Attachment 1 Statement of Work.docx

Defense Logistics Agency

DEFENSE DISTRIBUTION CENTER, SUSQUEHANNA

INSTALLATION OPERATIONS

5750 3rd Street Building 750 New Cumberland, Pa 17070

STATEMENT OF WORK/SPECIFICATIONS

PREVENTIVE MAINTENANCE OF ELEVATORS, DUMBWAITERS, AND PLATFORM LIFTS

AT

DEFENSE DISTRIBUTION CENTER, SUSQUEHANNA NEW CUMBERLAND, PA

TABLE OF CONTENTS

Section Number

Title Page Number

Preventive Maintenance of Elevators, Dumbwaiters, and Platform Lifts

List of Exhibits

Exhibit 1 Building / Equipment Inventory List 1 Sheet

Exhibit 2 Service Call Work Authorization Form 1 Sheet

1.0 SCOPE OF WORK

The purpose for this contract is to maintain existing lift equipment, such as elevators, dumbwaiters, and platform lifts, located throughout the Defense Distribution Center, Susquehanna site in good, operating condition. Lift equipment, as used throughout this document, refers to elevators, dumbwaiters, and platform lifts installed in multiple buildings across the installation.

The basis of all work defined herein is taken from the American Society of Mechanical Engineers (ASME), Chapter A17. The Scope of Work shall include two types of service as follows:

1.1 Preventive Maintenance (PM) of lift equipment includes the periodic inspection and testing to assure operability and reliability of active components in the event these components are called into service. PM is scheduled maintenance and occurs during normal business hours.

1.2 Remedial Maintenance (RM) is unscheduled work that needs to be performed to bring the system back to full performance. This work may be required at any time of day and would typically be in response to a failed or failing component.

1.3 Software Maintenance (SM) includes patching of the firmware upgrades to the building level controllers, and software patches if applicable. This work will be completed by a DoD 8570 certified worker as defined under Personnel Technical and Cyber Qualifications.

The Building / Equipment Inventory List (Exhibit 1) is provided to identify each building located on this installation containing lift equipment that will be serviced by this contract.

This is a non-personal services contract to provide maintenance and testing services on lift equipment at the Defense Distribution Center, Susquehanna. The Government shall not exercise any supervision or control over the contract service providers performing the services herein.

Such contract service providers shall be accountable solely to the Contractor who, in turn is responsible to the Government. The Government will not control the methods used by the Contractor to perform the service requirements set forth in the SOW.

2.0 TECHNICAL DEFINITIONS

As used throughout this contract, the following terms shall have the meaning as set forth below.

2.1 Where "as shown'', ''as indicated", "as detailed'', or words of similar import are used, it shall be understood that reference is made to this SOW and the drawings accompanying this SOW unless stated otherwise.

2.2 Where "as directed", "as required", "as permitted", "approval", "acceptance", or words of similar import are used, it shall be understood that direction, requirement, permission, approval, or acceptance of the appointed ‘Government Representative’ is intended unless stated otherwise.

2.3 “Government Representative” is an authorized person(s) representing the Government. The Government Representative provides technical direction, clarification, and guidance with respect to the contract specifications and SOW.

Statement of Work Preventive Maintenance of Elevators, Dumbwaiters, and Platform Lifts

Preventive Maintenance of Elevators, Dumbwaiters, and Platform Lifts

2.4 The term “Contractor” as used herein refers to both the prime Contractor and any subcontractors. The prime Contractor is responsible for and shall ensure that his/her subcontractors comply with the provisions of this contract.

2.5 Facility: An establishment, structure, building, or assembly of units of equipment designated for a specific function.

2.6 Lift Equipment: Lift equipment, as used throughout this document, refers to elevators, dumbwaiters, and platform lifts installed in multiple buildings across the installation.

2.7 Frequency of Service: The period of time between a required service action such as inspection or testing.

2.7.1 Annual (A)

Services performed once during each 12 month period of the contract at intervals of 345 to 365 calendar days.

2.7.2 Semiannual (SA)

Services performed twice during each 12 month period of the contract at intervals of 160 to 200 calendar days.

2.7.3 Quarterly (Q)

Services performed four times during each 12 month period of the contract at intervals of 80 to 100 calendar days.

2.7.4 Monthly (M)

Services performed 12 times during each 12 month period of the contract at intervals of 28 to 31 calendar days.

2.8 Impairment: When work on lift equipment is required such that the system must be disabled, the system shall be considered impaired.

2.9 Installation: The Installation as referenced in the specification means the Defense Distribution Center, Susquehanna located in New Cumberland, PA.

2.10 Maintenance/Repair: The preservation or restoration of a piece of equipment, a system or a facility to such condition that it may be effectively utilized for its designated purposes. Maintenance/repair may be adjustment, overhaul, reprocessing or replacement of constituent parts or materials that are missing or have deteriorated by action of the elements or usage or replacement of the entire unit or system if deemed beyond economical repair.

2.11 Quality Assurance (QA): A method used by the Government to provide some measure of control over the quality of purchased goods and services received.

2.12 Quality Control (QC): A method used by the Contractor to control the quality of goods and services produced.

2.13 Regular Working Hours: The Government's regular (normal) working hours are Mondays through Fridays from 0700 to 1530, excluding federal holidays and any other days specifically designated by the Government Representative. The Government observes the following federal holidays:

If a holiday falls on a Saturday, it will be observed on the preceding Friday. If the holiday falls on a Sunday, it will be observed on the following Monday. The Contractor shall not be required to perform services on these days unless an urgent or emergency service call is received from the Government Representative. Also, in the event an Executive Order issued by the President of the United States declares Agencies of the Federal Government closed on a Contractor-scheduled service date, the Government Representative shall advise the Contractor on whether services should be performed for that day or services should be rescheduled.

2.14 Response Time: Response time is defined as the time allowed the Contractor after initial notification of a work requirement to physically be on the premises at the work site with appropriate tools, equipment, and materials, ready to perform the work required. Response time (period of time) is a function of the type of service call that the Contractor receives from the Government. Response times are designated in the appropriate sections in this SOW. See paragraph 8.1, Response Time, for required response times based on the classification of the service call.

2.15 Service Call: A service call is a call initiated by the Government in response to the failure of a lift equipment system or a component within the system. See Section 7.3, Service Call Classification, for a description of the types of service calls that the Contractor may expect to receive.

3.0 GENERAL REQUIREMENTS

The Contractor shall furnish all labor, supervision, tools, materials, equipment, transportation, and management necessary to provide inspection, testing, and maintenance of lift equipment on the Defense Distribution Center, Susquehanna site.

This contract will initially service 11 elevators, 1 dumbwaiter, and 3 platform lifts on the Installation.

With the ongoing effort of building consolidation and expansion, the Government reserves the right to ADD to or DELETE systems from the contract anytime during the period of the contract as the need arises.

3.1 Exhibit 1 identifies each system to be maintained by building, the unique system identifier, location, type, manufacturer, lift method, travel distance, and capacity for each of these systems. The systems and equipment to be serviced under this contract include the following:

3.1.1 Hydraulic Passenger Elevator

3.1.2 Electric Passenger Elevator

3.1.3 Hydraulic Freight Elevator

3.1.4 Electric Dumbwaiter

3.1.5 Electric Wheelchair Platform Lift

3.2 All work shall be performed by personnel specifically qualified and trained to work on lift equipment systems. See paragraph 11.0, Personnel Qualifications, below for specific requirements for these individuals. All work shall be completed in accordance with the requirements specified herein.

3.3 All workmanship shall meet the standards specified herein and shall be accomplished in conformance with approved and accepted standards of the industry; equipment manufacturers; all applicable Federal, State, and Local standards; and all applicable building and safety codes.

3.4 When the Contractor completes work on a system or piece of equipment, that system or piece of equipment shall be free of missing components or defects that would prevent it from functioning as originally intended and designed. Corrective repair or replacement work shall be carried to completion including operational checks and cleanup of the job site. Except where otherwise noted or directed by the Government Representative, replacements shall match existing in dimensions, finish, color, and design.

3.5 Safety Hazards: The Contractor shall immediately notify the Government Representative and the Building Manager of any recognized safety hazard that might adversely affect building occupants.

3.6 The Contractor shall inspect, test, and maintain all systems and equipment as defined in ASME A17 and by the equipment manufacturer.

3.7 During and at completion of work, debris shall not be permitted to spread unnecessarily into adjacent areas nor accumulate in the work area itself. All such debris, excess material, and parts shall be cleaned up and removed at the completion of the job and/or at the end of each workday if work is in progress.

3.8 During the term of the contract, the Government may add, replace, renovate, or improve lift equipment systems at the Government's expense and by means not associated with this contract. Changes, replacements, or deletions which result in an increase or decrease in contract requirements will result in adjustments to the contract price and shall be coordinated through the Contracting Officer/Contract Specialist.

3.9 Equipment, components, and parts, other than that installed under this contract, shall not be removed or replaced or deficiencies corrected while still under warranty of the manufacturer or the installer without prior approval of the Government Representative. The Contractor shall report all defects in material or workmanship, defective parts, or improper installation and adjustments found to the Government Representative so that necessary corrective action may be taken. The Contractor shall be knowledgeable of the equipment, parts, and components that are covered by warranty and the duration of such warranties. Available warranty information will be furnished to the Contractor by the Government.

3.10 There may be other work occurring within or around various buildings that are included as part of this contract throughout the term of this contract. Other Contractors and / or Government personnel shall be engaged in similar and supporting work that will require close cooperation and coordination. In the event that conflicts do occur with other Contractors that cannot be satisfactorily resolved, the matter shall be referred to the Government Representative for resolution.

3.11 The Contractor shall be responsible for the installation and removal of signage as related to elevator service. When it becomes necessary to remove a piece of equipment from service for longer than one (1) hour, the contractor shall place “OUT OF SERVICE” signs at each landing or in each elevator that the equipment or system serve.

4.0 TECHNICAL GUIDELINES

This contract must adhere to the following technical and cybersecurity guidelines in all work performed under this contract:

AWS B2.1 – Welding Procedure and Performance Qualification AWS D1.1 – Structural Welding Code – Steel ASME A17.1 – Safety Code for Elevators and Escalators

ASME A17.2 – Guide for Inspection of Elevators, Escalators, and Moving Walks ASME A17.3 – Safety Code for Existing Elevators and Escalators ASME QEI - 1 – Standard for the Qualification of Elevator Inspectors

ASTM E 2074 – Standard Test Method for Fire Tests of Door Assemblies, Including Positive Pressure Testing of Slide-Hinged and Pivoted Swinging Door Assemblies

ICC IBC – International Building Code ICC IPC – International Plumbing Code NEMA MG 1 – Standard for Motors and Generators NFPA 70 – National Electrical Code 29 CFR 1910.27 – Fixed Ladders

36 CFR 1191 – Americans with Disabilities Act (ADA) Accessibility Guidelines for Buildings and Facilities

Committee on National Security Systems Instruction 1253, Security Categorization and Control Selection for National Security Systems, July 29, 2022

Federal Information Processing Standards Publication 199, Standards for Security Categorization of Federal Information and Information Systems, February 2004

Federal Information Processing Standards Publication 200, Minimum Security Requirements for Federal Information and Information Systems, March 2006

Federal Information Security Management Act (P.L. 107-347, Title III), December 2002

Department of Defense Instruction 5000.02, Operation of the Defense Acquisition System, January 23, 2020

Department of Defense Instruction 5200.39, Critical Program Information (CPI) Identification and Protection within the Research, Development, Test, and Evaluation (RDT&E) Incorporating Change 3, Effective October 1, 2020

44 U.S.C. § 3542, January 2012

Department of Defense Instruction 8500.01, Cybersecurity, Incorporating Change 1, Effective October 7, 2019

Department of Defense Instruction 8510.01, Risk Management Framework (RMF) for DoD Information Technology, July 19, 2022

Department of Defense Instruction 5200.44, Protection of Mission Critical Functions to Achieve Trusted Systems & Networks, Incorporating Change 3, October 15, 2018 DoD Program Manager’s Guidebook for Integrating the Cybersecurity Risk Management Framework (RMF) into the System Acquisition Lifecycle

Defense Acquisition Guidebook (DAG)

Department of Defense Directive 8140.01, Cyberspace Workforce Management, October 5, 2020

Department of Defense Instruction 8330.01, Interoperability of Information Technology (IT), Including National Security Systems (NSS), September 27, 2022

Department of Defense Instruction 8580.1, Information Assurance (IA) in the Defense Acquisition System, July 9, 2004

National Institute of Standards and Technology Special Publication 800-82 Revision 2, Guide to Industrial Control Systems (ICS) Security, February 2015

UFGS-25 50 00.00 20 Cybersecurity of Facility-Related Control Systems

United Facilities Criteria (UFC) 4-010-06, Cybersecurity of Facilities-Related Control Systems

Department of Defense DoD 8570.01-M, Information Assurance Workforce Improvement Program, change 3 dated 24 Jan 2012

DoD Manual (DoDM) 8140.03 Cyberspace Workforce Qualification & Management Program, dated 15 Feb 2023

Deputy Under Secretary of Defense (Installations and Environment) Memo dated 19 Mar 14, subject: Real Property Related ICS Cybersecurity

Defense Logistics Agency Risk Management Framework Standard Operating Procedures, April 2021

Office of the Assistant Secretary of Defense Facility Related Control Systems (FRCS) Master List Memo, October 2020

Defense Logistics Agency Approved Cybersecurity Computing Environment List, October 2021

Department of Defense Control Systems Security Requirements Guide Version 1, Release 1, July 14, 2021

5.0 LIFT EQUIPMENT SYSTEM TESTS

The Contractor shall be responsible for all scheduling of the required tests, and shall provide notification to the Government POC fifteen (15) days prior to any testing. Any safety test that is performed shall be done so as to minimize interference with normal government business.

5.1 All elevator inspections, annual no load and pressure test, and five (5) years full load weight test; annual dumbwaiter; and annual porch-lift platform testing shall be performed within three (3) months after the contract start date. The cost to perform these safety tests will be included in the price of the contract.

5.2 All tests shall be performed in accordance with the ASME A17.7 (Safety Code for Elevators and Escalators), and ASME 17.1 and 17.2 (Inspectors Manual), and any of their most current revisions.

5.3 The Contractor shall employ a third party, independent Licensed Elevator Inspector to conduct the required certification tests.

5.4 A copy of the elevator inspection report and certifications shall be provided to the Government Point of Contact (POC) within seven (7) working days after inspection is completed.

6.0 PREVENTIVE MAINTENANCE (PM) (Scheduled)

This maintenance service contract shall require the systematic inspection and testing to verify proper system operation; detect incipient failures either before they occur or before they develop into major defects; minimize malfunction, breakdown, and deterioration of systems and equipment; and identify any repairs required to bring lift equipment up to the manufacturer's operating standards to maintain a high degree of reliability.

6.1 The Contractor shall perform maintenance, inspection, testing, and repairs as required by the Manufacturers and ASME A17. Monthly maintenance shall be performed during the first fifteen (15) working days of each month. The contractor elevator technician shall report to the Government Representative before starting work. The Contractor shall implement all necessary work control procedures to ensure timely accomplishment of all maintenance and repair work requirements, as well as to permit tracking of all work in progress. The Contractor shall plan and schedule all work to insure that material, labor, tools and equipment are available to complete maintenance or repair work within the specified time limits and in accordance with the quality standards. The status of any work shall be provided within one (1) hour of the inquiry during regular work hours.

6.2 The Contractor shall perform elevator rated speed test on an annual basis to assure that the equipment is meeting the targets specified by the manufacturer, and shall make any corrections necessary to assure this. A copy of this report shall be submitted to the Government Representative within seven (7) working days after completion of the test.

6.3 The Contractor shall perform preventive maintenance during each month on the elevators and annually on dumbwaiters and porch-lift platforms to ensure reliable and continuous safe operation. The maintenance work shall be performed in accordance with commercial practices manufacturer’s specifications and shall be intended to maintain the elevators, dumbwaiters and porch-lift platforms in safe and reliable operating condition until the next scheduled maintenance or inspection.

6.4 The Contractor shall use a printed checklist for all inspections, PM, testing and all repairs, and shall submit a copy of the PM report at the time of each visit; reports of all other inspections and repairs must be submitted within five (5) days of the inspection or repair. The report shall identify each elevator, the location, maintenance work performed, repairs needed, date of inspection, name of inspector, and the overall condition of the elevator. If repairs require additional work considered over and above routine maintenance work, the Contractor shall, at that time, provide the Government Representative with information as to the extent of the repairs and the length of time necessary to complete the repairs.

6.5 The contractor shall prepare a proposed joint inspection plan fifteen (15) days after the contractor receives notice of award for the purpose of identifying any pre-existing deficiencies with the elevator. The contractor and the Government Representative together shall make a complete inspection of all the elevators and their components. No later than ten (10) days before commencement of services, the contractor shall prepare and submit to the Government Representative a pre-existing deficiency report consisting of all observed pre-existing deficiencies noted during the joint inspection. If the contractor can correct any deficiency through normal preventive maintenance procedures, the Government Representative will direct that it be done as such. If preventive maintenance procedures cannot be used to correct the deficiency, the Contractor shall prepare a proposal to accomplish the noted repairs and submit to the Government Representative within five (5) days of the contract start date. Any deficiencies found more than thirty (30) days after the contract start date shall not be considered pre-existing deficiencies and therefore shall be the responsibility of the contractor. Nothing in the pre-existing deficiencies shall diminish the Contractors’ obligation to maintain any deficient item to the extent that it is safely operable.

6.6 When inspection and/or testing determine that a part, component, or other piece of equipment requires replacement or repair, this work shall be completed under Remedial Maintenance. See paragraph 7.0, Remedial Maintenance.

6.7 Transportation associated with moving from building to building on the Installation including the movement of testing apparatus, tools, and materials for PM or RM work shall be included in the contract unit price for the associated service.

6.8 The Contractor shall schedule PM. The Contractor shall submit a detailed PM schedule to the Government representative for approval at least 10 working days prior to the start date of the services to be provided under this contract. The PM schedule shall conform to and include the following requirements:

6.8.1 The schedule shall cover the entire term of the contract and shall include, for each lift equipment system listed in Exhibit 1, the location (facility/building number); work to be performed (e.g., monthly PM); and the week of the month that PMs will be performed.

6.8.2 The schedule shall be in a format such that the completion of each PM inspection shall be indicated on the schedule showing date of service and the individual performing the service. This information shall be entered electronically on the schedule or form for documentation.

6.8.3 Once the Contractor's PM schedule is approved, the Contractor shall perform PM inspections without further authorization by the Government Representative.

6.8.4 The Contractor shall strictly adhere to the scheduled PM dates to facilitate Government verification of work. If the Contractor finds it necessary to reschedule a PM, a written request shall be made to the Government Representative detailing the reasons for the proposed change at least five (5) working days prior to the originally scheduled PM date. No scheduled PM dates shall be changed without the prior approval of the Government.

6.8.5 The Government reserves the right to review the Contractor’s PM schedules at any time to confirm that PM is being conducted as scheduled.

6.9 All repairs required as a result of PM inspections and testing shall be accomplished under Section 7.0, Remedial Maintenance (RM), with the approval of the Government Representative.

6.9.1 The Contractor shall submit a list of equipment deficiencies noted during the PM inspections and testing, at least monthly, which are beyond the SOW for preventive maintenance as described in this document. These reports shall provide a detailed description of identified deficiencies.

6.9.2 The Government Representative may issue a Service Call Work Authorization for correction of the deficiencies noted. The work may also be performed by means other than this contract or the work may be deferred.

6.9.3 If at the time of the inspection or test the Contractor feels it would be more economical to make such repairs while conducting the inspection, such as while a valve is open for cleaning and inspection, the Contractor may notify the Government Representative by phone of the defect and request a Service Call Work Authorization to make the repair at that time. If the Government Representative authorizes the work, the Contractor may proceed at that time.

6.10 The Contractor shall complete and maintain a Preventive Maintenance Inspection Record for each item of equipment and system listed in Exhibit 1. The Contractor shall maintain the completed forms in a history file throughout the term of the contract as defined in paragraph 21.0, Documentation and Records, below.

7.0 REMEDIAL MAINTENANCE (RM)

This type of maintenance service includes all work necessary to diagnose equipment malfunctions and restore the equipment to normal operating condition. The Contractor shall submit a Service Call Work Authorization, Exhibit 2, for ANY work that is done as Remedial Maintenance.

7.1 For repairs being completed under this contract, all major system materials, parts, and components together with their installation shall conform to the requirements of the manufacturer and standard commercial practices.

7.2 The need for RM service by definition is service that is not identified on the maintenance and testing schedule and is therefore unscheduled. The notification of an RM service requirement shall, in most cases, be initiated through a service call from the Government Representative. The Contractor shall receive the call for RM services in one of two ways as follows:

7.2.1 During Regular Working Hours: The Government Representative will advise the Contractor by phone of any service call requests received during regular working hours as well as the service call classification based on the definitions provided in paragraph 7.3 Service Call Classification below. The Contractor shall provide a description of the problem or requested work, date and time received, location, classification, and other appropriate information on a Service Call Work Authorization form (Exhibit 2). A copy of this form shall be forwarded to the Government Representative for written approval. For routine service calls as defined in paragraph 7.3.2 Routine Service Calls below, the Contractor shall obtain written approval prior to initiating work on the routine service call including the purchase of any required materials or components.

There may be instances where the Contractor identifies an RM requirement as a result of his inspection or testing activities. In these cases, the Contractor shall complete the Service Call Work Authorization form and submit the completed form to the Government Representative for approval prior to initiating any work on this Service Call Work Authorization form.

7.2.2 After Regular Working Hours: The Contractor shall receive service call requests directly from the Government Representative after regular working hours, on weekends, and holidays. Calls received after normal working hours shall be classified by the Government in accordance with the definitions provided in paragraph 7.3, Service Call Classification, below.

7.2.2.1. For emergency service calls, the Contractor shall be authorized under the direction of the Government Representative, to make immediate required repairs to a lift system. The Contractor’s authorization is limited to the amount initially discussed between the Contractor and the Government Representative. If, in the opinion of the Contractor, initial costs set forth appear to be inadequate during repairs, contact the Government Representative and provide a revised estimate of the projected costs for the repair. The Contractor shall not exceed the verbal cost limit set by the Government Representative without authorization.

7.2.2.2. Emergency repairs and their associated labor costs shall continue until completion of the repair. The duration of this service call classification continues regardless of the time of day.

7.2.2.3. Upon completion of the emergency repair, the Contractor shall fill out and complete the Service Call Work Authorization form. This form shall be submitted to the Government Representative for approval. Maintain an approved copy of this form in the Contractor’s record under the system that the repair was made to.

7.3 Service Call Classification

Repair Service call classifications shall fall into one of two categories. The call classification shall be determined through the following definitions:

7.3.1 Emergency Service Calls: Service calls will be classified as emergency at the discretion of the Government Representative. Generally, emergency calls will consist of correcting failures which constitute an immediate danger to personnel, threaten to damage property, or threaten to disrupt activity operations and/or training missions. The Contractor shall respond to emergency repair calls and trapped calls. The contractor shall respond within two (2) hours at the location during normal business hours and within four (4) hours after notification at times other than normal business hours. Downtime of the elevator will be kept to an absolute minimum. The contractor shall notify the Government Representative of all projected downtime of the elevator or its components, and the estimated time for repair. The contractor shall prepare and submit a written report to the Government Representative within five (5) business days after the emergency repair. The report shall include the date and time of the service call, the location of the elevator, the repairs performed, and the name of the technician performing the repairs. These service calls can occur at any time of the day or night.

7.3.2 Routine Service Calls: Service calls will be classified as routine when the work does not qualify as an emergency call. The Government Representative will notify the Contractor by phone of repairs to be made from an inspection report or service call. The Contractor shall report to the work location, survey the repair and provide the Government Representative with an estimated time to repair. The Contractor shall commence repair work immediately after notification from the Government Representative. Downtime of the elevator will be kept to an absolute minimum. The Contractor shall notify the Government Representative of all projected downtime for the elevator or its components, and the estimated time for repair. The Contractor shall prepare and submit a written report within two (2) business days after completion of routine repairs. These service calls will occur only during normal working hours.

7.4 Completed Calls: Within one working day after completion of each service call, the Contractor shall add the following information to the Service Call Work Authorization form and return to the Government Representative:

7.4.1 Description of work actually completed.

7.4.2 Brief description of material and parts used, including quantities.

7.4.3 Date and time work began.

7.4.4 Date and time work was completed.

7.4.5 Hours of labor (by trade) expended.

7.4.6 Signature or initials of the Contractor's craftsman performing the work (or supervisor), indicating that the work has been completed.

7.5 If the Contractor determines that repairs need to be performed off-site, the Contractor shall notify the Government Representative in writing providing the make, model, serial number and estimated date for return of the equipment. The Contractor will begin repairs only after approval by the Government Representative.

7.5.1 The Contractor shall comply with all applicable laws, regulations and requirements regarding over-the-road permits. The Contractor shall be responsible for obtaining all necessary permits required to transport Government owned equipment to and/or from the repair facility.

7.5.2 In the event of damage/wreckage to Government owned equipment during transportation, the Contractor shall be liable for the total cost of repairs and/or replacement of damaged or destroyed equipment.

7.5.3 If repairs are more extensive, cost more than originally estimated, or are determined to exceed seventy (70) percent of the value of a new and identical piece of equipment, the Contractor shall obtain the approval of the Government Representative before continuing work.

8.0 SOFTWARE MAINTENANCE (SM)

8.1 Privileged Access

The DoD 8570.01-M and 8140-M, Information Assurance Workforce Improvement Programs requires training and certification for Information Assurance (IA) duties and Cybersecurity duties performed. All contract employees performing cyber-IA functions shall meet the requirements in accordance with DoD/DLA guidance.

Additionally, all contract employees shall be certified in operating systems on any system on which system administration duties are performed. Proof of certification shall be provided before privileged access is granted, at time of proposal/resume submission; this includes, but is not limited to, system administration access, network administration access, router/switch access, or firewall access. All documentation required for security certification will be maintained by both the Contractor and the Government.

All contract employees shall have acquired the necessary certifications, per the DoD 8570/8140-M, and remain in good standing for the duration of the contract. These certification requirements are not based on position title; they are based on duties. All Contractor personnel requiring elevated/privileged access to any network or OT system, subsystem, or components, either during provisioning or post award, shall obtain an IT-I (a clearance requiring a Single Scope Background Investigation) or IT-II (a clearance requiring a National Agency Check with Law and Credit (NACLC) or NACLC equivalent) as applicable and meet DoD 8570.01-M IA Technical (IAT) II baseline and computing environment certifications.

The Contractor shall provide a copy of all current certifications to the Contracting Officer at time of award and remain in good standing during the contract period of performance. The Contractor shall provide the monthly DoD 8570.01-M deliverable report to the COR or J6 technical Point of Contact (POC) that includes a list of applicable DoD 8570.01-M key personnel. If a certification becomes obsolete during the life of the contract, the Contractor shall be responsible for ensuring applicable personnel obtain an acceptable replacement certification. The Contractor is responsible for all SOW requirements and shall provide skilled, experienced, professional, or technical personnel consistent with the task-specific requirements.

DoD 8570.01 baseline certifications can be found here:

https://public.cyber.mil/cwmp/dod-approved-DoD 8570.01-M-baseline-certifications/

DoD 8140 baseline certifications can be found here:

DoDM 8140.03 (Manual) Cyberspace Workforce Qualification and Management Program

8.2 Cybersecurity Strength Requirements

The Contractor shall adhere to all existing authorities and policies of the Director of National Intelligence regarding the protection of sensitive compartmented information (SCI), as directed by Executive Order 12333 and other laws and regulations.

The Contractor shall satisfy the Risk Management Framework (RMF) requirements of subchapter III of chapter 35 of Title 44, United States Code (U.S.C.), also known as the “Federal Information Security Management Act (FISMA) of 2002”.

The Contractor shall enable DLA to meet the standards required by the Office of Management and Budget (OMB) and the Secretary of Commerce, pursuant to FISMA and section 11331 of Title 40, U.S.C.

FIPS 199 / CNSSI 1253 Security Categorization: The Contractor shall participate in categorization discussions with the DLA J6 PM, functional lead, and the Information System Security Manager (ISSM) and provide all required FIPS 199 documentation as requested to support security categorization.

The Contractor shall provide a recommendation on system categorization based on sound technical expertise in accordance with FIPS 199 then work in coordination with the prescribed DLA System Owner (SO) and ISSM to support the categorization IAW FIPS 199, CNSSI 1253 and OSD Facility Related Control Systems (FRCS) Master List including DLA specific systems, then document the results of the security categorization in the System DLA FIPS 199 document and the Concept of Operations (CONOPs).

Assigned DLA PM will coordinate with the Contractor to identify and document Confidentiality, Availability, Integrity (CIA) of the system in a DLA FIPS 199 document for approval by DLA ISSM personnel.

8.3 Cybersecurity Assurance Requirements

The Contractor shall design, develop, and integrate cybersecurity solutions supporting the Department of Defense and all other applicable Government agencies.

This will be achieved through abiding by all applicable cybersecurity policies, regulations, and directives to ensure a favorable Assessment and Authorization (A&A), Assessment and Incorporate (A&I), or FRCS Assess Only Risk Assessment (FRCS AORA) decision, as well as obtaining an Authority to Connect (ATC) to DLA’s network. The Contractor shall mitigate risk identified through the RMF authorization process down to a level acceptable to the DLA Authorizing Official (AO).

Coding for Security. The Contractor shall provide documentation of development practices and standards applied to Government approved Contractor-written control system software, including firmware, used to ensure a high level of defense against unauthorized access.

The solution shall comply with the security control requirements documented in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53r4, “Security and Privacy Controls for Federal Information Systems and Organizations” and NIST 800-82r2, “Guide to Industrial Control Systems (ICS) Security”. The Contractor shall provide details of any alternative but equally effective security measures used to compensate for the inability to satisfy a particular derived security requirement (mitigation to control compliance findings). This information shall be submitted in writing to the DLA J6 PM for cybersecurity approval as soon as the alternative is identified.

8.3.1 Contractor Services Activities

Typical Contractor services activities include:

a. Analyzing DLA physical, electrical, computerized, and mechanical environments the identified FRCS solution will control (e.g., the physical Operational process to be controlled, such as those used in manufacturing, metering and robotics)

b. Developing a DLA Automation Solution FRCS architecture in terms of devices, dataflow, and control loops, outlining interconnectivity with engineering and operator workstations, and Safety Instrumented Systems (SISs) for testing; testing shall be in accordance with DoD Control Systems Security Requirements Guide (SRG), and other identified DLA test processes.

c. Defining how the DLA FRCS Automation Solution will connect to external (e.g., plant) and networks, by system description, concept, and dataflow diagram on Perdue Levels. Guidance on the applicability of Purdue Enterprise Reference Architecture (PERA) levels are found in the United Facilities Criteria (UFC) 4-010-06, Cybersecurity of Facilities-Related Control Systems

d. Installing, configuring, patching, backing up, and testing for DLA handover of the Automation Solution to the DLA asset owner for operation.

e. Gaining approval of the DLA asset owner for many of the decisions made and outputs generated during the execution of these activities.

The Contractor shall protect unclassified DoD data from unauthorized access or disclosure in accordance with DoDI 8582.01, “Security of Unclassified Information on Non-DoD Information Systems.” Controlled Unclassified Information: All Government controlled unclassified information obtained by the Contractor shall be protected in accordance with National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, “Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations”.

Agencies or Military Services providing external information system services must comply with DLA information security requirements and employ overlayed security controls in accordance with applicable federal laws, Executive Orders, directives, instructions, policies, regulations, standards, and guidance.

8.4 Tasks and Deliverables

The Contractor shall provide required implementation and design documentation to the DLA PM and security engineering teams to conduct a cybersecurity risk assessment (RA) of proposal. Results from accepted RAs will be incorporated into the Systems concepts of operations (CONOPs).

The Contractor, in collaboration with assigned security manager, PM and system owner, shall identify and document applicable cybersecurity enterprise architectures and deliver system conceptual design drawings.

The Contractor shall leverage, to the greatest extent possible, DLA Enterprise processes and capabilities.

8.5 System and Network Requirements

All system/network components and applications shall be compatible with all applicable Defense Information System Agency (DISA) Security Technical Implementation Guides (STIGs). Any STIG exceptions must be identified as part of the Contractor’s proposal to the Government and approved by J6 Cybersecurity. Exceptions incurring risk found unacceptable to the DLA Authorizing Official are not permitted.

All network components and applications shall be IPv4 and IPv6 compatible.

Network components shall allow configuration of IEEE 802.1x or port security for authentication.

The Contractor shall provide a complete list of all ports, protocols and services required for any computer system running control system applications or required to interface the control system applications. The listing shall include all ports and services required for normal operation as well as any other ports and services required for emergency operation. The listing shall also include an explanation or cross reference to justify why each service is necessary for operation.

The Contractor shall identify any system wireless communication capability, enabled, or disabled. All wireless communications shall meet applicable STIG requirements to include FIPS 140-2 certification. Any requirement to use wireless or cellular must be approved in writing by DLA J6, coordinated with the J62B PM and documented with the DLA Frequency Manager.

8.6 Information and Operational Technology Infrastructure Requirements

The Contractor will be responsible for the implementation including meeting all required STIG compliance.

The Contractor shall be responsible for all configuration and deployment which meet DoD, NIST and USG regulatory and cybersecurity policy requirements.

The Contractor is responsible for all software maintenance activities for any/all appliances including but not limited to, firmware updates, OS patching, software patches etc. for the duration of the contract period.

The Contractor will be responsible for all physical maintenance activities for any/all appliances including but not limited to, replacement of defective components such as hard drives (to be destroyed onsite per DoD policy, guidance), motherboards, daughterboards etc. for the duration of the contract period.

Maintenance activities start after handover of the DLA Automation Solution to the DLA asset owner and may continue until the asset owner no longer requires them.

Activities are typically short and frequently recurring, and may include one of more of the following:

A. Patching and anti-virus updates

B. Equipment upgrades and maintenance, including small engineering adjustments not directly related to control algorithms

C. Component and system migration

D. Change management

E. Contingency plan management

All maintenance activities will include completion of identified DoD/DLA Security Awareness training, independent of other training received.

System(s) shall operate using a Contractor fully supported operating system (OS), software, and firmware throughout the duration of the contract. All operating systems, software, and firmware shall be upgraded prior to the Contractor’s end of mainstream support for the operating system, software, or firmware. The solution must be upgradeable and remain compliant to DoD cybersecurity specifications during the lifecycle of the solution.

Any removable flash media required for system operation must be reviewed and approved in writing by the DLA J6 Flash Media Approval Program prior to implementation.

All FRCS OT solution(s) and/or system(s) must use the PERA Model for Control Hierarchy (reference ISBN 1-55617-265-6) to provide logical and/or physical architecture for networking, security hardware, software, and methods. The PERA Model is an industry standard for manufacturing and/or industrial control systems that segments hardware, devices, and equipment into a hierarchical based design.

8.6.1 Deliverables

The table below provides a summary of the deliverables required of the Contractor based on identified cybersecurity requirements for Assess and Authorize (A&A), Assess and Incorporate (A&I), and Facility Related Control System Lean Cybersecurity Risk Assessment (FRCS LCRA).

DoD 8570.01-M/8140 Report

RMF Documentation:

Final - six (6) months after contract award

Final - six (6) months after contract award

Final - six (6) months after contract award

PII Confidentiality Impact Level (PCIL) Categorization Worksheet Privacy Impact Assessment

8.7 PERFORMANCE SCHEDULE

The Contractor shall have adequate procedures for receiving and responding to service calls 24 hours per day, seven days a week, including weekends and holidays. The Contractor shall provide primary and secondary local or toll free telephone numbers for receipt of all service calls. All telephone calls shall be answered by an individual fully familiar with the Contractor's work control procedures and the terms and conditions of this contract. Service calls shall be considered received by the Contractor at the time and date the telephone call is placed by the Government Representative. This includes leaving a voice message on an answering machine. In the event that that the Government was unable to make live contact with the Contractor, the Contractor shall make live voice contact with the Government Representative within one hour. The Government Representative shall define the type of service call being made. The Contractor’s response to service calls shall depend on the type of service required as follows:

8.7 Response Time

8.7.1 For Emergency Calls

The Contractor shall respond immediately and must be on the job site and working within 2 hours after receipt of an emergency service call. Travel time for emergency calls will be paid. The Contractor shall work continuously without interruption and shall arrest the emergency condition before departing the job site. The Contractor shall inform the Government Representative if estimated costs for the repairs currently in progress will exceed the original authorized amount. The Contractor shall keep track of these expenses and inform the Government Representative of final costs before departing the work site.

If additional labor and material are required after completion of the original emergency call,…