Attachment 1 - Statement of Work.pdf

DLA Information Operations Statement of Work (SOW)

REVISION - As of June 19, 2020 Page 1

I. OVERVIEW

A. The Defense Logistics Agency (DLA) seeks to enter into a contract for TWENTY TWO (22) Multifunctional Devices for up to 60 month lease of Federal Supply Class (FSC) 3610 equipment along with services associated with this leased FSC 3610 equipment. The geographic scope of this contracting action is OUTSIDE THE CONTIGUOUS UNITED STATES (OCONUS) – KUWAIT and limited to a 50 mile (81 kilometer) radius and within the same country of the delivery schedule. This contract is in support of the U.S. Central Command (USCENTCOM).

B. The leased FSC 3610 equipment sought are A3 Multifunctional Devices (MFDs), accessories and office document devices (hereafter collectively referred to as “devices”). Specific details are found in sections II and III.

C. The services associated with the leased FSC 3610 equipment sought are delivery and installation (section IV), end-user training (section V), full service maintenance, including all consumable supplies (excluding paper)(section VI), relocation (section VII), technical refresh (section VIII), removal (section IX), reports (section X), network functionality (section XII), and network security (section XIII).

II. DEVICES AND CONFIGURATIONS

A. All devices shall meet the following requirements:

1. Simplex/duplex copying, printing, and scanning.

2. Automatic Document Feeder with a 30 page minimum capacity and duplexing.

3. Basic inline finishing functions which include stacking, collating, and multi-position stapling.

4. Operate using at least 30% or greater recycled 20 lb. paper.

5. Free-standing with casters/wheels (or cabinets provided as needed). No devices shall be configured for table-top use.

6. Copy resolution of at least 600 x 600 DPI.

7. Print resolution of at least 1,200 x 1,200 DPI.

8. Support current desktop and server operating systems.

9. A minimum of 1 Gigabyte of document management memory.

10. Print drivers shall be capable of Page Description Language (PDL) to support Adobe PS3, PCL5E and PCL6.

11. Delivered with up-to-date software/firmware and drivers, with 32-bit and 64-bit architecture driver support. Provide all subsequent updates along with installation instructions to DLA.

12. Operate using 220 volt 15 amp 50 hertz (Hz) alternating current (AC) electrical current with “type G” socket.

13. Equipped with an external surge protector to protect all electronic components. The external surge protector shall be provided in addition to any internal surge protectors. External surge protectors shall have a minimum five (5) year manufacturer’s warranty that covers:

a. Replacement of the surge protector if it fails, at no cost to the Government.

b. Repair or replacement of any device provided through this SOW damaged by a power surge when properly connected to the Contractor-provided surge protector.

14. Include a printed operator’s manual, in English, for each device.

15. Default to:

Attachment 1 - Statement of Work SP7000-20-Q-1025

REVISION - As of June 19, 2020 Page 2

a. Automatically go into sleep mode after 20 minutes of inactivity

b. Automatically go into hibernation after an hour of inactivity.

c. Print duplex (2-sided).

d. Print in gray scale on both monochrome and color MFDs

e. “Draft” quality printing rather than “high” quality printing

f. Display all information in English.

B. Devices shall meet the following security requirements:

1. Devices with hard drives shall have an encryption or overwrite Security Kit.

2. Only CLASSIFIED designated devices shall be placed on the Secret Internet Protocol Router Network (SIPRNet). All CLASSIFIED designated devices shall include a removable hard drive. A removable hard drive is a hard drive the end-user may easily remove, and reinsert into the device on a recurring basis. All devices with removable hard drives shall have a locking mechanism to secure the hard drive.

3. All Universal Serial Bus (USB) ports/memory card slots on the devices shall be disabled when delivered except: the printer port used to connect the device to a single computer; Common Access Card (CAC) readers; and any USB ports needed for servicing/maintaining equipment. Additionally, unused ports, protocols and services on each device shall be able to be enabled/disabled by the local IT administrator.

4. All devices shall have a secure scanning functionality that complies with Federal Information Processing Standard (FIPS) 140-2 encryption with routing and full integration to standard network infrastructure destinations, which include: Scan-to-Email, Scan-to-Folder, Scan-to-Network, Scan-to-Server and Scan-to-PC. Scanned documents shall be made available as a TIFF, JPEG and as a PDF file format. The default scan resolution shall be 300 x 300 DPI. The default scan output file type shall be PDF. Devices shall have Optical Character Recognition (OCR) in order to process and produce text-searchable documents to the scan destination. Note: Full integration does not mean scanning to proprietary back-end content, document or records management systems to support customized indexing or metadata requirements.

5. All Non-Classified Internet Protocol Router (NIPR) devices, volume bands 1-5, shall have analog fax only. Note: The analog fax function shall be configured to separate/isolate the fax controller from the network controller. SIPR devices shall NOT have fax capability.

6. All devices shall have:

a. CAC/Personal Identity Verification (PIV) enablement in order to secure the device from unauthorized use and shall have a “Secure Print” feature that allows end-users to use authentication credentials (ex. ID, Login) and password identification (PIN) to release print jobs on the device.

b. Print on-demand solution (e.g., equivalent to “Follow Me,” “Follow You,” “Push” or “Pull” printing) that shall allow end-users to release print output on any device on the network.

III. CONTRACT LINE ITEM NUMBER (CLIN) AND VOLUME BAND SPECIFICATIONS:

A. In addition to the features/capabilities/configurations set forth in section II (outlined above), the Contractor shall provide all devices in accordance with the chart below:

REVISION - As of June 19, 2020 Page 3

CLIN QUANTITY

Volume

Band

NIPR

SIPR

Estimated Monthly

Impressions

Min. Speed (PPM) Paper Capacity

Mono Color Mono/Color

0001 11 VB-2SC SIPR 5,000 5,000 35

One (1) Bypass Tray [100 Sheet Minimum] - Up to 11" x 17" Two (2) Adjustable Paper Trays [500 Sheet Minimum/Tray]

- Up to 11" x 17"

0002 11 VB-2NC NIPR 5,000 5,000 35

One (1) Bypass Tray [100 Sheet Minimum] - Up to 11" x 17" Two (2) Adjustable Paper Trays [500 Sheet Minimum/Tray]

- Up to 11" x 17"

IV. DELIVERY AND INSTALLATION

A. Delivery and Installation of Ordered Devices:

1. Delivery and Installation of ordered devices shall be in accordance with (IAW) the timeframes outlined in the chart below:

Amount of Devices Per Contracting Action

Maximum Number of Calendar Days to Complete Delivery and Installation

Up to 100 30 days after receipt of contract

101 - 200 45 days after receipt of contract

201 – 500 60 days after receipt of contract

More than 500 90 day after receipt of contract

2. Installation shall be defined as device is fully operational as ordered, to include network connectivity and scanning, if required. The Contractor shall provide onsite technical and system analyst support and appropriate digital cards/products to successfully connect devices to DLA customers’ networks.

3. Upon completion of device delivery, the Contractor shall obtain customer signature and date on each bill of lading (BOL) or packing slip, and provide this proof of delivery to the designated DLA POC within ten (10) business days after delivery. The Contractor shall also provide the Installation Report (Appendix #1) or a modified delivery schedule with serial numbers added to the designated DLA POC within ten (10) business days after delivery and installation have been completed.

4. If a device cannot be delivered and installed within the delivery time that is given, the Contractor shall notify the issuing Contracting Officer as soon as the delay is realized, of the expected delivery date for the ordered device(s).

5. Regardless of installation date, all devices, including replacement devices, shall maintain a co-terminus Period of Performance (PoP).

6. Upon installation, the Contractor shall affix on each device a sticker with the following information:

manufacturer’s name, model number, device serial number and toll-free telephone number(s) to place service maintenance calls and order consumable supplies. Additionally, the Contractor shall add the PoP end date to DLA EMS sticker and affix to device. (DLA shall provide the DLA EMS stickers.)

7. The Contractor shall provide English-speaking personnel at the toll-free number(s) provided.

B. Options to Order Additional Quantities of Devices:

REVISION - As of June 19, 2020 Page 4

1. As options, the Contractor shall, at the same unit price, provide up to twenty percent (20%) more co-terminus leased devices than set forth at each CLIN of a delivery order; provided that DLA exercises and issues its options, if at all, prior to the end of the 24th month following the effective date of the contract.

V. TRAINING

A. The Contractor shall provide on-site training, in English, as specified in the contract, to end-users.

B. The Contractor shall coordinate directly with each command’s POC listed on the contract to establish the training schedule.

C. Training shall include the following:

1. How to operate the basic function keys of the device.

2. How to operate special features including duplexing, enlargements, reductions, and multiple job queues.

3. Diagnosis and resolution of basic device malfunctions, including paper jams.

4. Location and procedures for installing consumables such as paper, toner, staples, etc.

D. The Contractor shall submit a Summary of On-Site Training Report (Microsoft Excel format), listing device serial number, personnel trained and date training was completed, to the designated DLA POC within five (5) business days of training completion. Initial invoice payment shall not be released until this report is received.

E. In addition to on-site training, the Contractor shall provide a quick reference desk guide (single sheet, 8.5” x 11” paper size, laminated, full color and able to be easily stowed away with the device). The contractor shall also provide a CD-ROM/DVD and/or web-based training (URL printed on a sticker to be placed on the front of the device) to serve as follow-up training.

VI. MAINTENANCE

A. Service

1. The Contractor shall maintain each device at a minimum 95% monthly available rate. Maintaining the devices includes:

a. Preventive maintenance

b. Service calls

c. Repairs

d. Troubleshooting

e. Connectivity

f. All associated labor and travel

2. If a malfunction cannot be corrected during the initial service call, the Contractor shall resolve all issues no later than ten (10) calendar days from date of initial service call.

3. The Contractor shall provide English speaking service technician support Monday through Friday from 8:00 a.m. – 4:30 p.m. local time, with the exception of Federal holidays.

4. Service for Non-Remote Areas: Non-Remote Areas are defined as service locations being within a fifty (50) mile radius commute of a metropolitan area, which for the purpose of this SOW is defined

REVISION - As of June 19, 2020 Page 5 as a statistical area with a population of 50,000 persons and above. For service in non-remote areas:

a. The Contractor shall respond to work stoppage situations within two (2) business hours of a service call. Work stoppage is defined as a required function of the device (printing, copying, scanning or faxing) is non-operational. A telephone call (unless it results in solving the problem) shall not be deemed an acceptable service response. The service technician shall call the end-user within an hour to discuss the service problem and time of arrival. It is estimated that 10% of service calls shall be classified as “work stoppage” across the total device population on a yearly basis.

b. The Contractor shall respond to non-work stoppage situations within four (4) business hours of a service call. Non-Work stoppage is defined as a required function of the device (printing, copying, scanning or faxing) is degraded. A telephone call (unless it results in solving the problem) shall not be deemed an acceptable service response. The service technician shall call the end-user within an hour to discuss the service problem and time of arrival.

5. Service for Remote Areas: Remote Areas are defined as service locations being beyond a fifty

(50) mile radius commute of a metropolitan area. For service in remote areas:

a. The Contractor shall respond to work stoppage situations within four (4) business hours of a service call. A telephone call (unless it results in solving the problem) shall not be deemed an acceptable service response. The service technician shall call the end-user within an hour to discuss the service problem and time of arrival. It is estimated that 10% of service calls shall be classified as “work stoppage” across the total device population on a yearly basis.

b. The Contractor shall respond to non-work stoppage situations within eight (8) business hours of a service call. A telephone call (unless it results in solving the problem) shall not be deemed an acceptable service response. The service technician shall call the end-user within an hour to discuss the service problem and time of arrival.

6. In the case of devices cleared for CLASSIFIED material, the Contractor’s repair technicians shall have a Department of Defense (DoD) security clearance equal to or higher than the classification of the device and be able to provide verification when requested.

7. The Contractor shall be responsible for all damages due to normal wear and tear and loss or damage caused by the Contractor or its agents.

8. If a device is determined to be non-repairable, to include damaged devices, the Contractor shall inform the designated DLA POC within two (2) business days of making this determination. The Contractor shall deliver and install a comparable replacement device within fifteen (15) calendar days from written notification from the Contracting Officer.

B. Consumable Supplies

1. The Contractor shall provide all consumable supplies (including staples) necessary for the operation of the devices. Paper is excluded as a consumable supply.

2. The Contractor shall deliver all required consumable supplies to the designated locations listed on the delivery schedule identified on the contract, within three (3) business days after receipt of a request for supplies.

VII. DEVICE RELOCATION

A. For device relocations, the Contractor shall:

REVISION - As of June 19, 2020 Page 6

1. Provide device relocation services, within a 50-mile radius, for 100% of the total number of devices ordered, for each year of the specified period of performance. (For example, if there are 100 devices ordered, the Contractor shall provide relocations for up to 100 devices per year. This could be relocating the same device 100 times, relocating 100 different devices one time each or any other combination thereof each year.) The device relocations shall not require rigging or special handling. Devices shall not be relocated without written approval from the designated DLA POC and shall be completed within thirty (30) calendar days after receipt of the written request.

2. Include the following: Breakdown and packing of equipment, shipping, uncrating, re-installation and end-user training.

3. Be responsible for any and all repairs that may be required following any relocation performed.

4. Upon completion, obtain customer signature on the Removal/Relocation Report contained within Appendix #2 and the MFD Hard Drive Removal Record (Appendix #3) if applicable.

VIII. TECHNICAL REFRESH

A. In the event the Contractor is no longer able to provide the products proposed, the Contractor may, only after written approval by the Contracting Officer, remove the products from the contract and provide replacement products which shall meet or exceed the Volume Band requirements as listed in this SOW, at the contract price.

1. Replacement devices shall be newer technology than the models they are replacing. If the Contractor submits new models for testing, the devices shall be “in production” and not near “end of life.”

2. Prior to delivery, if replacement devices have not been previously tested by DLA, they shall be tested as outlined in section XV.

IX. DEVICE REMOVAL

A. For device removal, the Contractor shall:

1. Remove all devices and associated supplies within thirty (30) calendar days of contract expiration or receipt of a modification signed by the Contracting Officer.

2. Notify the issuing Contracting Officer as soon as any delay in device removal is realized.

3. Prior to device removal, remove all hard drives and surrender them to DLA (or its assignee). Upon completion of the hard drive removal, the Contractor shall obtain the required signatures on both the Removal/Relocation Report (Appendix #2) and the MFD Hard Drive Removal Record (Appendix #3). After the hard drive has been removed, ALL classification stickers shall be removed prior to device removal/disposal.

4. The Government reserves the right to withhold final payment if all devices are not removed from the premises within thirty (30) calendar days of contract expiration or termination.

5. 5. Be subject to payment of all disposal fees incurred by the Government for any devices not removed within thirty (30) calendar days of termination or expiration. After this time period, the devices will be considered abandoned.

X. REPORTS

A. The Contractor shall provide the following reports:

1. Installation Report, as referenced in section IV.A.3.

2. Summary of On-Site Training Report, as referenced in section V.D.

REVISION - As of June 19, 2020 Page 7

3. Device Listing Report (Microsoft Excel format) shall be submitted via Wide Area Work Flow (WAWF) to the DLA POC with the monthly invoice. The report shall contain an accurate listing of all devices under contract (model, serial number, location).

4. Removal/Relocation Report, as applicable, as referenced in section VII.A.6 and IX.A.

B. Upon request, the Contractor shall provide the following reports within 5 business days, at no cost to the Government:

1. Usage Report (Appendix #4) shall be submitted to the DLA POC.

2. Response Time Report shall be submitted to the DLA POC and the Contracting Officer. This report shall identify the technician’s response time, defined as the time between when the service call is placed and when the technician arrives onsite to repair the equipment. If the issue is able to be resolved on the phone, the response time shall be defined as the time the service call was placed and when the issue was resolved over the phone.

3. Device Downtime Report shall be submitted to the DLA POC. This report shall identify the time the equipment was inoperable/non-functional. Downtime is defined as the time the service call is placed notifying the Contractor’s representative that the equipment is inoperable/non-functional or when the technician begins service on the equipment if the device is operable/functional upon arrival. In addition, the report shall include information relative to the frequency of service calls, production volume between service calls, types of repairs, as well as parts required.

4. Device Uptime Report shall be submitted to the DLA POC and the Contracting Officer. This report shall identify the time the equipment was operable and available and will be used to verify the required minimum 95% monthly available rate, as outlined in section VI.A.1.

XI. INVOICING

A. All invoices shall be submitted with the Device Listing Report via Wide Area Work Flow (WAWF) and shall be submitted in United States Dollars. The following website provides additional information regarding WAWF including information for “vendors getting started” with the system:

https://wawf.eb.mil/xhtml/unauth/help/help.xhtml.

B. For devices that are relocated or removed, invoices shall include the Removal/Relocation Report

(Appendix #2) and the Hard Drive Removal Record (Appendix #3) and the BOL. Invoices submitted without the applicable reports shall not be paid.

XII. NETWORK FUNCTIONALITY

A. DoD policy prohibits the publication of network configuration information; therefore, DoD installations shall not fill out pre-installation site surveys. The required information shall be provided at time of installation.

B. The Contractor shall provide devices that shall operate on and coexist on a network supporting all of the following:

1. Internet Protocol Version 4 (IPv4),

2. Internet Protocol Version 6 (IPv6),

3. A hybrid of IPv4 and IPv6.

C. Support shall be provided for network configurations based on agency hardware/software.

XIII. NETWORK SECURITY

REVISION - As of June 19, 2020 Page 8

A. The Contractor shall provide devices that can be configured to comply with the current Defense Information Systems Agency (DISA) Security Technical Implementation Guide (STIG) titled Multifunction Device and Network Printer STIG (latest version and release), available at:

https://cyber.mil/.

B. Contractors shall monitor industry standard vulnerability sites (e.g. http://nvd.nist.gov/, https://www.us-cert.gov/ncas/alerts, http://oval.mitre.org/) and take appropriate actions if their equipment is subject to a known vulnerability. When vulnerabilities are identified by the Contractor, DLA or its customers, the Contractor shall provide remediation for distribution to all installed equipment in accordance with USCYBERCOM TASKORD regulations unless a different time period is directed by USCYBERCOM via DLA. The TASKORD is For Official Use Only. The following is authorized to be quoted from the TASKORD for reference:

1. Assured Compliance Assessment Solution (ACAS) assigns severity scores of critical, high, medium and low to plug-in findings.

a. Critical findings reflect discovery of a common vulnerability and exposure (CVE) that poses significant risk to the confidentiality, integrity, and availability of DODIN Networks. Actions to mitigate or remediate critical vulnerabilities shall be initiated upon discover with the goal of mitigation/remediation within seven (7) calendar days.

b. Findings with a severity score of high shall be addressed in the same manner as vulnerabilities addressed via Information Assurance Vulnerability Alert (IAVA) directives and mitigated or remediated within twenty-one (21) calendar days of discovery.

c. Findings with severity scores of medium and low shall be addressed in accordance with local Approving Official (AO), Information System Security Manager (ISSM), or Information System Security Officer (ISSO) guidance until further notice.

d. In all instances, DoD components shall consider exposure to threat, mission impact, sensitivity of data, and current mitigating security controls when prioritizing implementation of fix actions.

C. In the event remediation cannot be achieved within the mandated timeline, the Contractor shall provide a Plan of Action and Milestones and receive approval thereof by the Customer’s agency Authorizing Official or designee for risk acceptance.

D. All devices shall be International Organization for Standardization (ISO)/International Electrotechnical Commission (IEC) 15408 (Common Criteria) certified IAW CNSSP-11 using the National Information Assurance Partnership (NIAP) approved criteria or equivalent.

1. A device shall be acceptable if it is included on either the NIAP CCEVS Product Compliant List (https://www.niap-ccevs.org/Product/) or Common Criteria Portal Certified Products list (http://www.commoncriteriaportal.org/products/).

2. All devices shall have current ISO/IEC 15408 certification and recertification, if applicable, before the Contractor can schedule lab time. See section XIV. Guidance for Common Criteria Maintenance and Reevaluation is available at: https://www.niap-ccevs.org/documents_and_guidance/ccevs/scheme-pub-6.pdf

E. All devices shall be capable of obtaining accreditation through the Risk Management Framework (RMF) for DoD Information Technology (IT). As part of this, the Contractor agrees to provide all requested information and work in good faith with DLA so the DLA customers can expeditiously obtain RMF accreditation prior to device delivery and installation. The Contractor shall also provide devices for vulnerability and STIG testing to DLA or customer’s site. The Contractor further agrees that if the proposed device(s) does not obtain RMF accreditation, the contractor shall remove the device(s).

Information regarding RMF is found in Risk Management Framework (RMF) for DoD Information

REVISION - As of June 19, 2020 Page 9

Technology (IT) Instruction 8510.1 dated 12 March 2014:

http://www.dtic.mil/whs/directives/corres/pdf/851001_2014.pdf. In order to maintain RMF and STIG compliance, devices are required to have the most up-to-date firmware, out outlined in section

II.A.10.

F. The Contractor shall supply a SMARTCARD Public Key Infrastructure (PKI) Solution which is compliant with DODI 8520.03 and NIST FIPS 201 (PIV) standards. The contractor shall provide card readers that shall read and process all approved CAC and PIV cards. The Contractor shall maintain compliance with DoD-wide SMARTCARD and DoD PKI standards, and support all approved physical cards during the full lease period.

G. The contractor shall provide a SMARTCARD PKI Solution with SIPRNet token capability, which is compliant with DoD requirements for PK-enabling and interoperability as set forth in DODI 8520.02.

The Contractor shall provide card readers that shall read and process all approved SIPRNet token cards. The Contractor shall provide device support systems that incorporate the use of PKI for encryption of information in transit or at rest. The Contractor shall provide devices that are compatible with 3.3 volt SafeNet SC650 token and that are compatible with the 90Meter Middleware solution for CAC, known as CAC Smart Card Manager-90. The Contractor shall maintain compliance with DoD wide SIPR and DoD PKI standards, and support all approved physical cards and firmware during the full lease period. For current DODI instructions go to:

http://www.dtic.mil/whs/directives/corres/ins1.html.

H. The Contractor shall ensure that CAC/SIPR token authentication is available for scanning, printing and copying and shall be:

1. Capable of digitally signing emails using the senders DoD PKI Certificate(s).

2. Capable of encrypting emails using the receivers DoD PKI Certificate(s).

3. Capable of scan to file on networked devices.

4. In compliance with Homeland Security Presidential Directive-12 (HSOP-12).

I. The Contractor shall produce certificates of compliance, if requested.

XIV. TESTING

A. Unless previously tested and approved by DLA, all devices proposed in response to the contract shall be tested for compliance with Network Security as defined in section XIII after award.

B. The estimated time for testing is twenty (20) business days. Testing and approval shall be performed by the DLA Information Operations EMS Division in conjunction with the Contractor’s assistance. The Contractor shall provide onsite engineering assistance and other support necessary to configure, setup, and test the equipment as needed.

1. DLA has agreements with our DoD customers to test devices to meet DoD RMF and STIG Compliance. If all devices pass the preliminary testing process, DLA shall submit a compliance memorandum to the Contractor informing them that the devices have passed the preliminary testing process. In some cases, prior to being added to the DLA customer’s network, additional certification procedures and testing shall be required prior to risk acceptance. If required by DLA, the Contractor shall deliver test devices to the DLA customer prior to proceeding with installation.

DLA shall exercise due diligence to assist with technical mitigation and resolve any questions and/or concerns raised by that agency during the testing review process.

2. Upon request, the Contractor shall provide a representative device from each common criteria certified family and engineering support to the NAVWAR test facility in San Diego, CA for all devices that are to be placed on the Navy & Marine Corps Intranet (NMCI). All devices will be tested to operate on the NMCI for the "printer, scanner and fax" functions. The NMCI Testing Checklist

REVISION - As of June 19, 2020 Page 10

(Appendix #5) outlines what functionalities will be tested to operate on the NMCI network prior to placement of devices on the NMCI Certified Device List (CDL). The Device Manufacturer Questionnaire (Appendix #6) shall be provided to the NAVWAR test facility prior to delivery. The NMCI certification process can take from 4 to 6 months

3. For devices ordered to be installed on Navy networks, the Contractor shall provide networked equipment that shall be tested to operate Outside the Contiguous United States (OCONUS) Navy Enterprise Network (ONE-Net) for the "printer, scanner and fax" functions. This equipment shall be accredited to operate and added to the ONE-Net Approved Products List (APL) prior to the delivery of devices.

4. If the devices do not pass any of the testing procedures for any reason, DLA shall not proceed with installation of said devices at the customer locations and DLA shall terminate the contract.

C. A device shall not be tested if it cannot be assigned to one of the Volume Bands as outlined in section V.

D. The devices shall be delivered with all required accessories, software, firmware, etc. Output paper handling accessories are not tested and shall not be delivered to the lab.

E. Approved devices previously submitted to DLA for testing are not required to be re-tested.

F. The Contractor shall deliver the devices for each Volume Band series to DLA Information Operations J67E located at 430 Mifflin Avenue, Building 430, New Cumberland, PA 17071, for testing, at no cost to the government. Delivery coordination shall take place within five (5) business days of contract award.

G. The Contractor shall resolve non-compliance issues as quickly as possible. If the issues cannot be resolved within fourteen (14) calendar days, the test shall be suspended. After the non-compliance issues are resolved by the Contractor, the suspended session shall be scheduled when lab time is next available. If requested by DLA, the Contractor shall remove their devices from the lab to avoid delaying the next scheduled test.

H. For all devices tested and placed on the DLA contract, the Contractor shall collaborate with the DLA POC to develop the testing results package. The Contractor shall develop the device Implementation Guide. The Implementation Guide shall provide step-by-step instructions and screenshots to configure the devices in accordance with the testing results. Government acceptance of the Implementation Guide is at the discretion of the DLA EMS Division.

I. The security requirements set forth in this SOW are minimum device specifications and have been identified as the basic requirements common across Government agencies. These are the minimum security requirements applicable to all devices awarded under this contract. Each ordering activity may have its own hardware/software acceptance processes. All devices shall be subject to ordering activity hardware/software evaluation processes. If the device fails a security evaluation, the Contractor may select a different technology or mitigate the failed controls to fulfill this requirement. The Contractor shall be available to meet with the information technology (IT) and security personnel at a mutually convenient time during the evaluation process, and shall identify a mutually acceptable solution. The Contractor shall provide the necessary equipment or expertise to complete security testing and integration into the existing environment. The customer agency may require the Contractor to ship devices to a specific location for testing at time of award.

J. If, during the life of the contract, a requirement in section XII and XIII is changed, updated or revised, the Contractor shall comply with the most current version of the requirement.

K. The Contractor shall remove all hardware from the DLA test lab within fourteen (14) calendar days upon notification of test completion.

XV. SUPPLY CHAIN RISK MANAGEMENT

A. As part of its quote, the Contractor shall provide written documentation demonstrating how the integrity and security of all equipment, components thereof, repair parts and consumables it will provide and/or use in performing this contract will meet the standards set forth in National Institute of

REVISION - As of June 19, 2020 Page 11

Standards and Technology (NIST) Special Publication 800-61. This documentation shall clearly demonstrate how the Contractor is taking effective measures to mitigate the risks of foreign intelligence services, terrorist groups, or others from inserting unwanted functionality into the supplies and/or services DLA receives through this contract. Additionally, this documentation shall provide specific details of what—

1. Policies the Contractor has in place to prevent both (a) the use of counterfeit or altered equipment, components thereof, consumables and parts and (b) their introduction into the Contractor’s supply chain;

2. Security procedures the Contractor uses to track the chain of custody of equipment, components thereof, consumables and parts, to include while this material is in storage and in transit; and

3. Steps the Contractor takes to ensure the integrity and authenticity of new, refurbished or remanufactured equipment, components thereof, repair parts and consumables to prevent tampering so they will perform according to specifications without additional unwanted functionality.

B. The Contractor shall continuously meet the standards of NIST Special Publication 800-61 while taking effective measures to mitigate the risks of foreign intelligence services, terrorist groups, or others from inserting unwanted functionality into the supplies and/or services provided through this contract.

Upon request, the Contractor shall provide written documentation meeting all requirements set forth in part A, above.

XVI. ENTERPRISE MANAGEMENT TOOL

A. The Contractor shall provide an Enterprise Management Tool that manages devices. The management/monitoring software tool shall reside within the customers’ network in order to monitor, manage and generate usage to facilitate continued fleet optimization reports.

B. The Enterprise Management Tool shall use SNMP V3. The management tool shall monitor meter reads, volume, usage, supply levels, and issue notifications/alerts about device status. The notifications/alerts shall notify designated personnel when to order consumables and request maintenance/repair services.

XVII. INSTALLATION SECURITY REQUIREMENTS

A. The Contractor shall comply with all rules and regulations to obtain Government installation access in order to meet all response times identified within the SOW.

B. The Contractor shall comply with Government base access requirements as set forth in the base/ command regulations.

C. The Contractor shall be responsible for any and all fees associated with the application process and/or enrollment to access any installation or facility..

D. For devices cleared for CLASSIFIED material, the Contractor’s repair technicians shall have a DoD security clearance equal to or higher than the classification of the device and shall provide verification when requested.

XVIII. GENERAL CONDITIONS

A. The Contractor shall assign a single point of contact (POC) to coordinate with the Contracting Officer in all aspects of this contract within 3 business days of receipt of the award. The Contractor shall provide its assigned POC’s name, title, business address, phone number and email address to the Contracting Officer.

REVISION - As of June 19, 2020 Page 12

B. The Contractor shall comply with the Health Insurance Portability and Accountability Act (HIPAA) when installing devices at Government medical sites.

C. The Contractor shall comply with the Section 508 accessibility requirements. By submission of its offer, the Contractor affirms that its Electronic Information Technology (EIT) supplies and services are accessible as outlined in the law, the standard, and FAR Subpart 39.2. The Contractor shall complete the Voluntary Product Accessible Template (VPAT®) document (Appendix #7). If applicable, Contractors shall indicate where their Section 508 EIT compliance information is available for review (e.g., Contractor’s website or other location the Contracting Officer can access). The Contracting Officer may require a demonstration of Section 508 compliance prior to award.

XIX. ADDITIONAL REQUIREMENTS

A. Synchronized Predeployment and Operational Tracker (SPOT):

1. The Contractor shall ensure all Contractor employees comply with all guidance, instructions, and general orders applicable to U.S. Armed Forces and DoD civilians and issued by the Theater Commander or his/her representative. This shall include any and all guidance and instructions issued based on the need to ensure mission accomplishment, force protection, and safety.

2. Synchronized Predeployment Operational Tracker (SPOT): The prime Contractor shall enter before deployment and maintain data for all Contractor personnel to include sub-contractors that are authorized to accompany U.S. Armed Forces deployed outside the United States in accordance with clause DFARS 252.225-7995/DFARS DOD Class Deviation 2017-O0004.

The Contractor shall use the SPOT web-based system, at https://spot.dmdc.mil/privacy.aspx, to enter and maintain the data.

3. The prime Contractor is responsible to close out the deployment of personnel, including subcontractor employees at all tiers, at the end of the contract completion period and to release the personnel from the prime Contractor's company in the SPOT database IAW DFARS 252.225- 7995/DFARS DOD Class Deviation 2017-O0004.The release of employee information must be accomplished no more than 30 calendar days after the end of the contract completion date. See solicitation attachment 8 - Synchronized Predeployment and Operational Tracker (SPOT) DoD business rules attached for SPOT details.

B. Joint Contingency and Expeditionary Services (JCXS) and Joint Contracting and Contingency Services

(JCCS) registration:

1. Vendors are required to be registered in JCXS and JCCS prior to contract award.

2. Joint Contracting and Contingency Services (JCCS) registration: All JCCS information and registration can be accomplished at: https://www.jccs.gov/jccscoe/.

3. All Offerors shall be registered in JCCS registration at time of quote submission. Offerors may have a pending account at the time of quote submission; however, in order to be eligible for award, all offerors shall be APPROVED in JCCS. In addition, all subcontractors at all tiers shall be registered in JCCS at the time of quote submission and must be approved in JCCS at the time of award.

4. A “subcontractor” is identified as any supplier, distributor, vendor, or firm (company) that furnishes supplies or services to or for a prime contractor, or for another subcontractor.

5. Subcontractors: The Offeror shall submit a listing of all proposed subcontractors, at all tiers, to the

KO at the time of quote submission. If the Offeror will not use subcontractors to perform during the life of the contract, the Offeror shall submit a negative response to the Contracting Officer at the time of quote submission. Failure of the Offeror or the subcontractor to be registered in JCCS, REVISION - As of June 19, 2020 Page 13 failure to provide the names of all subcontractors, or failure of the Offeror to provide a negative reply will deem the Offeror nonresponsive and ineligible for award. All Offerors and subcontractors must be approved in JCCS in order to receive award. A status of “pending approval” in JCCS is not sufficient for award. Contractors are ultimately responsible for their status in JCCS and for rectifying issues, such as missing documentation, prior to quote submission.

6. All offerors, including subcontractors at all tiers, must input current and authentic copies of the following documents into JCCS to complete the JCCS registration process:

a. Country business license

b. Tax Identification (ID) certificate

c. CAGE Code (or NATO CAGE Code)

d. National ID or Passport copies for key management personnel and ownership

e. CENTCOM Eligibility section of vendor profile completed

C. Host Nation Taxes: The United States Government is exempt under Kuwait Law and does not pay Host Nation taxes.

D. Security Requirements: Contractor personnel performing work under this contract must be able to gain unescorted access to the Kuwait installation.

E. The Contractor shall ensure that employees meet the guidelines issued by the United States and Kuwait Government’s Labor Laws regarding Host Country Nationals (HCN’s) employment.

F. The Contractor’s employees shall not bring into nor remove from any Government installation any contraband material.

G. The Contractor shall comply with all local laws, ordinances, and regulations and shall obtain and pay for all necessary permits and licenses required to operate in Kuwait.

H. The Contractor shall review and comply with all of the requirements found in the appropriate DOD Foreign Clearance Guide (FCG)- see https://www.fcg.pentagon.mil/ This guide contains information on USCENTCOM/Kuwait General Entry Requirements, Aircraft Entry Requirements, Personnel Entry Requirements for Official Travel, Personnel Entry Requirements for Leave Travel, Ship Entry Requirements, and Travel Information. DoD Directive 4500.43E, DoD Foreign Clearance Program (FCP) requires DoD sponsored contractors to comply with guidance provide therein. While this site is .mill.gov domain-restricted and for official use only, DoD contractors supporting DoD contracts may request a user name and password at the webpage above. The FCG also contains key POC information.

I. Sexual Assault and Sexual Harassment Policy. The Contractor shall ensure all employees comply with the Sexual Assault and Sexual Harassment Policy outlined below.

1. Policy. The Department of Defense has adopted a policy to prevent sexual assault and sexual harassment. Contractors and contractor employees in the United States Central Command (CENTCOM) Area of Responsibility (AOR) shall not –

a. Commit acts of sexual assault against any person on any camp, post, installation, or other United States enclave within the CENTCOM AOR; or

b. Sexually harass any person on any camp, post, installation, or other United States enclave within the CENTCOM AOR.

REVISION - As of June 19, 2020 Page 14

2. Sexual Assault and Sexual Harassment Policy Definitions.

a. As used in this policy – “Sexual Assault” means – A crime defined as intentional sexual contact, characterized by use of force, physical threat or abuse of authority or when the victim does not or cannot consent. Sexual assault includes rape, nonconsensual sodomy (oral or anal sex), indecent assault (unwanted, inappropriate sexual contact or fondling), or attempts to commit these acts. Sexual assault can occur without regard to gender or spousal relationship or age of victim.

b. “Consent” will not be deemed or construed to mean the failure by the victim to offer physical resistance. Consent is not given when a person uses force, threat of force, or coercion or when the victim is asleep, incapacitated, or unconscious.

c. Sexual Harassment” means – Gender discrimination that involves unwelcomed sexual advances, requests for sexual favors and other verbal or physical conduct of a sexual nature between the same or opposite sex genders when such conduct has the purpose or effect of unreasonably interfering with an individual’s work performance or creates an intimidating, hostile, or offensive working environment. Categories of sexual harassment are:

d. Verbal – Examples include telling sexual jokes; using sexually explicit profanity, threats, sexually oriented cadences, or sexual comments; whistling in a sexually suggestive manner; and describing certain attributes of one’s physical appearance in a sexual manner.

e. Nonverbal – Examples include staring at someone, blowing kisses, winking, or licking one’s lips in a suggestive manner. The term may also include printed material (for example, displaying sexually oriented pictures or cartoons); using sexually oriented screen savers on one’s computer; or sending sexually oriented notes, letters, faxes or email.

f. Physical Contact – Examples include touching, patting, pinching, bumping, grabbing, cornering, or blocking a passageway; kissing; and providing unsolicited back or neck rubs.

3. Sexual Harassment Policy Compliance, Contractor Requirements.

a. The Contractor shall conduct training of all employees initially and annually to prevent sexual assault and sexual harassment. This training must, at a minimum, ensure that all the Contractor employees understand the sexual harassment policy and definitions outlined in the SOW.

b. The contractor shall provide the Contracting Officer with the following information at a minimum: employee’s name, civil identification number and date trained. Proof of Sexual Harassment Policy Compliance.

1). Initially: The employee training is due within five (30) days after initial contract award.

2). Annually: Each employee’s compliance with this training requirement shall be reported to the Contracting Officer annually.

3). New employees: Training is due prior to new employees being allowed on the installation.

c. Notification. The Contractor shall inform the Contracting Officer immediately of a sexual harassment occurrence.

d. Subcontracts. The prime contractor shall incorporate the sexual harassment section of the SOW in all subcontracts.

REVISION - As of June 19, 2020 Page 15

J. OPSEC Security Requirements

1. Requirement for OPSEC training. Per AR 530-1 Operations Security, the contractor employees must complete Level I OPSEC Awareness training. New employees must be trained within 30 calendar days of their reporting for duty and annually thereafter.

2. AT level 1 training (general): AT Level I training. This standard language is for contractor employees with an area of performance within an Army controlled installation, facility or area. All contractor employees, to include subcontractor employees, requiring access Army installations, facilities and controlled access areas shall complete AT Level I awareness training within 30 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee, to the COR or to the contracting officer, if a COR is not assigned, within 5 calendar days after completion of training by all employees and subcontractor personnel. AT level I awareness training is available at the following website:

http://jko.jten.mil

3. AT awareness training for US based contractor personnel traveling overseas: AT Awareness

Training for Contractor Personnel Traveling Overseas. This standard language required US based contractor employees and associated sub-contractor employees to make available and to receive government provided area of responsibility (AOR) specific AT awareness training as directed by AR 525-13. Specific AOR training content is directed by the combatant commander with the unit ATO being the local point of contact.

4. Army Training Certification Tracking System (ATCTS) registration for contractor employees who require access to government information systems. All contractor employees with access to a government info system must be registered in the ATCTS (Army Training Certification Tracking System) at commencement of services, and must successfully complete the DOD Information Assurance Awareness prior to access to the IS and then annually thereafter.

5. Information assurance/information technology training. For information assurance

(IA)/information technology (IT) training. All contractor employees and associated sub-contractor employees must complete the DoD IA awareness training before issuance of network access and annually thereafter. All contractor employees working IA/IT functions must comply with DoD and Army training requirements in DoD 8570.01, DoD 8570.01-M and AR 25-2 within six months of appointment to IA/IT functions

6. Contract requiring performance or delivery in a foreign country. For Contract Requiring

Performance or Delivery in a Foreign Country, DFARS Clause 252.225-7043, Antiterrorism/Force Protection for Defense Contractors Outside the US. The clause shall be used in solicitations and contracts that require performance or delivery in a foreign country. This clause applies to both contingencies and non-contingency support. The key AT requirement is for non-local national contractor personnel to comply with theater clearance requirements and allows the combatant commander to exercise oversight to ensure the contractor’s compliance with combatant commander and subordinate task force commander policies and directives.

7. Handling/Access to Classified Information: For contracts that require handling or access to classified information. Contractor shall comply with FAR 52.204-2, Security Requirements. This clause involves access to information classified “Confidential,” “Secret,” or “Top Secret” and requires contractors to comply with— (1) The Security Agreement (DD Form 441), including the

REVISION - As of June 19, 2020 Page 16

National Industrial Security Program Operating Manual (DoD 5220.22-M); (2) any revisions to DOD 5220.22-M, notice of which has been furnished to the contractor

8. Threat Awareness Reporting Program: Threat Awareness Reporting Program. For all contractors with security clearances.