ELMR core shall be certified Motorola products to ensure 100 percent operability and functionality with existing ELMR infrastructure. Remote system monitoring, technical support, and dispatch services shall be supported by Motorola’s Federal Secure Support Center to resolve system issues, to include:

• Monitoring events for further developments

• Attempting remote restoration

• Escalating event information to Motorola Technical Support

• Dispatching a local service technician

• Ordering logical replacement parts in advance of failure

3.4.7. Contractor shall provide infrastructure repair. Infrastructure may be repaired down to the component level, as applicable. Third party infrastructure may be sent to the OEM or third party vendor for repair. When infrastructure is no longer supported by the OEM, or third party vendor, the contractor shall replace infrastructure with similar infrastructure. The contractor shall provide priority shipment for all required equipment.

3.4.8. Contractor shall provide on-site technical response and restoral services as determined by the COR and the following Priority Level Definitions. Contractor shall support incident management and trouble escalation processes for dispatched on-site repair activities.

Priority Level Definitions:

• Critical. Contractor shall provide 24x7 support and respond within 4 (four) hours after detection, or Government notification, of a Critical priority system failure.

Contractor shall provide a continual effort until the system is restored or a workaround resolution is employed. Critical system failures are defined as:

• Core failure affecting all bases causing in ability to process voice calls

• High. Contractor shall provide support during normal business hours and respond within 4 (four) hours after detection, or Government notification, of a High priority system failure. Contractor shall provide a duty hours effort until the system is restored or a workaround resolution is employed. High priority system failures are defined as:

• Console positions down (>= 33%) Console site link down

• < 33% of Sites/Subsites down or Sites/Subsites >= 33% of channels down

• >= 50% of Conventional channels (CCGW) down

• Devices; Site Router/switch, GPS down

• Medium. Contractor shall provide…