Attachment 1 - Statement of Work (SOW).pdf
PDF 2 MB Posted
- Solicitation number
- SP700026Q1024
- Issued by
-
Defense Logistics Agency
About this file
This is a Performance Work Statement (PWS) for the lease of A3 Multifunctional Devices (MFDs) and associated services to the Defense Logistics Agency (DLA) for deployment at installations outside the contiguous United States, specifically in Bahrain in support of the ONE-Net initiative, for up to 84 months.
The contractor must provide devices meeting specific technical requirements including simplex/duplex copying, printing, and scanning; automatic document feeders with 30-page minimum capacity; basic inline finishing functions (stacking, collating, multi-position stapling); copy resolution of at least 600 x 600 DPI; print resolution of at least 1,200 x 1,200 DPI; 1 Gigabyte minimum document management memory; support for current desktop and server operating systems; operation on 220 volt 50 Hz AC power; and equipped external surge protectors with five-year manufacturer's warranty. Devices must default to sleep mode after 20 minutes of inactivity, hibernation after one hour, duplex printing, grayscale output, and English language display. All devices require encryption or overwrite security kits, disabled USB ports except for printer and CAC readers, FIPS 140-2 compliant secure scanning functionality with OCR capability, and CAC/PIV enablement with secure print features. Specified volume bands range from 25 to 70 PPM with corresponding monthly impression volumes from 3,000 to 70,000 impressions.
The contractor must deliver and install devices with full operational network connectivity and scanning functionality, obtain customer signatures on bills of lading, and provide Installation Reports within ten business days. On-site training in English must cover basic operation, special features, diagnostics, and consumable installation, with training reports submitted within five business days. The contractor shall maintain a minimum 95% monthly device availability rate, provide English-speaking technician support Monday through Friday 8:00 a.m. to 4:30 p.m. local time, respond to work stoppage situations within two business hours for non-remote areas and four business hours for remote areas, and resolve all malfunctions within ten calendar days of initial service call. All consumable supplies including staples must be delivered within three business days of request, excluding paper. Upon contract expiration or termination, devices must be removed within 30 days with all hard drives surrendered to DLA; failure to remove devices within this timeframe subjects the contractor to payment of government disposal fees and withholding of final payment. The contractor must provide monthly Device Listing Reports via WAWF, Installation Reports, Training Reports, and upon request, Usage Reports, Response Time Reports, Device Downtime Reports, and Device Uptime Reports.
All devices must undergo security testing for compliance with DISA Security Technical Implementation Guide (STIG) standards, be capable of RMF accreditation, and possess current ISO/IEC 15408 Common Criteria certification through NIAP. Devices must support IPv4 and IPv6 network protocols, include CAC/PIV and SIPRNet token authentication capabilities, and comply with DODI 8520.03 and NIST FIPS 201 standards. The contractor must monitor industry vulnerability sites and provide remediation within seven calendar days for critical CVE findings and twenty-one calendar days for high-severity findings. Devices proposed for OCONUS Navy networks must be tested to operate on the ONE-Net and added to the ONE-Net Approved Products List prior to delivery, requiring an estimated additional 130 days. Unless previously tested and approved by DLA, all devices must be tested for network security compliance with an estimated twenty-day testing timeframe at DLA Information Operations in New Cumberland, Pennsylvania at no cost to the government, with coordination required within five business days of contract award. The contractor must provide an Enterprise Management Tool using SNMP V3 to monitor devices, supply chain risk management documentation demonstrating compliance with NIST Special Publication 800-61 standards, and demonstrate measures to prevent counterfeiting and tampering with equipment and consumables.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| Attachment 4 - SOW Compliance Form.pdf | ||
| Attachment 3 - Schedule of Supplies and Services.xlsx | XLSX spreadsheet | |
| RFQ SP700026Q1024.pdf | ||
| Attachment 5 - Full Text Provisions.pdf | ||
| Attachment 2 - Device List Locations.xlsx | XLSX spreadsheet |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
"th services
I. OVERVIEW
A. The Defense Logistics Agency (D Devices for up to 8lmon associated with this lease • •
Bahrain - (ONE-Net).
B. The leased equipment sought are A3 Multifunctional Devices (MFDs ), accessories and office document devices (hereafter collectively referred to as "devices"). Specific details are found in sections II and III.
C. The services associated with the leased - equipment sought are delivery and installation ( section IV), end-user training ( section V), full service maintenance, including all consumable supplies ( excluding paper) ( section VI), removal ( section IX), reports ( section X), network functionality ( section XII). and network security ( section XIII).
II. DEVICES AND CONFIGURATIONS
A. All devices shall meet the following requirements:
1. Simplex/duplex copying, printing, and scanning.
2. Automatic Document Feeder with a 30 page minimum capacity and duplexing.
3. Basic inline finishing functions which include stacking, collating, and multi-position stapling.
4. Operate using at least 30% or greater recycled 20 lb. paper.
5. Free-standing with casters/wheels ( or cabinets provided as needed). No devices shall be configured for table-top use.
6. Copy resolution of at least 600 x 600 DPI.
7. Print resolution of at least 1,200 x 1,200 DPI.
8. Support current desktop and server operating systems.
9. A minimum of 1 Gigabyte of document management memory.
10. Print drivers shall be capable of Page Description Language (PDL) to support Adobe PS3, PCLSE and
PCL6.
11. Delivered with up-to-date software/firmware and drivers, with 32-bit and 64-bit architecture driver support. Provide all subsequent updates along with installation instructions to DLA.
12. Operate using 220 volt 50 hertz (Hz) alternating current (AC). In the event the later (20 amp) is offered, the Contractor shall clearly identify these models in proposals and in all price lists. No external transformers shall be used as an exception. The contractor shall also identify the power plug part number required.
13. Equipped with an external surge protector to protect all electronic components. The external surge protector shall be provided in addition to any internal surge protectors. External surge protectors shall have a minimum five (5) year manufacturer's warranty that covers:
a. Replacement of the surge protector if it fails, at no cost to the Government.
b. Repair or replacement of any device provided through this PWS damaged by a power surge when properly connected to the Contractor-provided surge protector.
14. Include a printed operator’s manual, in English, for each device.
15. Default to:
a. Automatically go into sleep mode after 20 minutes of inactivity
b. Automatically go into hibernation after an hour of inactivity.
c. Print duplex (2‐sided).
d. Print in gray scale on both monochrome and color MFDs
e. “Draft” quality printing rather than “high” quality printing
f. Display all information in English.
| B. Devices | shall | meet | the | following | security | requirements: | |||||
| 1. Devices | with | hard | drives | shall | have | an | encryption | or | overwrite | Security | Kit. |
| 2. Only | CLASSIFIED | designated | devices | shall | be | placed | on | the Secret | Internet | Protocol | Router | |||||
| Network | (SIPRNet). | All | CLASSIFIED | designated | devices | shall | include | a | removable | hard | drive. | A | ||||
| removable | hard | drive | is | a | hard | drive | the | end‐user | may | easily | remove, | and | reinsert | into | the | device |
| on | a | recurring | basis. | All | devices | with | removable | hard | drives | shall | have | a | locking | mechanism | to | |
| secure | the | hard | drive. |
| 3. All | Universal | Serial | Bus | (USB) | ports/memory | card | slots | on | the | devices | shall | be | disabled | when | |
| delivered | except: | the | printer | port | used | to | connect | the | device | to | a | single | computer; | Common | Access |
| Card | (CAC) | readers; | and | any | USB | ports | needed | for | servicing/maintaining | equipment. | Additionally, | ||||
| unused | ports, | protocols | and | services | on | each | device | shall | be | able | to | be | enabled/disabled | by | the |
| local | IT | administrator. |
| 4. All | devices | shall | have | a | secure | scanning | functionality | that | complies | with | Federal | Information | ||||||
| Processing | Standard | (FIPS) | 140‐2 | encryption | with | routing | and | full | integration | to | standard | network | ||||||
| infrastructure | destinations, | which | include: | Scan‐to‐Email, | Scan‐to‐Folder, | Scan‐to‐Network, | Scan‐ | |||||||||||
| to‐Server | and | Scan‐to‐PC. | Scanned | documents | shall | be | made | available | as | a | TIFF, | JPEG | and | as | a | |||
| file | format. | The | default | scan | resolution | shall | be | 300 | x | 300 | DPI. | The | default | scan | output | file | type | |
| shall | be | PDF. | Devices | shall | have | Optical | Character | Recognition | (OCR) | in | order | to | process | and | ||||
| produce | text‐searchable | documents | to | the | scan | destination. | Note: | Full | integration | does | not | mean | ||||||
| scanning | to | proprietary | back‐end | content, | document | or | records | management | systems | to | support | |||||||
| customized | indexing | or | metadata | requirements. |
| 5. All | Non‐Classified | Internet | Protocol | Router | (NIPR) | devices, | volume | bands | 1‐5, | shall | have | analog | fax | |
| only. | Note: | The | analog | fax | function | shall | be | configured | to | separate/isolate | the | fax | controller | from |
| the | network | controller. | SIPR | devices | shall | NOT | have | fax | capability. |
6. All devices shall have:
| a. CAC/Personal | Identity | Verification | (PIV) | enablement | in | order | to | secure | the | device | from | ||
| unauthorized | use | and | shall | have | a | “Secure | Print” | feature | that | allows | end‐users | to | use |
| authentication | credentials | (ex. | ID, | Login) | and | password | identification | (PIN) | to | release | jobs | ||
| on | the | device. |
| b. Print | on‐demand | solution | (e.g., | equivalent | to | “Follow | Me,” | “Follow | You,” | “Push” | or | “Pull” | ||
| printing) | that | shall | allow | end‐users | to | release | output | on | any | device | on | the | network. |
III. SPECIFICATIONS:
| A. In | addition | to | the | features/capabilities/configurations | set | forth | in | section | II | (outlined | above), | the |
| Contractor | shall | provide | all | devices | in | accordance | with | the | chart | below: |
| analyst | support | and | appropriate | digital | cards/products | to | successfully | connect | devices | to | DLA |
| customers’ | networks. |
| 3. Upon | completion | of | device | delivery, | the | Contractor | shall | obtain | customer | signature | and | date | on | |||
| each | bill | of | lading | (BOL) | or | packing | slip, | and | provide | this | proof | of | delivery | to | the | designated |
| Contracting | Officer | Representative | (COR) | within | ten | (10) | business | days | after | delivery. | The | |||||
| Contractor | shall | also | provide | the | Installation | Report | (Appendix | #1) | or | a | modified | delivery | schedule | |||
| with | serial | numbers | added | to | the | designated | COR | within | ten | (10) | business | days | after | |||
| delivery | and | installation | have | been | completed. |
| 4. If | a | device | cannot | be | delivered | and | installed | within | the | delivery | time | that | is | given, | the | Contractor |
| shall | notify | the | issuing | Contracting | Officer | as | soon | as | the | delay | is | realized, | of | the | expected | delivery |
| date | for | the | ordered | device(s). |
| 5. Regardless | of | installation | date, | all | devices, | including | replacement | devices, | shall | maintain | a | co‐ |
| terminus | Period | of | Performance | (PoP). |
| 6. Upon | installation, | the | Contractor | shall | affix | on | each | device | a | sticker | with | the | following | information: | |||||
| manufacturer’s | name, | model | number, | device | serial | number | and | toll‐free | telephone | number(s) | to | ||||||||
| place | service | maintenance | calls | and | order | consumable | supplies. | Additionally, | the | Contractor | shall | ||||||||
| add | the | PoP | end | date | to | DLA | EMS | sticker | and | affix | to | device. | (DLA | shall | provide | the | DLA | EMS |
stickers.)
7. The Contractor shall provide English‐speaking personnel at the toll‐free number(s) provided.
V. TRAINING
A. The Contractor shall provide on‐site training, in English, as specified in the contract, to end‐users.
| B. The | Contractor | shall | coordinate | directly | with | each | command’s | POC | listed | on | the | contract | to | establish |
| the | training | schedule. |
C. Training shall include the following:
1. How to operate the basic function keys of the device.
2. How to operate special features including duplexing, enlargements, reductions, and multiple job queues.
3. Diagnosis and resolution of basic device malfunctions, including paper jams.
4. Location and procedures for installing consumables such as paper, toner, staples, etc.
| D. The | Contractor | shall | submit | a | Summary | of | On‐Site | Training | Report | (Microsoft | Excel | format), | listing | |||
| device | serial | number, | personnel | trained | and | date | training | was | completed, | to | the | designated | COR | within | ||
| five | (5) | business | days | of | training | completion. | Initial | invoice | payment | shall | not | be | released | until | this | |
| report | is | received. |
| E. In | addition | to | on‐site | training, | the | Contractor | shall | provide | a | quick | reference | desk | guide | (single | sheet, | |||
| 8.5” | x | 11” | paper | size, | laminated, | full | color | and | able | to | be | easily | stowed | away | with | the | device). | The |
| contractor | shall | also | provide | a | CD‐ROM/DVD | and/or | web‐based | training | (URL | printed | on | a | sticker | to | ||||
| be | placed | on | the | front | of | the | device) | to | serve | as | follow‐up | training. |
VI. MAINTENANCE
A. Service
| 1. The | Contractor | shall | maintain | each | device | at | a | minimum | 95% | monthly | available | rate. | Maintaining |
| the | devices | includes: |
a. Preventive maintenance
b. Service calls
c. Repairs
d. Troubleshooting
e. Connectivity
f. All associated labor and travel
| 2. If | a | malfunction | cannot | be | corrected | during | the | initial | service | call, | the | Contractor | shall | resolve | all |
| issues | no | later | than | ten | (10) | calendar | days | from | date | of | initial | service | call. |
| 3. The | Contractor | shall | provide | English | speaking | service | technician | support | Monday | through | Friday | ||
| from | 8:00 | a.m. | – | 4:30 | p.m. | local | time, | with | the | exception | of | Federal | holidays. |
| 4. Service | for | Non‐Remote | Areas: | Non‐Remote | Areas | are | defined | as | service | locations | being | within | a | |||
| fifty | (50) | mile | radius | commute | of | a | metropolitan | area, | which | for | the | purpose | of | this PWS | is | defined |
| as | a | statistical | area | with | a | population | of | 50,000 | persons | and | above. | For | service | in | non‐remote |
areas:
| a. The | Contractor | shall | respond | to | work | stoppage | situations | within | two | (2) | business | hours | of | ||||
| a | service | call. | Work | stoppage | is | defined | as | a | required | function | of | the | device | (printing, | |||
| copying, | scanning | or | faxing) | is | non‐operational. | A | telephone | call | (unless | it | results | in | solving | ||||
| the | problem) | shall | not | be | deemed | an | acceptable | service | response. | The | service | technician | shall | ||||
| call | the | end‐user | within | an | hour | to | discuss | the | service | problem | and | time | of | arrival. | It | is | |
| estimated | that | 10% | of | service | calls | shall | be | classified | as | “work | stoppage” | across | the | total | |||
| device | population | on | a | yearly | basis. |
| b. The | Contractor | shall | respond | to | non‐work | stoppage | situations | within | four | (4) | business | |||||
| hours | of | a | service | call. | Non‐Work | stoppage | is | defined | as | a | required | function | of | the | device | |
| (printing, | copying, | scanning | or | faxing) | is | degraded. | A | telephone | call | (unless | it | results | in | |||
| solving | the | problem) | shall | not | be | deemed | an | acceptable | service | response. | The | service | ||||
| technician | shall | call | the | end‐user | within | an | hour | to | discuss | the | service | problem | and | time | of |
arrival.
| 5. Service | for | Remote | Areas: | Remote | Areas | are | defined | as | service | locations | being | beyond | a | fifty | |
| (50) mile | radius | commute | of | a | metropolitan | area. | For | service | in | remote | areas: |
| a. The | Contractor | shall | respond | to | work | stoppage | situations | within | four | (4) | business | hours | of | |||||
| a | service | call. | A | telephone | call | (unless | it | results | in | solving | the | problem) | shall | not | be | deemed | an | |
| acceptable | service | response. | The | service | technician | shall | call | the | end‐user | within | an | hour | to | |||||
| discuss | the | service | problem | and | time | of | arrival. | It | is | estimated | that | 10% | of | service | calls | shall | be | |
| classified | as | “work | stoppage” | across | the | total | device | population | on | a | yearly | basis. |
| b. The | Contractor | shall | respond | to | non‐work | stoppage | situations | within | eight | (8) | business | |||||||
| hours | of | a | service | call. | A | telephone | call | (unless | it | results | in | solving | the | problem) | shall | not | be | |
| deemed | an | acceptable | service | response. | The | service | technician | shall | call | the | end‐user | within | ||||||
| an | hour | to | discuss | the | service | problem | and | time | of | arrival. |
| 6. In | the | case | of | devices | cleared | for | CLASSIFIED | material, | the | Contractor’s | repair | technicians | shall | ||
| have | a | Department | of | Defense | (DoD) | security | clearance | equal | to | or | higher | than | the | classification | of |
| the | device | and | be | able | to | provide | verification | when | requested. |
| 7. The | Contractor | shall | be | responsible | for | all | damages | due | to | normal | wear | and | tear | and | loss | or |
| damage | caused | by | the | Contractor | or | its | agents. |
| 8. If | a | device | is | determined | to | be | non‐repairable, | to | include | damaged | devices, | the | Contractor | shall |
| inform | the | designated | COR | within | two | (2) | business | days | of | making | this | determination. | The | |
| Contractor | shall | deliver | and | install | a | comparable | replacement | device | within | fifteen | (15) | calendar | ||
| days | from | written | notification | from | the | Contracting | Officer. |
B. Consumable Supplies
| 1. The | Contractor | shall | provide | all | consumable | supplies | (including | staples) | necessary | for | the |
| operation | of | the | devices. | Paper | is | excluded | as | a | consumable | supply. |
| 2. The | Contractor | shall | deliver | all | required | consumable | supplies | to | the | designated | locations | listed | on | ||
| the | delivery | schedule | identified | on | the | contract, | within | three | (3) | business | days | after | receipt | of | a |
| request | for | supplies. |
IX. DEVICE REMOVAL
A. For device removal, the Contractor shall:
| 1. Remove | all | devices | and | associated | supplies | within | thirty | (30) | calendar | days | of | contract | expiration |
| or | receipt | of | a | modification | signed | by | the | Contracting | Officer. |
2. Notify the issuing Contracting Officer as soon as any delay in device removal is realized.
| 3. Prior | to | device | removal, | remove | all | hard | drives | and | surrender | them | to | DLA | (or | its | assignee). | Upon |
| completion | of | the | hard | drive | removal, | the | Contractor | shall | obtain | the | required | signatures | on | both | ||
| the | Removal/Relocation | Report | (Appendix | #2) | and | the | MFD | Hard | Drive | Removal | Record | (Appendix | ||||
| #3). | After | the | hard | drive | has | been | removed, | ALL | classification | stickers | shall | be | removed | prior | ||
| to | device | removal/disposal. |
| 4. The | Government | reserves | the | right | to | withhold | final | payment | if | all | devices | are | not | removed | from |
| the | premises | within | thirty | (30) | calendar | days | of | contract | expiration | or | termination. |
| 5 5. Be | subject | to | payment | of | all | disposal | fees | incurred | by | the | Government | for | any | devices | not | removed |
| within | thirty | (30) | calendar | days | of | termination | or | expiration. | After | this | time | period, | the | devices | ||
| will | be | considered | abandoned. |
X. REPORTS
A. The Contractor shall provide the following reports:
1. Installation Report, as referenced in section IV.A.3.
2. Summary of On‐Site Training Report, as referenced in section V.D.
| 3. Device | Listing | Report | (Microsoft | Excel | format) | shall | be | submitted | via | Wide | Area | Work | Flow | ||||
| (WAWF) | to | the | COR | with | the | monthly | invoice. | The | report | shall | contain | an | accurate | listing | of | all | |
| devices | under | contract | (model, | serial | number, | location). |
4. Removal/Relocation Report, as applicable, as referenced in section VII.A.6 and IX.A.
| B. Upon | request, | the | Contractor | shall | provide | the | following | reports | within | 5 | business | days, | at | no | cost | to |
| the | Government: |
1. Usage Report (Appendix #4) shall be submitted to the COR and the Contracting Officer.
| 2. Response | Time | Report | shall | be | submitted | to | the | COR | and | the | Contracting | Officer. | This | report | shall | |||
| identify | the | technician’s | response | time, | defined | as | the | time | between | when | the | service | call | is | placed | |||
| and | when | the | technician | arrives | onsite | to | repair | the | equipment. | If | the | issue | is | able | to | be | resolved | |
| on | the | phone, | the | response | time | shall | be | defined | as | the | time | the | service | call | was | placed | and | when |
| the | issue | was | resolved | over | the | phone. |
| 3. Device | Downtime | Report | shall | be | submitted | to | the | COR | and | the | Contracting | Officer. | This | report | |
| shall | identify | the | time | the | equipment | was | inoperable/non‐functional. | Downtime | is | defined | as | the | |||
| time | the | service | call | is | placed | notifying | the | Contractor’s | representative | that | the | equipment | is | ||
| inoperable/non‐functional | or | when | the | technician | begins | service | on | the | equipment | if | the | device | is | ||
| operable/functional | upon | arrival. | In | addition, | the | report | shall | include | information | relative | to | the | |||
| frequency | of | service | calls, | production | volume | between | service | calls, | types | of | repairs, | as | well | as | |
| parts | required. |
| 4. Device | Uptime | Report | shall | be | submitted | to | the | COR | and | the | Contracting | Officer. | This | report | shall | |
| identify | the | time | the | equipment | was | operable | and | available | and | will | be | used | to | verify | the | required |
| minimum | 95% | monthly | available | rate, | as | outlined | in | section | VI.A.1. |
XI. INVOICING
| A. All | invoices | shall | be | submitted | with | the | Device | Listing | Report | via | Wide | Area | Work | Flow | (WAWF) |
| and | shall | be | submitted | in | United | States | Dollars. | The | following | website | provides | additional |
| information | regarding | WAWF | including | information | for | “vendors | getting | started” | with | the | system: |
| https://wawf.eb.mil/xhtml/unauth/help/help.xhtml. |
XII. NETWORK FUNCTIONALITY
| A. DoD | policy | prohibits | the | publication | of | network | configuration | information; | therefore, | DoD | |||
| installations | shall | not | fill | out | pre‐installation | site | surveys. | The | required | information | shall | be | |
| provided | at | time | of | installation. |
| B. The | Contractor | shall | provide | devices | that | shall | operate | on | and | coexist | on | a | network | supporting | all | of |
| the | following: |
1. Internet Protocol Version 4 (IPv4),
2. Internet Protocol Version 6 (IPv6),
3. A hybrid of IPv4 and IPv6.
C. Support shall be provided for network configurations based on agency hardware/software.
XIII. NETWORK SECURITY
| A. The | Contractor | shall | provide | devices | that | can | be | configured | to | comply | with | the | current | Defense |
| Information | Systems | Agency | (DISA) | Security | Technical | Implementation | Guide | (STIG) | titled | |||||
| Multifunction | Device | and | Network | Printer | STIG | (latest | version | and | release), | available | at: |
https://cyber.mil/.
| B. Contractors | shall | monitor | industry | standard | vulnerability | sites | (e.g. | http://nvd.nist.gov/, | |||||||||
| https://www.us‐cert.gov/ncas/alerts, | http://oval.mitre.org/) | and | take | appropriate | actions | if | their | ||||||||||
| equipment | is | subject | to | a | known | vulnerability. | When | vulnerabilities | are | identified | by | the | Contractor, | ||||
| DLA | or | its | customers, | the | Contractor | shall | provide | remediation | for | distribution | to | all | installed | ||||
| equipment | in | accordance | with | USCYBERCOM | TASKORD | regulations | unless | a | different | time | period | is | |||||
| directed | by | USCYBERCOM | via | DLA. | The | TASKORD | is | For | Official | Use | Only. | The | following | is | authorized | ||
| to | be | quoted | from | the | TASKORD | for | reference: |
| 1. Assured | Compliance | Assessment | Solution | (ACAS) | assigns | severity | scores | of | critical, | high, | medium |
| and | low | to | plug‐in | findings. |
| a. Critical | findings | reflect | discovery | of | a | common | vulnerability | and | exposure | (CVE) | that | poses | |
| significant | risk | to | the | confidentiality, | integrity, | and | availability | of | DODIN | Networks. | Actions | to | |
| mitigate | or | remediate | critical | vulnerabilities | shall | be | initiated | upon | discover | with | the | goal | of |
| mitigation/remediation | within | seven | (7) | calendar | days. |
| b. Findings | with | a | severity | score | of | high | shall | be | addressed | in | the | same | manner | as | vulnerabilities |
| addressed | via | Information | Assurance | Vulnerability | Alert | (IAVA) | directives | and | mitigated | or | |||||
| remediated | within | twenty‐one | (21) | calendar | days | of | discovery. |
| c. Findings | with | severity | scores | of | medium | and | low | shall | be | addressed | in | accordance | with | local |
| Approving | Official | (AO), | Information | System | Security | Manager | (ISSM), | or | Information | System | ||||
| Security | Officer | (ISSO) | guidance | until | further | notice. |
| d. In | all | instances, | DoD | components | shall | consider | exposure | to | threat, | mission | impact, | sensitivity |
| of | data, | and | current | mitigating | security | controls | when | prioritizing | implementation | of | fix |
actions.
| C. In | the | event | remediation | cannot | be | achieved | within | the | mandated | timeline, | the | Contractor | shall | ||
| provide | a | Plan | of | Action | and | Milestones | and | receive | approval | thereof | by | the | Customer’s | agency | |
| Authorizing | Official | or | designee | for | risk | acceptance. |
| D. All | devices | shall | be | International | Organization | for | Standardization | (ISO)/International | Electrotechnical | ||
| Commission | (IEC) | 15408 | (Common | Criteria) | certified | IAW | CNSSP‐11 | using | the | National | Information |
| Assurance | Partnership | (NIAP) | approved | criteria | . |
1. A device shall be acceptable if it is included on either the NIAP CCEVS Product Compliant List (https://www.niap‐ccevs.org/Product/)
| 2. All | devices | shall | have | current | ISO/IEC | 15408 | certification | and | recertification, | if | applicable, | before | ||
| the | Contractor | can | schedule | lab | time. | See | section | XIV. | Guidance | for | Common | Criteria | Maintenance | |
| and | Reevaluation | is | available | at: | https://www.niap‐ |
ccevs.org/documents and guidance/ccevs/scheme‐pub‐6.pdf
| E. All | devices | shall | be | capable | of | obtaining | accreditation | through | the | Risk | Management | Framework | (RMF) | |||
| for | DoD | Information | Technology | (IT). | As | part | of | this, | the | Contractor | agrees | to | provide | all | requested | |
| information | and | work | in | good | faith | with | DLA | so | the | DLA | customers | can | expeditiously | obtain | RMF | |
| accreditation | prior | to | device | delivery | and | installation. | The | Contractor | shall | also | provide | devices | for | |||
| vulnerability | and | STIG | testing | to | DLA | or | customer’s | site. | The | Contractor | further | agrees | that | if | the | |
| proposed | device(s) | does | not | obtain | RMF | accreditation, | the | contractor | shall | remove | the | device(s). | ||||
| Information | regarding | RMF | is | found | in | Risk | Management | Framework | (RMF) | for | DoD | Information | ||||
| Technology | (IT) | Instruction | 8510.1 | dated | 12 | March | 2014: | |||||||||
| http://www.dtic.mil/whs/directives/corres/pdf/851001 2014.pdf. | In | order | to | maintain | RMF | and | ||||||||||
| STIG | compliance, | devices | are | required | to | have | the | most | up‐to‐date | firmware, | out | outlined | in | section |
II.A.10.
| F. The | Contractor | shall | supply | a | SMARTCARD | Public | Key | Infrastructure | (PKI) | Solution | which | is | compliant | |||
| with | DODI | 8520.03 | and | NIST | FIPS | 201 | (PIV) | standards. | The | contractor | shall | provide | card | readers | that | |
| shall | read | and | process | all | approved | CAC | and | PIV | cards. | The | Contractor | shall | maintain | compliance | with | |
| DoD‐wide | SMARTCARD | and | DoD | PKI | standards, | and | support | all | approved | physical | cards | during | the | full | ||
| lease | period. |
| G. The | contractor | shall | provide | a | SMARTCARD | PKI | Solution | with | SIPRNet | token | capability, | which | is | |||
| compliant | with | DoD | requirements | for | PK‐enabling | and | interoperability | as | set | forth | in | DODI | 8520.02. | |||
| The | Contractor | shall | provide | card | readers | that | shall | read | and | process | all | approved | SIPRNet | token | ||
| cards. | The | Contractor | shall | provide | device | support | systems | that | incorporate | the | use | of | PKI | for | ||
| encryption | of | information | in | transit | or | at | rest. | The | Contractor | shall | provide | devices | that | are | compatible | |
| with | 3.3 | volt | SafeNet | SC650 | token | and | that | are | compatible | with | the | 90Meter | Middleware | solution | for | |
| CAC, | known | as | CAC | Smart | Card | Manager‐90. | The | Contractor | shall | maintain | compliance | with | DoD | wide | ||
| SIPR | and | DoD | PKI | standards, | and | support | all | approved | physical | cards | and | firmware | during | the | full | |
| lease | period. | For | current | DODI | instructions | go | to: |
http://www.dtic.mil/whs/directives/corres/ins1.html.
| H. The | Contractor | shall | ensure | that | CAC/SIPR | token | authentication | is | available | for | scanning, | printing | and |
| copying | and | shall | be: |
1. Capable of digitally signing emails using the senders DoD PKI Certificate(s).
2. Capable of encrypting emails using the receivers DoD PKI Certificate(s).
3. Capable of scan to file on networked devices.
4. In compliance with Homeland Security Presidential Directive‐12 (HSOP‐12).
I. The Contractor shall produce certificates of compliance, if requested.
XIV. TESTING
| A. Unless | previously | tested | and | approved | by | DLA, | all | devices | proposed | in | response | to | the | contract | shall | be |
| tested | for | compliance | with | Network | Security | as | defined | in | section | XIII | after | award. |
| B. The | estimated | time | for | testing | is | twenty | (20) | business | days. | Testing | and | approval | shall | be | performed | |
| by | the | DLA | Information | Operations | EMS | Division | in | conjunction | with | the | Contractor’s | assistance. | The | |||
| Contractor | shall | provide | onsite | engineering | assistance | and | other | support | necessary | to | configure, | setup, | ||||
| and | test | the | equipment | as | needed. |
| 1. DLA | has | agreements | with | our | DoD | customers | to | test | devices | to | meet | DoD | RMF | and | STIG |
| Compliance. | If | all | devices | pass | the | preliminary | testing | process, | DLA | shall | submit | a | compliance | ||
| memorandum | to | the | Contractor | informing | them | that | the | devices | have | passed | the | preliminary | |||
| testing | process. | In | some | cases, | prior | to | being | added | to | the | DLA | customer’s | network, | additional | |
| certification | procedures | and | testing | shall | be | required | prior | to | risk | acceptance. | If | required | by | DLA, | |
| the | Contractor | shall | deliver | test | devices | to | the | DLA | customer | prior | to | proceeding | with | installation. | |
| DLA | shall | exercise | due | diligence | to | assist | with | technical | mitigation | and | resolve | any | questions and/ | ||
| or | concerns | raised | by | that | agency | during | the | testing | review | process. |
| 2. For | devices | ordered | to | be | installed | on | OCONUS | Navy | networks, | the | Contractor | shall | provide | |
| networked | equipment | that | shall | be | tested | to | operate | Outside | the | Contiguous | United | States | ||
| (OCONUS) | Navy | Enterprise | Network | (ONE‐Net) | for | the | "printer, | scanner | and | fax" | functions. | This | ||
| equipment | shall | be | accredited | to | operate | and | added | to | the | ONE‐Net | Approved | Products | List | (APL) |
| prior | to | the | delivery | of | devices. The ONE-Net approval process requires an estimated additional |
130 days.
| 3. If | the | devices | do | not | pass | any | of | the | testing | procedures | for | any | reason, | DLA | shall | not | proceed | with |
| installation | of | said | devices | at | the | customer | locations | and | DLA | shall | terminate | the | contract. |
C. A device shall not be tested if it cannot be assigned to one of the Volume Bands as outlined in section V.
| D. The | devices | shall | be | delivered | with | all | required | accessories, | software, | firmware, | etc. | Output | paper | |
| handling | accessories | are | not | tested | and | shall | not | be | delivered | to | the | lab. |
E. Approved devices previously submitted to DLA for testing are not required to be re‐tested.
| F. The | Contractor | shall | deliver | the | devices | for | each | Volume | Band | series, | under | each | Functional | Area, | to | ||
| DLA | Information | Operations | J67E | located | at | 430 | Mifflin | Avenue, | Building | 430, | New | Cumberland, | PA | ||||
| 17071, | for | testing, | at | no | cost | to | the | government. | Delivery | coordination | shall | take | place | within | five | (5) | |
| business | days | of | contract | award. |
| G. The | Contractor | shall | resolve | non‐compliance | issues | as | quickly | as | possible. | If | the | issues | cannot | be | |||
| resolved | within | fourteen | (14) | calendar | days, | the | test | shall | be | suspended. | After | the | non‐compliance | ||||
| issues | are | resolved | by | the | Contractor, | the | suspended | session | shall | be | scheduled | when | lab | time | is | next | |
| available. | If | requested | by | DLA, | the | Contractor | shall | remove | their | devices | from | the | lab | to | avoid | delaying | |
| the | next | scheduled | test. |
| H. For | all | devices | tested | and | placed | on | the | DLA | contract, | the | Contractor | shall | collaborate | with | the | COR | to |
| develop | the | testing | results | package. | The | Contractor | shall | develop | the | device | Implementation | Guide. | |||||
| The | Implementation | Guide | shall | provide | step‐by‐step | instructions | and | screenshots | to | configure | the | ||||||
| devices | in | accordance | with | the | testing | results. | Government | acceptance | of | the | Implementation | Guide | is | ||||
| at | the | discretion | of | the | DLA | EMS | Division. |
| I. The | security | requirements | set | forth | in | this | PWS | are | minimum | device | specifications | and | have | been |
| identified | as | the | basic | requirements | common | across | Government | agencies. | These | are | the | minimum | ||
| security | requirements | applicable | to | all | devices | awarded | under | this | contract. | Each | ordering | activity | may | |
| have | its | own | hardware/software | acceptance | processes. | All | devices | shall | be | subject | to | ordering | activity |
| hardware/software | evaluation | processes. | If | the | device | fails | a | security | evaluation, | the | Contractor | may | |||
| select | a | different | technology | or | mitigate | the | failed | controls | to | fulfill | this | requirement. | The | Contractor | |
| shall | be | available | to | meet | with | the | information | technology | (IT) | and | security | personnel | at | a | mutually |
| convenient | time | during | the | evaluation | process, | and | shall | identify | a | mutually | acceptable | solution. | The | ||
| Contractor | shall | provide | the | necessary | equipment | or | expertise | to | complete | security | testing | and | |||
| integration | into | the | existing | environment. | The | customer | agency | may | require | the | Contractor | to | ship | ||
| devices | to | a | specific | location | for | testing | at | time | of | award. |
| J. If, | during | the | life | of | the | contract, | a | requirement | in | section | XII | and | XIII | is | changed, | updated | or | revised, |
| the | Contractor | shall | comply | with | the | most | current | version | of | the | requirement. |
| K. The | Contractor | shall | remove | all | hardware | from | the | DLA | test | lab | within | fourteen | (14) | calendar | days |
| upon | notification | of | test | completion. |
XV. SUPPLY CHAIN RISK MANAGEMENT
| A. As | part | of | its | quote, | the | Contractor | shall | provide | written | documentation | demonstrating | how | the | |||
| integrity | and | security | of | all | equipment, | components | thereof, | repair | parts | and | consumables | it | will | |||
| provide | and/or | use | in | performing | this | contract | will | meet | the | standards | set | forth | in | National | Institute | of |
| Standards | and | Technology | (NIST) | Special | Publication | 800‐61. | This | documentation | shall | clearly | ||||||
| demonstrate | how | the | Contractor | is | taking | effective | measures | to | mitigate | the | risks | of | foreign | |||
| intelligence | services, | terrorist | groups, | or | others | from | inserting | unwanted | functionality | into | the | supplies | ||||
| and/or | services | DLA | receives | through | this | contract. | Additionally, | this | documentation | shall | provide | |||||
| specific | details | of | what— |
| 1. Policies | the | Contractor | has | in | place | to | prevent | both | (a) | the | use | of | counterfeit | or | altered | equipment, |
| components | thereof, | consumables | and | parts | and | (b) | their | introduction | into | the | Contractor’s | supply |
chain;
| 2. Security | procedures | the | Contractor | uses | to | track | the | chain | of | custody | of | equipment, | components | ||
| thereof, | consumables | and | parts, | to | include | while | this | material | is | in | storage | and | in | transit; | and |
| 3. Steps | the | Contractor | takes | to | ensure | the | integrity | and | authenticity | of | new, | refurbished | or |
| remanufactured | equipment, | components | thereof, | repair | parts | and | consumables | to | prevent | ||||
| tampering | so | they | will | perform | according | to | specifications | without | additional | unwanted |
functionality.
| B. The | Contractor | shall | continuously | meet | the | standards | of | NIST | Special | Publication | 800‐61 | while | taking | |
| effective | measures | to | mitigate | the | risks | of | foreign | intelligence | services, | terrorist | groups, | or | others | from |
| inserting | unwanted | functionality | into | the | supplies | and/or | services | provided | through | this | contract. | |||
| Upon | request, | the | Contractor | shall | provide | written | documentation | meeting | all | requirements | set | forth | ||
| in | part | A, | above. |
XVI. ENTERPRISE MANAGEMENT TOOL
| A. The | Contractor | shall | provide | an | Enterprise | Management | Tool | that | manages | devices. | The | |
| management/monitoring | software | tool | shall | reside | within | the | customers’ | network | in | order | to | monitor, |
| manage | and | generate | usage | to | facilitate | continued | fleet | optimization | reports. |
| B. The | Enterprise | Management | Tool | shall | use | SNMP | V3. | The | management | tool | shall | monitor | meter | reads, | |
| volume, | usage, | supply | levels, | and | issue | notifications/alerts | about | device | status. | The | notifications/alerts | ||||
| shall | notify | designated | personnel | when | to | order | consumables | and | request | maintenance/repair |
services.
XVII. INSTALLATION SECURITY REQUIREMENTS
REVISION ‐ As of July 21, 2020
| A. The | Contractor | shall | comply | with | all | rules | and | regulations | to | obtain | Government | installation | access | in |
| order | to | meet | all | response | times | identified | within | the | PWS. |
| B. The | Contractor | shall | comply | with | Government | base | access | requirements | as | set | forth | in | the | base/ |
| command | regulations. |
| C. The | Contractor | shall | be | responsible | for | any | and | all | fees | associated | with | the | application | process | and/or |
| enrollment | to | access | any | installation | or | facility. |
| D. For | devices | cleared | for | CLASSIFIED | material, | the | Contractor’s | repair | technicians | shall | have | a | DoD | ||
| security | clearance | equal | to | or | higher | than | the | classification | of | the | device | and | shall | provide | verification |
| when | requested. | The | contractor’s | repair | technicians | shall | be | escorted | through | all | areas | where | |||
| CLASSIFIED | documents | are | processed. |
| E. Contractor’s | repair | technicians | shall | be | provided | with | ISA | AB | RBAF | badge | or | shall | be | escorted | by | the | ||
| customer | while | on | the | installation. | The | installation | consists | of | four | (4) | gates, | two | of | which | are | manned | ||
| by | the | US | Army | and | two | of | which | are | manned | by | local | government | personnel. | The | local | government | ||
| will | require | the | RBAF | identification. |
XVIII. GENERAL CONDITIONS
| A. The | Contractor | shall | assign | a | single | point | of | contact | (POC) | to | coordinate | with | the | Contracting | Officer | in | ||
| all | aspects | of | this | contract | within | 3 | business | days | of | receipt | of | the | award. | The | Contractor | shall | provide | |
| its | assigned | POC’s | name, | title, | business | address, | phone | number | and | address | to | the | Contracting |
Officer.
| B. The | Contractor | shall | comply | with | the | Health | Insurance | Portability | and | Accountability | Act | (HIPAA) |
| when | installing | devices | at | Government | medical | sites. |
| C. The | Contractor | shall | comply | with | the | Section | 508 | accessibility | requirements. | By | submission | of | its | offer, | ||
| the | Contractor | affirms | that | its | Electronic | Information | Technology | (EIT) | supplies | and | services | are | ||||
| accessible | as | outlined | in | the | law, | the | standard, | and | FAR | Subpart | 39.2. | The | Contractor | shall | complete | the |
| Voluntary | Product | Accessible | Template | (VPAT®) | document | (Appendix | #5). | If | applicable, | Contractors | ||||||
| shall | indicate | where | their | Section | 508 | EIT | compliance | information | is | available | for | review | (e.g., | |||
| Contractor’s | website | or | other | location | the | Contracting | Officer | can | access). | The | Contracting | Officer | may | |||
| require | a | demonstration | of | Section | 508 | compliance | prior | to | award. |
XIX. APPENDICES
A. Appendix #1: Installation Report
B. Appendix #2: Removal/Relocation Report
C. Appendix #3: Hard Drive Removal Record
D. Appendix #4: Usage Report
E. Appendix #5: VPAT® Template
REVISION ‐ As of July 21, 2020
Appendix #3 Equipment Management Solutions Hard Drive Removal Record
Form log number
FY ‐ SEQ#
DLADCSVC ‐ ‐
Contract number
Customer (Agency/Command)
Drive manufacturer and model
Hard drive serial number
MFD serial number
Date removed
Printed name of technician removing hard drive
Signature of technician removing hard drive
Drive classification ☐ Classified (up to Secret) ☐ Unclassified (CUI)
Hard drive disposition
☐ Retained by customer ☐ Shipped to DLA Information Operations
☐ Shipped to NSA
Printed name of EMS Division representative accepting drive for DLA Information Operations or customer accepting drive
Signature of EMS Division representative accepting drive for DLA information Operations or customer accepting drive
Printed name/title of person sanitizing hard drive
Signature of person sanitizing hard drive
Date destroyed
Printed name/title verification after Degaussing and Crushing
Signature for verification after degaussing and crushing
Degausser/crusher location ☐ DSI HD‐1T (Phil) ☐ EM/Garner Model TS‐1 (NOR)
☐ SEM Model 0101(Phil) ☐ SEM Model 0101(NOR)
Post‐Sanitization destination (recycling center)
Contact phone number to degausser operator and verification personnel
File details come from the government source that posted it. Updated .