Attachment 1 - Statement of Work (SOW).pdf
PDF 2 MB Posted
- Attached to
- Up to 6-Month Lease of 81 MFDs for Bahrain
- Solicitation number
- SP700026Q1011
- Issued by
-
Defense Logistics Agency
About this file
Performance Work Statement Summary
This Performance Work Statement (PWS) outlines the Defense Logistics Agency's (DLA) requirements for leasing A3 Multifunctional Devices (MFDs) with associated services for a six-month period in support of Bahrain operations (ONE-Net). The contract covers equipment procurement, delivery, installation, training, maintenance, and removal of multifunction copiers/printers/scanners located outside the contiguous United States (OCONUS). Nine device line item numbers (CLINs 0001-0009) are specified across volume bands ranging from VB-1NM to VB-5NM, with estimated monthly impressions from 3,000 to 70,000 for monochrome and color functions combined.
All devices must meet stringent security and operational requirements, including FIPS 140-2 encryption compliance, CAC/PIV card enablement, removable hard drives with locking mechanisms for classified systems, and adherence to DISA Security Technical Implementation Guides. Devices must support IPv4, IPv6, and hybrid network configurations with analog fax capability (NIPR only), secure scanning to multiple destinations, and print resolution minimums of 600 x 600 DPI for copying and 1,200 x 1,200 DPI for printing. The contractor must provide on-site training within five business days, maintain 95% monthly device availability with two-hour response times for work stoppages in non-remote areas and four-hour response times in remote areas, deliver consumable supplies within three business days, and manage device removal within thirty days of contract expiration. All proposed devices require testing and approval by DLA Information Operations EMS Division within twenty business days of award, with additional 130-day approval timelines required for OCONUS Navy Enterprise Network integration. The contractor must supply Enterprise Management Tools using SNMP V3 monitoring, provide equipment with current ISO/IEC 15408 Common Criteria certification, and comply with NIST Special Publication 800-61 supply chain risk management standards.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| Attachment 4 - SOW Compliance Form.pdf | ||
| Attachment 3 - Schedule of Supplies and Services.xlsx | XLSX spreadsheet | |
| Attachment 2 - Device List Locations.xlsx | XLSX spreadsheet | |
| RFQ SP700026Q1011.pdf | ||
| Attachment 5 - Full Text Provisions.pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
14. Include a printed operator’s manual, in English, for each device.
15. Default to:
a. Automatically go into sleep mode after 20 minutes of inactivity
b. Automatically go into hibernation after an hour of inactivity.
c. Print duplex (2‐sided).
d. Print in gray scale on both monochrome and color MFDs
e. “Draft” quality printing rather than “high” quality printing
f. Display all information in English.
| B. Devices | shall | meet | the | following | security | requirements: | |||||
| 1. Devices | with | hard | drives | shall | have | an | encryption | or | overwrite | Security | Kit. |
| 2. Only | CLASSIFIED | designated | devices | shall | be | placed | on | the Secret | Internet | Protocol | Router | |||||
| Network | (SIPRNet). | All | CLASSIFIED | designated | devices | shall | include | a | removable | hard | drive. | A | ||||
| removable | hard | drive | is | a | hard | drive | the | end‐user | may | easily | remove, | and | reinsert | into | the | device |
| on | a | recurring | basis. | All | devices | with | removable | hard | drives | shall | have | a | locking | mechanism | to | |
| secure | the | hard | drive. |
| 3. All | Universal | Serial | Bus | (USB) | ports/memory | card | slots | on | the | devices | shall | be | disabled | when | |
| delivered | except: | the | printer | port | used | to | connect | the | device | to | a | single | computer; | Common | Access |
| Card | (CAC) | readers; | and | any | USB | ports | needed | for | servicing/maintaining | equipment. | Additionally, | ||||
| unused | ports, | protocols | and | services | on | each | device | shall | be | able | to | be | enabled/disabled | by | the |
| local | IT | administrator. |
| 4. All | devices | shall | have | a | secure | scanning | functionality | that | complies | with | Federal | Information | ||||||
| Processing | Standard | (FIPS) | 140‐2 | encryption | with | routing | and | full | integration | to | standard | network | ||||||
| infrastructure | destinations, | which | include: | Scan‐to‐Email, | Scan‐to‐Folder, | Scan‐to‐Network, | Scan‐ | |||||||||||
| to‐Server | and | Scan‐to‐PC. | Scanned | documents | shall | be | made | available | as | a | TIFF, | JPEG | and | as | a | |||
| file | format. | The | default | scan | resolution | shall | be | 300 | x | 300 | DPI. | The | default | scan | output | file | type | |
| shall | be | PDF. | Devices | shall | have | Optical | Character | Recognition | (OCR) | in | order | to | process | and | ||||
| produce | text‐searchable | documents | to | the | scan | destination. | Note: | Full | integration | does | not | mean | ||||||
| scanning | to | proprietary | back‐end | content, | document | or | records | management | systems | to | support | |||||||
| customized | indexing | or | metadata | requirements. |
| 5. All | Non‐Classified | Internet | Protocol | Router | (NIPR) | devices, | volume | bands | 1‐5, | shall | have | analog | fax | |
| only. | Note: | The | analog | fax | function | shall | be | configured | to | separate/isolate | the | fax | controller | from |
| the | network | controller. | SIPR | devices | shall | NOT | have | fax | capability. |
6. All devices shall have:
| a. CAC/Personal | Identity | Verification | (PIV) | enablement | in | order | to | secure | the | device | from | ||
| unauthorized | use | and | shall | have | a | “Secure | Print” | feature | that | allows | end‐users | to | use |
| authentication | credentials | (ex. | ID, | Login) | and | password | identification | (PIN) | to | release | jobs | ||
| on | the | device. |
| b. Print | on‐demand | solution | (e.g., | equivalent | to | “Follow | Me,” | “Follow | You,” | “Push” | or | “Pull” | ||
| printing) | that | shall | allow | end‐users | to | release | output | on | any | device | on | the | network. |
III. SPECIFICATIONS:
| A. In | addition | to | the | features/capabilities/configurations | set | forth | in | section | II | (outlined | above), | the |
| Contractor | shall | provide | all | devices | in | accordance | with | the | chart | below: |
| analyst | support | and | appropriate | digital | cards/products | to | successfully | connect | devices | to | DLA |
| customers’ | networks. |
| 3. Upon | completion | of | device | delivery, | the | Contractor | shall | obtain | customer | signature | and | date | on | |||
| each | bill | of | lading | (BOL) | or | packing | slip, | and | provide | this | proof | of | delivery | to | the | designated |
| Contracting | Officer | Representative | (COR) | within | ten | (10) | business | days | after | delivery. | The | |||||
| Contractor | shall | also | provide | the | Installation | Report | (Appendix | #1) | or | a | modified | delivery | schedule | |||
| with | serial | numbers | added | to | the | designated | COR | within | ten | (10) | business | days | after | |||
| delivery | and | installation | have | been | completed. |
| 4. If | a | device | cannot | be | delivered | and | installed | within | the | delivery | time | that | is | given, | the | Contractor |
| shall | notify | the | issuing | Contracting | Officer | as | soon | as | the | delay | is | realized, | of | the | expected | delivery |
| date | for | the | ordered | device(s). |
| 5. Regardless | of | installation | date, | all | devices, | including | replacement | devices, | shall | maintain | a | co‐ |
| terminus | Period | of | Performance | (PoP). |
| 6. Upon | installation, | the | Contractor | shall | affix | on | each | device | a | sticker | with | the | following | information: | |||||
| manufacturer’s | name, | model | number, | device | serial | number | and | toll‐free | telephone | number(s) | to | ||||||||
| place | service | maintenance | calls | and | order | consumable | supplies. | Additionally, | the | Contractor | shall | ||||||||
| add | the | PoP | end | date | to | DLA | EMS | sticker | and | affix | to | device. | (DLA | shall | provide | the | DLA | EMS |
stickers.)
7. The Contractor shall provide English‐speaking personnel at the toll‐free number(s) provided.
V. TRAINING
A. The Contractor shall provide on‐site training, in English, as specified in the contract, to end‐users.
| B. The | Contractor | shall | coordinate | directly | with | each | command’s | POC | listed | on | the | contract | to | establish |
| the | training | schedule. |
C. Training shall include the following:
1. How to operate the basic function keys of the device.
2. How to operate special features including duplexing, enlargements, reductions, and multiple job queues.
3. Diagnosis and resolution of basic device malfunctions, including paper jams.
4. Location and procedures for installing consumables such as paper, toner, staples, etc.
| D. The | Contractor | shall | submit | a | Summary | of | On‐Site | Training | Report | (Microsoft | Excel | format), | listing | |||
| device | serial | number, | personnel | trained | and | date | training | was | completed, | to | the | designated | COR | within | ||
| five | (5) | business | days | of | training | completion. | Initial | invoice | payment | shall | not | be | released | until | this | |
| report | is | received. |
| E. In | addition | to | on‐site | training, | the | Contractor | shall | provide | a | quick | reference | desk | guide | (single | sheet, | |||
| 8.5” | x | 11” | paper | size, | laminated, | full | color | and | able | to | be | easily | stowed | away | with | the | device). | The |
| contractor | shall | also | provide | a | CD‐ROM/DVD | and/or | web‐based | training | (URL | printed | on | a | sticker | to | ||||
| be | placed | on | the | front | of | the | device) | to | serve | as | follow‐up | training. |
VI. MAINTENANCE
A. Service
| 1. The | Contractor | shall | maintain | each | device | at | a | minimum | 95% | monthly | available | rate. | Maintaining |
| the | devices | includes: |
a. Preventive maintenance
b. Service calls
c. Repairs
d. Troubleshooting
e. Connectivity
f. All associated labor and travel
| 2. If | a | malfunction | cannot | be | corrected | during | the | initial | service | call, | the | Contractor | shall | resolve | all |
| issues | no | later | than | ten | (10) | calendar | days | from | date | of | initial | service | call. |
| 3. The | Contractor | shall | provide | English | speaking | service | technician | support | Monday | through | Friday | ||
| from | 8:00 | a.m. | – | 4:30 | p.m. | local | time, | with | the | exception | of | Federal | holidays. |
| 4. Service | for | Non‐Remote | Areas: | Non‐Remote | Areas | are | defined | as | service | locations | being | within | a | |||
| fifty | (50) | mile | radius | commute | of | a | metropolitan | area, | which | for | the | purpose | of | this PWS | is | defined |
| as | a | statistical | area | with | a | population | of | 50,000 | persons | and | above. | For | service | in | non‐remote |
areas:
| a. The | Contractor | shall | respond | to | work | stoppage | situations | within | two | (2) | business | hours | of | ||||
| a | service | call. | Work | stoppage | is | defined | as | a | required | function | of | the | device | (printing, | |||
| copying, | scanning | or | faxing) | is | non‐operational. | A | telephone | call | (unless | it | results | in | solving | ||||
| the | problem) | shall | not | be | deemed | an | acceptable | service | response. | The | service | technician | shall | ||||
| call | the | end‐user | within | an | hour | to | discuss | the | service | problem | and | time | of | arrival. | It | is | |
| estimated | that | 10% | of | service | calls | shall | be | classified | as | “work | stoppage” | across | the | total | |||
| device | population | on | a | yearly | basis. |
| b. The | Contractor | shall | respond | to | non‐work | stoppage | situations | within | four | (4) | business | |||||
| hours | of | a | service | call. | Non‐Work | stoppage | is | defined | as | a | required | function | of | the | device | |
| (printing, | copying, | scanning | or | faxing) | is | degraded. | A | telephone | call | (unless | it | results | in | |||
| solving | the | problem) | shall | not | be | deemed | an | acceptable | service | response. | The | service | ||||
| technician | shall | call | the | end‐user | within | an | hour | to | discuss | the | service | problem | and | time | of |
arrival.
| 5. Service | for | Remote | Areas: | Remote | Areas | are | defined | as | service | locations | being | beyond | a | fifty | |
| (50) mile | radius | commute | of | a | metropolitan | area. | For | service | in | remote | areas: |
| a. The | Contractor | shall | respond | to | work | stoppage | situations | within | four | (4) | business | hours | of | |||||
| a | service | call. | A | telephone | call | (unless | it | results | in | solving | the | problem) | shall | not | be | deemed | an | |
| acceptable | service | response. | The | service | technician | shall | call | the | end‐user | within | an | hour | to | |||||
| discuss | the | service | problem | and | time | of | arrival. | It | is | estimated | that | 10% | of | service | calls | shall | be | |
| classified | as | “work | stoppage” | across | the | total | device | population | on | a | yearly | basis. |
| b. The | Contractor | shall | respond | to | non‐work | stoppage | situations | within | eight | (8) | business | |||||||
| hours | of | a | service | call. | A | telephone | call | (unless | it | results | in | solving | the | problem) | shall | not | be | |
| deemed | an | acceptable | service | response. | The | service | technician | shall | call | the | end‐user | within | ||||||
| an | hour | to | discuss | the | service | problem | and | time | of | arrival. |
| 6. In | the | case | of | devices | cleared | for | CLASSIFIED | material, | the | Contractor’s | repair | technicians | shall | ||
| have | a | Department | of | Defense | (DoD) | security | clearance | equal | to | or | higher | than | the | classification | of |
| the | device | and | be | able | to | provide | verification | when | requested. |
| 7. The | Contractor | shall | be | responsible | for | all | damages | due | to | normal | wear | and | tear | and | loss | or |
| damage | caused | by | the | Contractor | or | its | agents. |
| 8. If | a | device | is | determined | to | be | non‐repairable, | to | include | damaged | devices, | the | Contractor | shall |
| inform | the | designated | COR | within | two | (2) | business | days | of | making | this | determination. | The | |
| Contractor | shall | deliver | and | install | a | comparable | replacement | device | within | fifteen | (15) | calendar | ||
| days | from | written | notification | from | the | Contracting | Officer. |
B. Consumable Supplies
| 1. The | Contractor | shall | provide | all | consumable | supplies | (including | staples) | necessary | for | the |
| operation | of | the | devices. | Paper | is | excluded | as | a | consumable | supply. |
| 2. The | Contractor | shall | deliver | all | required | consumable | supplies | to | the | designated | locations | listed | on | ||
| the | delivery | schedule | identified | on | the | contract, | within | three | (3) | business | days | after | receipt | of | a |
| request | for | supplies. |
IX. DEVICE REMOVAL
A. For device removal, the Contractor shall:
| 1. Remove | all | devices | and | associated | supplies | within | thirty | (30) | calendar | days | of | contract | expiration |
| or | receipt | of | a | modification | signed | by | the | Contracting | Officer. |
2. Notify the issuing Contracting Officer as soon as any delay in device removal is realized.
| 3. Prior | to | device | removal, | remove | all | hard | drives | and | surrender | them | to | DLA | (or | its | assignee). | Upon |
| completion | of | the | hard | drive | removal, | the | Contractor | shall | obtain | the | required | signatures | on | both | ||
| the | Removal/Relocation | Report | (Appendix | #2) | and | the | MFD | Hard | Drive | Removal | Record | (Appendix | ||||
| #3). | After | the | hard | drive | has | been | removed, | ALL | classification | stickers | shall | be | removed | prior | ||
| to | device | removal/disposal. |
| 4. The | Government | reserves | the | right | to | withhold | final | payment | if | all | devices | are | not | removed | from |
| the | premises | within | thirty | (30) | calendar | days | of | contract | expiration | or | termination. |
| 5 5. Be | subject | to | payment | of | all | disposal | fees | incurred | by | the | Government | for | any | devices | not | removed |
| within | thirty | (30) | calendar | days | of | termination | or | expiration. | After | this | time | period, | the | devices | ||
| will | be | considered | abandoned. |
X. REPORTS
A. The Contractor shall provide the following reports:
1. Installation Report, as referenced in section IV.A.3.
2. Summary of On‐Site Training Report, as referenced in section V.D.
| 3. Device | Listing | Report | (Microsoft | Excel | format) | shall | be | submitted | via | Wide | Area | Work | Flow | ||||
| (WAWF) | to | the | COR | with | the | monthly | invoice. | The | report | shall | contain | an | accurate | listing | of | all | |
| devices | under | contract | (model, | serial | number, | location). |
4. Removal/Relocation Report, as applicable, as referenced in section VII.A.6 and IX.A.
| B. Upon | request, | the | Contractor | shall | provide | the | following | reports | within | 5 | business | days, | at | no | cost | to |
| the | Government: |
1. Usage Report (Appendix #4) shall be submitted to the COR and the Contracting Officer.
| 2. Response | Time | Report | shall | be | submitted | to | the | COR | and | the | Contracting | Officer. | This | report | shall | |||
| identify | the | technician’s | response | time, | defined | as | the | time | between | when | the | service | call | is | placed | |||
| and | when | the | technician | arrives | onsite | to | repair | the | equipment. | If | the | issue | is | able | to | be | resolved | |
| on | the | phone, | the | response | time | shall | be | defined | as | the | time | the | service | call | was | placed | and | when |
| the | issue | was | resolved | over | the | phone. |
| 3. Device | Downtime | Report | shall | be | submitted | to | the | COR | and | the | Contracting | Officer. | This | report | |
| shall | identify | the | time | the | equipment | was | inoperable/non‐functional. | Downtime | is | defined | as | the | |||
| time | the | service | call | is | placed | notifying | the | Contractor’s | representative | that | the | equipment | is | ||
| inoperable/non‐functional | or | when | the | technician | begins | service | on | the | equipment | if | the | device | is | ||
| operable/functional | upon | arrival. | In | addition, | the | report | shall | include | information | relative | to | the | |||
| frequency | of | service | calls, | production | volume | between | service | calls, | types | of | repairs, | as | well | as | |
| parts | required. |
| 4. Device | Uptime | Report | shall | be | submitted | to | the | COR | and | the | Contracting | Officer. | This | report | shall | |
| identify | the | time | the | equipment | was | operable | and | available | and | will | be | used | to | verify | the | required |
| minimum | 95% | monthly | available | rate, | as | outlined | in | section | VI.A.1. |
XI. INVOICING
| A. All | invoices | shall | be | submitted | with | the | Device | Listing | Report | via | Wide | Area | Work | Flow | (WAWF) |
| and | shall | be | submitted | in | United | States | Dollars. | The | following | website | provides | additional |
| information | regarding | WAWF | including | information | for | “vendors | getting | started” | with | the | system: |
| https://wawf.eb.mil/xhtml/unauth/help/help.xhtml. |
XII. NETWORK FUNCTIONALITY
| A. DoD | policy | prohibits | the | publication | of | network | configuration | information; | therefore, | DoD | |||
| installations | shall | not | fill | out | pre‐installation | site | surveys. | The | required | information | shall | be | |
| provided | at | time | of | installation. |
| B. The | Contractor | shall | provide | devices | that | shall | operate | on | and | coexist | on | a | network | supporting | all | of |
| the | following: |
1. Internet Protocol Version 4 (IPv4),
2. Internet Protocol Version 6 (IPv6),
3. A hybrid of IPv4 and IPv6.
C. Support shall be provided for network configurations based on agency hardware/software.
XIII. NETWORK SECURITY
| A. The | Contractor | shall | provide | devices | that | can | be | configured | to | comply | with | the | current | Defense |
| Information | Systems | Agency | (DISA) | Security | Technical | Implementation | Guide | (STIG) | titled | |||||
| Multifunction | Device | and | Network | Printer | STIG | (latest | version | and | release), | available | at: |
https://cyber.mil/.
| B. Contractors | shall | monitor | industry | standard | vulnerability | sites | (e.g. | http://nvd.nist.gov/, | |||||||||
| https://www.us‐cert.gov/ncas/alerts, | http://oval.mitre.org/) | and | take | appropriate | actions | if | their | ||||||||||
| equipment | is | subject | to | a | known | vulnerability. | When | vulnerabilities | are | identified | by | the | Contractor, | ||||
| DLA | or | its | customers, | the | Contractor | shall | provide | remediation | for | distribution | to | all | installed | ||||
| equipment | in | accordance | with | USCYBERCOM | TASKORD | regulations | unless | a | different | time | period | is | |||||
| directed | by | USCYBERCOM | via | DLA. | The | TASKORD | is | For | Official | Use | Only. | The | following | is | authorized | ||
| to | be | quoted | from | the | TASKORD | for | reference: |
| 1. Assured | Compliance | Assessment | Solution | (ACAS) | assigns | severity | scores | of | critical, | high, | medium |
| and | low | to | plug‐in | findings. |
| a. Critical | findings | reflect | discovery | of | a | common | vulnerability | and | exposure | (CVE) | that | poses | |
| significant | risk | to | the | confidentiality, | integrity, | and | availability | of | DODIN | Networks. | Actions | to | |
| mitigate | or | remediate | critical | vulnerabilities | shall | be | initiated | upon | discover | with | the | goal | of |
| mitigation/remediation | within | seven | (7) | calendar | days. |
| b. Findings | with | a | severity | score | of | high | shall | be | addressed | in | the | same | manner | as | vulnerabilities |
| addressed | via | Information | Assurance | Vulnerability | Alert | (IAVA) | directives | and | mitigated | or | |||||
| remediated | within | twenty‐one | (21) | calendar | days | of | discovery. |
| c. Findings | with | severity | scores | of | medium | and | low | shall | be | addressed | in | accordance | with | local |
| Approving | Official | (AO), | Information | System | Security | Manager | (ISSM), | or | Information | System | ||||
| Security | Officer | (ISSO) | guidance | until | further | notice. |
| d. In | all | instances, | DoD | components | shall | consider | exposure | to | threat, | mission | impact, | sensitivity |
| of | data, | and | current | mitigating | security | controls | when | prioritizing | implementation | of | fix |
actions.
| C. In | the | event | remediation | cannot | be | achieved | within | the | mandated | timeline, | the | Contractor | shall | ||
| provide | a | Plan | of | Action | and | Milestones | and | receive | approval | thereof | by | the | Customer’s | agency | |
| Authorizing | Official | or | designee | for | risk | acceptance. |
| D. All | devices | shall | be | International | Organization | for | Standardization | (ISO)/International | Electrotechnical | ||
| Commission | (IEC) | 15408 | (Common | Criteria) | certified | IAW | CNSSP‐11 | using | the | National | Information |
| Assurance | Partnership | (NIAP) | approved | criteria | . |
1. A device shall be acceptable if it is included on either the NIAP CCEVS Product Compliant List (https://www.niap‐ccevs.org/Product/)
| 2. All | devices | shall | have | current | ISO/IEC | 15408 | certification | and | recertification, | if | applicable, | before | ||
| the | Contractor | can | schedule | lab | time. | See | section | XIV. | Guidance | for | Common | Criteria | Maintenance | |
| and | Reevaluation | is | available | at: | https://www.niap‐ |
ccevs.org/documents and guidance/ccevs/scheme‐pub‐6.pdf
| E. All | devices | shall | be | capable | of | obtaining | accreditation | through | the | Risk | Management | Framework | (RMF) | |||
| for | DoD | Information | Technology | (IT). | As | part | of | this, | the | Contractor | agrees | to | provide | all | requested | |
| information | and | work | in | good | faith | with | DLA | so | the | DLA | customers | can | expeditiously | obtain | RMF | |
| accreditation | prior | to | device | delivery | and | installation. | The | Contractor | shall | also | provide | devices | for | |||
| vulnerability | and | STIG | testing | to | DLA | or | customer’s | site. | The | Contractor | further | agrees | that | if | the | |
| proposed | device(s) | does | not | obtain | RMF | accreditation, | the | contractor | shall | remove | the | device(s). | ||||
| Information | regarding | RMF | is | found | in | Risk | Management | Framework | (RMF) | for | DoD | Information | ||||
| Technology | (IT) | Instruction | 8510.1 | dated | 12 | March | 2014: | |||||||||
| http://www.dtic.mil/whs/directives/corres/pdf/851001 2014.pdf. | In | order | to | maintain | RMF | and | ||||||||||
| STIG | compliance, | devices | are | required | to | have | the | most | up‐to‐date | firmware, | out | outlined | in | section |
II.A.10.
| F. The | Contractor | shall | supply | a | SMARTCARD | Public | Key | Infrastructure | (PKI) | Solution | which | is | compliant | |||
| with | DODI | 8520.03 | and | NIST | FIPS | 201 | (PIV) | standards. | The | contractor | shall | provide | card | readers | that | |
| shall | read | and | process | all | approved | CAC | and | PIV | cards. | The | Contractor | shall | maintain | compliance | with | |
| DoD‐wide | SMARTCARD | and | DoD | PKI | standards, | and | support | all | approved | physical | cards | during | the | full | ||
| lease | period. |
| G. The | contractor | shall | provide | a | SMARTCARD | PKI | Solution | with | SIPRNet | token | capability, | which | is | |||
| compliant | with | DoD | requirements | for | PK‐enabling | and | interoperability | as | set | forth | in | DODI | 8520.02. | |||
| The | Contractor | shall | provide | card | readers | that | shall | read | and | process | all | approved | SIPRNet | token | ||
| cards. | The | Contractor | shall | provide | device | support | systems | that | incorporate | the | use | of | PKI | for | ||
| encryption | of | information | in | transit | or | at | rest. | The | Contractor | shall | provide | devices | that | are | compatible | |
| with | 3.3 | volt | SafeNet | SC650 | token | and | that | are | compatible | with | the | 90Meter | Middleware | solution | for | |
| CAC, | known | as | CAC | Smart | Card | Manager‐90. | The | Contractor | shall | maintain | compliance | with | DoD | wide | ||
| SIPR | and | DoD | PKI | standards, | and | support | all | approved | physical | cards | and | firmware | during | the | full | |
| lease | period. | For | current | DODI | instructions | go | to: |
http://www.dtic.mil/whs/directives/corres/ins1.html.
| H. The | Contractor | shall | ensure | that | CAC/SIPR | token | authentication | is | available | for | scanning, | printing | and |
| copying | and | shall | be: |
1. Capable of digitally signing emails using the senders DoD PKI Certificate(s).
2. Capable of encrypting emails using the receivers DoD PKI Certificate(s).
3. Capable of scan to file on networked devices.
4. In compliance with Homeland Security Presidential Directive‐12 (HSOP‐12).
I. The Contractor shall produce certificates of compliance, if requested.
XIV. TESTING
| A. Unless | previously | tested | and | approved | by | DLA, | all | devices | proposed | in | response | to | the | contract | shall | be |
| tested | for | compliance | with | Network | Security | as | defined | in | section | XIII | after | award. |
| B. The | estimated | time | for | testing | is | twenty | (20) | business | days. | Testing | and | approval | shall | be | performed | |
| by | the | DLA | Information | Operations | EMS | Division | in | conjunction | with | the | Contractor’s | assistance. | The | |||
| Contractor | shall | provide | onsite | engineering | assistance | and | other | support | necessary | to | configure, | setup, | ||||
| and | test | the | equipment | as | needed. |
| 1. DLA | has | agreements | with | our | DoD | customers | to | test | devices | to | meet | DoD | RMF | and | STIG |
| Compliance. | If | all | devices | pass | the | preliminary | testing | process, | DLA | shall | submit | a | compliance | ||
| memorandum | to | the | Contractor | informing | them | that | the | devices | have | passed | the | preliminary | |||
| testing | process. | In | some | cases, | prior | to | being | added | to | the | DLA | customer’s | network, | additional | |
| certification | procedures | and | testing | shall | be | required | prior | to | risk | acceptance. | If | required | by | DLA, | |
| the | Contractor | shall | deliver | test | devices | to | the | DLA | customer | prior | to | proceeding | with | installation. | |
| DLA | shall | exercise | due | diligence | to | assist | with | technical | mitigation | and | resolve | any | questions and/ | ||
| or | concerns | raised | by | that | agency | during | the | testing | review | process. |
| 2. For | devices | ordered | to | be | installed | on | OCONUS | Navy | networks, | the | Contractor | shall | provide | |
| networked | equipment | that | shall | be | tested | to | operate | Outside | the | Contiguous | United | States | ||
| (OCONUS) | Navy | Enterprise | Network | (ONE‐Net) | for | the | "printer, | scanner | and | fax" | functions. | This | ||
| equipment | shall | be | accredited | to | operate | and | added | to | the | ONE‐Net | Approved | Products | List | (APL) |
| prior | to | the | delivery | of | devices. The ONE-Net approval process requires an estimated additional |
130 days.
| 3. If | the | devices | do | not | pass | any | of | the | testing | procedures | for | any | reason, | DLA | shall | not | proceed | with |
| installation | of | said | devices | at | the | customer | locations | and | DLA | shall | terminate | the | contract. |
C. A device shall not be tested if it cannot be assigned to one of the Volume Bands as outlined in section V.
| D. The | devices | shall | be | delivered | with | all | required | accessories, | software, | firmware, | etc. | Output | paper | |
| handling | accessories | are | not | tested | and | shall | not | be | delivered | to | the | lab. |
E. Approved devices previously submitted to DLA for testing are not required to be re‐tested.
| F. The | Contractor | shall | deliver | the | devices | for | each | Volume | Band | series, | under | each | Functional | Area, | to | ||
| DLA | Information | Operations | J67E | located | at | 430 | Mifflin | Avenue, | Building | 430, | New | Cumberland, | PA | ||||
| 17071, | for | testing, | at | no | cost | to | the | government. | Delivery | coordination | shall | take | place | within | five | (5) | |
| business | days | of | contract | award. |
| G. The | Contractor | shall | resolve | non‐compliance | issues | as | quickly | as | possible. | If | the | issues | cannot | be | |||
| resolved | within | fourteen | (14) | calendar | days, | the | test | shall | be | suspended. | After | the | non‐compliance | ||||
| issues | are | resolved | by | the | Contractor, | the | suspended | session | shall | be | scheduled | when | lab | time | is | next | |
| available. | If | requested | by | DLA, | the | Contractor | shall | remove | their | devices | from | the | lab | to | avoid | delaying | |
| the | next | scheduled | test. |
| H. For | all | devices | tested | and | placed | on | the | DLA | contract, | the | Contractor | shall | collaborate | with | the | COR | to |
| develop | the | testing | results | package. | The | Contractor | shall | develop | the | device | Implementation | Guide. | |||||
| The | Implementation | Guide | shall | provide | step‐by‐step | instructions | and | screenshots | to | configure | the | ||||||
| devices | in | accordance | with | the | testing | results. | Government | acceptance | of | the | Implementation | Guide | is | ||||
| at | the | discretion | of | the | DLA | EMS | Division. |
| I. The | security | requirements | set | forth | in | this | PWS | are | minimum | device | specifications | and | have | been |
| identified | as | the | basic | requirements | common | across | Government | agencies. | These | are | the | minimum | ||
| security | requirements | applicable | to | all | devices | awarded | under | this | contract. | Each | ordering | activity | may | |
| have | its | own | hardware/software | acceptance | processes. | All | devices | shall | be | subject | to | ordering | activity |
| hardware/software | evaluation | processes. | If | the | device | fails | a | security | evaluation, | the | Contractor | may | |||
| select | a | different | technology | or | mitigate | the | failed | controls | to | fulfill | this | requirement. | The | Contractor | |
| shall | be | available | to | meet | with | the | information | technology | (IT) | and | security | personnel | at | a | mutually |
| convenient | time | during | the | evaluation | process, | and | shall | identify | a | mutually | acceptable | solution. | The | ||
| Contractor | shall | provide | the | necessary | equipment | or | expertise | to | complete | security | testing | and | |||
| integration | into | the | existing | environment. | The | customer | agency | may | require | the | Contractor | to | ship | ||
| devices | to | a | specific | location | for | testing | at | time | of | award. |
| J. If, | during | the | life | of | the | contract, | a | requirement | in | section | XII | and | XIII | is | changed, | updated | or | revised, |
| the | Contractor | shall | comply | with | the | most | current | version | of | the | requirement. |
| K. The | Contractor | shall | remove | all | hardware | from | the | DLA | test | lab | within | fourteen | (14) | calendar | days |
| upon | notification | of | test | completion. |
XV. SUPPLY CHAIN RISK MANAGEMENT
| A. As | part | of | its | quote, | the | Contractor | shall | provide | written | documentation | demonstrating | how | the | |||
| integrity | and | security | of | all | equipment, | components | thereof, | repair | parts | and | consumables | it | will | |||
| provide | and/or | use | in | performing | this | contract | will | meet | the | standards | set | forth | in | National | Institute | of |
| Standards | and | Technology | (NIST) | Special | Publication | 800‐61. | This | documentation | shall | clearly | ||||||
| demonstrate | how | the | Contractor | is | taking | effective | measures | to | mitigate | the | risks | of | foreign | |||
| intelligence | services, | terrorist | groups, | or | others | from | inserting | unwanted | functionality | into | the | supplies | ||||
| and/or | services | DLA | receives | through | this | contract. | Additionally, | this | documentation | shall | provide | |||||
| specific | details | of | what— |
| 1. Policies | the | Contractor | has | in | place | to | prevent | both | (a) | the | use | of | counterfeit | or | altered | equipment, |
| components | thereof, | consumables | and | parts | and | (b) | their | introduction | into | the | Contractor’s | supply |
chain;
| 2. Security | procedures | the | Contractor | uses | to | track | the | chain | of | custody | of | equipment, | components | ||
| thereof, | consumables | and | parts, | to | include | while | this | material | is | in | storage | and | in | transit; | and |
| 3. Steps | the | Contractor | takes | to | ensure | the | integrity | and | authenticity | of | new, | refurbished | or |
| remanufactured | equipment, | components | thereof, | repair | parts | and | consumables | to | prevent | ||||
| tampering | so | they | will | perform | according | to | specifications | without | additional | unwanted |
functionality.
| B. The | Contractor | shall | continuously | meet | the | standards | of | NIST | Special | Publication | 800‐61 | while | taking | |
| effective | measures | to | mitigate | the | risks | of | foreign | intelligence | services, | terrorist | groups, | or | others | from |
| inserting | unwanted | functionality | into | the | supplies | and/or | services | provided | through | this | contract. | |||
| Upon | request, | the | Contractor | shall | provide | written | documentation | meeting | all | requirements | set | forth | ||
| in | part | A, | above. |
XVI. ENTERPRISE MANAGEMENT TOOL
| A. The | Contractor | shall | provide | an | Enterprise | Management | Tool | that | manages | devices. | The | |
| management/monitoring | software | tool | shall | reside | within | the | customers’ | network | in | order | to | monitor, |
| manage | and | generate | usage | to | facilitate | continued | fleet | optimization | reports. |
| B. The | Enterprise | Management | Tool | shall | use | SNMP | V3. | The | management | tool | shall | monitor | meter | reads, | |
| volume, | usage, | supply | levels, | and | issue | notifications/alerts | about | device | status. | The | notifications/alerts | ||||
| shall | notify | designated | personnel | when | to | order | consumables | and | request | maintenance/repair |
services.
XVII. INSTALLATION SECURITY REQUIREMENTS
REVISION ‐ As of July 21, 2020
| A. The | Contractor | shall | comply | with | all | rules | and | regulations | to | obtain | Government | installation | access | in |
| order | to | meet | all | response | times | identified | within | the | PWS. |
| B. The | Contractor | shall | comply | with | Government | base | access | requirements | as | set | forth | in | the | base/ |
| command | regulations. |
| C. The | Contractor | shall | be | responsible | for | any | and | all | fees | associated | with | the | application | process | and/or |
| enrollment | to | access | any | installation | or | facility. |
| D. For | devices | cleared | for | CLASSIFIED | material, | the | Contractor’s | repair | technicians | shall | have | a | DoD | ||
| security | clearance | equal | to | or | higher | than | the | classification | of | the | device | and | shall | provide | verification |
| when | requested. | The | contractor’s | repair | technicians | shall | be | escorted | through | all | areas | where | |||
| CLASSIFIED | documents | are | processed. |
| E. Contractor’s | repair | technicians | shall | be | provided | with | ISA | AB | RBAF | badge | or | shall | be | escorted | by | the | ||
| customer | while | on | the | installation. | The | installation | consists | of | four | (4) | gates, | two | of | which | are | manned | ||
| by | the | US | Army | and | two | of | which | are | manned | by | local | government | personnel. | The | local | government | ||
| will | require | the | RBAF | identification. |
XVIII. GENERAL CONDITIONS
| A. The | Contractor | shall | assign | a | single | point | of | contact | (POC) | to | coordinate | with | the | Contracting | Officer | in | ||
| all | aspects | of | this | contract | within | 3 | business | days | of | receipt | of | the | award. | The | Contractor | shall | provide | |
| its | assigned | POC’s | name, | title, | business | address, | phone | number | and | address | to | the | Contracting |
Officer.
| B. The | Contractor | shall | comply | with | the | Health | Insurance | Portability | and | Accountability | Act | (HIPAA) |
| when | installing | devices | at | Government | medical | sites. |
| C. The | Contractor | shall | comply | with | the | Section | 508 | accessibility | requirements. | By | submission | of | its | offer, | ||
| the | Contractor | affirms | that | its | Electronic | Information | Technology | (EIT) | supplies | and | services | are | ||||
| accessible | as | outlined | in | the | law, | the | standard, | and | FAR | Subpart | 39.2. | The | Contractor | shall | complete | the |
| Voluntary | Product | Accessible | Template | (VPAT®) | document | (Appendix | #5). | If | applicable, | Contractors | ||||||
| shall | indicate | where | their | Section | 508 | EIT | compliance | information | is | available | for | review | (e.g., | |||
| Contractor’s | website | or | other | location | the | Contracting | Officer | can | access). | The | Contracting | Officer | may | |||
| require | a | demonstration | of | Section | 508 | compliance | prior | to | award. |
XIX. APPENDICES
A. Appendix #1: Installation Report
B. Appendix #2: Removal/Relocation Report
C. Appendix #3: Hard Drive Removal Record
D. Appendix #4: Usage Report
E. Appendix #5: VPAT® Template
REVISION ‐ As of July 21, 2020
Appendix #3 Equipment Management Solutions Hard Drive Removal Record
Form log number
FY ‐ SEQ#
DLADCSVC ‐ ‐
Contract number
Customer (Agency/Command)
Drive manufacturer and model
Hard drive serial number
MFD serial number
Date removed
Printed name of technician removing hard drive
Signature of technician removing hard drive
Drive classification ☐ Classified (up to Secret) ☐ Unclassified (CUI)
Hard drive disposition
☐ Retained by customer ☐ Shipped to DLA Information Operations
☐ Shipped to NSA
Printed name of EMS Division representative accepting drive for DLA Information Operations or customer accepting drive
Signature of EMS Division representative accepting drive for DLA information Operations or customer accepting drive
Printed name/title of person sanitizing hard drive
Signature of person sanitizing hard drive
Date destroyed
Printed name/title verification after Degaussing and Crushing
Signature for verification after degaussing and crushing
Degausser/crusher location ☐ DSI HD‐1T (Phil) ☐ EM/Garner Model TS‐1 (NOR)
☐ SEM Model 0101(Phil) ☐ SEM Model 0101(NOR)
Post‐Sanitization destination (recycling center)
Contact phone number to degausser operator and verification personnel
File details come from the government source that posted it. Updated .