Attachment__1_EPoS_IDIQ_Performance_Work_Statement_(PWS).pdf

Solicitation SP4703-17-R-CB01 Electronic Point of Sale (EPoS) and Supporting Services

IDIQ Performance Work Statement

Background

Defense Logistics Agency (DLA) Energy has the worldwide mission of providing petroleum and related support to United States (US) military forces and eligible Federal Civilians, State and Local Governments, Foreign Governments and Government contractors. This support includes fuel sold at aviation flight lines, fixed facility and mobile gas dispensers for vehicles and other ground support equipment; fuel sold to vessels both at sea and in port, and fuel deliveries to fixed installations. DLA Energy must accurately capture this sales data and process it through its enterprise system in a timely manner. DLA Energy’s existing Automated Fuels Service Station (AFSS) software/hardware application, Syntech FuelMaster®, is deployed in multiple versions with approximately 897 units at 340 locations worldwide.

The system is initialized by locally-encoded and locally-distributed source media, Vehicle Identification Link (VIL) keys, which turn on the gas pump while capturing data encoded on the VIL key to identify the appropriate customer for billing purposes. Collected sales data is uploaded each day to the upstream Accountable Property System of Record system, currently FuelManager® Defense (FMD), at DLA Energy’s 616 Defense Fuel Support Points (DFSPs).

DLA requires a robust mechanism for automatically capturing transactional data associated with DLA Energy sales that supports all environments where those sales occur. The existing point of sale systems do not meet the current standards for DoDI Certification and Accreditation or Financial Improvement and Audit Readiness (FIAR). Energy supply chain manpower is insufficient to support manual sales data capture and the corresponding reduction in data integrity is considered untenable from an audit readiness perspective. Therefore, DLA Information Operations, Operational Energy Operations (J62BG), Fort Belvoir, Virginia has partnered with DLA Energy in providing Information Technology (IT) support to ensure the current standards are met.

Objective

DLA Energy requires an electronic Point of Sale (EPoS) turnkey solution that meets the current standards for DoDI certification/accreditation and Audit Readiness and captures military fleet management fuel retail transactions at unattended military service stations, mobile ground fuel transactions, aviation fuel transactions for mobile airfield/flight line operations, and Custody Transfer Transactions. The solution shall comply with the security control requirements documented in National Institute of Standards and Technology (NIST) Special Publication (SP) 80053r4, “Security and Privacy Controls for Federal Information Systems and Organizations” and NIST 800-82r2, “Guide to Industrial Control Systems (ICS) Security as specified in this PWS.

Turnkey is defined as complete implementation to include physical preparation and installation of the device within the defined area of responsibility required to make the device operational and full implementation of the software solution to meet the requirements included in this PWS.

System Environment

The enterprise components of the solution shall comply with the system requirements for operating in a Defense Information Systems Agency (DISA) enclave. DISA enclave requirements do not apply to the firmware and operating systems for the fixed and mobile devices.

Electronic Point of Sale (EPoS) and Supporting Services IDIQ Performance Work Statement

The solution shall use only those operating systems (OS) capable of joining an Active Directory domain (e.g., Windows 10) and approved for use in a Government network environment.

Scope

The contractor shall provide a turnkey hardware and software solution that captures military fleet management fuel retail transactions at unattended military service stations, mobile ground fuel transactions and aviation fuel transactions for mobile airfield/flight line operations, and Fuel Custody Transfer Operations at Department of Defense (DoD) Fuel Retail/Storage locations.

The following is a conceptual operational view of the solution.

The EPoS enterprise has two components.

The first component is a database for storing transactional data and authenticating source media that each device will communicate with at time the sale is initiated. The second component is Windows Active Directory. Active Directory manages the user authentication when an individual user logs into their device with a Common Access Card. A request is sent to the Active Directory controller that allows or

Electronic Point of Sale (EPoS) and Supporting Services

IDIQ Performance Work Statement disallows login. Each device on a network is connected to the Active Directory (AD) and the device itself is authorized to be on the network. AD also manages the life cycle of the devices. It is responsible for pushing security updates, patches, and configuration changes to the devices that are connected.

As depicted in the diagram, Active Directory does not directly connect to the DLA Energy Accountable Property System of Record. There is no requirement for the fixed devices and mobile devices to communicate with each other. Independently they will each authenticate each device to the AD Domain Controller at DISA.

Active Directory Services

The contractor shall provide Active Directory services to manage the devices connected to the solution.

The contractor shall manage the Active Directory (AD) on behalf of the Government. The AD will be on a server at DISA and the contractor shall manage it remotely. All devices (fixed and mobile) shall communicate with the AD to be authorized for use. Use of default Windows communication will allow the AD to know if there are any problems or communication failures. Mobile devices require user login and require authentication of each individual user in addition to device authorization.

The contractor shall develop, deliver, configure and provide end user training documentation as required for AD services.

Fixed Facility Electronic Point of Sale Devices

The contractor shall deliver an electronic Point of Sale (EPoS) solution that is compliant with DoD network requirements and supports the Joint Information Environment for commercial mobile technology at fixed facilities.

The contractor shall develop all interface and application software that meets the requirements for fixed facility devices.

The contractor shall sustain all interface and application software that meets the requirements for fixed facility devices.

The contractor shall provide all labor, software, equipment, licenses, and other services necessary to prepare physical sites; ensure electrical and cable connectivity; and install fixed facility equipment at fixed facilities worldwide adhering to requirements defined in the Task Order.

The contractor shall provide site-specific support to include labor and equipment necessary to maintain physical sites in an operational state adhering to requirements defined in the Task Order.

The contractor shall develop, deliver, configure and provide end user training documentation as required for fixed facility point of sale device hardware and software.

Section 4.0 contains a conceptual operational view of the solution.

Mobile Electronic Point of Sale Devices

The contractor shall deliver mobile device hardware as procured by the Government.

Note: The Government may procure the mobile device hardware from the contractor or separately and provide as Government Furnished Equipment (GFE).

The contractor shall oversee delivery of mobile devices ordered by the Government whether provided by the Government or provided by the contractor.

Electronic Point of Sale (EPoS) and Supporting Services

IDIQ Performance Work Statement

The contractor shall maintain an inventory of all mobile device hardware on behalf of the Government whether provided by the Government or provided by the contractor.

The contractor shall develop and sustain all application software that meets the requirements for mobile devices.

The contractor shall ensure compliance with Federal, DoD and DLA information technology and security requirements, policies, procedures and standards.

The contractor shall provide technical upgrades to the software and hardware to remain viable with industry best practices.

The contractor shall install the mobile device application software on the mobile device hardware whether provided by the Government or provided by the contractor so devices are ready to ship.

The contactor shall provide a repository of ready-to-ship mobile devices.

The contractor shall replace mobile devices as directed by the Government to maintain an operational capability.

The contractor shall develop, deliver, configure and provide end user training documentation as required for mobile point of sale device hardware and software.

Information System and Industrial Cybersecurity

The contractor shall develop a software solution that complies with the security control requirements listed in section 5.6 below. The software shall be capable of obtaining an Authorizing Official (AO) Authority To Operate (ATO) by utilizing the Department of Defense (DoD) processes and procedures as defined in the DoD Instruction 8510.1 “Risk Management Framework (RMF) for DoD Information Technology (IT)” as implemented by DLA.

The contractor shall perform preventative and analytical activities aimed at enhancing the overall cybersecurity posture of the solution associated with integration within DLA networks, information systems, and applications.

The table below depicts the applicable requirements for Active Directory, Fixed Devices and Mobile Devices as detailed in section 5.6.

Section Section Identification Active

Directory1 Fixed

Devices Mobile Devices

5.6 Information System and Industrial Cybersecurity X X X

5.6.1 Cybersecurity Enterprise Architecture Support and Compliance X X X

5.6.2 Cybersecurity Engineering Support X X X

1 For the purpose of this applicability matrix, the term “Active Directory” also symbolically represents the Enterprise Software Solution as well as its correct definition as “…. Directory service that Microsoft developed to provide LDAP, SSL, hierarchical, internal storage of organization data, data availability across multiple servers, and management/update services …”

Services IDIQ Performance Work Statement

Section Section Identification Active

Directory1 Fixed

Devices Mobile Devices

5.6.3 Cybersecurity Assessment Program (CAP) X X X

5.6.3.1 Command Cyber Readiness Inspections (CCRI) X X X

5.6.3.2 Penetration Testing Support X X2 X3

5.6.4 Cybersecurity Certification and Accreditation (C&A) Service X X X

5.6.5 Cybersecurity POA&M Services X X X

5.6.6 Cybersecurity General Support Services X X X

5.6.7 FISMA Tracking and Reporting X

5.6.8 Applicable Cybersecurity Controls (Baseline) X X

5.6.9 Applicable Cybersecurity Controls (Industrial Control Systems Enhancement)

X

5.6.10 Controlled Unclassified Information (Contractor Internal Cybersecurity Controls)

X X X

Demonstrations

Evaluation of responses includes a Solution Demonstration of the use cases provided in section 5.7.1 Fixed Facility Device Use Case through section 5.7.5 Fuel Header Use Case in this PWS. Instructions and evaluation information for the demonstration are included in Attachment 8, Solution Demonstration.

Evaluation of responses also includes a Cybersecurity Demonstration of the use case provided in section

5.7.6 Security Technical Implementation Guide Use Case in this PWS. Instructions and evaluation information for the demonstration are included in Attachment 9, Cybersecurity Demonstration.

The Contracting Officer will schedule the Solution and Cybersecurity Demonstrations as part of the technical evaluation.

Tasks

The tasks listed below may be awarded separately or in a combination to address Government requirements under this IDIQ contract. Each Task Order will address the task list to define the work the contractor shall perform.

2 Primary focus of penetration testing is the Enterprise Software Solution however; fixed cellular/wireless devices subject to penetration type testing (Electronic/Physical Hardware) based on device design/implementation.

3 Primary focus of penetration testing is the Enterprise Software Solution however; mobile cellular/wireless devices subject to penetration type testing (Electronic/Physical Hardware) based on device design/implementation.

Electronic Point of Sale (EPoS) and Supporting Services

IDIQ Performance Work Statement

Task 1: Active Directory Domain Services Capability

The contractor shall provide management of an Active Directory (AD) capability that manages all mobile and fixed facility devices connected to the AD.

Active Directory Domain Services Environment

A domain controller running an operating system in the Windows Server family Hardware that meets the minimum hardware requirements of the edition of the operating system The presence of a fully functioning Active Directory replication topology The presence of a fully functioning File Replication Service (FRS) topology A backup schedule that includes a full backup once a week and an incremental backup once a day Regular monitoring of Active Directory, either through manual review of event logs or through an automated monitoring solution, such as Microsoft Operations Manager (MOM)

Task 2: Fixed Facility Device Interface and Application Software Development

The Government will provide the specifications for the interface to the DLA Energy Accountable Property System of Record as required by Task Order. Refer to Instructions to Offerors for further information.

The contractor shall develop a design that describes how functional and technical requirements are met considering solution hardware and software capacity and limitations, operating time and desired results.

The contractor shall ensure that application design and detailed specifications meet all requirements.

The contractor shall obtain Government concurrence with the detailed design through technical reviews as directed by the Task Order.

The contractor shall design and develop an architecture plan which includes the architectural process and approach, the architecture documentation or electronic models including hardware, connectivity, network infrastructure and components; associated Information Technology (IT) software in terms of component functions, implementation techniques, and interfaces; storage, backup and recovery procedures, recommended operational and administration procedures.

The contractor shall model operational, system, service, capability standard and data models as required by DLA Architecture standards.

Fixed Facility Application Software Requirements

The contractor shall provide all personnel, equipment, tools, materials, supervision and other items and non-personal service necessary to deliver, install, test and ensure devices are operational at all Continental United States (CONUS) and Outside of Contiguous United States (OCONUS) locations listed in Attachment List of EPoS Fixed Facility Device Locations.

Overall Device Requirements

End-user training shall come with the product and shall be provided by the contractor upon initial fielding o User manual should be written in non-technical, easy-to-understand language

Services IDIQ Performance Work Statement o No formal in-residence training post initial fielding training should be required to operate this program

The data shall be encrypted at rest and in transit using the National Institute of Standards and Technology (NIST) Federal Information Processing Standard 140-2 (FIPS 140-2)

Ability to update devices real time when changes occur (updates, password protect, etc.) as a whole, not individually o All updates will be managed through a DLA Managed Active Directory Solution o Push updates to devices wirelessly (cellular or satellite dependent on location)

Transaction data shall be secured at Service Station pedestals, handhelds or during transfer to the enterprise system

User shall not be able to manipulate, update or change data once a transaction has been completed The same system shall be used by all branches of military service using a standardized configuration The contractor shall provide an image for the GFE to be used with their software that has had all applicable STIG’s applied when a change is made for the device configuration o Image updates will be pushed through Windows Active Directory/Software management solutions Fixed facility equipment shall be provided as Contractor Furnished Equipment (CFE) System shall be worldwide deployable and legal to operate in all Host Nations

Custody Transfer Device Requirements

Transmits transactional data in accordance with data transfer standards for information integrity assurance to DLAs Energy Accountable Property System of Record

Utilizes current industry best practices to meet the DLA Energy needs and consists of established commercial items having documented commercial installation history and performance records, which demonstrate the system has a proven record of reliable field performance

Supports Audit Readiness and DoD reporting requirements for validation of source media and transactional integrity by authenticating against the enterprise repository o In the event that authentication does not occur within 15 seconds the device will failback to authenticate against a self-contained blacklist

Provides secure data transfer technology that meets DoD/DLA IT security standards

Environmental Requirements

Flammable Gases or Vapors: The device shall be safe to operate in a Class 1 Division 1 area in which o Ignitable concentrations of flammable gases or vapors may exist under normal operating conditions o Ignitable concentrations of such gases or vapors may exist frequently because of repair or maintenance operations or because of leakage o Breakdown or faulty operation of equipment or processes might release ignitable concentrations of flammable gases or vapors, and might cause simultaneous failure of electric equipment

Water Resistance: The device shall handle exposure to rain, water spray, or dripping water during storage, transit, or operation

Salt (Salt Fog): The device shall be able to withstand high levels of salt in the atmosphere associated with operating in salt (marine) environment

Sand and Dust: The device shall resist the effects of sand and dust obstructing openings, penetrating into cracks, crevices, bearings, and joints degrading its effectiveness, reliability and maintainability due to abrasions or clogging

Visibility: The device screen shall be easily viewable in low light and high glare environments

Services IDIQ Performance Work Statement

Electronic Communication Requirements

All communications shall be secured in transit using the National Institute of Standards and Technology (NIST) Federal Information Processing Standard 140-2 (FIPS 140-2)

The device shall electronically transmit captured transactional data to the centralized enterprise repository

The contractor shall provide internet connectivity, through cellular or satellite communication, for wirelessly obtaining lists of authorized source media and for the transmittal of transactional data to the enterprise solution

All transmissions shall occur in the background and not prohibit the continued use of the device

Blacklisted Transaction Requirements

Shall have a self-contained blacklist of source media that is no longer a valid purchase media Shall update the blacklist remotely using format specified in section 5.5.2.13 The blacklist shall be updated a minimum of three times daily, or during the first available connection in the event of loss of communications. The blacklist shall also have the ability to be updated via a USB connection to a local computer in the event that the environment prohibits wireless communication

All transactions initialized with authorized source media shall be validated against the blacklist if communication to the enterprise database fails or is unavailable

Source Media Requirements

Source media is defined as source media authorized and managed by DLA for the purchase of products from DLA

All source media shall be validated before authorizing the transaction Shall be configured to accept one or more commercially used electronic purchase media (i.e. magnetic stripe card, radio frequency identification (RFID), smart card, Quick Response (QR) Code). Initially the devices shall include card and barcode readers o The barcode reader must be capable of reading a barcode affixed to a piece of equipment and as a card with the barcode printed on it

Reconfiguration of the type of authorized source media shall be completed remotely through the Active Directory

The initial source media will be magnetic stripe cards issued through the DLA Energy Card Management Office

Subscriber Identity Module (SIM) Card Management

The contractor shall manage the SIM cards used in the EPoS fixed devices. The contractor shall:

Develop and update an inventory of SIM cards that provides accountability of the cards Note: Identification includes the Integrated circuit card identifier (ICC-ID) engraved on the body of the card and its International Mobile Subscriber Identity (IMSI).

Conduct inspections and tests on the cards to ensure industry standards are met Provide a repository of ready-to-ship SIM cards Support deployment of fixed devices by providing initial SIM cards Maintain operational capability by replacing inoperable cards Ensure compliance with Federal, DoD and DLA information technology and security requirements, policies, procedures and standards

Services IDIQ Performance Work Statement

Receipt Printing

All devices shall print a receipt at the user’s option (printer attached or built in)

Customer Identification

Customer identification shall be completed by capturing the receiver’s full name (First Name, Last Name) from DoD and Federal Personal Identity Verification (PIV) cards complying with FIPS 201 or state issued identification card complying with the Real ID Act of 2005 Note: The solution shall accept both the driver’s license and DoD PKI enabled card

If the identification card is not available or non-compliant with the above identified standards, the user shall be able to manually type in the First and Last Name Note: Manual input shall not be validated or verified because a list of customers does not exist.

Since the card is the authorized customer source medium not the individual, identification of who physically took position of the fuel is captured for research purposes after the fact.

The device will be limited to capturing the required information from the identification card and shall not authenticate the customer’s identification

Fixed Facility Device Temperature Requirements

High Temperature: 120 Degrees F Radiant, Low Temperature: 0 Degrees F ambient.

o Devices deployed in locations where the environment exceeds the operating range shall have the capability of adding a contractor provided retrofit of heating and cooling mechanisms Retrofitted equipment shall not change the Intrinsically Safe rating of the device

High temperatures in some environments may exceed 150 degrees Radiant and may fall below - 60 degrees

Fixed Facility Device Requirements

Shall have an alternate method for obtaining transactional data in the event that the communication link is broken o All direct interfaces with computers shall meet all cybersecurity requirements Shall store 10,000 transactions in the event that communications fail Fixed facility devices shall be configured with the available fuel products through an update from the

Active Directory solutions The device shall prohibit the dispensing of fuel until an authorized purchase media has been authenticated, and identification has been presented The device shall allow users to input the odometer reading at the time of purchase.

The device shall capture the user’s name User Identification shall be completed by the user inserting a Federally issued PIV or driver’s license o The device shall capture their name from the presented identification

The device shall be configurable with facility specific information that shall capture the selling location information o Information shall include Issuer Department of Defense Activity Address Code (DoDAAC), and Processing DoDAAC

The device shall allow manual bypass by the facility operator o Access to the bypass shall be secured

DWM0032

Highlight

DWM0032

Highlight

DWM0032

Highlight

DWM0032

Highlight

Services IDIQ Performance Work Statement

Note: Manual input shall not be validated or verified because a list of customers does not exist. Since the card is the authorized customer source medium, identification of who physically took position of the fuel is captured for research purposes after the fact.

Task 3: Fixed Facility Device Interface and Application Software Sustainment

The contractor shall sustain all interface and application software that meets the requirements for fixed facility devices.

Sustainment Plan

The contractor shall develop and implement a Sustainment Plan for the installed solution by site to ensure that the installed systems and equipment meet the requirements. The Sustainment Plan shall include the periodic maintenance, repair, replacement, and overhaul of existing systems, hardware, and software inclusive of Information Assurance Vulnerability Alerts (IAVA Patching).

The Sustainment Plan shall include the contractor’s approach to:

Position qualified personnel, test equipment, etc. needed to quickly diagnose and make repairs Plan, perform, and document system confidence tests, periodic inspections, and preventive maintenance Identify critical system operations and implement strategies to prevent potential failures or administrative down-time from creating a critical system outage Analyze fault histories and fault trends to proactively predict and mitigate repetitive issues

Configuration Management

The contractor shall conduct Configuration Management (CM) for all incidents, and requests for change using the Government’s in-place CM tracking system. The Government will provide information on the system change process DLA uses after contract award. The contractor shall update and track all development efforts by submission, review, level of effort (LOE), funding, approval, delivery, testing, and applying of the enhancement to production.

The contractor shall create, maintain, and post technical documentation and revisions for the application as directed by Task Order and as approved by the Contracting Officer’s Representative (COR). The contractor shall accept input from the help desk for base level user issues / problems and update technical documentation as required.

The contractor shall provide the necessary controls and data gathering capabilities to assemble, verify, and validate requirements for various ongoing interface development efforts. The contractor shall provide the direct quality assurance support. The contractor shall also assist with the onsite tier 3 support documentation and assistance with performance of Beta testing as directed by the Task Order. The contractor shall provide Quality Assurance Reports to the COR for each system and software change request, as they are required.

Tier 1 Help Desk Support

The DLA Enterprise Help Desk (EHD) will provide tier 1 Help Desk Support. The Government will provide instructions on EHD access and use at contract award.

Services IDIQ Performance Work Statement

Tier 2 Help Desk Support

The contractor shall provide tier 2 Help Desk support through technical assistance to the Government in resolving any problems associated with EPoS. These problems may include but are not limited to hardware or software failure or errors that hinder operations.

The contractor shall review and analyze production trouble tickets and resolve issues.

The contractor shall identify methods and mechanisms to actively assist system users in performing their tasks, minimizing the need to communicate with the help desk for items that are addressed by online system documentation or other methods.

Tier 3 Help Desk Support

The contractor shall provide tier 3 Help Desk support on tickets assigned by the Enterprise Help Desk (EHD) and report on work done on those tickets to the EHD. Tier 3 is the support beyond the scope of tier 2 and includes functional application support and making recommendations for changes to the EPoS application software or business processes. It includes developers, subject matter experts, other representatives that are appropriate to ensure tickets for the EPoS software; both Commercial off the Shelf (COTS) and developed software are resolved within the EPoS configuration management process.

On Site Support

If a site is determined to be in a down condition, the contractor shall immediately notify the EPoS PMO and the Government will determine the appropriate response. If the Government directs the contractor to travel to the site to work on site repairs, the contractor shall dispatch personnel to meet the required repair time as defined below. The required repair time will not begin until the Government directs the contractor to proceed to the site. The contractor is authorized to travel to a site at the direction of the COR.

CONUS - The contractor required repair time for a down site is three (3) calendar days after notification.

Notification begins at 0800 hours on the following normal business day on which a call is received. If the notification is received on a Saturday, a Sunday or a federal holiday, the repair time starts at 0800 hours on the first normal business day thereafter. However, if the third calendar day falls on a Saturday, Sunday, or a federal holiday, the contractor shall report on the first normal business day thereafter.

OCONUS - The contractor shall be permitted a seven (7) day response time after notification for all non- CONUS and special sites. Start time for notification is the same as CONUS sites. If on-site support by contractor personnel is required, the contractor repair time will not start until such time that appropriate clearances have been obtained with the assistance of EPoS PMO.

OTHER - Other maintenance issues that do not render the site down will be managed in the same expeditious manner, however, the 3 and 7-day period will not apply.

Problem Resolution

The contractor shall work as an integrated team with Government personnel and other Government contractors supporting sustainment of the solution. The contractor shall assist the Government with continued interface support between the contractor’s application and upstream Accountable Property System of Record, currently FuelManager® Defense (FMD). The contractor shall use the system change process in use at contract award, currently Eagle Incident and Request for Change process to complete all changes to the system. Instructions on access to and use of the DLA change process will be provided at contract award.

Electronic Point of Sale (EPoS) and Supporting Services

IDIQ Performance Work Statement

The contractor shall perform all necessary research, analysis, and troubleshooting of work orders generated by a help desk ticket, to address problem issues with configuration management, cybersecurity, DoD Network, the contractor’s application and associated interfaces. The contractor shall coordinate and work with Information Operations technical staff at Fort Belvoir, Application Support Group (ASG) Senior Analysts, Service Control Points (SCPs) and other support activities involved with connectivity, configuration, and access to resolve problems. The contractor shall document the description of the problem and its resolution for the user and help desk in accordance with the ASG Standard Operating Procedure (SOP).

Post Production Support

The contractor shall provide post production support; develop and execute a release plan; and transfer knowledge on the product to the Government-designated sustainment organization. The contractor shall fix all defects found in production: provide support to users, business process analysts, others as designated by the Government. The contractor shall provide post production support until the capability is within acceptable process and system performance thresholds; support the complete acceptance of the capability as it transitions to normal operations, support and sustainment.

Covered Defense Information

In accordance with Defense Federal Acquisition Regulation Supplement (DFARS) Procedures, Guidance, and Information (PGI) 204.7303-1 General, this solicitation is expected to result in a contract that will require covered defense information to be furnished by the Government and/or developed or delivered by the contractor, or when the contractor provides operationally critical support.

Definitions

Code of Federal Regulations (CFR), Title 32, Subtitle A, Chapter 1, Subchapter M, Part 236, Department of Defense (DoD) - Defense Industrial Base (DIB) Cyber Security (CS) Activities provides the following definitions.

Covered defense information means unclassified controlled technical information or other information (as described in the Controlled Unclassified Information (CUI) Registry at http://www.archives.gov/cui/registry/category-list.html) that requires safeguarding or dissemination controls pursuant to and consistent with law, regulations, and Government wide policies, and is

Marked or otherwise identified in an agreement and provided to the contractor by or on behalf of the DoD in support of the performance of the agreement; or

Collected, developed, received, transmitted, used, or stored by or on behalf of the contractor in support of the performance of the agreement.

Defense Industrial Base (DIB) means the Department of Defense, Government, and private sector worldwide industrial complex with capabilities to perform research and development, design, produce, and maintain military weapon systems, subsystems, components, or parts to satisfy military requirements.

Government furnished information (GFI) means information provided by the Government under the voluntary DIB CS program including but not limited to cyber threat information and cybersecurity practices.

Information means any communication or representation of knowledge such as facts, data, or opinions in any medium or form, including textual, numerical, graphic, cartographic, narrative, or audiovisual.

Electronic Point of Sale (EPoS) and Supporting Services

IDIQ Performance Work Statement

Information system means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.

Malicious software means software or firmware intended to perform an unauthorized process that will have adverse impact on the confidentiality, integrity, or availability of an information system. This definition includes a virus, worm, Trojan horse, or other code-based entity that infects a host, as well as spyware and some forms of adware.

Media means physical devices or writing surfaces, including but not limited to, magnetic tapes, optical disks, magnetic disks, large-scale integration memory chips, and printouts onto which covered defense information is recorded, stored, or printed within a covered contractor information system.

Operationally critical support means supplies or services designated by the Government as critical for airlift, sealift, intermodal transportation services, or logistical support that is essential to the mobilization, deployment, or sustainment of the Armed Forces in a contingency operation.

Threat means any circumstance or event with the potential to adversely impact organization operations (including mission, functions, image, or reputation), organization assets, individuals, other organizations, or the Nation through an information system via unauthorized access, destruction, disclosure, modification of information and/or denial of service.

Requirements

The Government will provide to the contractor and the contractor will produce CDI information. The contractor shall protect this information using applicable ICS/SCADA OT controls described in National Institute of Standards and Technology Special Publication (NIST SP) 800-82, “Guide to Industrial Control Systems (ICS) Security Supervisory Control and Data Acquisition (SCADA) systems, Distributed Control Systems (DCS), and Other Control System Configurations such as Programmable Logic Controllers (PLC).” The contractor shall provide internal protections to reduce internal and external compromises as outlined in NIST SP 800-171, "Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations." The contractor shall comply with the systems security engineering (SE) principles outlined in NIST SP 800-160, "Systems Security Engineering" for developing trustworthy secure systems.

Security Incident Reporting

In addition to adhering to the reporting requirements as outlined in DFARS clause 252.204-7012, when the contractor discovers a cyber-incident that affects covered defense information or the contractor’s ability to meet the requirements of the contract, the contractor shall:

Provide the results of any reviews conducted for evidence of compromise of covered defense information or that affect the contractor’s ability to provide operationally critical support;

including, but not limited to, identifying compromised computers, servers, specific data, and user accounts

Rapidly report the incident(s) to the applicable Contracting Officer and the DLA Cyber Resilience Program Office (specific information regarding incident notification guidelines and point of contact information will be provided at the time of contract award)

Preserve and protect relevant artifacts (e.g., configurations, audit logs, packets, etc.) for at least 90 days from the submission of the cyber-incident report so that if it is deemed necessary, DLA’s Cyber Resilience Program Office or Cyber Emergency Response Team may request access to the artifacts

Services IDIQ Performance Work Statement

Provide, as requested by the Contracting Officer on behalf of the DLA Cyber Emergency Response Team, access to additional information (to include damage assessment information gathered, etc.) or equipment that is necessary to conduct a forensic analysis related to an identified incident

Fixed Facility Device Installation

The contractor shall install the solution in fixed facility refueling systems and dispensing equipment.

As directed by the Task Order, the contractor shall furnish labor and materials to remove the old Fuel Master card reader and accessory equipment; reroute and connect electrical communication and power control wires; install the Fuel Site controller; connect the communications link; and check for correct operation.

The contractor shall assign, report and mark applicable EPoS property in accordance with DoD Federal Acquisition Regulation Supplement (DFARS) 252.211-7007 Reporting of Government Furnished Equipment in the DoD Item Unique Identification (IUD) Registry.

Permits

The contractor shall develop, coordinate, and assist the installation site in applying for and obtaining all applicable permits, access (including off-base easements and leases), agreements, licenses, and certificates required to perform and complete effort as specified under this PWS. The contractor shall comply with all applicable permit conditions and shall keep all permits current until the work is complete.

Remote and Austere Sites

The contractor may be requested to perform work as specified at remote and austere locations. The contractor shall be responsible for all contractor personnel, security, supplies, equipment, and infrastructure.

High Risk/Hostile Environments

When work takes place in High Risk/Contingency or Hostile Environments, security and logistical support will be provided by the US Military or host nation forces. The contractor shall be responsible for all contractor support requirements including supplies, equipment, and infrastructure, water, utility systems, housing, dining, transportation, medical care, and security when those facilities and services are not available. The contractor shall screen contractor personnel to ensure the personnel may be trained as appropriate and issued a weapon in accordance with applicable U.S. and host nation laws, and shall present the screening results to the COR for approval before a weapon is issued. Detailed information on what support will be required from the contractor shall be provided in the requirements document.

Site Access Badges

The contractor shall obtain and monitor contractor personnel assigned security badges for the duration of the site work. All security badges or passes shall be returned to the base POC upon expiration of the badge, upon completion of the project, or when possession of the badge is no longer necessary. All source documents used to obtain access badges, such as passports and other identification documents, shall remain valid for the entire period that access badges are required. Lead times for site access badges at overseas locations shall be coordinated with appropriate site/installation security officials. See section

9.0 for additional security requirements including Common Access Cards.

Services IDIQ Performance Work Statement

Capability Decommission

The contractor shall remove and dispose of existing equipment as required to install EPoS and as directed by Task Order.

The contractor shall abide by FAR 52.245-1 Government Property and Defense Contract Management Agency instructions pertaining to disposal of Government Property in the removal and disposition of any Government Property when decommissioning Government property as directed by the Task Order.

The contractor shall provide a report detailing the units and unit serial numbers of the decommissioned property to the official identified in the Task Order.

Installation Site Support

The contractor shall provide all labor, software, equipment, licenses, and other services necessary to survey and prepare physical sites; ensure electrical and cable connectivity at fixed facilities worldwide adhering to requirements defined in the Task Order.

Fixed Facility Device Sustainment

Technology Refreshment

Technology refreshment is defined as the periodic replacement of commercial off-the-shelf (COTS) components within a large system providing cost-effective support and upgrade strategies to keep a program ahead of the obsolescence curve.

The contractor shall set forth a strategy and schedule to replace or upgrade particular items or types of equipment and software during the contract period of performance. The work performed shall be associated with existing capabilities that are part of EPoS. Ancillary hardware, software and/or services shall not be the primary purpose of the work ordered, but be an integral part of the total solution offered.

The contractor shall procure and install the required upgrade or replacement according to a technology refresh plan approved by the Government and not later than the date on which the applicable item of equipment or software has been in service for the period set forth for refreshment.

Preventive Maintenance

The contractor shall perform preventive maintenance on EPoS as installed and shall:

Monitor each installation site Develop individual Preventive Maintenance Inspections (PMI) checklists for each system and associated equipment Conduct a PMI within a period not to exceed 24 months from the previous inspection Complete checklists during the PMI to document all tests and measurements performed, evaluate components and undertake required maintenance actions Adhere to manufacturer’s guidelines to the maximum extent possible Develop additional steps for the testing, inspection, and preventive maintenance if additional functionality is customized for EPoS Include Information Assurance Vulnerability Alerts (IAVA Patching) Produce a PMI report with copies of the completed checklists identifying all actions required to bring the system back to its intended level of performance

Services IDIQ Performance Work Statement

Provide all test equipment, tools, support equipment and supplies necessary to perform preventive maintenance

Calibrate test equipment according to manufacturer recommended standards

Corrective Maintenance

The contractor shall perform corrective maintenance on EPoS as installed and shall:

Repair or replace any malfunctioning hardware and software; reprogramming, replacing, or updating associated firmware and software as required

Include Information Assurance Vulnerability Alerts (IAVA Patching) Replace the component with new equipment after a third service call following two previous repairs within a two-year period Provide all support equipment, tools, test equipment, and supplies necessary to perform corrective maintenance Calibrate test equipment according to manufacturer recommended standards Obtain customer sign-off on each resolved service call and upload the signed document to the

Government designated service call system Perform diagnostics from remote locations when this technique speeds the response, prevents travel, or otherwise proves to be time and cost effective (remote connections are subject to cybersecurity Certification and Accreditation (C&A) requirements)

Fixed Facility Site Support

The contractor shall provide site-specific support to include labor and equipment necessary to maintain physical sites in an operational state adhering to requirements defined in the Task Order.

The Government will:

Identify each issue by site Determine the requirement Handle site support efforts on a case-by-case basis Award as a separate Task Order

Task 4: System Integration

Program Management

The contractor shall provide program management to establish governance of the work accomplished by Task Orders on this contract; develop and implement project plans, establish communication and escalation procedures. The contractor shall support change control processes; monitor, control and report program status, cost, schedule and performance; conduct regular program reviews; manage program budget; schedule and attend meetings with the Program Management Office (PMO), users and their representatives, consumers and providers of data.

These activities shall be an on-going effort; performed over the life of the contract, to ensure that all the requirements defined in this PWS and subsequent Task Orders (TOs) are met. The contractor shall perform Program Management to include technical planning, cost planning, performance functions, briefings, and attendance at functional and technical meetings with Portfolio personnel and consumers.

Services IDIQ Performance Work Statement

Configuration Management

The contractor shall develop and execute a written configuration management plan that addresses product management and version control for changes to software, hardware, business processes documentation and all other control items; and recreate all baseline deliveries from any point in time. The contractor shall support the Configuration Control governance structure; evaluate all changes to the approved system requirements baseline for risk to security, and for schedule and cost impact; provide evaluations in writing and in sufficient detail to allow for review and approval by the Configuration Control governance structure as required.

Business Requirements Analysis

The contractor shall provide business process requirements analysis to formulate and define objectives based on user needs and an understanding of fuel management systems and industry requirements;

analyze processes and reengineering efforts with an understanding of technical problems and solutions as they relate to the current and future business environment. The contractor shall integrate new processes with existing ones; work with the PMO and user community to identify and communicate any impacts to the business; ensure translation of requirements into appropriate system specifications.

Systems Specification Development

The contractor shall work with the EPoS PM, Functional System Owner and subject matter experts to create a work breakdown structure and to develop a systems requirements specification that become the basis of configured COTS and developed software. The contractor shall:

Perform information gathering and analysis to understand as-is and to-be processes Note: Information gathering includes customer interviews; subject matter expert interviews;

review of procedures manuals, application documents, and application testing documentation.

Create a Work Break-Down Structure outlining the activities and time required to complete each activity for the required systems requirements specification

Write the systems requirements specification, that includes: detailed end to end process flows;

business requirements; business edits and/or business rules; error processing requirements;

validations, reporting requirements; data mappings; user interface mock screens; application interfaces; project assumptions, constraints, dependencies; performance requirements;

sustainment requirements; archiving requirements; application access requirements, and any applicable appendices (i.e. data dictionaries, parking lot issues, etc.)

Ensure that the documented requirements are clear, discrete and testable Provide a requirements traceability matrix and risk management plan to include mitigation strategies based on the systems requirements specification Submit project information to the EPoS PMO Provide PMO updates at agreed upon timeframes/frequencies Update any applicable application or training documents based on the systems functional requirements specification

Design

The contractor shall design solutions to determine how EPoS functional and technical requirements can be met considering computer equipment capacity and limitations, operating time and form of desired results.

The contractor shall prepare detailed specifications for applications based on identified requirements;

provide…