Attachment 1 Performance Work Statement.pdf

US Department of Agriculture (USDA)

Performance Work Statement

Contents

Project Title

General Information

1.0 Background and Purpose

2.0 Definitions/Period of Performance

Contractor Requirements

3.0 Technical Requirements / Tasks

4.0 Deliverable / Schedule

5.0 Government Furnished

6.0 Travel

7.0 Contractor’s Key Personnel

8.0 Security Requirements

9.0 Data Rights

10.0 Section 508 - Electronic and Information Technology Standards

11.0 Performance Requirement Measures

Attachment.......................................................................................................... Error! Bookmark not defined.

Project Title

Repair of Failing/Expired Facility Control System for PBARC

General Information

1.0 Background and Purpose

The Clinger-Cohen Act of 1996 established the position of the Chief Information Officer (CIO). The CIO implements the provisions of the Clinger-Cohen Act of 1996 and the Paperwork Reduction Act of 1995 regarding the acquisition, management, and use of information technology (IT) resources; manages United

States Department of Agriculture (USDA), Agricultural Research Service (ARS) compliance with the Computer

Security Act of 1987, the Federal Information Security Management Act of 2002 (FISMA), Homeland Security

Presidential Directive 7 of December 17, 2003, and Presidential Decision Directive 63 of May 22, 1998, Critical

Infrastructure Protection; and implements the Office of Management and Budget Circular A-130, Management of Federal Information Resources. The CIO serves as the principal advisor to the Agency on information resources and information systems management and strives to improve the operations and service delivery of

ARS's programs through the effective use of technology. The CIO directs ARS's Office of the CIO (OCIO), which supports these activities.

The United States Department of Agriculture (USDA) Agriculture Research Service (ARS) Office of the Chief

Information Officer (OCIO) requires contractor assistance with installation of a new Delta enteliVAULT and enteliWEB Facility Control System for the Daniel K. Inouye Pacific Basin Agricultural Research Center.

2.0 Definitions/Period of Performance

The period of performance: 90 days after award.

Contractor Requirements

3.0 Technical Requirements / Tasks

The contractor will perform the following tasks as a part of this engagement:

1) Vendor shall obtain their own Lincpass for access to the USDA network via domain-joined laptop and server containing BAS system.

2) Daniel K. Inouye Pacific Basin Agricultural Research Center will configure an existing GFE purchased server with applicable software to have it compliant with Cybersecurity and Privacy Operations Center standards for connectivity to the network.

3) Vendor shall install and upgrade all software and licenses applicable to the quote submitted to PBARC for services on said server.

4) Vendor shall provide training of system to appropriate administrators of the system to the extent necessary for functioning of the building controls.

5) Vendor shall test the system to ensure that the functionality of the BAS system is adequate for the needs of the location.

6) Vendor shall provide troubleshooting on a contract basis depending on the needs of the location.

4.0 Deliverable / Schedule

Key Deliverables

Item

No.

Deliverable Submitted To Due By

1 Obtain GFE server that meets specifications for the BAS system.

LITS 12/30/24

2 Install Microsoft

Server 2022 on

Server.

LITS Two weeks after award of contract

3 Configure server with open network ports to USDA network and BAS network.

LITS Two weeks after award of contract

4 Rename server to

ARS naming convention standards and install required software including

Microsoft Defender

Enterprise, Tanium, and security software.

LITS Two weeks after award of contract

5 Have VLAN created for the BAS system separate from the main VLAN.

IOC/IOD Two weeks after award of contract

6 Schedule vendor for installation of BAS system.

LITS 1/13/25

7 Create Hypervisor running Microsoft

Server 2022 for the

BAS system.

LITS 1/17/25

8 Create backup system for the server to backup to local NAS device.

LITS 1/22/25

9 Create domain joined USDA laptop configured for vendor to remote into the server.

Vendor 1/31/25

10 Vendor to complete installation and setup.

LITS 2/1/25

5.0 Government Furnished

The government shall provide workspace, computer, and telephone access to the contractor. Government furnished resources can be obtained between the hours of 6:00 a.m. to 9:00 p.m. Monday through Friday at 64

Nowelo St. Hilo, HI 96720.

6.0 Travel

Hilo, HI premises

7.0 Contractor’s Key Personnel

The contractor shall perform all work described in this Performance Work Statement in accordance with all applicable Federal, State, and local laws, regulations, codes, technical specifications, manufacturers guidelines, USDA, REE, and the ARS mission.

8.0 Security Requirements

All contractor personnel who work at USDA must have approval for facility access. Prior to work starting, the contractor must supply the names of those employees selected to perform the work. Due to security requirements, pre-notification of all visitors to the USDA Daniel K. Inouye Pacific Basin Agricultural Research

Center is required. Anyone requiring access must get approval from OCIO prior to arrival to this location.

9.0 Data Rights

The contractor shall adhere to the Privacy Act, Title 5 of the U.S. Code, Section 552a and applicable agency rules and regulations. The Contractor Program Manager shall ensure that all contract personnel take the required

USDA Privacy training.

10.0 Section 508 - Electronic and Information Technology Standards

This contract vehicle is subject to Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 749d) as amended by the Workforce Investment Act of 1998 (P.L. 105-220). The Revised Section 508 Standards, which consist of

508 Chapters 1 and 2 (Appendix A), along with Chapters 3 through 7 (Appendix C), contain scoping and technical requirements for information and communication technology (ICT) to ensure accessibility and usability by individuals with disabilities. Compliance with these standards is mandatory for Federal agencies subject to Section 508 of the Rehabilitation Act of 1973, as amended (29 U.S.C. 794d).

Each ICT product or service furnished under this contract shall comply with the Revised Section 508 ICT

Accessibility Standards at a minimum, as specified in the contract. If any furnished product or service is determined to be noncompliant, the Contracting Officer will notify the Contractor in writing. The Contractor shall, without charge to the Government, remediate or replace the noncompliant products or services within a specified timeframe as determined by the Government in writing. If such remediation or replacement is not completed within the time specified, the Government shall have the following recourses:

1) Cancellation of the contract, delivery, task order, purchase, or line item without termination liabilities; or

2) In the case of custom ICT being developed by a contractor for the Government, the Government shall have the right to have any necessary changes made or repairs performed by itself or by another firm for the noncompliant ICT, with the contractor liable for reimbursement to the Government for any expenses incurred thereby.

The contractor must ensure all noncompliant ICT products and services are provided pursuant to extensive market research and exhibit the highest level of compliance while satisfying the contract requirements.

For every ICT product or service accepted under this contract by the Government that does not comply with the

Revised Section 508 Accessibility Standards, the contractor shall, at the discretion of the Government, remediate or upgrade the item with a compliant equivalent product or service, if commercially available and cost neutral, on either a contract specified refresh cycle for the product or service, or on a contract effective option/renewal date, whichever shall occur first.

Section 508 Compliance

Vendors, contractors, and their respective ICT products and services shall comply with the following standards, policies, and procedures. In the event of conflicts between the referenced documents and this contract vehicle, the contract vehicle shall take precedence.

1) Revised Section 508 ICT Accessibility Standards

2) Section 508 of the Rehabilitation Act as amended (29 U.S.C. 794d)

3) Federal Acquisition Regulation (FAR) Subpart 39.2

4) USDA Section 508 Departmental Regulation

Additionally, all contract deliverables are subject to these standards.

https://www.access-board.gov/ict/#about-the-ict-accessibility-standards https://www.access-board.gov/law/ra.html#text-of-section-508-of-the-rehabilitation-act-of-1973-as-amended-29-usc-794d https://www.acquisition.gov/sites/default/files/current/far/html/Subpart%2039_2.html http://www.ocio.usda.gov/document/departmental-regulation-4030-001

All ICT products and services, regardless of format, must conform to the applicable Section 508 standards to allow Federal employees and members of the public with disabilities equivalent access to and use of information and data provided to those without disabilities.

All contractors, sub-contractors, and consultants are responsible for preparing or posting content must comply with the applicable Section 508 accessibility standards and, where applicable, those set forth in the referenced policy or standards document. Remediation of any noncompliant ICT or materials as set forth in this contract vehicle shall be the responsibility of the contractor, sub-contractor, or consultant.

According to the Access Board’s Section 508 Scoping Requirements The following Section 508 provisions apply to the products and/or services identified in this contract vehicle:

• C202 Functional Performance Criteria: Where the requirements in Chapters 4 and 5 do not address one or more functions of telecommunications or customer premises equipment, the functions not addressed shall conform to the Functional Performance Criteria specified in Chapter 3.

• C203 Electronic Content: Electronic content that is integral to the use of telecommunications or customer premises equipment shall conform to Level A and Level AA Success Criteria and

Conformance Requirements in WCAG 2.0.

• C204 Hardware: Where components of telecommunications equipment and customer premises equipment are hardware, and transmit information or have a user interface, those components shall conform to applicable requirements in Chapter 4.

• C205 Software: Where software is integral to the use of telecommunications functions of telecommunications equipment or customer premises equipment and has a user interface, such software shall conform to C205 and the applicable requirements in Chapter 5.

WCAG Conformance: User interface components, as well as the content of platforms and applications shall conform to Level A and Level AA Success Criteria and Conformance Requirements in WCAG 2.0.

• C206 Support Documentation and Services: Where support documentation and services and provided for telecommunications equipment and customer premises equipment, manufacturers shall ensure that such documentation and services conform to Chapter 6 and are made available upon request at no additional charge.

In addition, vendors and contractors shall comply with the standards, policies, and procedures below for all ICT pursuant to this contract:

• For Custom ICT Development Services, the vendor or contractor shall ensure the ICT fully conforms to the applicable Revised Section 508 standards prior to delivery and before final acceptance.

• For Installation, Configuration, and Integration Services, the vendor or contractor shall not install, configure, or integrate the equipment and software in a way that reduces the level of conformance with the applicable Revised Section 508 standards.

• For Maintenance, Upgrades, and Replacements, the vendor or contractor shall ensure maintenance upgrades, substitutions, and replacements do not reduce the original level of conformance with the applicable Revised Section 508 standards at the time of the contract award.

• Service Personnel are ensured by the vendor or contractor to possess the knowledge, skills, and ability necessary to address the applicable Revised Section 508 standards and shall provide supporting documentation upon request.

• When providing Hosting Services, the vendor or contractor shall not reduce the existing level of conformance of the electronic content with the applicable Revised Section 508 standards.

• When purchasing ICT where 1) Section 508 validation is not possible prior to award, 2) the ICT will be changed after the award, or 3) ICT will be hosted in a third-party environment, the vendor or contractor shall test and validate the ICT solution for conformance to the Revised Section 508 standards, in accordance with the required testing methods as defined by the agency.

https://www.access-board.gov/ict/#508-chapter-2-scoping-requirements https://www.access-board.gov/ict/#C202-functional-performance-criteria https://www.access-board.gov/ict/#C203-electronic-content https://www.access-board.gov/ict/#C204-hardware https://www.access-board.gov/ict/#C205-software https://www.access-board.gov/ict/#C206-documentation-services

• The vendor or contractor shall document and maintain information regarding the measures taken to ensure compliance with the applicable requirements. This documentation includes but is not limited to testing records, product demonstrations, and reported defects by end users and testers.

• Prior to acceptance, the vendor or contractor shall provide an Accessibility Conformance Report

(ACR) for each ICT item that is developed, updated, and/or configured for the agency, and when product substitutions are offered. The ACR should be based on the latest version of the Voluntary

Product Accessibility Template (VPAT) provided by the Information Technology Industry Council

(ITI). To be considered for award, an ACR must be submitted for each ICT item, and must be completed according to the instructions provided by the ITI.

Note: A supplemental ACR may be required if the agency has additional or stricter accessibility requirements than what is outlined in the VPAT.

• Prior to acceptance, the agency reserves the right to require a full working demonstration of the completed ICT item to demonstrate conformance to the agency’s accessibility requirements in addition to independent testing to validate.

• In the case of non-compliance where the vendor or contractor claims its products and/or services satisfy the applicable Revised Section 508 standards specified in the contract vehicle, the contracting officer will promptly inform the vendor or contractor in writing of the non-compliance. The vendor or contractor shall, at no cost to the agency, repair or replace the non-compliant products or services within the period specified by the contracting officer.

All Information and Communications Technology (ICT) subject to the Revised Section 508 standards will be evaluated for Section 508 conformance and usability. The test must be administered by a Federal Section 508

Testing Center. All maintenance for ICT that requires upgrades, modifications, installations, repairs, and purchases shall adhere to the Revised Section 508 standards.

11.0 Performance Requirement Measures

Compliance with Internet Protocol Version (IPv6)

This contract involves the acquisition of Information Technology (IT) that uses Internet Protocol (IP)

Technology. In order to comply with OMB Memorandum M-05-22, Transition Planning for Internet Protocol

Version 6 (IPv6) issued on August 2, 2005, the contractor agrees that: (1) all deliverables that involve IT that uses IP (products, services, software, etc.) will comply with IPv6 standards set forth in the USGv6 Profile

(NIST Special Publication 500-267) and interoperate with both IPv4 and IPv6 systems and products; and (2) it has IPv6 technical support for such deliverables. If the contractor plans to offer a deliverable that involves IT that is not compliant with these requirements, the contractor agrees to obtain the Contracting Officer’s approval before starting work on the deliverable.

Protection of Information

Information about USDA networks and/or the security posture of any USDA information assets gathered or created under this SOW is sensitive but unclassified information. It is anticipated that this information will be gathered, created, stored within the primary Government work location. If contractor personnel must remove any information from the primary work area for any reason, the information must remain in the possession of the contractor at all times or locked in a secure location. If contractor personnel are away from primary work area for any reason, they must secure any hardcopy information by storing the information in a locked shelf or drawer and or use a password protected screen saver if the information is on a computer.

Prior approval must be obtained in the contractor must remove any materials from their work area.

General Overview:

Subject: Delta Control System Upgrade https://www.section508.gov/sell/vpat https://www.section508.gov/sell/vpat http://www.itic.org/policy/accessibility http://www.itic.org/policy/accessibility

Scope of Work

1. Renew existing software and bring system up to date.

2. Upgrade existing Historian software to enteliVAULT current software.

3. Install software on PBARC virtual machine server.