Attachment 1A - Draft BCS_UCS PWS HQ Task Order 12.17.pdf

Defense Logistics Agency (DLA)

Defense Contract Services Office (DCSO)

Building Control Systems/Utility Control Systems (BCS/UCS)

Task Order

For

Elevator Systems/ Electrical & Lighting Systems (Building)/ HVAC + BAS + Utility

Metering Systems/ Electrical Distribution (Site)

Routine and Ad-Hoc Components

Needs to cover requirements at the following location(s):

DLA Headquarters Complex, Fort Belvoir, VA (HQC)

TABLE OF CONTENTS

Section C – Descriptions and Specifications

C.1 GENERAL/BACKGROUND INFO

C1.1 Description of Services/Introduction

C1.2 Background

C1.3 Objectives

C1.4 Definitions/Acronyms

C.2 GENERAL INFORMATION

C2.1 Contract Type

C2.2 Place of Performance

C2.3 Period of Performance

C2.4 Business Hours

C2.5 Identification Badges

C.3 GOVERNMENT INFORMATION

C3.1 COR

C3.2 TPOC

C3.3 Government Furnished Property, Equipment and Services

C.4 CONTRACTOR INFORMATION

C4.1 Key Personnel

C4.2 Phase In/Out Period

C4.3 Outgoing Transition Plan

C4.4 Program Management Support

C4.5 Post Award Conference/Periodic Progress Meetings

C4.6 Supervision of Contractor Employees

C4.7 Meeting Attendance

C4.8 Government Kick-Off Meeting

C4.9 Monthly Status Report (MSR) and Briefing

C4.10 Contractor Furnished Items and Services

C4.11 Personnel Security Requirements

C4.12 Citizenship

C4.13 Installation Security

C4.14 Physical Security

C4.15 Identification of Contractor Personnel

C.5 QUALITY CONTROL

C5.1 Quality Control Program

C5.2 Quality Control Plan

C5.3 Quality Assurance

C5.4 Acceptable Performance Levels

C5.5 Quality Assurance Surveillance Plan (QASP)

C.6 SECURITY/CYBERSECURITY REQUIREMENTS

C6.1 Personnel Requirements

C6.2 Privileged Access

C6.3 Cybersecurity Strength Requirements

C6.4 Cybersecurity Assurance Requirements

C6.5 Tasks and Deliverables

C6.6 System and Network Requirements

C6.7 Information and Operational Technology Infrastructure Requirements

C6.8 Deliverables

C6.9 Information Security

C6.10 Privacy Act Information

C6.11 Sensitive Information

C.7 SPECIFIC TASK(S) AND DELIVERABLE(S) (Includes Life Cycle Management

Cyber Security)

C7.1 Elevator Systems

C7.1.1 Requirements/Specifications

C7.1.2 General Scope and Location Breakdown

C7.1.3 Replacement, Modernization, Renovation

C7.1.4 As Built Drawings

C7.1.5 Service Order/Calls

C7.1.6 Service Order Call Categories

C7.1.7 Maintenance Program

C7.1.8 Lift Equipment System Tests

C7.1.9 Routine/Preventive Maintenance

C7.1.10 Service Order/Call Classification

C7.1.11 Software Maintenance

C7.1.12 Replacement Parts/Products

C7.1.13 Changes to Lift Equipment Systems

C7.1.14 Warranties

C7.1.15 Work Conflicts

C7.1.16 Signage

C7.1.17 Required Contractor Training and Certs

C7.1.18 Deliveries

C7.2 Electrical & Lighting Systems (Building)

C7.2.1 Requirements/Specifications

C7.2.2 General Scope and Location Breakdown

C7.2.3 Replacement, Modernization, and Renovation

C7.2.4 As Built Drawings

C7.2.5 Initial Site Assessment Survey

C7.2.6 Service Orders

C7.2.7 Service Order Call Categories

C7.2.8 Operations and Maintenance Program

C7.2.9 Routine/Preventive Maintenance

C7.2.10 Proactive Facility Tours

C7.2.11 Facility Related Control System (FRCS)

C7.2.12 Operations Support

C7.2.13 Required Contractor Training and Certifications

C7.2.14 Contractor Personnel

C7.2.15 Building Operations

C7.2.16 Material

C7.2.17 Replacement Parts/Products

C7.2.18 Warranty

C7.2.19 Deliveries

C7.3 HVAC + BAS + Utility Metering Systems

C7.3.1 Requirements/Specifications

C7.3.2 General Scope and Location Breakdown

C7.3.3 Replacement, Modernization, and Renovation

C7.3.4 As Built Drawings

C7.3.5 Initial Site Assessment Survey

C7.3.6 Service Orders

C7.3.7 Service Order Call Categories

C7.3.8 Operations and Maintenance Program

C7.3.9 Routine/Preventive Maintenance

C7.3.10 Proactive Facility Tours

C7.3.11 HVAC Building Automation Controls

C7.3.12 Corrective Maintenance Service Order Proposals

C7.3.13 Building Operations

C7.3.14 Replacement Parts/Products

C7.3.15 Warranty

C7.3.16 Contractor Personnel

C7.3.17 Deliveries

C7.4 Electrical Distribution (Site)

C7.4.1 Requirements/Specifications

C7.4.2 General Scope and Location Breakdown

C7.4.3 Replacement, Modernization, and Renovation

C7.4.4 As Built Drawings

C7.4.5 Initial Site Assessment Survey

C7.4.6 Service Orders

C7.4.7 Service Order Call Categories

C7.4.8 Operations and Maintenance Program

C7.4.9 Routine/Preventive Maintenance

C7.4.10 Proactive Facility Tours

C7.4.11 Site Utility Controls Systems

C7.4.12 Corrective Maintenance Service Order Proposals

C7.4.13 Building Operations

C7.4.14 Replacement Parts/Products

C7.4.15 Equipment Warranty

C7.4.16 Contractor Personnel

C7.4.17 Deliveries

C7.5 Deliverable(s)

C7.6 Enterprise Business Systems – Plant Maintenance

C.8 APPLICABLE STANDARDS

C8.1 Site Requirements

C8.2 Safety Requirements

C8.3 Environmental Compliance

C8.4 Refrigerant

C8.5 Potable Water Systems

C8.6 Hazardous Waste

C8.7 Electrical Safety

C.9 ATTACHMENT(S) AND FORM(S)

ATTACHMENT 1 SITE SPECIFIC DEFINITIONS AND ACRONYMS

ATTACHMENT 2 TECHNICAL REFERENCES & CODES

ATTACHMENT 3 CAC PROCEDURES

ATTACHMENT 4 TECHNICAL EXHIBIT LIST

ATTACHMENT 5 DOCUMENTATION OF SERVICE FORM

ATTACHMENT 6 PERFORMANCE REQUIREMENTS SUMMARY (PRS)

ATTACHMENT 7 OPEN/CLOSED LOOP WATER LIMITS

ATTACHMENT 8 INVENTORY LISTS

C.1 GENERAL BACKGROUND INFORMATION

C1.1 Description of Services/Introduction

C1.1.1 This is a non-personal services Task Order (TO) to provide and implement a comprehensive program for the operation, maintenance, repairs, service, testing, inspection, and certification of Elevator Systems, Electrical & Lighting Systems (Building), HVAC + BAS +

Utility Metering Systems, Electrical Distribution Systems (Site), and Life Cycle Management

Cyber Security at the following location:

• DLA Headquarters Complex, Fort Belvoir, VA (HQC)

C1.1.2 The prime contractor shall furnish all management, labor, supervision, tools, materials, equipment, incidental engineering, and transportation necessary to perform maintenance service work to meet or exceed general craft and industry standards, applicable laws, regulations, codes and Federal specifications for the buildings and structures identified within this document.

C1.2 Background

C1.2.1 The Defense Logistics Agency (DLA) is a United States (U.S.) Department of Defense

(DoD) agency providing worldwide logistics support to the missions of the Military Departments and the Combatant Commands.

C1.2.2 DLA Installation Management (DM) is responsible for new construction (MILCON or

Capital expenditures), System Maintenance of all Site equipment, and Facilities Related Control

Systems (FRCS). DM serves as the functional and doctrinal proponent for all real property system requirements, policies, and procedures including industry standards, The American

Society of Heating, Refrigeration and Air Conditioning Engineers (ASHRAE), United Facilities

Criteria (UFC) and National Fire Protection Association (NFPA), National Electric Code (NEC), International Building Code (IBC), American Society of mechanical Engineers (ASME) code.

Institute of Electrical and Electronic Engineers Code (IEEE), State and Local Codes, and

Department of Defense (DoD) installation policy.

C1.2.3 The Defense Logistics Agency (DLA) McNamara Headquarters Complex (HQC), located on Fort Belvoir, Virginia, 8725 John J. Kingman Road, Fort Belvoir, VA 22060-0621, is a significant facility supporting the mission of the Warfighter. The HQC spans 75 acres and includes a 1.2 million square foot Headquarters Office Building. In addition to traditional office spaces, it houses several secure facilities, a cafeteria, a barbershop, a fitness center, two snack bars, three access gates, visitors control center, recreational building, irrigation well house, three story parking garage, CDC, out control structure, as well as material receiving and screening facility.

C1.2.4 This contract will encompass a wide array of Building Control Systems (BCS) and Utility

Control System (UCS) equipment. These control systems ensure the proper function of the systems to meet minimum efficiency and code related criteria. A control system (CS) as it pertains to Facility Related Control System (FRCS) can have many levels. The Equipment level can include multiple pieces of factory supplied equipment directly connected to create a manufacturer system to optimize efficiency. The Building Level consists of a building level controller(s), dedicated communication trunks (LON, BACnet, MODBUS, N2, other proprietary communications protocols), field level devices, sensors, actuators, or other devices.

C1.3 Objective(s)

C1.3.1 This TO PWS acquisition is intended to support Elevator Systems, Electrical & Lighting

Systems (Building), HVAC + BAS + Utility Metering Systems, Electrical Distribution Systems

(Site) equipment, FRCS requirements, and sustainment support for the DLA Headquarters at Ft.

Belvoir, - These duties include, but are not limited to:

1. Day to day maintenance and sustainment for both equipment and FRCS.

2. Performing scheduled preventive, predictive maintenance, and asset management functions to ensure the long-term efficient operation of facility infrastructure.

3. Performing scheduled and unscheduled maintenance, repairs, and replacements as needed on infrastructure components.

4. Maintaining operations and maintenance & repair records for all infrastructure components in electronic format.

5. Maintaining the inventory and electronic inventory records for the consumable supplies needed for system sustainment and maintenance.

6. Information technical networking support (ITNS) of the systems includes but not limited to cybersecurity, networking, server and client administration, database management, and Information System Security Engineering (ISSE), cybersecurity/system administration for the FRCS.

C1.3.2 The operations will be performed to comply with all federal, state, and local laws and regulations. The services shall be provided in a safe, secure, effective, and efficient manner and shall meet the highest standards prevalent in the industry.

C1.4 Definitions/Acronyms

C1.4.1 DEFINITIONS: Refer to Task Order ATTACHMENT 1: SITE SPECIFIC

DEFINITIONS AND ACRONYMS and IDIQ PWS ATTACHMENT 1: DEFINITONS AND

ACRONYMS.

C.2 GENERAL INFORMATION

C2.1 Contract Type

C2.1.1 The Government will award a Firm Fixed Price task order for routine and ad hoc work.

C2.2 Place of Performance

C2.2.1 The work to be performed under this TO shall be performed at Government facilities located on DLA, Andrew T. McNamara Headquarters Complex (HQC), 8725 John J. Kingman

Road, Fort Belvoir, VA 22060-0621. Work may be performed at other location(s), when feasible and upon approval by the COR, work shall be performed at remote locations.

C2.3 Period of Performance

C2.3.1 The period of performance shall be for one (1) base year of 12 months and four (4) 12-month option years.

Base Year: 1 November 2025 – 31 October 2026

Option Year I: 1 November 2026 – 31 October 2027

Option Year II: 1 November 2027 – 31 October 2028

Option Year III: 1 November 2028 – 31 October 2029

Option Year IV: 1 November 2029 – 31 October 2030

C2.4 Business Hours

C2.4.1 The contractor shall conduct business between the hours of 06:00 A.M. through 06:00

P.M. Eastern Time, Monday through Friday, except Federal holidays or when Government facilities are closed due to emergencies, administrative closings or similar Government directed facility closings. See details in section C3 Specific Tasks and Deliverables.

Federal Holidays are as follows:

New Year’s Day 1st day of January

Martin Luther King Jr.'s Birthday 3rd Monday of January

Presidents’ Day 3rd Monday of February

Memorial Day Last Monday of May

Juneteenth 19th Day of June

Independence Day 4th day of July

Labor Day 1st Monday of September

Columbus Day 2nd Monday of October

Veterans Day 11th day of November

Thanksgiving Day 4th Thursday of November

Christmas Day 25th day of December

C2.5 Identification Badges

C2.5.1 Contractor employees (including those of subcontractors) requiring physical access to the contractual place of performance and/or access to the DLA network/system for successful contract performance will be required to obtain a Common Access Card (CAC) prior to starting work. Lost or stolen CACs must be promptly reported by the Contractor to the KO or their authorized representative and to the appropriate Government security personnel. The Government will retain sole decisional authority on issuance of a replacement CAC.

C.3 GOVERNMENT INFORMATION

C3.1 COR

C3.2 TPOC

C.3.3 Government Furnished Property, Equipment and Services

C3.3.1 All Government-furnished property (GFP) will be provided in accordance with FAR

52.245-1, and FAR 52.245-9. The Government will provide access to standard office-related

Government Furnished Equipment/Information/Software (e.g., computers, office cubicle space with desk, cabinets and chair, network access, Command Access Card (CAC), CAC readers, phone service, database, office supplies, and networked printer capabilities) while working in

Government spaces for the subject task order. Government property shall be used ONLY in performance of this task order. The Contractor is accountable for all property provided by the

Government and shall be responsible for the security and condition of said property. All GFP is the property of the U.S. Government and shall not be transferred to any individual, or agency, public or private without the express written approval of the Contracting Officer.

C3.3.2 The Contractor shall provide a method of tracking and managing GFP. Serialized items shall be annotated at the time of issue, with a signature of acknowledgement by the individual

Contractor(s).

C3.3.3 Government personnel will determine property disposition, acquisitions, and final acceptance of deliveries of Government services/supplies.

C3.3.4 Contractor assumes the risk of, and shall be responsible for, any loss or destruction of, or damage to, items of Government property, that are removed from the installation/premises by the

Contractor.

C3.3.5 Government telephones shall not be used for personal reasons, for any toll or long-distance calls unless authorized by the COR/TPOC. Telephone access will be made available for the

Contractor’s use for local calls only. Long distance and toll calls require prior authorization by the

COR/TPOC and will be limited to credit cards only. Telephone billing will be monitored by the

COR/TPOC monthly. Unauthorized calls by the Contractor will be reported for resolution.

C3.3.6 As-built drawings and Operation and Maintenance (O&M) manuals will be made available for Contractor use during the term of the contract to the extent that these resources are available.

C3.3.7 The Government will provide the contractor access to the EBS system via a computer terminal at the HQC.

C3.3.8 The Government shall provide a two-way radio to all Maintenance Mechanics for use while in the HQC and shall be used to contact Maintenance personal during normal duty hours.

C3.3.9 The Government shall furnish the utility services and existing electrical outlets, for use in the work to be performed under this contract.

C3.3.10 The Government shall furnish the contractor with office space and a Government owned computer in the A/B elevator penthouse.

C3.3.11 Refer to section C7 Specific Tasks and Deliverables for other details.

C.4 CONTRACTOR INFORMATION

C4.1 Key Personnel

C4.1.1 Certain experienced professional and/or technical personnel are essential for successful accomplishment of the work to be performed under this TO. These "Key Personnel" shall be identified by name within the Contractor’s Task Order Proposal (TOP) and their qualifications shall be submitted with letters of commitment for evaluation during the source selection process.

The Contractor agrees that such personnel shall not be removed or replaced within the performance of this contract unless the following measures are taken and fully documented in writing. See details in section C7 Specific Tasks and Deliverables.

C4.1.2 If the key personnel, for any reason, becomes or is expected to become unavailable for work under this contract for a continuous period exceeding 30 work days, or is expected to devote substantially less effort to the work than indicated in the proposal or initially anticipated, the Contractor shall, subject to the concurrence of the Contracting Officer, promptly replace personnel with personnel who possess equal, or better, qualifications as the original employee.

C4.1.3 All requests for approval of substitutions hereunder must be in writing and provide a detailed explanation of the circumstances necessitating the proposed substitutions. The request shall contain the qualifications for the proposed substitute and any other information requested by the Contracting Officer. The Contracting Officer must concur in writing with the change.

C4.1.4 Key Personnel include the following: (refer to section C.7 Specific Tasks and

Deliverables).

C4.1.5 Knowledge Skills and Abilities of other Personnel: Other personnel on the Task Order should have the following qualifications: (refer to section C.7 Specific Tasks and Deliverables).

C4.2 Phase In/Out Period

C4.2.1 To minimize any decreases in productivity and to prevent possible negative impacts on additional services, the Contractor shall have personnel on board, during the thirty (30) day phase in/ phase out periods. During the phase in period, the Contractor shall become familiar with performance requirements to commence full performance of services on the contract start date.

C4.2.2 The Contractor shall provide a plan 30 days after award. The Contractor shall coordinate with the Government in planning and implementing a complete transition to the Contractor's support model. The Contractor shall collaborate with the Government to develop and deliver an

Incoming Transition Plan. The Government will designate a transition period for the incoming

Contractor to coordinate and work with the incumbent Contractor, if applicable. The transition plan shall include, but is not limited to the following:

1. Coordination with Government representatives.

2. Review, evaluation, and transition of current contract requirements.

3. Government-approved training and certification process.

4. Transfer of hardware warranties and software license.

5. Transfer of Government Furnished Equipment (GFE)

6. Coordinate with the Government to account for Government keys, ID/access cards, and security codes.

C4.3 Outgoing Transition Plan

C4.3.1 The Contractor shall provide an Outgoing Transition Plan a minimum of 60 days before the contract end date. The plan shall account for 30 days of outgoing transition for transitioning work from an active contract to a follow-on contract/order or Government entity. This transition may be to a government entity, another contractor or to the incumbent contractor under a new contract/order. In accordance with the Government-approved plan, the Contractor shall assist the

Government in planning and implementing a complete transition from this Contract and/or orders issued under this Contract to a successful provider. This shall include formal coordination with Government staff and successor staff and management. This transition plan shall include, but is not limited to:

1. Coordination with Government representatives

2. Review, evaluation, and transition of current contract requirements

3. Transfer of hardware warranties and software licenses

4. Transfer of all necessary technical documentation

5. Transfer of Government Furnished Equipment (GFE)

6. Turn-in of all Government keys, ID/access cards, and passwords

C4.4 Program Management Support

C4.4.1 The Contractor shall provide complete program management support that fully integrates, manages, controls, and documents all phases of the PWS requirements. The Program Manager shall be the focal point for all issues involving execution of this Task Order and shall keep the

Government fully informed, both verbally and in writing.

C4.5 Post Award Conference/Periodic Progress Meetings

C4.5.1 The Contractor shall attend any post award conference convened by the contracting activity or contract administration office IAW Federal Acquisition Regulation (FAR) Subpart

42.5(a) (b), Post Award Orientation. The Contracting Officer, CORs, and other Government personnel, as appropriate, may meet periodically with the Contractor to review the Contractor's performance. At these meetings, the Contracting Officer or designated representative will apprise the Contractor of how the Government views the Contractor's performance and the

Contractor shall apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the Government.

C4.6 Supervision of Contractor Employees

C4.6.1 The Government will not exercise any supervision or control over Contractor or

Subcontractor employees while performing work under the contract. Such employees shall be accountable solely to the Contractor, not the Government. The Contractor, in turn, shall be accountable to the Government for Contractor or Subcontractor employees.

C4.7 Meeting Attendance

C4.7.1 The Contractor shall attend meetings, briefings, planning sessions, conferences, and events both locally and at remote locations. Guidance for Contractor travel can be found in FAR

31.205-46(a). All requests for travel shall be approved by the COR prior to incurring cost, as travel will be reimbursed IAW the FAR. Proposed travel shall include the anticipated costs for the travel for review by the COR. Requests for travel approval shall be prepared in a legible manner, include a description of proposed travel, a list of travelers with all proposed costs, the contract number, Contract Line-Item Number (CLIN), and be submitted to the COR at least 48 hours prior to travel.

C4.8 Government Kick-Off Meeting

C4.8.1 The Contractor shall participate in a Government-scheduled, Kick-Off Meeting after TO award. The purpose of this Kick-Off Meeting is to: (1) aid both the Government and Contractor personnel in achieving a clear and mutual understanding of all requirements; and (2) identify and resolve potential problems. The Contractor shall be prepared to discuss any issues requiring clarification. The Kick-Off Meeting shall include as a minimum: a program review, and personnel and physical security issues.

C4.9 Monthly Status Report (MSR) and Briefing

C4.9.1 The Contractor shall provide a MSR and briefing that analyzes the Task Order status and provides TO’s accounting information. The MSR is due the 15th of every month. The MSR shall include the following elements:

• A summary of work performed by each specific task area for the reporting period

• A summary of problems encountered and recommended solutions

• A summary of problems anticipated and preventive measures.

• A summary of training and certifications completed or outstanding

C4.10 Contractor Furnished Items and Services

C4.10.1 General. The Contractor shall furnish all supplies, equipment, facilities and services required to perform work under this contract that are not listed under Part 3 of this PWS.

C4.10.2 Contract and Task Order Management. The Contractor shall provide all management, administration, security, quality control, and all else required to ensure successful completion of the awarded Task Order.

C4.10.3 Personnel. The Contractor shall furnish adequate supervision, including an on-site Task

Order Lead and the labor necessary to perform all services in an orderly, timely, and efficient manner. The Program Manager shall have the authority to act on behalf of the Contractor. The

Contractor shall use qualified and experienced employees capable of achieving the goals established in the task order. All personnel shall maintain current qualifications and obtain all training required to meet mission requirements. Contractor personnel are employees of the

Contractor and under its administrative control and supervision. The Contractor, through its personnel, shall perform the tasks ordered herein.

C4.10.4 Personal Services. Contractor shall select, supervise, and exercise control and direction over his employees under this contract. The Government will not exercise any supervision or control over the Contractor's employees in performance of contractual services under this contract. The Contractor shall ensure that no prohibited personal services (as described in FAR

37.104) are performed under this contract.

C4.10.5 Work Products. In advance of beginning work on specific work products, the

Contractor’s PM shall coordinate product timelines and format with the Primary COR and/or designated Government official in instances where this PWS or available guidance doesn’t establish timelines or format. All Contractor work products shall first be submitted for review and approval by a Supporting COR and/or designated Government official.

C4.10.6 Refer to section C7 Specific Tasks and Deliverables for other details.

C4.11 Personnel Security Requirements

Most work to be performed under this requirement is unclassified, however, a security clearance may be required at some locations to allow unescorted access within certain buildings. Security clearance requirements will be further defined at the Task Order level. All Contractor personnel proposed to work on the network, or any IT capabilities/functions (at a minimum) will be required to have an IT III (Non-Sensitive), IT II (Non-Critical Sensitive), or IT I (Critical Sensitive). See

Attachment 8 Contractor Personnel Security Requirements for specific requirements.

C4.12 Citizenship

C.4.12.1 Each Contractor employee shall be a citizen of the United States of America, or an alien who has been lawfully admitted for permanent residence, or who presents evidence from the

Immigration and Naturalization Service that employment will not affect his immigration status.

C4.13 Installation Security

C4.13.1 Contractor Security Regulations and Conduct. The Contractor or any visitors of the

Contractor entering DoD locations to perform contract requirements shall abide by all security regulations and may be subject to security inspections. Contractor personnel and property shall be subject to search and seizure upon entering, while on, and upon leaving the DoD locations pursuant to regulatory guidance.

C4.13.1.1 All Contractor personnel shall always conduct themselves IAW acceptable business decorum. The Contractor shall remove any individual from the site whose continued presence or employment on this contract is deemed by the KO or designee to be contrary to the public interest, adversely affect health, morale, welfare, or good order and discipline on the installation, or is inconsistent with the best interests of national security. IAW USC Title 18, Crimes and Criminal

Procedure, Part I, Crimes, Chapter 67, Military and Navy, Section 1382, the Installation

Commander has the authority to bar individuals from the host installation.

C4.13.1.2 In the event of a strike by Contractor personnel, the Contractor shall be responsible for the cost of any increased security as determined necessary by the Installation or DLA Site

Commander/Director.

C4.13.1.3 The Contractor shall report immediately to the KO or designee any suspected, alleged, or actual criminal incidents IAW DLAI 5105 Reporting of Criminal Incidents.

C4.13.2 Contractor Vehicles. The Contractor shall register all Contractor vehicles used in performance of the contract requirements and ensure that Contractor employee vehicles to be driven on the host installation, to include motorcycles, are registered with the host installation security office and are in conformance with State and local regulations in effect at the time of registration and as long as employed by the Contractor. Evidence of a valid driver’s license, vehicle registration card, and insurance are required for registration. Contractor employees shall maintain current registration and proof of insurance on all Privately-Owned Vehicles (POV) brought on host installation. The Contractor shall maintain current registration and proof of insurance on all Contractor-owned vehicles brought on the host installation.

C4.13.2.1 The Contractor and its employees shall abide by host installation parking regulations.

All vehicles shall be parked in designated parking areas only. The Contractor and its employees shall conform to Federal, State and host installation driving regulations.

C4.14 Physical Security

C4.14.1 Contractor Control Access. The Contractor shall control access by locking or unlocking the areas or facilities used by the Contractor in the performance of the contract requirements. The

Contractor shall lock all overhead doors, cages, vaults, warehouse doors, windows, and other areas for reasons of internal security before leaving an area unattended and prior to the conclusion of any working day.

C4.14.2 The Contractor shall operate under the site’s approved security plan.

C4.14.3 In the event a Contractor area is found unsecured or there is an alarm response during non-duty hours, the Contractor’s designated Point of Contact (POC) will be required to secure the area. The Contractor shall inform the KO or designee of the results of the alarm response. The

Contractor shall report any facility security violations to the KO or designee within one (1) hour of discovery.

C4.14.4 Physical Security Reporting and Working Groups. Upon request of the KO or designee, the Contractor shall prepare and provide reports to update progress on all recommended corrective actions stemming from Government inspections or assessments conducted at the site (i.e., Security

Program Review (SPR), OPSEC/INFOSEC inspections, Vulnerability Assessments (VA), DoD and DLA regulations or policies etc.)

C4.14.4.1 The Contractor’s Security Specialist shall participate in working groups (i.e., Physical

Security Anti-terrorism, Force Protection and OPSEC), if requested.

C4.14.5 Key Control. The Contractor shall establish and maintain a Key and Lock Control

Program as part of their Physical Security SOP, IAW DLAM 5200.08 DLA Physical Security

Manual. The Contractor shall safeguard keys provided by the Government. The Contractor shall designate in writing to the KO or designee a key custodian to manage the key control program by the start of full performance.

C4.14.5.1 The Contractor shall develop and maintain a roster of employees with key or lock access requirements for key control boxes or equivalent system IAW DLAM 5200.08 DLA Physical

Security Manual. The Contractor shall provide the KO or designee updated rosters as information changes. At all times the Contractor shall keep all keys within the Key and Lock Control Program under continuous accountability and shall limit the number of individuals authorized to draw keys to the minimum required by security and operational requirements.

C4.14.5.2 The Contractor shall not duplicate keys or allow their use by unauthorized Contractor personnel. The Contractor shall report any deviation from these rules or lost keys to the KO or designee within one (1) hour after discovery of occurrence and submit a detailed written report by close of business (COB) the same working day. If lost keys are discovered at the end of the day, and it is not possible to submit a written report to the KO or designee by COB the same working day, the Contractor shall submit the report within two (2) hours of the beginning of business on the next working day. The Contractor shall reimburse the Government for all costs associated with replacing locks or re-keying as a result of key duplication or loss.

C4.15 Identification of Contractor Personnel

C4.15.1 The Homeland Security Presidential Directive 12 (HSPD-12) dated 27 September 2012 has established criteria for Contractors who require a Common Access Card (CAC) for either physical access to an installation or access to government information technology (IT) systems.

The Government requires Personnel Security Investigations (PSI) to establish that applicants or incumbents either employed by the Government or working for the Government under contract are suitable for the job and are eligible for a public trust or sensitive position. Upon favorable review and initiation of the PSI, Contractor personnel may be granted temporary access pending final adjudication of the PSI.

C4.15.2 A Contractor Investigative Request (CIR) form annotating the appropriate designation shall be submitted for each contract employee.

C.5 Quality Control

C5.1 Quality Control Program

C5.1.1 A Quality Control Program (QCP) shall be developed and implemented by the

Contractor. The Contractor’s QCP shall ensure Contract compliance, and act to ensure that potential problems with building services, equipment and systems are identified, documented, and resolved prior to failure. The Contractor shall create and implement data collection and analysis plans to continually monitor and improve efficiency in operations, resource consumption, environmental impact and tenant satisfaction. In the event the Government Quality

Assurance Program identifies deficiencies the Contractor shall implement progressively responsive quality control measures commensurate with the severity of the Government's deficiencies. Deficiencies identified by the QCP or QASP shall be recorded in EBS.

C5.2 Quality Control Plan

C5.2.1 The “Quality Control Plan” (QC plan) is the Contractor’s complete written system for identifying and correcting deficiencies and monitoring and improving efficiencies to continually improve the quality of services provided. Preparation of the QC plan is the responsibility of the

Contractor and is due with the Contractor’s proposal.

C5.2.2 The QC plan, revisions or updates shall be submitted for approval by the KO or designee.

A review of the QC Plan can be initiated by direction of the CO or designee.

C5.2.3 The QC plan shall detail the Contractor’s methods, frequencies, documentation, and remedies for ensuring that all aspects of contract work performed is of the highest quality. It shall describe procedures for correcting problems, data gathering, improving efficiencies, and addressing quality assurance findings by the Government. The Contractor shall further customize the QC plan to meet facility specific conditions. The QC plan shall describe the Contractor’s overall approach, methods, roles and responsibilities relating to Quality Control of all areas of contract work including service calls, preventive maintenance/inspection schedules, and operating data collection and analysis. The revised QC plan is to be submitted for review and approval to the CO or designee within 30 calendar days of Contract start date.

C5.3 Quality Assurance

C5.3.1 The Government’s role in quality assurance is to ensure that the Contractor is achieving the quality levels established in the operation and maintenance services contract and focuses on the Contractors’ QC plan. The Government periodically validates the execution of the

Contractor's QCP by reviewing such areas as the Contractor's inspection forms, service request logs, tenant reports, tenant satisfaction surveys, EBS surveys, and the timeliness of corrective actions.

C5.3.2 As part of the Government’s quality assurance program, the Government may:

• Review and, if warranted, reject any reports or other submittals required from the

Contractor.

• Review performance and service records, including monthly progress reports, BAS data, EBS data, and any computerized or hard copy records maintained by the

Contractor documenting performance under this Contract, and require correction of any unsatisfactory conditions noted.

• Determine the adequacy of the Contractor’s QCP and documentation and the overall success of this program. The Government shall order improvements, if it determines the program is insufficient or ineffective.

C5.3.3 Obtain tenant satisfaction and EBS survey information and require improvements in service based on such information to the extent such results correlate with deficiencies in

Contract requirements.

C5.3.4 Conduct physical inspections of facility equipment and systems, including programs and files maintained on computers in Contractor onsite offices and work areas, and require correction of deficiencies noted.

C5.3.5 Perform inspections with Government personnel or independent third-party inspectors.

C5.4 Acceptable Performance Levels

C5.4.1 The following table identifies the Acceptable Performance Levels (APLs) for services required for Preventive and Remedial Maintenance as defined in this P W S . A “Minor” deficiency will be is defined as an error, occurrence, or actions that do not impact material support, (e.g., administrative, filing, typographical, e t c . ) . A “Significant” error is defined as an error, occurrence, or action that results in a delay or re-works impacting material support.

C5.5 Quality Assurance Surveillance Plan (QASP)

C5.5.1 The Government will evaluate the Contractor’s performance IAW the TO Quality

Assurance Surveillance Plan (QASP) prepared by the Government. The Contractor’s performance shall adhere to the metrics in the TO Performance Requirements Summary (PRS)

(see attachment in IDIQ PWS).

C5.5.2 Contractor compliance to the performance standards will be tallied for Contractor

Performance Assessment Reporting System (CPARS) reporting periods and the results of the data will be used to substantiate objective CPARS ratings of Contractor performance.

C5.5.3 Contractor's failure to meet or to demonstrate an attempt to meet performance metrics may result in the Government not exercising optional option year periods.

C.6 SECURITY/CYBERSECURITY REQUIREMENTS

The contractor shall provide cybersecurity (CS) in accordance with all current policies, procedures, and statutes, to include all references located in Attachment 3 References/Codes.

C6.1 Personnel Requirements

C6.1.1 The Contractor shall provide skilled, experienced, professional and/or technical personnel consistent with the task requirements of this PWS. A Staffing Plan should be provided in the

Contractor’s technical proposal and updated throughout the duration of the contract if significant changes occur. Contractor personnel supporting cybersecurity functions shall be appropriately certified according to DoD Manual (DoDM) 8140.03 Cyberspace Workforce Qualification &

Management Program upon contract and/or MOD awards.

NOTE: DLA’s minimum certification required for the System Administrator (451) work role is the CompTIA A+, Network+, Security+ or Certified Network Defender (CND) certification. Individuals must also complete 20-hours of continuous education annually, or the number of hours required to maintain certification; whichever is greater.

DLA is in the process of developing organizational policy for Environment-Specific

Requirements for each cybersecurity work role. DLA will convey the requirement to vendors, along with the expected timeline for meeting the requirement, after the policy has been approved.

C6.1.2 The Contractor is responsible to provide qualified personnel, as specified, and as required by the PWS, and shall bear all cost for training its personnel. The Government will not reimburse the Contractor for the cost for training of Contractor personnel. Training will not be allowed on

Government time.

C6.1.3 The Contractor shall provide a monthly DoD 8140.03 deliverable report as specified by the

COR/TPOC, that includes a list of applicable key personnel. The following information shall be provided in the report, due by the 5th business day of each month:

Work Role

Work Role Task

Company

Contract Name/Description

COR Name

Contract #

Primary Foundational Qualification Personnel Certification Held and

Expiration Date

Primary Foundational Qualification Personnel Certification Status (Current or

Past Due)

C6.1.4 If a certification becomes obsolete during the life of the contract, the Contractor shall be responsible for ensuring applicable personnel obtain an acceptable replacement certification prior to the IT/OT product’s end of support or end of life.

C6.1.5 The provisions of this PWS shall be fully applicable to all subcontractors.

C6.1.6 Information given to the Contractor during the life of this contract shall only be used for the purpose of carrying out the provisions of this contract. Agency marked “Controlled

Unclassified (CUI)” or bearing other sensitivity markings shall be handled in accordance with

(IAW) Agency information security program regulations and shall not be divulged or disclosed without Agency permission in writing. Requests for disclosure shall be addressed to the

Contracting Officer (KO).

C6.2 Privileged Access

C6.2.1 The DoD 8140, Information Assurance Workforce Improvement Programs requires training and certification for - Cybersecurity duties performed. All contract employees performing cyber-IA functions shall meet the requirements in accordance with DoD/DLA guidance.

C6.2.2 Additionally, all contract employees shall be certified in operating systems on any system on which system administration duties are performed. Proof of certification shall be provided before privileged access is granted, at time of proposal/resume submission; this includes, but is not limited to, system administration access, network administration access, router/switch access, or firewall access. All documentation required for security certification will be maintained by both the Contractor and the Government.

C6.2.3 All contract employees shall have acquired the necessary certifications, at time of award, per the DoD 8140, and remain in good standing for the duration of the contract. These certification requirements are not based on position title; they are based on duties. All Contractor personnel requiring elevated/privileged access to any network or OT system, subsystem, or components, either during provisioning or post award, shall satisfy any necessary and/or applicable requirements to meet DLA account provisioning, system administration, and personnel certification standards.

C6.2.4 The Contractor shall provide a copy of all current certifications to the Contracting Officer at time of award and remain in good standing during the contract period of performance. The

Contractor shall provide the monthly DoD 8140 deliverable report to the COR/TPOC that includes a list of applicable DoD 8140 key personnel. If a certification becomes obsolete during the life of the contract, the Contractor shall be responsible for ensuring applicable personnel obtain an acceptable replacement certification. The Contractor is responsible for all PWS requirements and shall provide skilled, experienced, professional, or technical personnel consistent with the task-specific requirements.

DoD 8140 baseline certifications can be found here:

DoDM 8140.03 (Manual) Cyberspace Workforce Qualification and Management Program https://dl.dod.cyber.mil/wp-content/uploads/cyber-workforce/pdf/unclass-dod-manual-8140_03.pdf

C6.3 Cybersecurity Strength Requirements

C6.3.1 The Contractor shall adhere to all existing authorities and policies of the Director of

National Intelligence regarding the protection of sensitive compartmented information (SCI), as directed by Executive Order 12333 and other laws and regulations.

C6.3.2 The Contractor shall satisfy the Risk Management Framework (RMF) requirements of subchapter III of chapter 35 of Title 44, United States Code (U.S.C.), also known as the “Federal

Information Security Management Act (FISMA) of 2002”.

C6.3.3 The Contractor shall enable DLA to meet the standards required by the Office of

Management and Budget (OMB) and the Secretary of Commerce, pursuant to FISMA and section

11331 of Title 40, U.S.C.

C6.3.4 Federal Information Processing Standards (FIPS) 199 / Committee on National Security

Systems Instruction (CNSSI) 1253 Security Categorization: The Contractor shall participate in categorization discussions with the DLA J6 PM, functional lead, and the Information System

Security Manager (ISSM) and provide all required FIPS 199 documentation as requested to support security categorization.

C6.3.5 The Contractor shall provide a recommendation on system categorization based on sound technical expertise in accordance with FIPS 199 then work in coordination with the prescribed

DLA System Owner (SO) and ISSM to support the categorization IAW FIPS 199, CNSSI 1253 and OSD Facility Related Control Systems (FRCS) Master List including DLA specific systems, then document the results of the security categorization in the System DLA FIPS 199 document and the Concept of Operations (CONOPs).

C6.3.6 Assigned DLA PM will coordinate with the Contractor to identify and document

Confidentiality, Availability, Integrity (CIA) of the system in a DLA FIPS 199 document for approval by DLA ISSM personnel.

C6.4 Cybersecurity Assurance Requirements

C6.4.1 The Contractor shall design, develop, and integrate cybersecurity solutions supporting the

Department of Defense and Defense Logistics Agency (DLA) and its subordinate commands.

C6.4.2 This will be achieved through abiding by all applicable cybersecurity policies, regulations, and directives to ensure a favorable Assessment and Authorization (A&A), Assessment and

Incorporate (A&I), or FRCS Assess Only Risk Assessment (FRCS AORA) decision, as well as obtaining an Authority to Connect (ATC) to DLA’s network. The Contractor shall mitigate risk identified through the RMF authorization process down to a level acceptable to the DLA

Authorizing Official (AO).

C6.4.3 Coding for Security. The Contractor shall provide documentation of development practices and standards applied to Government approved Contractor-written control system software, including firmware, used to ensure a high level of defense against unauthorized access.

C6.4.4 The solution shall comply with the security control requirements documented in National

Institute of Standards and Technology (NIST) Special Publication (SP) 800-53r5, “Security and

Privacy Controls for Federal Information Systems and Organizations” and NIST 800-82r3, “Guide to Industrial Control Systems (ICS) Security”. The Contractor shall provide details of any alternative, but equally effective security measures used to compensate for the inability to satisfy a particular derived security requirement (mitigation to control compliance findings). This information shall be submitted in writing to the DLA J6 PM for cybersecurity approval as soon as the alternative is identified.

C6.4.5 Typical Contractor services activities include:

a. Analyzing DLA physical, electrical, computerized, and mechanical environments the identified FRCS solution will control (e.g., the physical Operational process to be controlled, such as those used in manufacturing, metering and robotics)

b. Developing a DLA Automation Solution FRCS architecture in terms of devices, dataflow, and control loops, outlining interconnectivity with engineering and operator workstations, and Safety Instrumented Systems (SISs) for testing; testing shall be in accordance with DoD Control Systems Security Requirements Guide

(SRG), and other identified DLA test processes.

c. Defining how the DLA FRCS Automation Solution will connect to external (e.g., plant) and networks, by system description, concept, hardware and software lists, and dataflow diagram on Perdue Levels. Guidance on the applicability of Purdue

Enterprise Reference Architecture (PERA) levels are found in the United Facilities

Criteria (UFC) 4-010-06, Cybersecurity of Facilities-Related Control Systems.

d. Installing, configuring, patching, backing up, and testing for DLA handover of the

Automation Solution to the DLA asset owner for operation.

e. Gaining approval of the DLA asset owner for many of the decisions made and outputs generated during the execution of these activities.

C6.4.6 The Contractor shall protect unclassified DoD data from unauthorized access or disclosure in accordance with DoDI 8582.01, “Security of Unclassified Information on Non-DoD

Information Systems.” Controlled Unclassified Information: All Government controlled unclassified information obtained by the Contractor shall be protected in accordance with National

Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, “Protecting

Controlled Unclassified Information in Nonfederal Information Systems and Organizations”.

C6.4.7 Agencies or Military Services providing external information system services must comply with DLA information security requirements and employ overlayed security controls in accordance with applicable federal laws, Executive Orders, directives, instructions, policies, regulations, standards, and guidance.

C6.5 Tasks and Deliverables

C6.5.1 The Contractor shall provide required implementation and design documentation to the

DLA PM and security engineering teams to conduct a cybersecurity Risk Assessment (RA) of proposal. Results from accepted RAs will be incorporated into the Systems concepts of operations

(CONOPs).

C6.5.2 The Contractor, in collaboration with assigned COR and TPOC shall identify and document applicable cybersecurity enterprise architectures and deliver system conceptual design drawings.

C6.5.3 The Contractor shall leverage, to the greatest extent possible, DLA Enterprise processes and capabilities.

C6.5.4 The Performance Requirements Summary (PRS) and RMF Documentation Chart and

Submission Dates Table, located in Attachment 4, provides a summary of the deliverables required of the Contractor based on identified cybersecurity requirements for Assess and Authorize (A&A), Assess and Incorporate (A&I), and Facility Related Control System Lean Cybersecurity Risk

Assessment (FRCS LCRA).

C6.6 System and Network Requirements

C6.6.1 All system/network components and applications shall be compatible with all applicable

Defense Information System Agency (DISA) Security Technical Implementation Guides (STIGs).

Any STIG exceptions must be identified as part of the Contractor’s proposal to the Government and approved by J6 Cybersecurity. Exceptions incurring risk found unacceptable to the DLA

Authorizing Official are not permitted.

C6.6.2 All network components and applications shall be IPv4 and IPv6 compatible.

C6.6.3 Network components shall allow configuration of IEEE 802.1x or port security for authentication.

C6.6.4…