Attachment 1 - Statement of Work.pdf

I. OVERVIEW

A. The Defense Logistics Agency (DLA) seeks to purchase twenty (20) Laser Printers and CAC readers for 2ID Korea. Specific details are found in sections II and III.

B. The services associated with the devices sought are delivery (Section IV), manufacturer’s warranty (Section

V), reports (Section VII), network functionality (Section IX), and network security (Section X).

II. DEVICE CONFIGURATIONS

A. All devices shall meet the following requirements:

1. Equipment shall be Trade Agreement Act (TAA) compliant.

2. All equipment, including all parts, accessories and finishers provided from Contractor shall be new (not refurbished or remanufactured) at contract award. New means composed of previously unused components, whether manufactured from virgin material, recovered material in the form of raw material, or materials and by-products generated from, and reused within, an original manufacturing process; provided that the supplies meet contract requirements, including but not limited to, performance, reliability, and life expectancy.

3. Support Microsoft Windows 11 or higher and MacOS 13 or higher desktop operating system and Microsoft Server 2016 or higher server operating systems.

4. Delivered with up-to-date software/firmware and drivers, with 32-bit and 64-bit architecture driver support.

5. Print Rate: Up to 29 Pages Per Minute or greater

6. Print resolution of at least 600 x 600 DPI.

7. Control Panel color graphics display size 2.7” or greater.

8. Capable of operating using 120VAC +/- 10% 60Hz.

9. Include a printed or digital (via compact disc (CD) or download link) operator’s manual, in English, for each device.

10. Memory: Minimum 1.25 Gigabyte of document management memory

11. Simplex/duplex printing

12. Recommended monthly print volume: 3,000 impressions

13. 50-sheet input multi-purpose tray

14. One (1) Paper Tray [250 Sheet Minimum/Tray] – Up to 8½" x 14"

15. Dimensions (W x D x H): 18.9 x 18.9 x 18.9 inches or smaller (VERY important as these devices will be utilized inside vehicles and not in the office) .

16. Common Access Card (CAC) SmartCard Reader

III. PURCHASE SPECIFICATIONS:

A. Twenty (20) Color Laser Printers - Minimum 29 pages per minute. Capable of 120VAC +/- 10% 60Hz.

Networkable Color Printers.

B. Twenty (20) SmartCard Readers – Licensed, compatible, and appropriate for printer model to utilize DoD CAC cards.

IV. DELIVERY

A. Upon completion of device delivery, the Contractor shall provide proof of delivery within ten (10) business days after delivery. This proof of delivery shall include: make, model, serial number, full delivery address (to include building number, floor, and room number if applicable), printed DLA Customer point of contact (DLA Customer POC) name, phone number, email address, date of delivery and DLA Customer POC signature. The Contractor shall provide this proof of delivery using an approved online repository where DLA can retrieve them 24 hours per day, 7 days per week, 365 days per year. If an online repository is not available, the required information shall be provided using the Delivery Report (Appendix #1).

B. Ship to:

Building 7300 Indianhead Ave Camp Humphreys, Pyeongtaek-si, Gyeonggi-do, Republic of Korea

V. MANUFACTURER’S WARRANTY

A. The Contractor shall provide a minimum one (1) year manufacturer’s OCONUS warranty with each Printer to replace or repair defective devices.

B. Telephonic Support: 24 hours a day, 7 days a week, 365 days a year (excluding U.S. holidays).

C. Type of Service: On-site (Time-to-React: Two government working days).

VII. REPORTS

A. The Contractor shall provide the following report:

1. Delivery Report (Appendix #1), as referenced in Section IV.A, which shall contain an accurate listing of all devices under contract (model, serial number, location). This report shall be submitted to the Contracting Officer Representative (COR).

VIII. INVOICING

A. Invoice shall be submitted via Wide Area Work Flow (WAWF) and shall be submitted in United States Dollars. The following website provides additional information regarding WAWF including information for “vendors getting started” with the system:

https://wawf.eb.mil/xhtml/unauth/help/help.xhtml.

IX. NETWORK FUNCTIONALITY

A. The Contractor shall provide devices that shall operate on and coexist on a network supporting all of the following:

1. Internet Protocol Version 4 (IPv4),

2. Internet Protocol Version 6 (IPv6),

3. A hybrid of IPv4 and IPv6.

B. The Contractor shall provide documentation and support to DLA for STIG compliant network configurations based on agency hardware/software (see section X.A. below).

X. NETWORK SECURITY

A. The Contractor shall provide devices that can be configured to comply with the current Defense Information Systems Agency (DISA) Security Technical Implementation Guide (STIG) titled Multifunction Device and Network Printer STIG (latest version and release), available at: https://cyber.mil/.

B. All devices shall support Simple Network Management Protocol (SNMP) version 3 (v3). Versions 1 and 2 (SNMPv1/SNMPv2) shall be disabled.

C. All hard drives that are put into service within Federal agencies shall remain in their custody. In the instance where a device is removed by the Contractor, all hard drives, whether internal, external, or otherwise, shall remain in possession of the Government and not be removed with the device.

D. Contractors shall monitor industry standard vulnerability sites (e.g. http://nvd.nist.gov/, https://www.us-cert.gov/ncas/alerts, http://oval.mitre.org/) and take appropriate actions if their equipment is subject to a known vulnerability. When vulnerabilities are identified by the Contractor, DLA or its customers, the Contractor shall provide remediation for distribution to all installed equipment in accordance with USCYBERCOM TASKORD regulations unless a different time period is directed by USCYBERCOM via DLA.

The TASKORD is Controlled Unclassified Information (CUI). The following is authorized to be quoted from the TASKORD for reference:

1. Assured Compliance Assessment Solution (ACAS) assigns severity scores of critical, high, medium and low to plug-in findings.

a. Critical findings reflect discovery of a common vulnerability and exposure (CVE) that poses significant risk to the confidentiality, integrity, and availability of DODIN Networks. Actions to mitigate or remediate critical vulnerabilities shall be initiated upon discover with the goal of mitigation/remediation within seven (7) calendar days.

b. Findings with a severity score of high shall be addressed in the same manner as vulnerabilities addressed via Information Assurance Vulnerability Alert (IAVA) directives and mitigated or remediated within twenty-one (21) calendar days of discovery.

c. Findings with severity scores of medium and low shall be addressed in accordance with local Approving Official (AO), Information System Security Manager (ISSM), or Information System Security Officer (ISSO) guidance until further notice.

d. In all instances, DOD components shall consider exposure to threat, mission impact, sensitivity of data, and current mitigating security controls when prioritizing implementation of fix actions.

E. In the event remediation cannot be achieved within the mandated timeline, the Contractor shall provide a Plan of Action and Milestones and receive approval thereof by the Customer’s agency Authorizing Official or designee for risk acceptance.

F. All Printers shall be International Organization for Standardization (ISO)/International Electrotechnical Commission (IEC) 15408 (Common Criteria) certified IAW CNSSP-11 using the National Information Assurance Partnership (NIAP) approved criteria or equivalent.

1. A device shall be acceptable if it is included on the NIAP CCEVS Product Compliant List (https://www.niap-ccevs.org/Products/).

2. All devices shall have current ISO/IEC 15408 certification and recertification, if applicable, before the Contractor can schedule lab time for testing. See section XI F. Guidance for Common Criteria Maintenance and Reevaluation is available at: https://www.niap-ccevs.org/documents_and_guidance/ ccevs/ scheme-pub-6.pdf

G. All devices shall be capable of obtaining accreditation through the Risk Management Framework (RMF) for DOD Information Technology (IT). As part of this, the Contractor agrees to provide all requested information and work in good faith with DLA so the DLA customers can expeditiously obtain RMF accreditation prior to device delivery and installation. The Contractor shall also provide devices for vulnerability and STIG testing to DLA or customer’s site at no cost to the Government. The Contractor further agrees that if the proposed device(s) does not obtain RMF accreditation, the contractor shall remove the device(s). Information regarding RMF is found in Risk Management Framework (RMF) for DOD Information Technology (IT) Instruction 8510.1 dated 12 March 2014:

http://www.dtic.mil/whs/directives/corres/pdf/851001_2014.pdf. In order to maintain RMF and STIG compliance, devices are required to be delivered with the most up-to-date firmware, as outlined in section

II.A.4.

I. The Contractor shall produce certificates of compliance, if requested.

XI. TESTING

A. All devices proposed in response to the contract shall be tested for compliance with Network Security as defined in section X after award. The Contractor shall deliver the devices for each Volume Band series, under each Functional Area, to DLA Document Services located at 430 Mifflin Avenue, Building 430, New Cumberland, PA 17070, for testing, at no cost to the government. Delivery coordination shall take place within five (5) business days of contract award. The MFD Configuration Manager can be reached at (717) 265-3131.

B. The estimated time for DLA testing is twenty (20) business days per device. Testing and approval shall be performed by the DLA Document Services EMS Division in conjunction with the Contractor’s assistance.

The Contractor shall provide onsite engineering assistance and other support necessary to configure, setup, and test the equipment as needed at no additional cost to the Government.

1. DLA tests devices to meet DOD RMF and STIG Compliance when applicable. If all devices pass the preliminary testing process, DLA shall submit a compliance memorandum to the Contractor informing them that the devices have passed the preliminary testing process. DLA reserves the right to offer devices to Customers after all devices in a particular category (MFD/printer/scanner) from all Contractors have been tested. In some cases, prior to being added to the DLA customer’s network, additional certification procedures and testing shall be required prior to risk acceptance. If required by DLA, the Contractor shall deliver test devices to the DLA customer prior to proceeding with installation.

DLA shall exercise due diligence to assist with technical mitigation and resolve any questions and/or concerns raised by that agency during the testing review process.

2. If the devices do not pass any of the testing procedures for any reason, DLA shall not proceed with installation of said devices at the customer locations and DLA shall terminate the contract.

C. A device shall not be tested if it does not meet the specification as outlined in sections II and III.

D. The devices shall be delivered with all required accessories, software, firmware, etc. Output paper handling accessories are not tested and shall not be delivered to the lab.

E. Approved devices previously submitted to DLA for testing are not required to be re-tested.

F. The Contractor shall deliver the devices for each model series, to DLA Document Services located at 430 Mifflin Avenue, Building 430, New Cumberland, PA 17071, for testing, at no cost to the government.

Delivery coordination shall take place within five (5) business days of contract award.

G. The Contractor shall resolve non-compliance issues as quickly as possible. If the issues cannot be resolved within fourteen (14) calendar days, the test shall be suspended. After the non-compliance issues are resolved by the Contractor, the suspended session shall be scheduled when lab time is next available. If requested by DLA, the Contractor shall remove their devices from the lab to avoid delaying the next scheduled test at no additional cost to the Government.

H. For all devices tested and placed on the DLA contract, the Contractor shall collaborate with the DLA Configuration Manager to develop the testing results package. The Contractor shall develop the device Implementation Guide. The Implementation Guide shall provide step-by-step instructions and screenshots to configure the devices in accordance with the testing results. Government acceptance of the Implementation Guide is at the discretion of the DLA EMS Division.

I. The security requirements set forth in this SOW are minimum device specifications and have been identified as the basic requirements common across Government agencies. These are the minimum security requirements applicable to all devices awarded under this contract. Each ordering activity may have its own hardware/software acceptance processes. All devices shall be subject to ordering activity hardware/software evaluation processes at the order level. If the device fails a security evaluation, the Contractor may select a different technology or mitigate the failed controls to fulfill this requirement. The Contractor shall be available to meet with the information technology (IT) and security personnel at a mutually convenient time during the evaluation process and shall identify a mutually acceptable solution.

The Contractor shall provide the necessary equipment or expertise to complete security testing and integration into the existing environment. At the order level, the customer agency may require the Contractor to ship devices to a specific location for testing at time of order award.

J. If, during the life of the contract, a requirement in section IX and X is changed, updated or revised, the Contractor shall comply with the most current version of the requirement.

K. The Contractor shall remove all hardware from the DLA test lab within fourteen (14) calendar days upon notification of test completion at no additional cost to the Government.

XII. SUPPLY CHAIN RISK MANAGEMENT

A. Upon request, the Contractor shall provide written documentation demonstrating how the integrity and security of all equipment, components thereof, repair parts and consumables it will provide and/or use in performing this contract will meet the standards set forth in National Institute of Standards and Technology (NIST) Special Publication 800-161. This documentation shall clearly demonstrate how the Contractor is taking effective measures to mitigate the risks of foreign intelligence services, terrorist groups, or others from inserting unwanted functionality into the supplies and/or services DLA receives through this contract.

Additionally, this documentation shall provide specific details of what—

1. Policies the Contractor has in place to prevent both (a) the use of counterfeit or altered equipment, components thereof, consumables and parts and (b) their introduction into the Contractor’s supply chain;

2. Security procedures the Contractor uses to track the chain of custody of equipment, components thereof, consumables and parts, to include while this material is in storage and in transit; and

3. Steps the Contractor takes to ensure the integrity and authenticity of equipment, components thereof, repair parts and consumables to prevent tampering so they will perform according to specifications without additional unwanted functionality.

B. The Contractor shall continuously meet the standards of NIST Special Publication 800-161 while taking effective measures to mitigate the risks of foreign intelligence services, terrorist groups, or others from inserting unwanted functionality into the supplies and/or services provided through this contract. Upon request, the Contractor shall provide written documentation meeting all requirements set forth in part A, above.

XIII. INSTALLATION SECURITY REQUIREMENTS

A. The Contractor shall comply with all Federal, DoD and local rules and regulations to obtain Government installation access in order to meet all response times identified within the PWS.

B. The Contractor shall comply with Government base access requirements as set forth in the base/ command regulations.

C. The Contractor shall be responsible for any and all fees associated with the application process and/or enrollment to access any installation or facility.

XIV. GENERAL CONDITIONS

A. The Contractor shall assign a single point of contact (POC) to coordinate with the Contracting Officer in all aspects of this contract within three (3) business days of receipt of the order. The Contractor shall provide its assigned POC’s name, title, business address, phone number and email address to the Contracting Officer.

B. The Contractor shall comply with the Section 508 accessibility requirements. By submission of its quote, the Proposer affirms that its Electronic Information Technology (EIT) supplies and services are accessible as outlined in the law, the standard, and FAR Subpart 39.2. The Proposer shall submit their completed Voluntary Product Accessible Template (VPAT®) with their quote. The most recent VPAT can be downloaded at: https://www.itic.org/policy/accessibility/vpat.

C. Device make/models must be included on the NIAP CCEVS Product Compliant List (https://www.niap-ccevs.org/Product/).

XV. APPENDICES

A. Appendix #1: Delivery Report

Appendix #1 DELIVERY REPORT

Activity Name DLA Customer Address

DLA Customer POC Phone # DLA Customer POC Email

Contractor Name/Contract # (last 4 digits only) Period of Performance (PoP) Start Date

CLIN# Manufacturer Model # Serial # Install Date Building # Floor #/Room #

To be completed by the DLA Customer (required):

DLA Customer Accepting Receipt of Device (Print): DLA Customer Phone Number/Email Address:

Date Device(s) Received: DLA Customer Signature:

(Continue on Page 2 if additional space is required)

CLIN# Manufacturer Model # Serial # Install Date Building # Floor #/Room #

(Page 2 – Delivery Report)